diff --git a/bin/tests/system/addzone/tests.sh b/bin/tests/system/addzone/tests.sh
index 60988ddf22..2937e79ea3 100755
--- a/bin/tests/system/addzone/tests.sh
+++ b/bin/tests/system/addzone/tests.sh
@@ -129,7 +129,7 @@ status=$((status + ret))
 if ! $FEATURETEST --with-lmdb; then
     echo_i "verifying no comments in NZF file ($n)"
     ret=0
-    hcount=`grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l`
+    hcount=$(grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l)
     [ $hcount -eq 0 ] || ret=1
     n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -140,7 +140,7 @@ echo_i "checking rndc showzone with previously added zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 showzone previous.example > rndc.out.ns2.$n
 expected='zone "previous.example" { type primary; file "previous.db"; };'
-[ "`cat rndc.out.ns2.$n`" = "$expected" ] || ret=1
+[ "$(cat rndc.out.ns2.$n)" = "$expected" ] || ret=1
 n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -181,7 +181,7 @@ fi
 if ! $FEATURETEST --with-lmdb; then
     echo_i "checking NZF file now has comment ($n)"
     ret=0
-    hcount=`grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l`
+    hcount=$(grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l)
     [ $hcount -eq 1 ] || ret=1
     n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -218,7 +218,7 @@ echo_i "checking rndc showzone with a normally-loaded zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 showzone normal.example > rndc.out.ns2.$n
 expected='zone "normal.example" { type primary; file "normal.db"; };'
-[ "`cat rndc.out.ns2.$n`" = "$expected" ] || ret=1
+[ "$(cat rndc.out.ns2.$n)" = "$expected" ] || ret=1
 n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -227,7 +227,7 @@ echo_i "checking rndc showzone with a normally-loaded zone with trailing dot ($n
 ret=0
 $RNDCCMD 10.53.0.2 showzone finaldot.example > rndc.out.ns2.$n
 expected='zone "finaldot.example." { type primary; file "normal.db"; };'
-[ "`cat rndc.out.ns2.$n`" = "$expected" ] || ret=1
+[ "$(cat rndc.out.ns2.$n)" = "$expected" ] || ret=1
 n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -236,7 +236,7 @@ echo_i "checking rndc showzone with a normally-loaded redirect zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.1 showzone -redirect > rndc.out.ns1.$n
 expected='zone "." { type redirect; file "redirect.db"; };'
-[ "`cat rndc.out.ns1.$n`" = "$expected" ] || ret=1
+[ "$(cat rndc.out.ns1.$n)" = "$expected" ] || ret=1
 n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -517,7 +517,7 @@ status=$((status + ret))
 if ! $FEATURETEST --with-lmdb; then
     echo_i "checking new NZF file has comment ($n)"
     ret=0
-    hcount=`grep "^# New zone file for view: external" ns2/external.nzf | wc -l`
+    hcount=$(grep "^# New zone file for view: external" ns2/external.nzf | wc -l)
     [ $hcount -eq 1 ] || ret=1
     n=$((n + 1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -556,7 +556,7 @@ _check_rndc_showzone_newly_added() (
 		expected='zone "added.example" { type primary; file "added.db"; };'
 	fi
 	$RNDCCMD 10.53.0.2 showzone added.example in external > rndc.out.ns2.$n 2>/dev/null &&
-	[ "`cat rndc.out.ns2.$n`" = "$expected" ]
+	[ "$(cat rndc.out.ns2.$n)" = "$expected" ]
 )
 retry_quiet 10  _check_rndc_showzone_newly_added || ret=1
 n=$((n + 1))
diff --git a/bin/tests/system/auth/tests.sh b/bin/tests/system/auth/tests.sh
index 19afca851e..6cd4a272a1 100644
--- a/bin/tests/system/auth/tests.sh
+++ b/bin/tests/system/auth/tests.sh
@@ -183,7 +183,7 @@ n=$((n + 1))
 echo_i "check that CHAOS addresses are compared correctly ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.1 +noall +answer ch test.example.chaos > dig.out.test$n
-lines=`wc -l < dig.out.test$n`
+lines=$(wc -l < dig.out.test$n)
 [ ${lines:-0} -eq 2 ] || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
 status=$((status + ret))
diff --git a/bin/tests/system/builtin/tests.sh b/bin/tests/system/builtin/tests.sh
index 49e1c45750..21213dedd7 100644
--- a/bin/tests/system/builtin/tests.sh
+++ b/bin/tests/system/builtin/tests.sh
@@ -134,7 +134,7 @@ do
 	}
 	count=$((count + 1))
 done
-lines=`grep "automatic empty zone: " ns1/named.run | wc -l`
+lines=$(grep "automatic empty zone: " ns1/named.run | wc -l)
 test $count -eq $lines -a $count -eq 99 || {
 	ret=1; echo_i "failed (count mismatch)";
 }
@@ -162,7 +162,7 @@ sleep 1
 grep "zone serial (0) unchanged." ns1/named.run > /dev/null && ret=1
 if [ $ret != 0 ] ; then echo_i "failed"; status=$((status + ret)); fi
 
-HOST_NAME=`$FEATURETEST --gethostname`
+HOST_NAME=$($FEATURETEST --gethostname)
 BIND_VERSION_STRING=$($NAMED -V | head -1)
 BIND_VERSION=$($NAMED -V | sed -ne 's/^BIND \([^ ]*\).*/\1/p')
 
diff --git a/bin/tests/system/cacheclean/tests.sh b/bin/tests/system/cacheclean/tests.sh
index ec63d34b32..8dc8b0de31 100755
--- a/bin/tests/system/cacheclean/tests.sh
+++ b/bin/tests/system/cacheclean/tests.sh
@@ -68,9 +68,9 @@ clear_cache () {
 }
 
 in_cache () {
-        ttl=`$DIG $DIGOPTS "$@" | awk '{print $2}'`
+        ttl=$($DIG $DIGOPTS "$@" | awk '{print $2}')
         [ -z "$ttl" ] && {
-                ttl=`$DIG $DIGOPTS +noanswer +auth "$@" | awk '{print $2}'`
+                ttl=$($DIG $DIGOPTS +noanswer +auth "$@" | awk '{print $2}')
                 [ "$ttl" -ge 3599 ] && return 1
                 return 0
         }
@@ -101,7 +101,7 @@ digcomp --lc dig.out.ns2 knowngood.dig.out || status=1
 
 n=$((n + 1))
 echo_i "only one tcp socket was used ($n)"
-tcpclients=`awk '$3 == "client" && $5 ~ /10.53.0.7#[0-9]*:/ {print $5}' ns2/named.run | sort | uniq -c | wc -l`
+tcpclients=$(awk '$3 == "client" && $5 ~ /10.53.0.7#[0-9]*:/ {print $5}' ns2/named.run | sort | uniq -c | wc -l)
 
 test $tcpclients -eq 1 || { status=1; echo_i "failed"; }
 
@@ -110,7 +110,7 @@ echo_i "reset and check that records are correctly cached initially ($n)"
 ret=0
 load_cache
 dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -E '(TXT|ANY)' | wc -l`
+nrecords=$(filter_tree flushtest.example ns2/named_dump.db.test$n | grep -E '(TXT|ANY)' | wc -l)
 [ $nrecords -eq 18 ] || { ret=1; echo_i "found $nrecords records expected 18"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -120,7 +120,7 @@ echo_i "check flushing of the full cache ($n)"
 ret=0
 clear_cache
 dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | wc -l`
+nrecords=$(filter_tree flushtest.example ns2/named_dump.db.test$n | wc -l)
 [ $nrecords -eq 0 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -204,7 +204,7 @@ n=$((n + 1))
 echo_i "check the number of cached records remaining ($n)"
 ret=0
 dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -v '^;' | grep -E '(TXT|ANY)' | wc -l`
+nrecords=$(filter_tree flushtest.example ns2/named_dump.db.test$n | grep -v '^;' | grep -E '(TXT|ANY)' | wc -l)
 [ $nrecords -eq 17 ] || { ret=1; echo_i "found $nrecords records expected 17"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -222,7 +222,7 @@ n=$((n + 1))
 echo_i "check the number of cached records remaining ($n)"
 ret=0
 dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -E '(TXT|ANY)' | wc -l`
+nrecords=$(filter_tree flushtest.example ns2/named_dump.db.test$n | grep -E '(TXT|ANY)' | wc -l)
 [ $nrecords -eq 1 ] || { ret=1; echo_i "found $nrecords records expected 1"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
diff --git a/bin/tests/system/chain/tests.sh b/bin/tests/system/chain/tests.sh
index 4a2b9eaef5..3ad8e31233 100644
--- a/bin/tests/system/chain/tests.sh
+++ b/bin/tests/system/chain/tests.sh
@@ -536,7 +536,7 @@ $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil > dig.out.1.$n 2>&1
 sleep 1
 $DIG $DIGOPTS +noall +answer @10.53.0.7 cname1.domain.nil > dig.out.2.$n 2>&1
-ttl=`awk '{print $2}' dig.out.2.$n`
+ttl=$(awk '{print $2}' dig.out.2.$n)
 [ "$ttl" -eq 86400 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index 43414c361c..c848136a05 100644
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -137,7 +137,7 @@ n=$((n + 1))
 echo_i "checking that named-checkconf warns of notify inconsistencies ($n)"
 ret=0
 $CHECKCONF notify.conf > checkconf.out$n 2>&1
-warnings=`grep "'notify' is disabled" < checkconf.out$n | wc -l`
+warnings=$(grep "'notify' is disabled" < checkconf.out$n | wc -l)
 [ $warnings -eq 3 ] || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -239,13 +239,13 @@ n=$((n + 1))
 echo_i "checking options allowed in inline-signing secondaries ($n)"
 ret=0
 $CHECKCONF bad-dnssec.conf > checkconf.out$n.1 2>&1 && ret=1
-l=`grep "dnssec-dnskey-kskonly.*requires inline" < checkconf.out$n.1 | wc -l`
+l=$(grep "dnssec-dnskey-kskonly.*requires inline" < checkconf.out$n.1 | wc -l)
 [ $l -eq 1 ] || ret=1
 $CHECKCONF bad-dnssec.conf > checkconf.out$n.2 2>&1 && ret=1
-l=`grep "dnssec-loadkeys-interval.*requires inline" < checkconf.out$n.2 | wc -l`
+l=$(grep "dnssec-loadkeys-interval.*requires inline" < checkconf.out$n.2 | wc -l)
 [ $l -eq 1 ] || ret=1
 $CHECKCONF bad-dnssec.conf > checkconf.out$n.3 2>&1 && ret=1
-l=`grep "update-check-ksk.*requires inline" < checkconf.out$n.3 | wc -l`
+l=$(grep "update-check-ksk.*requires inline" < checkconf.out$n.3 | wc -l)
 [ $l -eq 1 ] || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -253,13 +253,13 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "check file + inline-signing for secondary zones ($n)"
 $CHECKCONF inline-no.conf > checkconf.out$n.1 2>&1 && ret=1
-l=`grep "missing 'file' entry" < checkconf.out$n.1 | wc -l`
+l=$(grep "missing 'file' entry" < checkconf.out$n.1 | wc -l)
 [ $l -eq 0 ] || ret=1
 $CHECKCONF inline-good.conf > checkconf.out$n.2 2>&1 || ret=1
-l=`grep "missing 'file' entry" < checkconf.out$n.2 | wc -l`
+l=$(grep "missing 'file' entry" < checkconf.out$n.2 | wc -l)
 [ $l -eq 0 ] || ret=1
 $CHECKCONF inline-bad.conf > checkconf.out$n.3 2>&1 && ret=1
-l=`grep "missing 'file' entry" < checkconf.out$n.3 | wc -l`
+l=$(grep "missing 'file' entry" < checkconf.out$n.3 | wc -l)
 [ $l -eq 1 ] || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -277,16 +277,16 @@ echo_i "checking for missing key directory warning ($n)"
 ret=0
 rm -rf test.keydir
 $CHECKCONF warn-keydir.conf > checkconf.out$n.1 2>&1
-l=`grep "'test.keydir' does not exist" < checkconf.out$n.1 | wc -l`
+l=$(grep "'test.keydir' does not exist" < checkconf.out$n.1 | wc -l)
 [ $l -eq 1 ] || ret=1
 touch test.keydir
 $CHECKCONF warn-keydir.conf > checkconf.out$n.2 2>&1
-l=`grep "'test.keydir' is not a directory" < checkconf.out$n.2 | wc -l`
+l=$(grep "'test.keydir' is not a directory" < checkconf.out$n.2 | wc -l)
 [ $l -eq 1 ] || ret=1
 rm -f test.keydir
 mkdir test.keydir
 $CHECKCONF warn-keydir.conf > checkconf.out$n.3 2>&1
-l=`grep "key-directory" < checkconf.out$n.3 | wc -l`
+l=$(grep "key-directory" < checkconf.out$n.3 | wc -l)
 [ $l -eq 0 ] || ret=1
 rm -rf test.keydir
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
diff --git a/bin/tests/system/ckdnsrps.sh b/bin/tests/system/ckdnsrps.sh
index 3063adb00f..afc405d317 100644
--- a/bin/tests/system/ckdnsrps.sh
+++ b/bin/tests/system/ckdnsrps.sh
@@ -38,7 +38,7 @@ while getopts "xADM:S:" c; do
 	*) echo "$USAGE" 1>&2; exit 1;;
     esac
 done
-shift `expr $OPTIND - 1 || true`
+shift $(expr $OPTIND - 1 || true)
 if [ "$#" -ne 0 ]; then
     echo "$USAGE" 1>&2
     exit 1
diff --git a/bin/tests/system/cookie/tests.sh b/bin/tests/system/cookie/tests.sh
index 9d236aa59b..fad73d71a0 100755
--- a/bin/tests/system/cookie/tests.sh
+++ b/bin/tests/system/cookie/tests.sh
@@ -114,7 +114,7 @@ n=$((n + 1))
 echo_i "checking response size with COOKIE ($n)"
 ret=0
 $DIG $DIGOPTS +cookie large.example txt @10.53.0.1 > dig.out.test$n.l
-cookie=`getcookie dig.out.test$n.l`
+cookie=$(getcookie dig.out.test$n.l)
 $DIG $DIGOPTS +qr +cookie=$cookie large.example txt @10.53.0.1 +ignore > dig.out.test$n
 havetc dig.out.test$n && ret=1
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
@@ -134,9 +134,9 @@ n=$((n + 1))
 echo_i "checking COOKIE is learnt for TCP retry ($n)"
 ret=0
 $DIG $DIGOPTS +qr +cookie large.example txt @10.53.0.1 > dig.out.test$n
-linecount=`getcookie dig.out.test$n | wc -l`
+linecount=$(getcookie dig.out.test$n | wc -l)
 if [ $linecount != 3 ]; then ret=1; fi
-checkfull=`getcookie dig.out.test$n | fullcookie`
+checkfull=$(getcookie dig.out.test$n | fullcookie)
 if [ $checkfull != 1 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -154,7 +154,7 @@ echo_i "checking require-server-cookie default (no) ($n)"
 ret=0
 $DIG $DIGOPTS +qr +cookie +nobadcookie soa @10.53.0.1 > dig.out.test$n
 grep BADCOOKIE dig.out.test$n > /dev/null && ret=1
-linecount=`getcookie dig.out.test$n | wc -l`
+linecount=$(getcookie dig.out.test$n | wc -l)
 if [ $linecount != 2 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -166,7 +166,7 @@ $DIG $DIGOPTS +qr +cookie +nobadcookie soa @10.53.0.3 > dig.out.test$n
 grep "flags: qr[^;]* aa[ ;]" dig.out.test$n > /dev/null && ret=1
 grep "flags: qr[^;]* ad[ ;]" dig.out.test$n > /dev/null && ret=1
 grep BADCOOKIE dig.out.test$n > /dev/null || ret=1
-linecount=`getcookie dig.out.test$n | wc -l`
+linecount=$(getcookie dig.out.test$n | wc -l)
 if [ $linecount != 2 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -179,7 +179,7 @@ noerror=$(grep "status: NOERROR" dig.out.test$n | wc -l)
 badcookie=$(grep "status: BADCOOKIE" dig.out.test$n | wc -l)
 server=$(grep "COOKIE: ................................................" dig.out.test$n | wc -l)
 good=$(grep "COOKIE: ................................................ (good)" dig.out.test$n | wc -l)
-linecount=`getcookie dig.out.test$n | wc -l`
+linecount=$(getcookie dig.out.test$n | wc -l)
 if [ $noerror != 3 ]; then ret=1; fi
 if [ $badcookie != 1 ]; then ret=1; fi
 if [ $server != 3 ]; then ret=1; fi
@@ -196,7 +196,7 @@ noerror=$(grep "status: NOERROR" dig.out.test$n | wc -l)
 badcookie=$(grep "status: BADCOOKIE" dig.out.test$n | wc -l)
 server=$(grep "COOKIE: ................................................" dig.out.test$n | wc -l)
 good=$(grep "COOKIE: ................................................ (good)" dig.out.test$n | wc -l)
-linecount=`getcookie dig.out.test$n | wc -l`
+linecount=$(getcookie dig.out.test$n | wc -l)
 if [ $noerror != 1 ]; then ret=1; fi
 if [ $badcookie != 1 ]; then ret=1; fi
 if [ $server != 2 ]; then ret=1; fi
@@ -211,7 +211,7 @@ ret=0
 $DIG $DIGOPTS +qr +cookie +nobadcookie soa example @10.53.0.8 > dig.out.test$n
 grep "flags: qr[^;]* ad[ ;]" dig.out.test$n > /dev/null && ret=1
 grep BADCOOKIE dig.out.test$n > /dev/null || ret=1
-linecount=`getcookie dig.out.test$n | wc -l`
+linecount=$(getcookie dig.out.test$n | wc -l)
 if [ $linecount != 2 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -262,7 +262,7 @@ echo_i "get NS4 cookie for cross server checking ($n)"
 ret=0
 $DIG $DIGOPTS +cookie -b 10.53.0.4 soa . @10.53.0.4 > dig.out.test$n
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
-ns4cookie=`getcookie dig.out.test$n`
+ns4cookie=$(getcookie dig.out.test$n)
 test -n "$ns4cookie" || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -272,7 +272,7 @@ echo_i "get NS5 cookie for cross server checking ($n)"
 ret=0
 $DIG $DIGOPTS +cookie -b 10.53.0.4 soa . @10.53.0.5 > dig.out.test$n
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
-ns5cookie=`getcookie dig.out.test$n`
+ns5cookie=$(getcookie dig.out.test$n)
 test -n "$ns5cookie" || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -282,7 +282,7 @@ echo_i "get NS6 cookie for cross server checking ($n)"
 ret=0
 $DIG $DIGOPTS +cookie -b 10.53.0.4 soa . @10.53.0.6 > dig.out.test$n
 grep "; COOKIE:.*(good)" dig.out.test$n > /dev/null || ret=1
-ns6cookie=`getcookie dig.out.test$n`
+ns6cookie=$(getcookie dig.out.test$n)
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
index 26d77a500f..dceced6c93 100644
--- a/bin/tests/system/digdelv/tests.sh
+++ b/bin/tests/system/digdelv/tests.sh
@@ -798,7 +798,7 @@ if [ -x "$DIG" ] ; then
   echo "no_response no_response" | sendcmd 10.53.0.5
   dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 2 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -808,7 +808,7 @@ if [ -x "$DIG" ] ; then
   echo "partial_axfr partial_axfr" | sendcmd 10.53.0.5
   dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 2 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -818,7 +818,7 @@ if [ -x "$DIG" ] ; then
   echo "no_response partial_axfr" | sendcmd 10.53.0.5
   dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 2 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -828,7 +828,7 @@ if [ -x "$DIG" ] ; then
   echo "partial_axfr no_response" | sendcmd 10.53.0.5
   dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 && ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 2 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 2 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -838,7 +838,7 @@ if [ -x "$DIG" ] ; then
   echo "no_response complete_axfr" | sendcmd 10.53.0.5
   dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 || ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 1 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -848,7 +848,7 @@ if [ -x "$DIG" ] ; then
   echo "partial_axfr complete_axfr" | sendcmd 10.53.0.5
   dig_with_opts @10.53.0.5 example AXFR +tries=2 > dig.out.test$n 2>&1 || ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 1 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -858,7 +858,7 @@ if [ -x "$DIG" ] ; then
   echo "no_response no_response" | sendcmd 10.53.0.5
   dig_with_opts @10.53.0.5 example AXFR +tries=1 > dig.out.test$n 2>&1 && ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 1 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -867,7 +867,7 @@ if [ -x "$DIG" ] ; then
   ret=0
   dig_with_opts @10.53.0.5 example AXFR +retry=0 > dig.out.test$n 2>&1 && ret=1
   # Sanity check: ensure ans5 behaves as expected.
-  [ `grep "communications error.*end of file" dig.out.test$n | wc -l` -eq 1 ] || ret=1
+  [ $(grep "communications error.*end of file" dig.out.test$n | wc -l) -eq 1 ] || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
   status=$((status+ret))
 
@@ -945,8 +945,8 @@ if [ -x "$DIG" ] ; then
   echo_i "check that dig +bufsize restores default bufsize ($n)"
   ret=0
   dig_with_opts @10.53.0.3 a.example +bufsize=0 +bufsize +qr > dig.out.test$n 2>&1 || ret=1
-  lines=`grep "EDNS:.* udp:" dig.out.test$n | wc -l`
-  lines1232=`grep "EDNS:.* udp: 1232" dig.out.test$n | wc -l`
+  lines=$(grep "EDNS:.* udp:" dig.out.test$n | wc -l)
+  lines1232=$(grep "EDNS:.* udp: 1232" dig.out.test$n | wc -l)
   test $lines -eq 2 || ret=1
   test $lines1232 -eq 2 || ret=1
   if [ $ret -ne 0 ]; then echo_i "failed"; fi
diff --git a/bin/tests/system/dlzexternal/tests.sh b/bin/tests/system/dlzexternal/tests.sh
index 0ff1fa39dc..cbab5094e0 100644
--- a/bin/tests/system/dlzexternal/tests.sh
+++ b/bin/tests/system/dlzexternal/tests.sh
@@ -47,8 +47,8 @@ EOF
 	return 1
     }
 
-    out=`$DIG $DIGOPTS -t $type -q $host | grep -E "^$host"`
-    lines=`echo "$out" | grep "$digout" | wc -l`
+    out=$($DIG $DIGOPTS -t $type -q $host | grep -E "^$host")
+    lines=$(echo "$out" | grep "$digout" | wc -l)
     [ $lines -eq 1 ] || {
 	[ "$should_fail" ] || \
             echo_i "dig output incorrect for $host $type $cmd: $out"
@@ -83,14 +83,14 @@ update add testdc3.example.nil 86500 in a 10.53.0.12
 send
 EOF
 $NSUPDATE -k ns1/ddns.key ns1/update.txt > /dev/null 2>&1 && ret=1
-out=`$DIG $DIGOPTS +short a testdc3.example.nil`
+out=$($DIG $DIGOPTS +short a testdc3.example.nil)
 [ "$out" = "10.53.0.12" ] && ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
 status=$((status + ret))
 
 newtest "testing passing client info into DLZ driver"
-out=`$DIG $DIGOPTS +short -t txt -q source-addr.example.nil | grep -v '^;'`
-addr=`eval echo "$out" | cut -f1 -d'#'`
+out=$($DIG $DIGOPTS +short -t txt -q source-addr.example.nil | grep -v '^;')
+addr=$(eval echo "$out" | cut -f1 -d'#')
 [ "$addr" = "10.53.0.1" ] || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
 status=$((status + ret))
@@ -112,10 +112,10 @@ status=$((status + ret))
 
 newtest "testing AXFR from DLZ drivers"
 $DIG $DIGOPTS +noall +answer axfr example.nil > dig.out.example.ns1.test$n
-lines=`cat dig.out.example.ns1.test$n | wc -l`
+lines=$(cat dig.out.example.ns1.test$n | wc -l)
 [ ${lines:-0} -eq 4 ] || ret=1
 $DIG $DIGOPTS +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n
-lines=`cat dig.out.alternate.ns1.test$n | wc -l`
+lines=$(cat dig.out.alternate.ns1.test$n | wc -l)
 [ ${lines:-0} -eq 5 ] || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
 status=$((status + ret))
@@ -159,9 +159,9 @@ status=$((status + ret))
 newtest "testing correct behavior with findzone returning ISC_R_NOMORE"
 $DIG $DIGOPTS +noall a test.example.com > /dev/null 2>&1 || ret=1
 # we should only find one logged lookup per searched DLZ database
-lines=`grep "dlz_findzonedb.*test\.example\.com.*example.nil" ns1/named.run | wc -l`
+lines=$(grep "dlz_findzonedb.*test\.example\.com.*example.nil" ns1/named.run | wc -l)
 [ $lines -eq 1 ] || ret=1
-lines=`grep "dlz_findzonedb.*test\.example\.com.*alternate.nil" ns1/named.run | wc -l`
+lines=$(grep "dlz_findzonedb.*test\.example\.com.*alternate.nil" ns1/named.run | wc -l)
 [ $lines -eq 1 ] || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
 status=$((status + ret))
@@ -169,15 +169,15 @@ status=$((status + ret))
 newtest "testing findzone can return different results per client"
 $DIG $DIGOPTS -b 10.53.0.1 +noall a test.example.net > /dev/null 2>&1 || ret=1
 # we should only find one logged lookup per searched DLZ database
-lines=`grep "dlz_findzonedb.*example\.net.*example.nil" ns1/named.run | wc -l`
+lines=$(grep "dlz_findzonedb.*example\.net.*example.nil" ns1/named.run | wc -l)
 [ $lines -eq 1 ] || ret=1
-lines=`grep "dlz_findzonedb.*example\.net.*alternate.nil" ns1/named.run | wc -l`
+lines=$(grep "dlz_findzonedb.*example\.net.*alternate.nil" ns1/named.run | wc -l)
 [ $lines -eq 1 ] || ret=1
 $DIG $DIGOPTS -b 10.53.0.2 +noall a test.example.net > /dev/null 2>&1 || ret=1
 # we should find several logged lookups this time
-lines=`grep "dlz_findzonedb.*example\.net.*example.nil" ns1/named.run | wc -l`
+lines=$(grep "dlz_findzonedb.*example\.net.*example.nil" ns1/named.run | wc -l)
 [ $lines -gt 2 ] || ret=1
-lines=`grep "dlz_findzonedb.*example\.net.*alternate.nil" ns1/named.run | wc -l`
+lines=$(grep "dlz_findzonedb.*example\.net.*alternate.nil" ns1/named.run | wc -l)
 [ $lines -gt 2 ] || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
 status=$((status + ret))
@@ -214,7 +214,7 @@ $DIG $DIGOPTS @10.53.0.1 long.name.is.not.there a > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 grep "^long.name.*A.*100.100.100.3" dig.out.ns1.test$n > /dev/null || ret=1
 grep "flags:[^;]* aa[ ;]" dig.out.ns1.test$n > /dev/null || ret=1
-lookups=`grep "lookup #.*\.not\.there" ns1/named.run | wc -l`
+lookups=$(grep "lookup #.*\.not\.there" ns1/named.run | wc -l)
 [ "$lookups" -eq 1 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
diff --git a/bin/tests/system/dns64/tests.sh b/bin/tests/system/dns64/tests.sh
index 4d39f513b2..4ee42dce4c 100644
--- a/bin/tests/system/dns64/tests.sh
+++ b/bin/tests/system/dns64/tests.sh
@@ -1286,7 +1286,7 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
-list=`$DIG $DIGOPTS -b 10.53.0.6 @10.53.0.2 +short aaaa a-only.example | sort`
+list=$($DIG $DIGOPTS -b 10.53.0.6 @10.53.0.2 +short aaaa a-only.example | sort)
 for a in $list
 do
 	ret=0
@@ -1298,10 +1298,10 @@ do
 	status=$((status + ret))
 done
 
-rev=`$ARPANAME 2001:aaaa::10.0.0.1`
+rev=$($ARPANAME 2001:aaaa::10.0.0.1)
 regex='..\(.*.IP6.ARPA\)'
-rev=`expr "${rev}" : "${regex}"`
-fin=`expr "${rev}" : "............${regex}"`
+rev=$(expr "${rev}" : "${regex}")
+fin=$(expr "${rev}" : "............${regex}")
 while test "${rev}" != "${fin}"
 do
 	ret=0
@@ -1312,7 +1312,7 @@ do
 	n=$((n + 1))
 	if [ $ret != 0 ]; then echo_i "failed"; fi
 	status=$((status + ret))
-	rev=`expr "${rev}" : "${regex}"`
+	rev=$(expr "${rev}" : "${regex}")
 done
 
 echo_i "checking dns64-server and dns64-contact ($n)"
diff --git a/bin/tests/system/dnstap/tests.sh b/bin/tests/system/dnstap/tests.sh
index 2f8a2d5339..a4ba30264c 100644
--- a/bin/tests/system/dnstap/tests.sh
+++ b/bin/tests/system/dnstap/tests.sh
@@ -31,7 +31,7 @@ dnstap_data_ready() {
 	min_size_expected=$3
 
 	kill -HUP $fstrm_capture_pid
-	file_size=`wc -c < "$capture_file" | tr -d ' '`
+	file_size=$(wc -c < "$capture_file" | tr -d ' ')
 	if [ $file_size -lt $min_size_expected ]; then
 		return 1
 	fi
@@ -111,39 +111,39 @@ sleep 1
 
 echo_i "checking initial message counts"
 
-udp1=`$DNSTAPREAD ns1/dnstap.out.save | grep "UDP " | wc -l`
-tcp1=`$DNSTAPREAD ns1/dnstap.out.save | grep "TCP " | wc -l`
-aq1=`$DNSTAPREAD ns1/dnstap.out.save | grep "AQ " | wc -l`
-ar1=`$DNSTAPREAD ns1/dnstap.out.save | grep "AR " | wc -l`
-cq1=`$DNSTAPREAD ns1/dnstap.out.save | grep "CQ " | wc -l`
-cr1=`$DNSTAPREAD ns1/dnstap.out.save | grep "CR " | wc -l`
-rq1=`$DNSTAPREAD ns1/dnstap.out.save | grep "RQ " | wc -l`
-rr1=`$DNSTAPREAD ns1/dnstap.out.save | grep "RR " | wc -l`
-uq1=`$DNSTAPREAD ns1/dnstap.out.save | grep "UQ " | wc -l`
-ur1=`$DNSTAPREAD ns1/dnstap.out.save | grep "UR " | wc -l`
+udp1=$($DNSTAPREAD ns1/dnstap.out.save | grep "UDP " | wc -l)
+tcp1=$($DNSTAPREAD ns1/dnstap.out.save | grep "TCP " | wc -l)
+aq1=$($DNSTAPREAD ns1/dnstap.out.save | grep "AQ " | wc -l)
+ar1=$($DNSTAPREAD ns1/dnstap.out.save | grep "AR " | wc -l)
+cq1=$($DNSTAPREAD ns1/dnstap.out.save | grep "CQ " | wc -l)
+cr1=$($DNSTAPREAD ns1/dnstap.out.save | grep "CR " | wc -l)
+rq1=$($DNSTAPREAD ns1/dnstap.out.save | grep "RQ " | wc -l)
+rr1=$($DNSTAPREAD ns1/dnstap.out.save | grep "RR " | wc -l)
+uq1=$($DNSTAPREAD ns1/dnstap.out.save | grep "UQ " | wc -l)
+ur1=$($DNSTAPREAD ns1/dnstap.out.save | grep "UR " | wc -l)
 
-udp2=`$DNSTAPREAD ns2/dnstap.out.save | grep "UDP " | wc -l`
-tcp2=`$DNSTAPREAD ns2/dnstap.out.save | grep "TCP " | wc -l`
-aq2=`$DNSTAPREAD ns2/dnstap.out.save | grep "AQ " | wc -l`
-ar2=`$DNSTAPREAD ns2/dnstap.out.save | grep "AR " | wc -l`
-cq2=`$DNSTAPREAD ns2/dnstap.out.save | grep "CQ " | wc -l`
-cr2=`$DNSTAPREAD ns2/dnstap.out.save | grep "CR " | wc -l`
-rq2=`$DNSTAPREAD ns2/dnstap.out.save | grep "RQ " | wc -l`
-rr2=`$DNSTAPREAD ns2/dnstap.out.save | grep "RR " | wc -l`
-uq2=`$DNSTAPREAD ns2/dnstap.out.save | grep "UQ " | wc -l`
-ur2=`$DNSTAPREAD ns2/dnstap.out.save | grep "UR " | wc -l`
+udp2=$($DNSTAPREAD ns2/dnstap.out.save | grep "UDP " | wc -l)
+tcp2=$($DNSTAPREAD ns2/dnstap.out.save | grep "TCP " | wc -l)
+aq2=$($DNSTAPREAD ns2/dnstap.out.save | grep "AQ " | wc -l)
+ar2=$($DNSTAPREAD ns2/dnstap.out.save | grep "AR " | wc -l)
+cq2=$($DNSTAPREAD ns2/dnstap.out.save | grep "CQ " | wc -l)
+cr2=$($DNSTAPREAD ns2/dnstap.out.save | grep "CR " | wc -l)
+rq2=$($DNSTAPREAD ns2/dnstap.out.save | grep "RQ " | wc -l)
+rr2=$($DNSTAPREAD ns2/dnstap.out.save | grep "RR " | wc -l)
+uq2=$($DNSTAPREAD ns2/dnstap.out.save | grep "UQ " | wc -l)
+ur2=$($DNSTAPREAD ns2/dnstap.out.save | grep "UR " | wc -l)
 
 mv ns3/dnstap.out.0 ns3/dnstap.out.save
-udp3=`$DNSTAPREAD ns3/dnstap.out.save | grep "UDP " | wc -l`
-tcp3=`$DNSTAPREAD ns3/dnstap.out.save | grep "TCP " | wc -l`
-aq3=`$DNSTAPREAD ns3/dnstap.out.save | grep "AQ " | wc -l`
-ar3=`$DNSTAPREAD ns3/dnstap.out.save | grep "AR " | wc -l`
-cq3=`$DNSTAPREAD ns3/dnstap.out.save | grep "CQ " | wc -l`
-cr3=`$DNSTAPREAD ns3/dnstap.out.save | grep "CR " | wc -l`
-rq3=`$DNSTAPREAD ns3/dnstap.out.save | grep "RQ " | wc -l`
-rr3=`$DNSTAPREAD ns3/dnstap.out.save | grep "RR " | wc -l`
-uq3=`$DNSTAPREAD ns3/dnstap.out.save | grep "UQ " | wc -l`
-ur3=`$DNSTAPREAD ns3/dnstap.out.save | grep "UR " | wc -l`
+udp3=$($DNSTAPREAD ns3/dnstap.out.save | grep "UDP " | wc -l)
+tcp3=$($DNSTAPREAD ns3/dnstap.out.save | grep "TCP " | wc -l)
+aq3=$($DNSTAPREAD ns3/dnstap.out.save | grep "AQ " | wc -l)
+ar3=$($DNSTAPREAD ns3/dnstap.out.save | grep "AR " | wc -l)
+cq3=$($DNSTAPREAD ns3/dnstap.out.save | grep "CQ " | wc -l)
+cr3=$($DNSTAPREAD ns3/dnstap.out.save | grep "CR " | wc -l)
+rq3=$($DNSTAPREAD ns3/dnstap.out.save | grep "RQ " | wc -l)
+rr3=$($DNSTAPREAD ns3/dnstap.out.save | grep "RR " | wc -l)
+uq3=$($DNSTAPREAD ns3/dnstap.out.save | grep "UQ " | wc -l)
+ur3=$($DNSTAPREAD ns3/dnstap.out.save | grep "UR " | wc -l)
 
 echo_i "checking UDP message counts"
 ret=0
@@ -317,38 +317,38 @@ status=$((status + ret))
 
 echo_i "checking reopened message counts"
 
-udp1=`$DNSTAPREAD ns1/dnstap.out | grep "UDP " | wc -l`
-tcp1=`$DNSTAPREAD ns1/dnstap.out | grep "TCP " | wc -l`
-aq1=`$DNSTAPREAD ns1/dnstap.out | grep "AQ " | wc -l`
-ar1=`$DNSTAPREAD ns1/dnstap.out | grep "AR " | wc -l`
-cq1=`$DNSTAPREAD ns1/dnstap.out | grep "CQ " | wc -l`
-cr1=`$DNSTAPREAD ns1/dnstap.out | grep "CR " | wc -l`
-rq1=`$DNSTAPREAD ns1/dnstap.out | grep "RQ " | wc -l`
-rr1=`$DNSTAPREAD ns1/dnstap.out | grep "RR " | wc -l`
-uq1=`$DNSTAPREAD ns1/dnstap.out | grep "UQ " | wc -l`
-ur1=`$DNSTAPREAD ns1/dnstap.out | grep "UR " | wc -l`
+udp1=$($DNSTAPREAD ns1/dnstap.out | grep "UDP " | wc -l)
+tcp1=$($DNSTAPREAD ns1/dnstap.out | grep "TCP " | wc -l)
+aq1=$($DNSTAPREAD ns1/dnstap.out | grep "AQ " | wc -l)
+ar1=$($DNSTAPREAD ns1/dnstap.out | grep "AR " | wc -l)
+cq1=$($DNSTAPREAD ns1/dnstap.out | grep "CQ " | wc -l)
+cr1=$($DNSTAPREAD ns1/dnstap.out | grep "CR " | wc -l)
+rq1=$($DNSTAPREAD ns1/dnstap.out | grep "RQ " | wc -l)
+rr1=$($DNSTAPREAD ns1/dnstap.out | grep "RR " | wc -l)
+uq1=$($DNSTAPREAD ns1/dnstap.out | grep "UQ " | wc -l)
+ur1=$($DNSTAPREAD ns1/dnstap.out | grep "UR " | wc -l)
 
-udp2=`$DNSTAPREAD ns2/dnstap.out | grep "UDP " | wc -l`
-tcp2=`$DNSTAPREAD ns2/dnstap.out | grep "TCP " | wc -l`
-aq2=`$DNSTAPREAD ns2/dnstap.out | grep "AQ " | wc -l`
-ar2=`$DNSTAPREAD ns2/dnstap.out | grep "AR " | wc -l`
-cq2=`$DNSTAPREAD ns2/dnstap.out | grep "CQ " | wc -l`
-cr2=`$DNSTAPREAD ns2/dnstap.out | grep "CR " | wc -l`
-rq2=`$DNSTAPREAD ns2/dnstap.out | grep "RQ " | wc -l`
-rr2=`$DNSTAPREAD ns2/dnstap.out | grep "RR " | wc -l`
-uq2=`$DNSTAPREAD ns2/dnstap.out | grep "UQ " | wc -l`
-ur2=`$DNSTAPREAD ns2/dnstap.out | grep "UR " | wc -l`
+udp2=$($DNSTAPREAD ns2/dnstap.out | grep "UDP " | wc -l)
+tcp2=$($DNSTAPREAD ns2/dnstap.out | grep "TCP " | wc -l)
+aq2=$($DNSTAPREAD ns2/dnstap.out | grep "AQ " | wc -l)
+ar2=$($DNSTAPREAD ns2/dnstap.out | grep "AR " | wc -l)
+cq2=$($DNSTAPREAD ns2/dnstap.out | grep "CQ " | wc -l)
+cr2=$($DNSTAPREAD ns2/dnstap.out | grep "CR " | wc -l)
+rq2=$($DNSTAPREAD ns2/dnstap.out | grep "RQ " | wc -l)
+rr2=$($DNSTAPREAD ns2/dnstap.out | grep "RR " | wc -l)
+uq2=$($DNSTAPREAD ns2/dnstap.out | grep "UQ " | wc -l)
+ur2=$($DNSTAPREAD ns2/dnstap.out | grep "UR " | wc -l)
 
-udp3=`$DNSTAPREAD ns3/dnstap.out | grep "UDP " | wc -l`
-tcp3=`$DNSTAPREAD ns3/dnstap.out | grep "TCP " | wc -l`
-aq3=`$DNSTAPREAD ns3/dnstap.out | grep "AQ " | wc -l`
-ar3=`$DNSTAPREAD ns3/dnstap.out | grep "AR " | wc -l`
-cq3=`$DNSTAPREAD ns3/dnstap.out | grep "CQ " | wc -l`
-cr3=`$DNSTAPREAD ns3/dnstap.out | grep "CR " | wc -l`
-rq3=`$DNSTAPREAD ns3/dnstap.out | grep "RQ " | wc -l`
-rr3=`$DNSTAPREAD ns3/dnstap.out | grep "RR " | wc -l`
-uq3=`$DNSTAPREAD ns3/dnstap.out | grep "UQ " | wc -l`
-ur3=`$DNSTAPREAD ns3/dnstap.out | grep "UR " | wc -l`
+udp3=$($DNSTAPREAD ns3/dnstap.out | grep "UDP " | wc -l)
+tcp3=$($DNSTAPREAD ns3/dnstap.out | grep "TCP " | wc -l)
+aq3=$($DNSTAPREAD ns3/dnstap.out | grep "AQ " | wc -l)
+ar3=$($DNSTAPREAD ns3/dnstap.out | grep "AR " | wc -l)
+cq3=$($DNSTAPREAD ns3/dnstap.out | grep "CQ " | wc -l)
+cr3=$($DNSTAPREAD ns3/dnstap.out | grep "CR " | wc -l)
+rq3=$($DNSTAPREAD ns3/dnstap.out | grep "RQ " | wc -l)
+rr3=$($DNSTAPREAD ns3/dnstap.out | grep "RR " | wc -l)
+uq3=$($DNSTAPREAD ns3/dnstap.out | grep "UQ " | wc -l)
+ur3=$($DNSTAPREAD ns3/dnstap.out | grep "UR " | wc -l)
 
 echo_i "checking UDP message counts"
 ret=0
@@ -543,7 +543,7 @@ fi
 
 echo_i "checking dnstap-read hex output"
 ret=0
-hex=`$DNSTAPREAD -x ns3/dnstap.out | tail -1`
+hex=$($DNSTAPREAD -x ns3/dnstap.out | tail -1)
 echo $hex | $WIRETEST > dnstap.hex
 grep 'status: NOERROR' dnstap.hex > /dev/null 2>&1 || ret=1
 grep 'ANSWER: 3, AUTHORITY: 1' dnstap.hex > /dev/null 2>&1 || ret=1
@@ -572,16 +572,16 @@ EOF
 	status=$((status + ret))
 	kill $fstrm_capture_pid
 	wait
-	udp4=`$DNSTAPREAD dnstap.out | grep "UDP " | wc -l`
-	tcp4=`$DNSTAPREAD dnstap.out | grep "TCP " | wc -l`
-	aq4=`$DNSTAPREAD dnstap.out | grep "AQ " | wc -l`
-	ar4=`$DNSTAPREAD dnstap.out | grep "AR " | wc -l`
-	cq4=`$DNSTAPREAD dnstap.out | grep "CQ " | wc -l`
-	cr4=`$DNSTAPREAD dnstap.out | grep "CR " | wc -l`
-	rq4=`$DNSTAPREAD dnstap.out | grep "RQ " | wc -l`
-	rr4=`$DNSTAPREAD dnstap.out | grep "RR " | wc -l`
-	uq4=`$DNSTAPREAD dnstap.out | grep "UQ " | wc -l`
-	ur4=`$DNSTAPREAD dnstap.out | grep "UR " | wc -l`
+	udp4=$($DNSTAPREAD dnstap.out | grep "UDP " | wc -l)
+	tcp4=$($DNSTAPREAD dnstap.out | grep "TCP " | wc -l)
+	aq4=$($DNSTAPREAD dnstap.out | grep "AQ " | wc -l)
+	ar4=$($DNSTAPREAD dnstap.out | grep "AR " | wc -l)
+	cq4=$($DNSTAPREAD dnstap.out | grep "CQ " | wc -l)
+	cr4=$($DNSTAPREAD dnstap.out | grep "CR " | wc -l)
+	rq4=$($DNSTAPREAD dnstap.out | grep "RQ " | wc -l)
+	rr4=$($DNSTAPREAD dnstap.out | grep "RR " | wc -l)
+	uq4=$($DNSTAPREAD dnstap.out | grep "UQ " | wc -l)
+	ur4=$($DNSTAPREAD dnstap.out | grep "UR " | wc -l)
 
 	echo_i "checking UDP message counts"
 	ret=0
@@ -690,16 +690,16 @@ EOF
 	status=$((status + ret))
 	kill $fstrm_capture_pid
 	wait
-	udp4=`$DNSTAPREAD dnstap.out | grep "UDP " | wc -l`
-	tcp4=`$DNSTAPREAD dnstap.out | grep "TCP " | wc -l`
-	aq4=`$DNSTAPREAD dnstap.out | grep "AQ " | wc -l`
-	ar4=`$DNSTAPREAD dnstap.out | grep "AR " | wc -l`
-	cq4=`$DNSTAPREAD dnstap.out | grep "CQ " | wc -l`
-	cr4=`$DNSTAPREAD dnstap.out | grep "CR " | wc -l`
-	rq4=`$DNSTAPREAD dnstap.out | grep "RQ " | wc -l`
-	rr4=`$DNSTAPREAD dnstap.out | grep "RR " | wc -l`
-	uq4=`$DNSTAPREAD dnstap.out | grep "UQ " | wc -l`
-	ur4=`$DNSTAPREAD dnstap.out | grep "UR " | wc -l`
+	udp4=$($DNSTAPREAD dnstap.out | grep "UDP " | wc -l)
+	tcp4=$($DNSTAPREAD dnstap.out | grep "TCP " | wc -l)
+	aq4=$($DNSTAPREAD dnstap.out | grep "AQ " | wc -l)
+	ar4=$($DNSTAPREAD dnstap.out | grep "AR " | wc -l)
+	cq4=$($DNSTAPREAD dnstap.out | grep "CQ " | wc -l)
+	cr4=$($DNSTAPREAD dnstap.out | grep "CR " | wc -l)
+	rq4=$($DNSTAPREAD dnstap.out | grep "RQ " | wc -l)
+	rr4=$($DNSTAPREAD dnstap.out | grep "RR " | wc -l)
+	uq4=$($DNSTAPREAD dnstap.out | grep "UQ " | wc -l)
+	ur4=$($DNSTAPREAD dnstap.out | grep "UR " | wc -l)
 
 	echo_i "checking UDP message counts"
 	ret=0
@@ -794,7 +794,7 @@ echo_i "checking large packet printing"
 ret=0
 # Expect one occurrence of "opcode: QUERY" below "reponse_message_data" and
 # another one below "response_message".
-lines=`$DNSTAPREAD -y large-answer.fstrm | grep -c "opcode: QUERY"`
+lines=$($DNSTAPREAD -y large-answer.fstrm | grep -c "opcode: QUERY")
 [ $lines -eq 2 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
diff --git a/bin/tests/system/dupsigs/ns1/reset_keys.sh b/bin/tests/system/dupsigs/ns1/reset_keys.sh
index 9f23d10c70..6f96c6af2d 100644
--- a/bin/tests/system/dupsigs/ns1/reset_keys.sh
+++ b/bin/tests/system/dupsigs/ns1/reset_keys.sh
@@ -23,18 +23,18 @@ timetodnssec() {
 }
 
 KEYDIR=keys/signing.test
-KSK=`$KEYGEN -a RSASHA256 -K $KEYDIR -q -f KSK $zone`
+KSK=$($KEYGEN -a RSASHA256 -K $KEYDIR -q -f KSK $zone)
 
-ZSK0=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK1=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK2=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK3=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK4=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK5=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK6=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK7=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK8=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
-ZSK9=`$KEYGEN -a RSASHA256 -K $KEYDIR -q $zone`
+ZSK0=$($KEYGEN -a RSASHA256 -K $KEYDIR -q $zone)
+ZSK1=$($KEYGEN -a RSASHA256 -K $KEYDIR -q $zone)
+ZSK2=$($KEYGEN -a RSASHA256 -K $KEYDIR -q $zone)
+ZSK3=$($KEYGEN -a RSASHA256 -K $KEYDIR -q $zone)
+ZSK4=$($KEYGEN -a RSASHA256 -K $KEYDIR -q $zone)
+ZSK5=$($KEYGEN -a RSASHA256 -K $KEYDIR -q $zone)
+ZSK6=$($KEYGEN -a RSASHA256 -K $KEYDIR -q $zone)
+ZSK7=$($KEYGEN -a RSASHA256 -K $KEYDIR -q $zone)
+ZSK8=$($KEYGEN -a RSASHA256 -K $KEYDIR -q $zone)
+ZSK9=$($KEYGEN -a RSASHA256 -K $KEYDIR -q $zone)
 
 # clear all times on all keys
 for FILEN in keys/signing.test/*.key
@@ -42,8 +42,8 @@ do
     $SETTIME -P none -A none -R none -I none -D none $FILEN
 done
 
-BASE=`date +%s`
-BASET=`timetodnssec $BASE`
+BASE=$(date +%s)
+BASET=$(timetodnssec $BASE)
 
 # reset the publish and activation time on the KSK
 $SETTIME -P $BASET -A $BASET $KEYDIR/$KSK
@@ -53,16 +53,16 @@ $SETTIME -P $BASET -A $BASET $KEYDIR/$ZSK0
 
 # schedule the first roll
 R1=$((BASE + 50))
-R1T=`timetodnssec $R1`
+R1T=$(timetodnssec $R1)
 
 $SETTIME -I $R1T $KEYDIR/$ZSK0
 $SETTIME -P $BASET -A $R1T $KEYDIR/$ZSK1
 
 # schedule the second roll (which includes the delete of the first key)
 R2=$((R1 + 50))
-R2T=`timetodnssec $R2`
+R2T=$(timetodnssec $R2)
 DT=$R2
-DTT=`timetodnssec $DT`
+DTT=$(timetodnssec $DT)
 
 $SETTIME -D $DTT $KEYDIR/$ZSK0
 $SETTIME -I $R2T $KEYDIR/$ZSK1
@@ -70,7 +70,7 @@ $SETTIME -P $R1T -A $R2T $KEYDIR/$ZSK2
 
 # schedule the third roll
 R3=$((R2 + 25))
-R3T=`timetodnssec $R3`
+R3T=$(timetodnssec $R3)
 
 $SETTIME -D $R3T $KEYDIR/$ZSK1
 $SETTIME -I $R3T $KEYDIR/$ZSK2
@@ -92,7 +92,7 @@ exit
 # duplicate signatures, see
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/231#note_9597
 R4=$((R3 + 10))
-R4T=`timetodnssec $R4`
+R4T=$(timetodnssec $R4)
 
 $SETTIME -D $R4T $KEYDIR/$ZSK2
 $SETTIME -I $R4T $KEYDIR/$ZSK3
diff --git a/bin/tests/system/dupsigs/tests.sh b/bin/tests/system/dupsigs/tests.sh
index 5d44d53d50..4ab3a732e2 100644
--- a/bin/tests/system/dupsigs/tests.sh
+++ b/bin/tests/system/dupsigs/tests.sh
@@ -47,7 +47,7 @@ retry_quiet 60 _wait_for_last_nsec_signed
 retry_quiet 10 fully_signed || status=1
 if [ $status != 0 ]; then echo_i "failed"; fi
 
-start=`date +%s`
+start=$(date +%s)
 now=$start
 end=$((start + 140))
 
@@ -57,14 +57,14 @@ while [ $now -lt $end ] && [ $status -eq 0 ]; do
 	$JOURNALPRINT ns1/signing.test.db.signed.jnl | $PERL check_journal.pl | cat_i
 	$DIG axfr signing.test -p ${PORT} @10.53.0.1 > dig.out.at$et
 	awk '$4 == "RRSIG" { print $11 }' dig.out.at$et | sort | uniq -c | cat_i
-	lines=`awk '$4 == "RRSIG" { print}' dig.out.at$et | wc -l`
+	lines=$(awk '$4 == "RRSIG" { print}' dig.out.at$et | wc -l)
 	if [ ${et} -ne 0 -a ${lines} -ne 1008 ]
 	then
 		echo_i "failed"
                 status=$((status + 1))
 	fi
 	sleep 5
-	now=`date +%s`
+	now=$(date +%s)
 done
 
 echo_i "exit status: $status"
diff --git a/bin/tests/system/dyndb/tests.sh b/bin/tests/system/dyndb/tests.sh
index ece180418a..ef02dea8f5 100644
--- a/bin/tests/system/dyndb/tests.sh
+++ b/bin/tests/system/dyndb/tests.sh
@@ -46,9 +46,9 @@ EOF
 	return 1
     }
 
-    out=`$DIG $DIGOPTS +noall +answer -t $type -q $host`
+    out=$($DIG $DIGOPTS +noall +answer -t $type -q $host)
     echo $out > added.a.out.$n
-    lines=`echo "$out" | grep "$ip" | wc -l`
+    lines=$(echo "$out" | grep "$ip" | wc -l)
     [ $lines -eq 1 ] || {
 	[ "$should_fail" ] || \
 	    echo_i "dig output incorrect for $host $type $cmd: $out"
@@ -57,9 +57,9 @@ EOF
 
     for i in 1 2 3 4 5 6 7 8 9 10
     do
-	out=`$DIG $DIGOPTS +noall +answer -x $ip`
+	out=$($DIG $DIGOPTS +noall +answer -x $ip)
 	echo $out > added.ptr.out.$n
-	lines=`echo "$out" | grep "$host" | wc -l`
+	lines=$(echo "$out" | grep "$host" | wc -l)
 	[ $lines -eq 1 ] && break;
 	$PERL -e 'select(undef, undef, undef, 0.1);'
     done
@@ -76,7 +76,7 @@ test_del() {
     host="$1"
     type="$2"
 
-    ip=`$DIG $DIGOPTS +short $host $type`
+    ip=$($DIG $DIGOPTS +short $host $type)
 
     cat <<EOF > ns1/update.txt
 server 10.53.0.1 ${PORT}
@@ -91,9 +91,9 @@ EOF
 	return 1
     }
 
-    out=`$DIG $DIGOPTS +noall +answer -t $type -q $host`
+    out=$($DIG $DIGOPTS +noall +answer -t $type -q $host)
     echo $out > deleted.a.out.$n
-    lines=`echo "$out" | grep "$ip" | wc -l`
+    lines=$(echo "$out" | grep "$ip" | wc -l)
     [ $lines -eq 0 ] || {
 	[ "$should_fail" ] || \
 	    echo_i "dig output incorrect for $host $type $cmd: $out"
@@ -102,9 +102,9 @@ EOF
 
     for i in 1 2 3 4 5 6 7 8 9 10
     do
-	out=`$DIG $DIGOPTS +noall +answer -x $ip`
+	out=$($DIG $DIGOPTS +noall +answer -x $ip)
 	echo $out > deleted.ptr.out.$n
-	lines=`echo "$out" | grep "$host" | wc -l`
+	lines=$(echo "$out" | grep "$host" | wc -l)
 	[ $lines -eq 0 ] && break
 	$PERL -e 'select(undef, undef, undef, 0.1);'
     done
diff --git a/bin/tests/system/fetchlimit/tests.sh b/bin/tests/system/fetchlimit/tests.sh
index 6664c59b39..a16659dbc4 100644
--- a/bin/tests/system/fetchlimit/tests.sh
+++ b/bin/tests/system/fetchlimit/tests.sh
@@ -40,8 +40,8 @@ burst() {
 }
 
 stat() {
-    clients=`rndccmd ${1} status | grep "recursive clients" |
-            sed 's;.*: \([^/][^/]*\)/.*;\1;'`
+    clients=$(rndccmd ${1} status | grep "recursive clients" |
+            sed 's;.*: \([^/][^/]*\)/.*;\1;')
     echo_i "clients: $clients"
     [ "$clients" = "" ] && return 1
     [ "$clients" -ge $2 ] || return 1
@@ -84,7 +84,7 @@ n=$((n + 1))
 echo_i "dumping ADB data ($n)"
 ret=0
 rndccmd 10.53.0.3 dumpdb -adb
-info=`grep '10.53.0.4' ns3/named_dump.db | sed 's/.*\(atr [.0-9]*\).*\(quota [0-9]*\).*/\1 \2/'`
+info=$(grep '10.53.0.4' ns3/named_dump.db | sed 's/.*\(atr [.0-9]*\).*\(quota [0-9]*\).*/\1 \2/')
 echo_i $info
 set -- $info
 quota=$4
@@ -101,9 +101,9 @@ for try in 1 2 3 4 5; do
     [ -f ns3/named.stats ] && break
     sleep 1
 done
-sspill=`grep 'spilled due to server' ns3/named.stats | sed 's/\([0-9][0-9]*\) spilled.*/\1/'`
+sspill=$(grep 'spilled due to server' ns3/named.stats | sed 's/\([0-9][0-9]*\) spilled.*/\1/')
 [ -z "$sspill" ] && sspill=0
-fails=`grep 'queries resulted in SERVFAIL' ns3/named.stats | sed 's/\([0-9][0-9]*\) queries.*/\1/'`
+fails=$(grep 'queries resulted in SERVFAIL' ns3/named.stats | sed 's/\([0-9][0-9]*\) queries.*/\1/')
 [ -z "$fails" ] && fails=0
 [ "$fails" -ge "$sspill" ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -126,7 +126,7 @@ n=$((n + 1))
 echo_i "dumping ADB data ($n)"
 ret=0
 rndccmd 10.53.0.3 dumpdb -adb
-info=`grep '10.53.0.4' ns3/named_dump.db | sed 's/.*\(atr [.0-9]*\).*\(quota [0-9]*\).*/\1 \2/'`
+info=$(grep '10.53.0.4' ns3/named_dump.db | sed 's/.*\(atr [.0-9]*\).*\(quota [0-9]*\).*/\1 \2/')
 echo_i $info
 set -- $info
 [ ${4:-${quota}} -lt $quota ] || ret=1
@@ -150,7 +150,7 @@ n=$((n + 1))
 echo_i "dumping ADB data ($n)"
 ret=0
 rndccmd 10.53.0.3 dumpdb -adb
-info=`grep '10.53.0.4' ns3/named_dump.db | sed 's/.*\(atr [.0-9]*\).*\(quota [0-9]*\).*/\1 \2/'`
+info=$(grep '10.53.0.4' ns3/named_dump.db | sed 's/.*\(atr [.0-9]*\).*\(quota [0-9]*\).*/\1 \2/')
 echo_i $info
 set -- $info
 [ ${4:-${quota}} -gt $quota ] || ret=1
@@ -192,9 +192,9 @@ for try in 1 2 3 4 5; do
     [ -f ns3/named.stats ] && break
     sleep 1
 done
-zspill=`grep 'spilled due to zone' ns3/named.stats | sed 's/\([0-9][0-9]*\) spilled.*/\1/'`
+zspill=$(grep 'spilled due to zone' ns3/named.stats | sed 's/\([0-9][0-9]*\) spilled.*/\1/')
 [ -z "$zspill" ] && zspill=0
-drops=`grep 'queries dropped' ns3/named.stats | sed 's/\([0-9][0-9]*\) queries.*/\1/'`
+drops=$(grep 'queries dropped' ns3/named.stats | sed 's/\([0-9][0-9]*\) queries.*/\1/')
 [ -z "$drops" ] && drops=0
 [ "$drops" -ge "$zspill" ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -236,7 +236,7 @@ rm -f ns3/named.stats
 touch ns3/named.stats
 rndccmd 10.53.0.3 stats
 wait_for_log 5 "queries dropped due to recursive client limit" ns3/named.stats || ret=1
-drops=`grep 'queries dropped due to recursive client limit' ns3/named.stats | sed 's/\([0-9][0-9]*\) queries.*/\1/'`
+drops=$(grep 'queries dropped due to recursive client limit' ns3/named.stats | sed 's/\([0-9][0-9]*\) queries.*/\1/')
 [ "${drops:-0}" -ne 0 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -264,7 +264,7 @@ for try in 1 2 3 4 5; do
     [ -f ns5/named.stats ] && break
     sleep 1
 done
-zspill=`grep 'spilled due to clients per query' ns5/named.stats | sed 's/ *\([0-9][0-9]*\) spilled.*/\1/'`
+zspill=$(grep 'spilled due to clients per query' ns5/named.stats | sed 's/ *\([0-9][0-9]*\) spilled.*/\1/')
 [ -z "$zspill" ] && zspill=0
 # ns5 configuration:
 #   clients-per-query 5
@@ -307,7 +307,7 @@ for try in 1 2 3 4 5; do
     [ -f ns5/named.stats ] && break
     sleep 1
 done
-zspill=`grep 'spilled due to clients per query' ns5/named.stats | sed 's/ *\([0-9][0-9]*\) spilled.*/\1/'`
+zspill=$(grep 'spilled due to clients per query' ns5/named.stats | sed 's/ *\([0-9][0-9]*\) spilled.*/\1/')
 [ -z "$zspill" ] && zspill=0
 # ns5 configuration:
 #   clients-per-query 5
diff --git a/bin/tests/system/filter-aaaa/ns1/sign.sh b/bin/tests/system/filter-aaaa/ns1/sign.sh
index b5cb86bf41..bf6f458162 100755
--- a/bin/tests/system/filter-aaaa/ns1/sign.sh
+++ b/bin/tests/system/filter-aaaa/ns1/sign.sh
@@ -22,7 +22,7 @@ outfile=signed.db.signed
 
 $KEYGEN -a $DEFAULT_ALGORITHM $zone 2>&1 > /dev/null | cat_i
 $KEYGEN -f KSK -a $DEFAULT_ALGORITHM $zone 2>&1 > keygen.out | cat_i
-keyname=`cat keygen.out`
+keyname=$(cat keygen.out)
 rm -f keygen.out
 
 keyfile_to_static_ds $keyname > trusted.conf
diff --git a/bin/tests/system/formerr/tests.sh b/bin/tests/system/formerr/tests.sh
index bded55cc88..75f4cc0b64 100644
--- a/bin/tests/system/formerr/tests.sh
+++ b/bin/tests/system/formerr/tests.sh
@@ -19,7 +19,7 @@ status=0
 
 echo_i "test name too long"
 $PERL formerr.pl -a 10.53.0.1 -p ${PORT} nametoolong > nametoolong.out
-ans=`grep got: nametoolong.out`
+ans=$(grep got: nametoolong.out)
 if [ "${ans}" != "got: 000080010000000000000000" ];
 then
 	echo_i "failed"; status=$((status + 1));
@@ -27,7 +27,7 @@ fi
 
 echo_i "two questions"
 $PERL formerr.pl -a 10.53.0.1 -p ${PORT} twoquestions > twoquestions.out
-ans=`grep got: twoquestions.out`
+ans=$(grep got: twoquestions.out)
 if [ "${ans}" != "got: 000080010000000000000000" ];
 then
 	echo_i "failed"; status=$((status + 1));
@@ -37,7 +37,7 @@ fi
 # but is a FORMERR without one.
 echo_i "empty question section (and no COOKIE option)"
 $PERL formerr.pl -a 10.53.0.1 -p ${PORT} noquestions > noquestions.out
-ans=`grep got: noquestions.out`
+ans=$(grep got: noquestions.out)
 if [ "${ans}" != "got: 000080010000000000000000" ];
 then
 	echo_i "failed"; status=$((status + 1));
diff --git a/bin/tests/system/geoip2/tests.sh b/bin/tests/system/geoip2/tests.sh
index 2a728a7ff8..b72a870714 100644
--- a/bin/tests/system/geoip2/tests.sh
+++ b/bin/tests/system/geoip2/tests.sh
@@ -50,7 +50,7 @@ ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
@@ -66,7 +66,7 @@ then
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
   done
@@ -89,7 +89,7 @@ ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
@@ -105,7 +105,7 @@ then
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-      j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+      j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
       [ "$i" = "$j" ] || lret=1
       [ $lret -eq 1 ] && break
   done
@@ -128,7 +128,7 @@ ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
@@ -144,7 +144,7 @@ then
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
   done
@@ -168,7 +168,7 @@ lret=0
 # deliberately skipping 4 and 6 as they have duplicate continents
 for i in 1 2 3 5 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
@@ -185,7 +185,7 @@ then
   # deliberately skipping 4 and 6 as they have duplicate continents
   for i in 1 2 3 5 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
   done
@@ -209,7 +209,7 @@ lret=0
 # skipping 2 on purpose here; it has the same region code as 1
 for i in 1 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
@@ -226,7 +226,7 @@ then
 # skipping 2 on purpose here; it has the same region code as 1
   for i in 1 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
   done
@@ -250,7 +250,7 @@ ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
@@ -266,7 +266,7 @@ then
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
   done
@@ -289,7 +289,7 @@ ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
@@ -305,7 +305,7 @@ then
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-      j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+      j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
       [ "$i" = "$j" ] || lret=1
       [ $lret -eq 1 ] && break
   done
@@ -328,7 +328,7 @@ ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
@@ -344,7 +344,7 @@ then
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-      j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+      j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
       [ "$i" = "$j" ] || lret=1
       [ $lret -eq 1 ] && break
   done
@@ -367,7 +367,7 @@ ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
@@ -383,7 +383,7 @@ then
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-      j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+      j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
       [ "$i" = "$j" ] || lret=1
       [ $lret -eq 1 ] && break
   done
@@ -406,7 +406,7 @@ ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
@@ -422,7 +422,7 @@ then
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-      j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+      j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
       [ "$i" = "$j" ] || lret=1
       [ $lret -eq 1 ] && break
   done
@@ -445,7 +445,7 @@ ret=0
 lret=0
 for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS txt example -b 10.53.0.$i > dig.out.ns2.test$n.$i || lret=1
-    j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+    j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1
     [ $lret -eq 1 ] && break
 done
@@ -461,7 +461,7 @@ then
   lret=0
   for i in 1 2 3 4 5 6 7; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i > dig.out.ns2.test$n.$i || lret=1
-      j=`cat dig.out.ns2.test$n.$i | tr -d '"'`
+      j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
       [ "$i" = "$j" ] || lret=1
       [ $lret -eq 1 ] && break
   done
diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
index 4765d25350..5f525d68de 100644
--- a/bin/tests/system/idna/tests.sh
+++ b/bin/tests/system/idna/tests.sh
@@ -109,7 +109,7 @@ idna_test() {
         echo_i "failed: dig command returned non-zero status"
         ret=1
     else
-        actual=`qname dig.out.$n`
+        actual=$(qname dig.out.$n)
         if [ "$4" != "$actual" ]; then
             echo_i "failed: expected answer $4, actual result $actual"
             ret=1
diff --git a/bin/tests/system/ixfr/tests.sh b/bin/tests/system/ixfr/tests.sh
index a4a604f897..a2ac4256e4 100644
--- a/bin/tests/system/ixfr/tests.sh
+++ b/bin/tests/system/ixfr/tests.sh
@@ -301,9 +301,9 @@ sub=$!
 $DIG -p ${PORT} ixfr=0 large @10.53.0.3 > dig.out.test$n
 kill $sub
 )
-lines=`grep hostmaster.large dig.out.test$n | wc -l`
+lines=$(grep hostmaster.large dig.out.test$n | wc -l)
 test ${lines:-0} -eq 2 || ret=1
-messages=`sed -n 's/^;;.*messages \([0-9]*\),.*/\1/p' dig.out.test$n`
+messages=$(sed -n 's/^;;.*messages \([0-9]*\),.*/\1/p' dig.out.test$n)
 test ${messages:-0} -gt 1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
diff --git a/bin/tests/system/keepalive/tests.sh b/bin/tests/system/keepalive/tests.sh
index d1165dd594..7314a9e1c3 100644
--- a/bin/tests/system/keepalive/tests.sh
+++ b/bin/tests/system/keepalive/tests.sh
@@ -83,12 +83,12 @@ echo_i "checking server config entry ($n)"
 ret=0
 n=$((n + 1))
 $RNDCCMD stats
-oka=`grep  "EDNS TCP keepalive option received" ns2/named.stats | \
-    tail -1 | awk '{ print $1}'`
+oka=$(grep  "EDNS TCP keepalive option received" ns2/named.stats | \
+    tail -1 | awk '{ print $1}')
 $DIG $DIGOPTS bar.example @10.53.0.3 > dig.out.test$n
 $RNDCCMD stats
-nka=`grep  "EDNS TCP keepalive option received" ns2/named.stats | \
-    tail -1 | awk '{ print $1}'`
+nka=$(grep  "EDNS TCP keepalive option received" ns2/named.stats | \
+    tail -1 | awk '{ print $1}')
 #echo oka ':' $oka
 #echo nka ':' $nka
 if [ "$oka" -eq "$nka" ]; then ret=1; fi
diff --git a/bin/tests/system/legacy/ns6/sign.sh b/bin/tests/system/legacy/ns6/sign.sh
index 9baecad2cd..f76b3c23c1 100755
--- a/bin/tests/system/legacy/ns6/sign.sh
+++ b/bin/tests/system/legacy/ns6/sign.sh
@@ -22,8 +22,8 @@ infile=edns512.db.in
 zonefile=edns512.db
 outfile=edns512.db.signed
 
-keyname1=`$KEYGEN -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null`
+keyname1=$($KEYGEN -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null)
+keyname2=$($KEYGEN -f KSK -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null)
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
diff --git a/bin/tests/system/legacy/ns7/sign.sh b/bin/tests/system/legacy/ns7/sign.sh
index 6356fa485a..c2153f9309 100755
--- a/bin/tests/system/legacy/ns7/sign.sh
+++ b/bin/tests/system/legacy/ns7/sign.sh
@@ -22,8 +22,8 @@ infile=edns512-notcp.db.in
 zonefile=edns512-notcp.db
 outfile=edns512-notcp.db.signed
 
-keyname1=`$KEYGEN -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null`
+keyname1=$($KEYGEN -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null)
+keyname2=$($KEYGEN -f KSK -a RSASHA512 -b 4096 -n zone $zone 2> /dev/null)
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
diff --git a/bin/tests/system/legacy/tests.sh b/bin/tests/system/legacy/tests.sh
index af1167352b..44d3b1196f 100755
--- a/bin/tests/system/legacy/tests.sh
+++ b/bin/tests/system/legacy/tests.sh
@@ -241,7 +241,7 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "checking recursive lookup to edns 512 + no tcp server does not cause query loops ($n)"
 ret=0
-sent=`grep -c -F "sending packet to 10.53.0.7" ns1/named.run`
+sent=$(grep -c -F "sending packet to 10.53.0.7" ns1/named.run)
 if [ $sent -ge 10 ]; then
 	echo_i "ns1 sent $sent queries to ns7, expected less than 10"
 	ret=1
diff --git a/bin/tests/system/names/tests.sh b/bin/tests/system/names/tests.sh
index f8768a84c9..9546298451 100644
--- a/bin/tests/system/names/tests.sh
+++ b/bin/tests/system/names/tests.sh
@@ -21,12 +21,12 @@ status=0
 
 echo_i "Getting message size with compression enabled"
 $DIG $DIGOPTS -b 10.53.0.1 @10.53.0.1 mx example > dig.compen.test
-COMPEN=`grep ';; MSG SIZE' dig.compen.test |sed -e "s/.*: //g"`
+COMPEN=$(grep ';; MSG SIZE' dig.compen.test |sed -e "s/.*: //g")
 cat dig.compen.test  |grep -v ';;' |sort > dig.compen.sorted.test
 
 echo_i "Getting message size with compression disabled"
 $DIG $DIGOPTS -b 10.53.0.2 @10.53.0.1 mx example > dig.compdis.test
-COMPDIS=`grep ';; MSG SIZE' dig.compdis.test |sed -e "s/.*: //g"`
+COMPDIS=$(grep ';; MSG SIZE' dig.compdis.test |sed -e "s/.*: //g")
 cat dig.compdis.test  |grep -v ';;' |sort > dig.compdis.sorted.test
 
 # the compression disabled message should be at least twice as large as with
diff --git a/bin/tests/system/nsec3/tests.sh b/bin/tests/system/nsec3/tests.sh
index 30b183196c..117bf636a7 100644
--- a/bin/tests/system/nsec3/tests.sh
+++ b/bin/tests/system/nsec3/tests.sh
@@ -186,7 +186,7 @@ _check_nsec3_nsec3param() {
 	grep "${ZONE}.*0.*IN.*NSEC3PARAM.*1.*0.*${ITERATIONS}.*${SALT}" "dig.out.test$n.nsec3param.$ZONE" > /dev/null || return 1
 
 	if [ -z "$SALT" ]; then
-		SALT=`awk '$4 == "NSEC3PARAM" { print $8 }' dig.out.test$n.nsec3param.$ZONE`
+		SALT=$(awk '$4 == "NSEC3PARAM" { print $8 }' dig.out.test$n.nsec3param.$ZONE)
 	fi
 	return 0
 }
diff --git a/bin/tests/system/nsupdate/krb/setup.sh b/bin/tests/system/nsupdate/krb/setup.sh
index a1b3ee6771..3d254a84e0 100644
--- a/bin/tests/system/nsupdate/krb/setup.sh
+++ b/bin/tests/system/nsupdate/krb/setup.sh
@@ -13,7 +13,7 @@
 
 set -x
 
-PWD=`pwd`
+PWD=$(pwd)
 
 KRB5_CONFIG="${PWD}/krb5.conf"
 export KRB5_CONFIG
@@ -21,7 +21,7 @@ export KRB5_CONFIG
 KRB5_KDC_PROFILE=${PWD}/krb5kdc
 export KRB5_KDC_PROFILE
 
-now=`date +%s`
+now=$(date +%s)
 lifetime=$((2147483647 - now))
 lifetime=$((lifetime / 3600 / 24 - 30))
 
diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
index 54e7a4ede6..6e257ae914 100755
--- a/bin/tests/system/nsupdate/tests.sh
+++ b/bin/tests/system/nsupdate/tests.sh
@@ -1117,7 +1117,7 @@ zone unreachable.
 update add unreachable. 600 A 192.0.2.1
 send
 END
-t2=`$PERL -e 'print time()'`
+t2=$($PERL -e 'print time()')
 grep "; Communication with 10.53.0.4#${PORT} failed: timed out" nsupdate.out.test$n > /dev/null 2>&1 || ret=1
 grep "not implemented" nsupdate.out.test$n > /dev/null 2>&1 && ret=1
 elapsed=$((t2 - t1))
@@ -1136,7 +1136,7 @@ zone unreachable.
 update add unreachable. 600 A 192.0.2.1
 send
 END
-t2=`$PERL -e 'print time()'`
+t2=$($PERL -e 'print time()')
 grep "; Communication with 10.53.0.4#${PORT} failed: timed out" nsupdate.out.test$n > /dev/null 2>&1 || ret=1
 grep "not implemented" nsupdate.out.test$n > /dev/null 2>&1 && ret=1
 elapsed=$((t2 - t1))
@@ -1155,7 +1155,7 @@ zone unreachable.
 update add unreachable. 600 A 192.0.2.1
 send
 END
-t2=`$PERL -e 'print time()'`
+t2=$($PERL -e 'print time()')
 grep "; Communication with 10.53.0.4#${PORT} failed: timed out" nsupdate.out.test$n > /dev/null 2>&1 || ret=1
 grep "not implemented" nsupdate.out.test$n > /dev/null 2>&1 && ret=1
 elapsed=$((t2 - t1))
@@ -1174,7 +1174,7 @@ zone unreachable.
 update add unreachable. 600 A 192.0.2.1
 send
 END
-t2=`$PERL -e 'print time()'`
+t2=$($PERL -e 'print time()')
 grep "; Communication with 10.53.0.4#${PORT} failed: timed out" nsupdate.out.test$n > /dev/null 2>&1 || ret=1
 grep "not implemented" nsupdate.out.test$n > /dev/null 2>&1 && ret=1
 elapsed=$((t2 - t1))
@@ -1193,7 +1193,7 @@ zone unreachable.
 update add unreachable. 600 A 192.0.2.1
 send
 END
-t2=`$PERL -e 'print time()'`
+t2=$($PERL -e 'print time()')
 grep "; Communication with 10.53.0.4#${PORT} failed: timed out" nsupdate.out.test$n > /dev/null 2>&1 || ret=1
 grep "not implemented" nsupdate.out.test$n > /dev/null 2>&1 && ret=1
 elapsed=$((t2 - t1))
diff --git a/bin/tests/system/padding/tests.sh b/bin/tests/system/padding/tests.sh
index 74fb337670..c952537826 100644
--- a/bin/tests/system/padding/tests.sh
+++ b/bin/tests/system/padding/tests.sh
@@ -60,7 +60,7 @@ echo_i "checking that padding is added to valid cookie responses ($n)"
 ret=0
 n=$((n + 1))
 $DIG $DIGOPTS +cookie foo.example @10.53.0.2 > dig.out.testc
-cookie=`getcookie dig.out.testc`
+cookie=$(getcookie dig.out.testc)
 $DIG $DIGOPTS +cookie=$cookie +padding=128 foo.example @10.53.0.2 > dig.out.test$n
 grep "; PAD" dig.out.test$n > /dev/null || ret=1
 grep "rcvd: 128" dig.out.test$n > /dev/null || ret=1
@@ -97,11 +97,11 @@ n=$((n + 1))
 nextpart ns2/named.stats > /dev/null
 $RNDCCMD 10.53.0.2 stats
 wait_for_log_peek 5 "--- Statistics Dump ---" ns2/named.stats || ret=1
-opad=`nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}'`
+opad=$(nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}')
 $DIG $DIGOPTS foo.example @10.53.0.3 > dig.out.test$n
 $RNDCCMD 10.53.0.2 stats
 wait_for_log_peek 5 "--- Statistics Dump ---" ns2/named.stats || ret=1
-npad=`nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}'`
+npad=$(nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}')
 if [ "$opad" -eq "$npad" ]; then echo_i "error: opad ($opad) == npad ($npad)"; ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -112,11 +112,11 @@ n=$((n + 1))
 nextpart ns2/named.stats > /dev/null
 $RNDCCMD 10.53.0.2 stats
 wait_for_log_peek 5 "--- Statistics Dump ---" ns2/named.stats || ret=1
-opad=`nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}'`
+opad=$(nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}')
 $DIG $DIGOPTS foo.example @10.53.0.4 > dig.out.test$n
 $RNDCCMD 10.53.0.2 stats
 wait_for_log_peek 5 "--- Statistics Dump ---" ns2/named.stats || ret=1
-npad=`nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}'`
+npad=$(nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}')
 if [ "$opad" -ne "$npad" ]; then echo_i "error: opad ($opad) != npad ($npad)"; ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
diff --git a/bin/tests/system/pending/tests.sh b/bin/tests/system/pending/tests.sh
index 94ece1607b..362cef3ef8 100644
--- a/bin/tests/system/pending/tests.sh
+++ b/bin/tests/system/pending/tests.sh
@@ -53,7 +53,7 @@ DIGOPTS_CD="$DIGOPTS +cd"
 echo_i "Priming cache."
 ret=0
 expect="10 mail.example."
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 hostile MX` || ret=1
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 hostile MX) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
 status=$((status + ret))
@@ -61,7 +61,7 @@ status=$((status + ret))
 echo_i "Checking that bogus additional is not returned with +CD."
 ret=0
 expect="10.0.0.2"
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 mail.example A` || ret=1
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 mail.example A) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
 status=$((status + ret))
@@ -73,7 +73,7 @@ status=$((status + ret))
 echo_i "Priming cache (pending additional A and AAAA)"
 ret=0
 expect="10 mail.example.com."
-ans=`$DIG $DIGOPTS @10.53.0.4 example.com MX` || ret=1
+ans=$($DIG $DIGOPTS @10.53.0.4 example.com MX) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
 status=$((status + ret))
@@ -91,7 +91,7 @@ status=$((status + ret))
 echo_i "Checking updated data to be returned (without CD)"
 ret=0
 expect="192.0.2.3"
-ans=`$DIG $DIGOPTS @10.53.0.4 mail.example.com A` || ret=1
+ans=$($DIG $DIGOPTS @10.53.0.4 mail.example.com A) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
 status=$((status + ret))
@@ -99,7 +99,7 @@ status=$((status + ret))
 echo_i "Checking updated data to be returned (with CD)"
 ret=0
 expect="2001:db8::3"
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 mail.example.com AAAA` || ret=1
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 mail.example.com AAAA) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
 status=$((status + ret))
@@ -111,7 +111,7 @@ status=$((status + ret))
 echo_i "Priming cache (pending answer)"
 ret=0
 expect="192.0.2.2"
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 pending-ok.example.com A` || ret=1
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 pending-ok.example.com A) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
 status=$((status + ret))
@@ -124,7 +124,7 @@ status=$((status + ret))
 echo_i "Confirming cached pending data to be returned with CD"
 ret=0
 expect="192.0.2.2"
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 pending-ok.example.com A` || ret=1
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 pending-ok.example.com A) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
 status=$((status + ret))
@@ -136,7 +136,7 @@ status=$((status + ret))
 echo_i "Priming cache (pending answer)"
 ret=0
 expect="192.0.2.102"
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 pending-ng.example.com A` || ret=1
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 pending-ng.example.com A) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
 status=$((status + ret))
@@ -149,7 +149,7 @@ status=$((status + ret))
 echo_i "Confirming updated data returned, not the cached one, without CD"
 ret=0
 expect="192.0.2.103"
-ans=`$DIG $DIGOPTS @10.53.0.4 pending-ng.example.com A` || ret=1
+ans=$($DIG $DIGOPTS @10.53.0.4 pending-ng.example.com A) || ret=1
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
 status=$((status + ret))
@@ -160,8 +160,8 @@ status=$((status + ret))
 echo_i "Trying to Prime out-of-bailiwick pending answer with CD"
 ret=0
 expect="10.10.10.10"
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 bad.example. A` || ret=1
-ans=`echo $ans | awk '{print $NF}'`
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 bad.example. A) || ret=1
+ans=$(echo $ans | awk '{print $NF}')
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
 status=$((status + ret))
@@ -169,8 +169,8 @@ status=$((status + ret))
 echo_i "Confirming the out-of-bailiwick answer is not cached or reused with CD"
 ret=0
 expect="10.10.10.10"
-ans=`$DIG $DIGOPTS_CD @10.53.0.4 nice.good. A` || ret=1
-ans=`echo $ans | awk '{print $NF}'`
+ans=$($DIG $DIGOPTS_CD @10.53.0.4 nice.good. A) || ret=1
+ans=$(echo $ans | awk '{print $NF}')
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
 status=$((status + ret))
@@ -181,8 +181,8 @@ status=$((status + ret))
 echo_i "Trying to Prime bogus NXDOMAIN"
 ret=0
 expect="SERVFAIL"
-ans=`$DIG +tcp -p ${PORT} @10.53.0.4 removed.example.com. A` || ret=1
-ans=`echo $ans | sed 's/^.*status: \([A-Z][A-Z]*\).*$/\1/'`
+ans=$($DIG +tcp -p ${PORT} @10.53.0.4 removed.example.com. A) || ret=1
+ans=$(echo $ans | sed 's/^.*status: \([A-Z][A-Z]*\).*$/\1/')
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
 status=$((status + ret))
@@ -190,8 +190,8 @@ status=$((status + ret))
 echo_i "Confirming the bogus NXDOMAIN was not cached"
 ret=0
 expect="SERVFAIL"
-ans=`$DIG +tcp -p ${PORT} @10.53.0.4 removed.example.com. A` || ret=1
-ans=`echo $ans | sed 's/^.*status: \([A-Z][A-Z]*\).*$/\1/'`
+ans=$($DIG +tcp -p ${PORT} @10.53.0.4 removed.example.com. A) || ret=1
+ans=$(echo $ans | sed 's/^.*status: \([A-Z][A-Z]*\).*$/\1/')
 test "$ans" = "$expect" || ret=1
 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'"
 status=$((status + ret))
diff --git a/bin/tests/system/reclimit/tests.sh b/bin/tests/system/reclimit/tests.sh
index 8fdb637503..7e80d2248b 100644
--- a/bin/tests/system/reclimit/tests.sh
+++ b/bin/tests/system/reclimit/tests.sh
@@ -40,8 +40,8 @@ ns3_sends_aaaa_queries() {
 #   - if ns3 sends AAAA queries, the query count should equal $2,
 #   - if ns3 does not send AAAA queries, the query count should equal $3.
 check_query_count() {
-	count1=`sed 's/[^0-9]//g;' $1`
-	count2=`sed 's/[^0-9]//g;' $2`
+	count1=$(sed 's/[^0-9]//g;' $1)
+	count2=$(sed 's/[^0-9]//g;' $2)
 	count=$((count1 + count2))
 	#echo_i "count1=$count1 count2=$count2 count=$count"
 	expected_count_with_aaaa=$3
@@ -141,7 +141,7 @@ if ns3_sends_aaaa_queries; then
 fi
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
 $DIG $DIGOPTS +short @10.53.0.4 count txt > dig.out.4.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
+eval count=$(cat dig.out.2.test$n)
 [ $count -le 50 ] || { ret=1; echo_i "count ($count) !<= 50"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -155,7 +155,7 @@ $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect6.example.org > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
+eval count=$(cat dig.out.2.test$n)
 [ $count -le 50 ] || { ret=1; echo_i "count ($count) !<= 50"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -173,7 +173,7 @@ if ns3_sends_aaaa_queries; then
   grep "status: SERVFAIL" dig.out.1.test$n > /dev/null || ret=1
 fi
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
+eval count=$(cat dig.out.2.test$n)
 [ $count -le 40 ] || { ret=1; echo_i "count ($count) !<= 40"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -187,7 +187,7 @@ $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS @10.53.0.3 indirect8.example.org > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
+eval count=$(cat dig.out.2.test$n)
 [ $count -le 40 ] || { ret=1; echo_i "count ($count) !<= 40"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -199,10 +199,10 @@ ns3_reset ns3/named4.conf.in
 $DIG $DIGOPTS @10.53.0.2 reset > /dev/null || ret=1
 $DIG $DIGOPTS +short @10.53.0.3 ns1.1.example.net > dig.out.1.test$n || ret=1
 $DIG $DIGOPTS +short @10.53.0.2 count txt > dig.out.2.test$n || ret=1
-eval count=`cat dig.out.2.test$n`
+eval count=$(cat dig.out.2.test$n)
 [ $count -lt 50 ] || ret=1
 $DIG $DIGOPTS +short @10.53.0.7 count txt > dig.out.3.test$n || ret=1
-eval count=`cat dig.out.3.test$n`
+eval count=$(cat dig.out.3.test$n)
 [ $count -lt 50 ] || { ret=1; echo_i "count ($count) !<= 50";  }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
diff --git a/bin/tests/system/redirect/tests.sh b/bin/tests/system/redirect/tests.sh
index 4e81bd721c..83b90ad485 100644
--- a/bin/tests/system/redirect/tests.sh
+++ b/bin/tests/system/redirect/tests.sh
@@ -56,11 +56,11 @@ echo_i "checking A zone redirect updates statistics ($n)"
 ret=0
 rm -f ns2/named.stats 2>/dev/null
 $RNDCCMD 10.53.0.2 stats || ret=1
-PRE=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns2/named.stats`
+PRE=$(sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns2/named.stats)
 $DIG $DIGOPTS nonexist. @10.53.0.2 -b 10.53.0.2 a > dig.out.ns2.test$n || ret=1
 rm -f ns2/named.stats 2>/dev/null
 $RNDCCMD 10.53.0.2 stats || ret=1
-POST=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns2/named.stats`
+POST=$(sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns2/named.stats)
 if [ $((POST - PRE)) != 1 ]; then ret=1; fi
 n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -360,7 +360,7 @@ rndc_reload ns2 10.53.0.2
 for i in 1 2 3 4 5 6 7 8 9; do
     tmp=0
     $DIG $DIGOPTS +short @10.53.0.2 soa example.nil > dig.out.ns1.test$n || tmp=1
-    set -- `cat dig.out.ns1.test$n`
+    set -- $(cat dig.out.ns1.test$n)
     [ $3 = 1 ] || tmp=1
     $DIG $DIGOPTS nonexist. @10.53.0.2 -b 10.53.0.2 a > dig.out.ns2.test$n || tmp=1
     grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || tmp=1
@@ -386,8 +386,8 @@ echo_i "checking AAAA nxdomain-redirect works for nonexist ($n)"
 ret=0
 rm -f ns4/named.stats 2>/dev/null
 $RNDCCMD 10.53.0.4 stats || ret=1
-PRE_RED=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns4/named.stats`
-PRE_SUC=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected and resulted in a successful remote lookup$/\1/p" ns4/named.stats`
+PRE_RED=$(sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns4/named.stats)
+PRE_SUC=$(sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected and resulted in a successful remote lookup$/\1/p" ns4/named.stats)
 $DIG $DIGOPTS nonexist. @10.53.0.4 -b 10.53.0.2 aaaa > dig.out.ns4.test$n || ret=1
 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 grep "nonexist.	.*2001:ffff:ffff::6464:6401" dig.out.ns4.test$n > /dev/null || ret=1
@@ -399,8 +399,8 @@ echo_i "checking AAAA nxdomain-redirect updates statistics ($n)"
 ret=0
 rm -f ns4/named.stats 2>/dev/null
 $RNDCCMD 10.53.0.4 stats || ret=1
-POST_RED=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns4/named.stats`
-POST_SUC=`sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected and resulted in a successful remote lookup$/\1/p" ns4/named.stats`
+POST_RED=$(sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected$/\1/p" ns4/named.stats)
+POST_SUC=$(sed -n -e "s/[    ]*\([0-9]*\).queries resulted in NXDOMAIN that were redirected and resulted in a successful remote lookup$/\1/p" ns4/named.stats)
 if [ $((POST_RED - PRE_RED)) != 1 ]; then ret=1; fi
 if [ $((POST_SUC - PRE_SUC)) != 1 ]; then ret=1; fi
 n=$((n + 1))
diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
index 8534274e5a..924507af75 100644
--- a/bin/tests/system/rndc/tests.sh
+++ b/bin/tests/system/rndc/tests.sh
@@ -231,7 +231,7 @@ do
 	grep "addition 6" ns2/other.db > /dev/null && break
 	sleep 1
 done
-serial=`awk '$3 ~ /serial/ {print $1}' ns2/other.db`
+serial=$(awk '$3 ~ /serial/ {print $1}' ns2/other.db)
 newserial=$((serial + 1))
 sed s/$serial/$newserial/ ns2/other.db > ns2/other.db.new
 echo 'frozen TXT "frozen addition"' >> ns2/other.db.new
@@ -274,7 +274,7 @@ do
 	grep "addition 6" ns2/nil.db > /dev/null && break
 	sleep 1
 done
-serial=`awk '$3 ~ /serial/ {print $1}' ns2/nil.db`
+serial=$(awk '$3 ~ /serial/ {print $1}' ns2/nil.db)
 newserial=$((serial + 1))
 sed s/$serial/$newserial/ ns2/nil.db > ns2/nil.db.new
 echo 'frozen TXT "frozen addition"' >> ns2/nil.db.new
@@ -326,7 +326,7 @@ n=$((n+1))
 echo_i "test 'rndc reload' on a zone with include files ($n)"
 ret=0
 grep "incl/IN: skipping load" ns2/named.run > /dev/null && ret=1
-loads=`grep "incl/IN: starting load" ns2/named.run | wc -l`
+loads=$(grep "incl/IN: starting load" ns2/named.run | wc -l)
 [ "$loads" -eq 1 ] || ret=1
 $RNDCCMD 10.53.0.2 reload > /dev/null || ret=1
 for i in 1 2 3 4 5 6 7 8 9
@@ -342,7 +342,7 @@ $RNDCCMD 10.53.0.2 reload > /dev/null || ret=1
 for i in 1 2 3 4 5 6 7 8 9
 do
     tmp=0
-    loads=`grep "incl/IN: starting load" ns2/named.run | wc -l`
+    loads=$(grep "incl/IN: starting load" ns2/named.run | wc -l)
     [ "$loads" -eq 2 ] || tmp=1
     [ $tmp -eq 0 ] && break
     sleep 1
@@ -518,7 +518,7 @@ do
 	echo_i "testing rndc buffer size limits (size=${i}) ($n)"
 	ret=0
 	$RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf testgen ${i} 2>&1 > rndc.out.$i.test$n || ret=1
-	{ actual_size=`$GENCHECK rndc.out.$i.test$n`; rc=$?; } || true
+	{ actual_size=$($GENCHECK rndc.out.$i.test$n); rc=$?; } || true
 	if [ "$rc" = "0" ]; then
             expected_size=$((i+1))
 	    if [ $actual_size != $expected_size ]; then ret=1; fi
@@ -682,7 +682,7 @@ n=$((n+1))
 echo_i "check rndc nta reports adding to multiple views ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 nta test.com > rndc.out.test$n 2>&1 || ret=1
-lines=`cat rndc.out.test$n | wc -l`
+lines=$(cat rndc.out.test$n | wc -l)
 [ ${lines:-0} -eq 2 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -693,7 +693,7 @@ ret=0
 $RNDCCMD 10.53.0.2 retransfer nil > rndc.out.test$n 2>&1 && ret=1
 grep "rndc: 'retransfer' failed: failure" rndc.out.test$n > /dev/null || ret=1
 grep "retransfer: inappropriate zone type: primary" rndc.out.test$n > /dev/null || ret=1
-lines=`cat rndc.out.test$n | wc -l`
+lines=$(cat rndc.out.test$n | wc -l)
 [ ${lines:-0} -eq 2 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
diff --git a/bin/tests/system/rpz/qperf.sh b/bin/tests/system/rpz/qperf.sh
index dc79de9311..146d1e2234 100644
--- a/bin/tests/system/rpz/qperf.sh
+++ b/bin/tests/system/rpz/qperf.sh
@@ -11,7 +11,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-for QDIR in `echo "$PATH" | tr : ' '` ../../../../contrib/queryperf; do
+for QDIR in $(echo "$PATH" | tr : ' ') ../../../../contrib/queryperf; do
     QPERF=$QDIR/queryperf
     if test -f "$QPERF" -a -x "$QPERF"; then
 	echo $QPERF
diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index 6dce8fdde6..4895469faa 100644
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -84,10 +84,10 @@ digcmd () {
     # Default to +noauth and @$ns3
     # Also default to -bX where X is the @value so that OS X will choose
     #	    the right IP source address.
-    digcmd_args=`echo "+nocookie +noadd +time=2 +tries=1 -p ${PORT} $*" |	\
+    digcmd_args=$(echo "+nocookie +noadd +time=2 +tries=1 -p ${PORT} $*" |	\
 	    sed -e "/@/!s/.*/& @$ns3/"					\
 		-e '/-b/!s/@\([^ ]*\)/@\1 -b\1/'			\
-		-e '/+n?o?auth/!s/.*/+noauth &/'`
+		-e '/+n?o?auth/!s/.*/+noauth &/')
     #echo_i "dig $digcmd_args 1>&2
     $DIG $digcmd_args || return
 }
@@ -96,12 +96,10 @@ digcmd () {
 GROUP_NM=
 TEST_NUM=0
 make_dignm () {
-    TEST_NUM=$(expr $TEST_NUM : '\([0-9]*\).*' || true)	    # trim '+' characters
     TEST_NUM=$((TEST_NUM + 1))
     DIGNM=dig.out$GROUP_NM-$TEST_NUM
     while test -f $DIGNM; do
-	TEST_NUM="$TEST_NUM+"
-	DIGNM=dig.out$GROUP_NM-$TEST_NUM
+	DIGNM="$DIGNM+"
     done
 }
 
@@ -115,7 +113,7 @@ setret () {
 # $1=domain
 # $2=DNS server and client IP address
 get_sn() {
-    SOA=`$DIG -p ${PORT} +short +norecurse soa "$1" "@$2" "-b$2"`
+    SOA=$($DIG -p ${PORT} +short +norecurse soa "$1" "@$2" "-b$2")
     SN=$(expr "$SOA" : '[^ ]* [^ ]* \([^ ]*\) .*' || true)
     test "$SN" != "" && return
     echo_i "no serial number from \`dig -p ${PORT} soa $1 @$2\` in \"$SOA\""
@@ -123,7 +121,7 @@ get_sn() {
 }
 
 get_sn_fast () {
-    RSN=`$DNSRPSCMD -n "$1"`
+    RSN=$($DNSRPSCMD -n "$1")
     #echo "dnsrps serial for $1 is $RSN"
     if test -z "$RSN"; then
 	echo_i "dnsrps failed to get SOA serial number for $1"
@@ -134,7 +132,7 @@ get_sn_fast () {
 # check that dnsrpzd has loaded its zones
 # $1=domain
 # $2=DNS server IP address
-FZONES=`sed -n -e 's/^zone "\(.*\)".*\(10.53.0..\).*/Z=\1;M=\2/p' dnsrpzd.conf`
+FZONES=$(sed -n -e 's/^zone "\(.*\)".*\(10.53.0..\).*/Z=\1;M=\2/p' dnsrpzd.conf)
 dnsrps_loaded() {
     test "$mode" = dnsrps || return 0
     n=0
@@ -206,7 +204,7 @@ restart () {
 	$RNDCCMD $ns$1 halt >/dev/null 2>&1
 	if test -f ns$1/named.pid; then
 	    sleep 1
-	    PID=`cat ns$1/named.pid 2>/dev/null`
+	    PID=$(cat ns$1/named.pid 2>/dev/null)
 	    if test -n "$PID"; then
 		echo_i "killing ns$1 server $PID"
 		kill -9 $PID
@@ -254,9 +252,11 @@ ckstats () {
     NSDIR="$3"
     EXPECTED="$4"
     $RNDCCMD $HOST stats
-    NEW_CNT=0`sed -n -e 's/[	 ]*\([0-9]*\).response policy.*/\1/p'  \
-		    $NSDIR/named.stats | tail -1`
-    eval "OLD_CNT=0\$${NSDIR}_CNT"
+    NEW_CNT=$(sed -n -e 's/[	 ]*\([0-9]*\).response policy.*/\1/p'  \
+		    $NSDIR/named.stats | tail -1)
+    eval "OLD_CNT=\$${NSDIR}_CNT"
+    NEW_CNT=$((NEW_CNT))
+    OLD_CNT=$((OLD_CNT))
     GOT=$((NEW_CNT - OLD_CNT))
     if test "$GOT" -ne "$EXPECTED"; then
 	setret "wrong $LABEL $NSDIR statistics of $GOT instead of $EXPECTED"
@@ -271,9 +271,11 @@ ckstatsrange () {
     MIN="$4"
     MAX="$5"
     $RNDCCMD $HOST stats
-    NEW_CNT=0`sed -n -e 's/[	 ]*\([0-9]*\).response policy.*/\1/p'  \
-		    $NSDIR/named.stats | tail -1`
-    eval "OLD_CNT=0\$${NSDIR}_CNT"
+    NEW_CNT=$(sed -n -e 's/[	 ]*\([0-9]*\).response policy.*/\1/p'  \
+		    $NSDIR/named.stats | tail -1)
+    eval "OLD_CNT=\$${NSDIR}_CNT"
+    NEW_CNT=$((NEW_CNT))
+    OLD_CNT=$((OLD_CNT))
     GOT=$((NEW_CNT - OLD_CNT))
     if test "$GOT" -lt "$MIN" -o "$GOT" -gt "$MAX"; then
 	setret "wrong $LABEL $NSDIR statistics of $GOT instead of ${MIN}..${MAX}"
@@ -384,8 +386,8 @@ addr () {
     make_dignm
     digcmd $2 >$DIGNM
     #ckalive "$2" "server crashed by 'dig $2'" || return 1
-    ADDR_ESC=`echo "$ADDR" | sed -e 's/\./\\\\./g'`
-    ADDR_TTL=`sed -n -e "s/^[-.a-z0-9]\{1,\}[	 ]*\([0-9]*\)	IN	AA*	${ADDR_ESC}\$/\1/p" $DIGNM`
+    ADDR_ESC=$(echo "$ADDR" | sed -e 's/\./\\./g')
+    ADDR_TTL=$(sed -n -e "s/^[-.a-z0-9]\{1,\}[	 ]*\([0-9]*\)	IN	AA*	${ADDR_ESC}\$/\1/p" $DIGNM)
     if test -z "$ADDR_TTL"; then
 	setret "'dig $2' wrong; no address $ADDR record in $DIGNM"
 	return 1
@@ -743,7 +745,7 @@ EOF
   ckstats $ns3 bugs ns3 8
 
   # superficial test for major performance bugs
-  QPERF=`sh qperf.sh`
+  QPERF=$(sh qperf.sh)
   if test -n "$QPERF"; then
     perf () {
 	date "+${TS}checking performance $1" | cat_i
@@ -755,8 +757,8 @@ EOF
 	PFILE="ns5/$2.perf"
 	$QPERF -c -1 -l30 -d ns5/requests -s $ns5 -p ${PORT} >$PFILE
 	comment "after test $1"
-	X=`sed -n -e 's/.*Returned *\([^ ]*:\) *\([0-9]*\) .*/\1\2/p' $PFILE \
-		| tr '\n' ' '`
+	X=$(sed -n -e 's/.*Returned *\([^ ]*:\) *\([0-9]*\) .*/\1\2/p' $PFILE \
+		| tr '\n' ' ')
 	if test "$X" != "$3"; then
 	    setret "wrong results '$X' in $PFILE"
 	fi
@@ -768,12 +770,12 @@ EOF
 
     # get qps with rpz
     perf 'with RPZ' rpz 'NOERROR:2900 NXDOMAIN:100 '
-    RPZ=`trim rpz`
+    RPZ=$(trim rpz)
     # turn off rpz and measure qps again
     echo "# RPZ off" >ns5/rpz-switch
-    RNDCCMD_OUT=`$RNDCCMD $ns5 reload`
+    RNDCCMD_OUT=$($RNDCCMD $ns5 reload)
     perf 'without RPZ' norpz 'NOERROR:3000 '
-    NORPZ=`trim norpz`
+    NORPZ=$(trim norpz)
 
     PERCENT=$(( (RPZ * 100 + (NORPZ / 2)) / NORPZ))
     echo_i "$RPZ qps with RPZ is $PERCENT% of $NORPZ qps without RPZ"
@@ -795,11 +797,11 @@ EOF
 
   if [ "$mode" = dnsrps ]; then
     echo_i "checking that dnsrpzd is automatically restarted"
-    OLD_PID=`cat dnsrpzd.pid`
+    OLD_PID=$(cat dnsrpzd.pid)
     kill "$OLD_PID"
     n=0
     while true; do
-	NEW_PID=`cat dnsrpzd.pid 2>/dev/null`
+	NEW_PID=$(cat dnsrpzd.pid 2>/dev/null)
 	if test -n "$NEW_PID" -a "0$OLD_PID" -ne "0$NEW_PID"; then
 	    #echo "OLD_PID=$OLD_PID  NEW_PID=$NEW_PID"
 	    break;
@@ -827,7 +829,7 @@ EOF
   if test -z "$HAVE_CORE"; then
     stop_server --use-rndc --port ${CONTROLPORT} ns3
     restart 3 "rebuild-bl-rpz"
-    HAVE_CORE=`find ns* -name '*core*' -print`
+    HAVE_CORE=$(find ns* -name '*core*' -print)
     test -z "$HAVE_CORE" || setret "found $HAVE_CORE; memory leak?"
   fi
 
@@ -896,7 +898,7 @@ EOF
   t=$((t + 1))
   echo_i "checking that ttl values are not zeroed when qtype is '*' (${t})"
   $DIG +noall +answer -p ${PORT} @$ns3 any a3-2.tld2 > dig.out.$t
-  ttl=`awk '/a3-2 tld2 text/ {print $2}' dig.out.$t`
+  ttl=$(awk '/a3-2 tld2 text/ {print $2}' dig.out.$t)
   if test ${ttl:=0} -eq 0; then setret "failed"; fi
 
   t=$((t + 1))
diff --git a/bin/tests/system/rpzrecurse/setup.sh b/bin/tests/system/rpzrecurse/setup.sh
index 8afe5d399b..4dcd5eda9d 100644
--- a/bin/tests/system/rpzrecurse/setup.sh
+++ b/bin/tests/system/rpzrecurse/setup.sh
@@ -66,9 +66,9 @@ done
 
 # decide whether to test DNSRPS
 $SHELL ../ckdnsrps.sh $TEST_DNSRPS $DEBUG
-test -z "`grep 'dnsrps-enable yes' dnsrps.conf`" && TEST_DNSRPS=
+test -z "$(grep 'dnsrps-enable yes' dnsrps.conf)" && TEST_DNSRPS=
 
-CWD=`pwd`
+CWD=$(pwd)
 cat <<EOF >dnsrpzd.conf
 PID-FILE $CWD/dnsrpzd.pid;
 
@@ -81,7 +81,7 @@ sed -n -e 's/^ *//' -e "/zone.*.*primary/s@file \"@&$CWD/ns2/@p" ns2/*.conf \
 
 # Run dnsrpzd to get the license and prime the static policy zones
 if test -n "$TEST_DNSRPS"; then
-    DNSRPZD="`../rpz/dnsrps -p`"
+    DNSRPZD="$(../rpz/dnsrps -p)"
     "$DNSRPZD" -D./dnsrpzd.rpzf -S./dnsrpzd.sock -C./dnsrpzd.conf \
 		-w 0 -dddd -L stdout >./dnsrpzd.run 2>&1
 fi
diff --git a/bin/tests/system/rpzrecurse/tests.sh b/bin/tests/system/rpzrecurse/tests.sh
index 98bede8163..eed53e82fd 100644
--- a/bin/tests/system/rpzrecurse/tests.sh
+++ b/bin/tests/system/rpzrecurse/tests.sh
@@ -63,7 +63,7 @@ run_query() {
     TESTNAME=$1
     LINE=$2
 
-    NAME=`sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1`
+    NAME=$(sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1)
     $DIG $DIGOPTS $NAME a @10.53.0.2 -p ${PORT} -b 127.0.0.1 > dig.out.${t}
     grep "status: SERVFAIL" dig.out.${t} > /dev/null 2>&1 && return 1
     return 0
@@ -75,7 +75,7 @@ expect_norecurse() {
     TESTNAME=$1
     LINE=$2
 
-    NAME=`sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1`
+    NAME=$(sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1)
     t=$((t + 1))
     echo_i "testing $NAME doesn't recurse (${t})"
     add_test_marker 10.53.0.2
@@ -91,7 +91,7 @@ expect_recurse() {
     TESTNAME=$1
     LINE=$2
 
-    NAME=`sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1`
+    NAME=$(sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1)
     t=$((t + 1))
     echo_i "testing $NAME recurses (${t})"
     add_test_marker 10.53.0.2
@@ -252,13 +252,13 @@ for mode in native dnsrps; do
   $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org CNAME > dig.out.${t}
   sleep 1
   echo_i "suspending authority server"
-  PID=`cat ns1/named.pid`
+  PID=$(cat ns1/named.pid)
   kill -STOP $PID
   echo_i "adding an NSDNAME policy"
   cp ns2/db.6a.00.policy.local ns2/saved.policy.local
   cp ns2/db.6b.00.policy.local ns2/db.6a.00.policy.local
   $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
-  test -f dnsrpzd.pid && kill -USR1 `cat dnsrpzd.pid` || true
+  test -f dnsrpzd.pid && kill -USR1 $(cat dnsrpzd.pid) || true
   sleep 1
   t=$((t + 1))
   echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})"
@@ -268,10 +268,10 @@ for mode in native dnsrps; do
   echo_i "removing the NSDNAME policy"
   cp ns2/db.6c.00.policy.local ns2/db.6a.00.policy.local
   $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
-  test -f dnsrpzd.pid && kill -USR1 `cat dnsrpzd.pid` || true
+  test -f dnsrpzd.pid && kill -USR1 $(cat dnsrpzd.pid) || true
   sleep 1
   echo_i "resuming authority server"
-  PID=`cat ns1/named.pid`
+  PID=$(cat ns1/named.pid)
   kill -CONT $PID
   add_test_marker 10.53.0.1
   for n in 1 2 3 4 5 6 7 8 9
@@ -295,12 +295,12 @@ for mode in native dnsrps; do
   $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org CNAME > dig.out.${t}
   sleep 1
   echo_i "suspending authority server"
-  PID=`cat ns1/named.pid`
+  PID=$(cat ns1/named.pid)
   kill -STOP $PID
   echo_i "adding an NSDNAME policy"
   cp ns2/db.6b.00.policy.local ns2/db.6a.00.policy.local
   $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
-  test -f dnsrpzd.pid && kill -USR1 `cat dnsrpzd.pid` || true
+  test -f dnsrpzd.pid && kill -USR1 $(cat dnsrpzd.pid) || true
   sleep 1
   t=$((t + 1))
   echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})"
@@ -310,10 +310,10 @@ for mode in native dnsrps; do
   echo_i "removing the policy zone"
   cp ns2/named.default.conf ns2/named.conf
   rndc_reconfig ns2 10.53.0.2
-  test -f dnsrpzd.pid && kill -USR1 `cat dnsrpzd.pid` || true
+  test -f dnsrpzd.pid && kill -USR1 $(cat dnsrpzd.pid) || true
   sleep 1
   echo_i "resuming authority server"
-  PID=`cat ns1/named.pid`
+  PID=$(cat ns1/named.pid)
   kill -CONT $PID
   add_test_marker 10.53.0.1
   for n in 1 2 3 4 5 6 7 8 9; do
@@ -392,7 +392,7 @@ for mode in native dnsrps; do
   echo_i "testing RPZ log clause (${t})"
   add_test_marker 10.53.0.2
   run_server log
-  cur=`awk 'BEGIN {l=0} /^/ {l++} END { print l }' ns2/named.run`
+  cur=$(awk 'BEGIN {l=0} /^/ {l++} END { print l }' ns2/named.run)
   $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.4 > dig.out.${t}
   $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.3 >> dig.out.${t}
   $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.2 >> dig.out.${t}
@@ -488,9 +488,9 @@ for mode in native dnsrps; do
   add_test_marker 10.53.0.2 10.53.0.3
   echo_i "timing 'nsip-wait-recurse yes' (default)"
   ret=0
-  t1=`$PERL -e 'print time()."\n";'`
+  t1=$($PERL -e 'print time()."\n";')
   $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.yes.$t
-  t2=`$PERL -e 'print time()."\n";'`
+  t2=$($PERL -e 'print time()."\n";')
   p1=$((t2 - t1))
   echo_i "elapsed time $p1 seconds"
 
@@ -501,9 +501,9 @@ for mode in native dnsrps; do
   wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1
 
   echo_i "timing 'nsip-wait-recurse no'"
-  t3=`$PERL -e 'print time()."\n";'`
+  t3=$($PERL -e 'print time()."\n";')
   $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.no.$t
-  t4=`$PERL -e 'print time()."\n";'`
+  t4=$($PERL -e 'print time()."\n";')
   p2=$((t4 - t3))
   echo_i "elapsed time $p2 seconds"
 
@@ -523,9 +523,9 @@ for mode in native dnsrps; do
   add_test_marker 10.53.0.2 10.53.0.3
   echo_i "timing 'nsdname-wait-recurse yes' (default)"
   ret=0
-  t1=`$PERL -e 'print time()."\n";'`
+  t1=$($PERL -e 'print time()."\n";')
   $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.yes.$t
-  t2=`$PERL -e 'print time()."\n";'`
+  t2=$($PERL -e 'print time()."\n";')
   p1=$((t2 - t1))
   echo_i "elapsed time $p1 seconds"
 
@@ -536,9 +536,9 @@ for mode in native dnsrps; do
   wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1
 
   echo_i "timing 'nsdname-wait-recurse no'"
-  t3=`$PERL -e 'print time()."\n";'`
+  t3=$($PERL -e 'print time()."\n";')
   $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.no.$t
-  t4=`$PERL -e 'print time()."\n";'`
+  t4=$($PERL -e 'print time()."\n";')
   p2=$((t4 - t3))
   echo_i "elapsed time $p2 seconds"
 
diff --git a/bin/tests/system/rrl/tests.sh b/bin/tests/system/rrl/tests.sh
index 7b9aac62cf..9465b93b92 100644
--- a/bin/tests/system/rrl/tests.sh
+++ b/bin/tests/system/rrl/tests.sh
@@ -54,9 +54,9 @@ setret () {
 #   The start of a second credits a rate limit.
 #   This would be far easier in C or by assuming a modern version of perl.
 sec_start () {
-    START=`date`
+    START=$(date)
     while true; do
-	NOW=`date`
+	NOW=$(date)
 	if test "$START" != "$NOW"; then
 	    return
 	fi
@@ -80,7 +80,7 @@ burst () {
     CNT=$XCNT
 
     DOMS=""
-    CNTS=`$PERL -e 'for ( $i = 0; $i < '$BURST_LIMIT'; $i++) { printf "%03d\n", '$QNUM' + $i; }'`
+    CNTS=$($PERL -e 'for ( $i = 0; $i < '$BURST_LIMIT'; $i++) { printf "%03d\n", '$QNUM' + $i; }')
     for CNT in $CNTS
     do
         eval BURST_DOM="$BURST_DOM_BASE"
@@ -112,14 +112,14 @@ ck_result() {
     # wait to the background mdig calls to complete.
     wait
     BAD=no
-    ADDRS=`grep -E "^$2$" mdig.out-$1				2>/dev/null | wc -l`
+    ADDRS=$(grep -E "^$2$" mdig.out-$1				2>/dev/null | wc -l)
     # count simple truncated and truncated NXDOMAIN as TC
-    TC=`grep -E "^TC|NXDOMAINTC$" mdig.out-$1			2>/dev/null | wc -l`
-    DROP=`grep -E "^drop$" mdig.out-$1				2>/dev/null | wc -l`
+    TC=$(grep -E "^TC|NXDOMAINTC$" mdig.out-$1			2>/dev/null | wc -l)
+    DROP=$(grep -E "^drop$" mdig.out-$1				2>/dev/null | wc -l)
     # count NXDOMAIN and truncated NXDOMAIN as NXDOMAIN
-    NXDOMAIN=`grep -E "^NXDOMAIN|NXDOMAINTC$" mdig.out-$1		2>/dev/null | wc -l`
-    SERVFAIL=`grep -E "^SERVFAIL$" mdig.out-$1			2>/dev/null | wc -l`
-    NOERROR=`grep -E "^NOERROR$" mdig.out-$1			2>/dev/null | wc -l`
+    NXDOMAIN=$(grep -E "^NXDOMAIN|NXDOMAINTC$" mdig.out-$1		2>/dev/null | wc -l)
+    SERVFAIL=$(grep -E "^SERVFAIL$" mdig.out-$1			2>/dev/null | wc -l)
+    NOERROR=$(grep -E "^NOERROR$" mdig.out-$1			2>/dev/null | wc -l)
 
     range $ADDRS "$3" 1 ||
     setret "$ADDRS instead of $3 '$2' responses for $1" &&
@@ -155,9 +155,9 @@ ckstats () {
     LABEL="$1"; shift
     TYPE="$1"; shift
     EXPECTED="$1"; shift
-    C=`cat ns2/named.stats |
+    C=$(cat ns2/named.stats |
         sed -n -e "s/[	 ]*\([0-9]*\).responses $TYPE for rate limits.*/\1/p" |
-        tail -1`
+        tail -1)
     C=$((C))
 
     range "$C" $EXPECTED 1 ||
@@ -282,7 +282,7 @@ sleep 2
 grep "min-table-size 1" broken.out > /dev/null || setret "min-table-size 0 was not changed to 1"
 
 if [ -f named.pid ]; then
-    kill `cat named.pid`
+    kill $(cat named.pid)
     setret "named should not have started, but did"
 fi
 
diff --git a/bin/tests/system/rsabigexponent/ns1/sign.sh b/bin/tests/system/rsabigexponent/ns1/sign.sh
index 73804326b0..8a2f6b99b5 100755
--- a/bin/tests/system/rsabigexponent/ns1/sign.sh
+++ b/bin/tests/system/rsabigexponent/ns1/sign.sh
@@ -19,7 +19,7 @@ zonefile=root.db
 
 cp ../ns2/dsset-example.in dsset-example.
 
-keyname=`$KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone`
+keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone)
 
 cat $infile $keyname.key > $zonefile
 
diff --git a/bin/tests/system/rsabigexponent/ns2/sign.sh b/bin/tests/system/rsabigexponent/ns2/sign.sh
index 88f4277966..53e2257e8d 100755
--- a/bin/tests/system/rsabigexponent/ns2/sign.sh
+++ b/bin/tests/system/rsabigexponent/ns2/sign.sh
@@ -20,7 +20,7 @@ outfile=example.db.bad
 for i in Xexample.+008+51650.key Xexample.+008+51650.private \
 	 Xexample.+008+52810.key Xexample.+008+52810.private
 do
-	cp $i `echo $i | sed s/X/K/`
+	cp $i $(echo $i | sed s/X/K/)
 done
 
 $SIGNER -g -s 20000101000000 -e 20361231235959 -o $zone \
diff --git a/bin/tests/system/serve-stale/tests.sh b/bin/tests/system/serve-stale/tests.sh
index 531d31bd96..d42e9b9687 100755
--- a/bin/tests/system/serve-stale/tests.sh
+++ b/bin/tests/system/serve-stale/tests.sh
@@ -599,7 +599,7 @@ status=$((status+ret))
 
 # Keep track of time so we can access these RRset later, when we expect them
 # to become ancient.
-t1=`$PERL -e 'print time()'`
+t1=$($PERL -e 'print time()')
 
 n=$((n+1))
 echo_i "verify prime cache statistics (low max-stale-ttl) ($n)"
@@ -695,11 +695,11 @@ status=$((status+ret))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 
 # Retrieve max-stale-ttl value.
-interval_to_ancient=`grep 'max-stale-ttl' ns1/named3.conf.in  | awk '{ print $2 }' | tr -d ';'`
+interval_to_ancient=$(grep 'max-stale-ttl' ns1/named3.conf.in  | awk '{ print $2 }' | tr -d ';')
 # We add 2 seconds to it since this is the ttl value of the records being
 # tested.
 interval_to_ancient=$((interval_to_ancient + 2))
-t2=`$PERL -e 'print time()'`
+t2=$($PERL -e 'print time()')
 elapsed=$((t2 - t1))
 
 # If elapsed time so far is less than max-stale-ttl + 2 seconds, then we sleep
@@ -1375,11 +1375,11 @@ stop_server --use-rndc --port ${CONTROLPORT} ns4
 # Load the cache as if it was five minutes (RBTDB_VIRTUAL) older. Since
 # max-stale-ttl defaults to a week, we need to adjust the date by one week and
 # five minutes.
-LASTWEEK=`TZ=UTC perl -e 'my $now = time();
+LASTWEEK=$(TZ=UTC perl -e 'my $now = time();
         my $oneWeekAgo = $now - 604800;
         my $fiveMinutesAgo = $oneWeekAgo - 300;
         my ($s, $m, $h, $d, $mo, $y) = (localtime($fiveMinutesAgo))[0, 1, 2, 3, 4, 5];
-        printf("%04d%02d%02d%02d%02d%02d", $y+1900, $mo+1, $d, $h, $m, $s);'`
+        printf("%04d%02d%02d%02d%02d%02d", $y+1900, $mo+1, $d, $h, $m, $s);')
 
 echo_i "mock the cache date to $LASTWEEK (serve-stale answers disabled) ($n)"
 ret=0
@@ -1612,10 +1612,10 @@ stop_server --use-rndc --port ${CONTROLPORT} ns5
 
 # Load the cache as if it was five minutes (RBTDB_VIRTUAL) older.
 cp ns5/named_dump.db.test$n ns5/named_dump.db
-FIVEMINUTESAGO=`TZ=UTC perl -e 'my $now = time();
+FIVEMINUTESAGO=$(TZ=UTC perl -e 'my $now = time();
         my $fiveMinutesAgo = 300;
         my ($s, $m, $h, $d, $mo, $y) = (localtime($fiveMinutesAgo))[0, 1, 2, 3, 4, 5];
-        printf("%04d%02d%02d%02d%02d%02d", $y+1900, $mo+1, $d, $h, $m, $s);'`
+        printf("%04d%02d%02d%02d%02d%02d", $y+1900, $mo+1, $d, $h, $m, $s);')
 
 n=$((n+1))
 echo_i "mock the cache date to $FIVEMINUTESAGO (serve-stale cache disabled) ($n)"
@@ -1728,12 +1728,12 @@ sleep 2
 nextpart ns3/named.run > /dev/null
 
 echo_i "sending queries for tests $((n+1))-$((n+3))..."
-t1=`$PERL -e 'print time()'`
+t1=$($PERL -e 'print time()')
 $DIG -p ${PORT} +tries=1 +timeout=11  @10.53.0.3 data.example TXT > dig.out.test$((n+1)) &
 $DIG -p ${PORT} +tries=1 +timeout=11  @10.53.0.3 nodata.example TXT > dig.out.test$((n+2)) &
 $DIG -p ${PORT} +tries=1 +timeout=11  @10.53.0.3 data.slow TXT > dig.out.test$((n+3)) &
 wait
-t2=`$PERL -e 'print time()'`
+t2=$($PERL -e 'print time()')
 
 # We configured a long value of 30 seconds for resolver-query-timeout.
 # That should give us enough time to receive an stale answer from cache
diff --git a/bin/tests/system/statistics/tests.sh b/bin/tests/system/statistics/tests.sh
index 1579eda67b..af57b60e2c 100644
--- a/bin/tests/system/statistics/tests.sh
+++ b/bin/tests/system/statistics/tests.sh
@@ -82,7 +82,7 @@ n=$((n + 1))
 ret=0
 echo_i "dumping initial stats for ns3 ($n)"
 rndc_stats ns3 10.53.0.3 || ret=1
-nsock0nstat=`grep "UDP/IPv4 sockets active" $last_stats | awk '{print $1}'`
+nsock0nstat=$(grep "UDP/IPv4 sockets active" $last_stats | awk '{print $1}')
 [ 0 -ne ${nsock0nstat} ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -118,7 +118,7 @@ n=$((n + 1))
 
 ret=0
 echo_i "verifying active sockets output in named.stats ($n)"
-nsock1nstat=`grep "UDP/IPv4 sockets active" $last_stats | awk '{print $1}'`
+nsock1nstat=$(grep "UDP/IPv4 sockets active" $last_stats | awk '{print $1}')
 [ $((nsock1nstat - nsock0nstat)) -eq 1 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
diff --git a/bin/tests/system/statschannel/tests.sh b/bin/tests/system/statschannel/tests.sh
index 0f59a9435d..d8e4a84a42 100644
--- a/bin/tests/system/statschannel/tests.sh
+++ b/bin/tests/system/statschannel/tests.sh
@@ -57,7 +57,7 @@ getzones() {
         json) path='json/v1/zones' ;;
         *) return 1 ;;
     esac
-    file=`$PERL fetch.pl -p ${EXTRAPORT1} $path`
+    file=$($PERL fetch.pl -p ${EXTRAPORT1} $path)
     cp $file $file.$1.$3
     { $PERL zones-${1}.pl $file $2 2>/dev/null | sort > zones.out.$3; result=$?; } || true
     return $result
@@ -79,34 +79,34 @@ echo_i "checking consistency between named.stats and xml/json ($n)"
 rm -f ns2/named.stats
 $DIGCMD +tcp example ns > dig.out.$n || ret=1
 $RNDCCMD 10.53.0.2 stats 2>&1 | sed 's/^/I:ns1 /'
-query_count=`awk '/QUERY/ {print $1}' ns2/named.stats`
-txt_count=`awk '/TXT/ {print $1}' ns2/named.stats`
-noerror_count=`awk '/NOERROR/ {print $1}' ns2/named.stats`
+query_count=$(awk '/QUERY/ {print $1}' ns2/named.stats)
+txt_count=$(awk '/TXT/ {print $1}' ns2/named.stats)
+noerror_count=$(awk '/NOERROR/ {print $1}' ns2/named.stats)
 if [ $PERL_XML ]; then
-    file=`$PERL fetch.pl -p ${EXTRAPORT1} xml/v3/server`
+    file=$($PERL fetch.pl -p ${EXTRAPORT1} xml/v3/server)
     mv $file xml.stats
     $PERL server-xml.pl > xml.fmtstats 2> /dev/null
-    xml_query_count=`awk '/opcode QUERY/ { print $NF }' xml.fmtstats`
+    xml_query_count=$(awk '/opcode QUERY/ { print $NF }' xml.fmtstats)
     xml_query_count=${xml_query_count:-0}
     [ "$query_count" -eq "$xml_query_count" ] || ret=1
-    xml_txt_count=`awk '/qtype TXT/ { print $NF }' xml.fmtstats`
+    xml_txt_count=$(awk '/qtype TXT/ { print $NF }' xml.fmtstats)
     xml_txt_count=${xml_txt_count:-0}
     [ "$txt_count" -eq "$xml_txt_count" ] || ret=1
-    xml_noerror_count=`awk '/rcode NOERROR/ { print $NF }' xml.fmtstats`
+    xml_noerror_count=$(awk '/rcode NOERROR/ { print $NF }' xml.fmtstats)
     xml_noerror_count=${xml_noerror_count:-0}
     [ "$noerror_count" -eq "$xml_noerror_count" ] || ret=1
 fi
 if [ $PERL_JSON ]; then
-    file=`$PERL fetch.pl -p ${EXTRAPORT1} json/v1/server`
+    file=$($PERL fetch.pl -p ${EXTRAPORT1} json/v1/server)
     mv $file json.stats
     $PERL server-json.pl > json.fmtstats 2> /dev/null
-    json_query_count=`awk '/opcode QUERY/ { print $NF }' json.fmtstats`
+    json_query_count=$(awk '/opcode QUERY/ { print $NF }' json.fmtstats)
     json_query_count=${json_query_count:-0}
     [ "$query_count" -eq "$json_query_count" ] || ret=1
-    json_txt_count=`awk '/qtype TXT/ { print $NF }' json.fmtstats`
+    json_txt_count=$(awk '/qtype TXT/ { print $NF }' json.fmtstats)
     json_txt_count=${json_txt_count:-0}
     [ "$txt_count" -eq "$json_txt_count" ] || ret=1
-    json_noerror_count=`awk '/rcode NOERROR/ { print $NF }' json.fmtstats`
+    json_noerror_count=$(awk '/rcode NOERROR/ { print $NF }' json.fmtstats)
     json_noerror_count=${json_noerror_count:-0}
     [ "$noerror_count" -eq "$json_noerror_count" ] || ret=1
 fi
@@ -117,7 +117,7 @@ n=$((n + 1))
 ret=0
 echo_i "checking malloced memory statistics xml/json ($n)"
 if [ $PERL_XML ]; then
-    file=`$PERL fetch.pl -p ${EXTRAPORT1} xml/v3/mem`
+    file=$($PERL fetch.pl -p ${EXTRAPORT1} xml/v3/mem)
     mv $file xml.mem
     $PERL mem-xml.pl $file > xml.fmtmem
     grep "'Malloced' => '[0-9][0-9]*'" xml.fmtmem > /dev/null || ret=1
@@ -125,7 +125,7 @@ if [ $PERL_XML ]; then
     grep "'maxmalloced' => '[0-9][0-9]*'" xml.fmtmem > /dev/null || ret=1
 fi
 if [ $PERL_JSON ]; then
-    file=`$PERL fetch.pl -p ${EXTRAPORT1} json/v1/mem`
+    file=$($PERL fetch.pl -p ${EXTRAPORT1} json/v1/mem)
     mv $file json.mem
     grep '"malloced":[0-9][0-9]*,' json.mem > /dev/null || ret=1
     grep '"maxmalloced":[0-9][0-9]*,' json.mem > /dev/null || ret=1
@@ -170,10 +170,10 @@ ret=0
 echo_i "checking if compressed output is really compressed ($n)"
 if $FEATURETEST --with-zlib;
 then
-    REGSIZE=`cat regular.headers | \
-        grep -i Content-Length | sed -e "s/.*: \([0-9]*\).*/\1/"`
-    COMPSIZE=`cat compressed.headers | \
-        grep -i Content-Length | sed -e "s/.*: \([0-9]*\).*/\1/"`
+    REGSIZE=$(cat regular.headers | \
+        grep -i Content-Length | sed -e "s/.*: \([0-9]*\).*/\1/")
+    COMPSIZE=$(cat compressed.headers | \
+        grep -i Content-Length | sed -e "s/.*: \([0-9]*\).*/\1/")
     if [ ! $((REGSIZE / COMPSIZE)) -gt 2 ]; then
         ret=1
     fi
@@ -188,8 +188,8 @@ n=$((n + 1))
 zone="dnssec"
 sign_prefix="dnssec-sign operations"
 refresh_prefix="dnssec-refresh operations"
-ksk_id=`cat ns2/$zone.ksk.id`
-zsk_id=`cat ns2/$zone.zsk.id`
+ksk_id=$(cat ns2/$zone.ksk.id)
+zsk_id=$(cat ns2/$zone.zsk.id)
 
 # Test sign operations for scheduled resigning.
 ret=0
@@ -276,12 +276,12 @@ n=$((n + 1))
 # Test sign operations for scheduled resigning (many keys).
 ret=0
 zone="manykeys"
-ksk8_id=`cat ns2/$zone.ksk8.id`
-zsk8_id=`cat ns2/$zone.zsk8.id`
-ksk13_id=`cat ns2/$zone.ksk13.id`
-zsk13_id=`cat ns2/$zone.zsk13.id`
-ksk14_id=`cat ns2/$zone.ksk14.id`
-zsk14_id=`cat ns2/$zone.zsk14.id`
+ksk8_id=$(cat ns2/$zone.ksk8.id)
+zsk8_id=$(cat ns2/$zone.zsk8.id)
+ksk13_id=$(cat ns2/$zone.ksk13.id)
+zsk13_id=$(cat ns2/$zone.zsk13.id)
+ksk14_id=$(cat ns2/$zone.ksk14.id)
+zsk14_id=$(cat ns2/$zone.zsk14.id)
 # The dnssec zone has 10 RRsets to sign (including NSEC) with the ZSKs and one
 # RRset (DNSKEY) with the KSKs. So starting named with signatures that expire
 # almost right away, this should trigger 10 zsk and 1 ksk sign operations per
diff --git a/bin/tests/system/stress/tests.sh b/bin/tests/system/stress/tests.sh
index 8b5a9627e3..5466ecbbf8 100644
--- a/bin/tests/system/stress/tests.sh
+++ b/bin/tests/system/stress/tests.sh
@@ -34,7 +34,7 @@ echo_i "waiting for background processes to finish"
 wait
 
 echo_i "killing reload loop"
-kill `cat reload.pid`
+kill $(cat reload.pid)
 
 # If the test has run to completion without named crashing, it has succeeded.
 # Otherwise, the crash will be detected by the test framework and the test will
diff --git a/bin/tests/system/tools/tests.sh b/bin/tests/system/tools/tests.sh
index c96871cd8e..a7113cb269 100644
--- a/bin/tests/system/tools/tests.sh
+++ b/bin/tests/system/tools/tests.sh
@@ -37,11 +37,11 @@ algo=1 flags=0 iters=12 salt="aabbccdd"
 while	read name hash
 do
 	echo_i "checking $NSEC3HASH $name"
-	{ out=`$NSEC3HASH $salt $algo $iters $name`; rc=$?; } || true
+	{ out=$($NSEC3HASH $salt $algo $iters $name); rc=$?; } || true
 	checkout $rc
 
 	echo_i "checking $NSEC3HASH -r $name"
-	{ out=`$NSEC3HASH -r $algo $flags $iters $salt $name`; rc=$?; } || true
+	{ out=$($NSEC3HASH -r $algo $flags $iters $salt $name); rc=$?; } || true
 	checkout $rc
 
 done <<EOF
@@ -67,22 +67,22 @@ checkempty() {
 }
 name=com algo=1 flags=1 iters=0
 echo_i "checking $NSEC3HASH '' $name"
-{ out=`$NSEC3HASH '' $algo $iters $name`; rc=$?; } || true
+{ out=$($NSEC3HASH '' $algo $iters $name); rc=$?; } || true
 checkempty $rc
 echo_i "checking $NSEC3HASH - $name"
-{ out=`$NSEC3HASH - $algo $iters $name`; rc=$?; } || true
+{ out=$($NSEC3HASH - $algo $iters $name); rc=$?; } || true
 checkempty $rc
 echo_i "checking $NSEC3HASH -- '' $name"
-{ out=`$NSEC3HASH -- '' $algo $iters $name`; rc=$?; } || true
+{ out=$($NSEC3HASH -- '' $algo $iters $name); rc=$?; } || true
 checkempty $rc
 echo_i "checking $NSEC3HASH -- - $name"
-{ out=`$NSEC3HASH -- - $algo $iters $name`; rc=$?; } || true
+{ out=$($NSEC3HASH -- - $algo $iters $name); rc=$?; } || true
 checkempty $rc
 echo_i "checking $NSEC3HASH -r '' $name"
-{ out=`$NSEC3HASH -r $algo $flags $iters '' $name`; rc=$?; } || true
+{ out=$($NSEC3HASH -r $algo $flags $iters '' $name); rc=$?; } || true
 checkempty $rc
 echo_i "checking $NSEC3HASH -r - $name"
-{ out=`$NSEC3HASH -r $algo $flags $iters - $name`; rc=$?; } || true
+{ out=$($NSEC3HASH -r $algo $flags $iters - $name); rc=$?; } || true
 checkempty $rc
 
 checkfail() {
@@ -94,13 +94,13 @@ checkfail() {
 	esac
 }
 echo_i "checking $NSEC3HASH missing args"
-{ out=`$NSEC3HASH 00 1 0 2>&1`; rc=$?; } || true
+{ out=$($NSEC3HASH 00 1 0 2>&1); rc=$?; } || true
 checkfail $rc
 echo_i "checking $NSEC3HASH extra args"
-{ out=`$NSEC3HASH 00 1 0 two names 2>&1`; rc=$?; } || true
+{ out=$($NSEC3HASH 00 1 0 two names 2>&1); rc=$?; } || true
 checkfail $rc
 echo_i "checking $NSEC3HASH bad option"
-{ out=`$NSEC3HASH -? 2>&1`; rc=$?; } || true
+{ out=$($NSEC3HASH -? 2>&1); rc=$?; } || true
 checkfail $rc
 
 echo_i "exit status: $status"
diff --git a/bin/tests/system/tsiggss/setup.sh b/bin/tests/system/tsiggss/setup.sh
index e13b312e0a..37b80fdf11 100644
--- a/bin/tests/system/tsiggss/setup.sh
+++ b/bin/tests/system/tsiggss/setup.sh
@@ -17,5 +17,5 @@ $SHELL clean.sh
 
 copy_setports ns1/named.conf.in ns1/named.conf
 
-key=`$KEYGEN -Cq -K ns1 -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n HOST -T KEY key.example.nil.`
+key=$($KEYGEN -Cq -K ns1 -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n HOST -T KEY key.example.nil.)
 cat ns1/example.nil.db.in ns1/${key}.key > ns1/example.nil.db
diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh
index 45be83bf8b..97cc7bb302 100644
--- a/bin/tests/system/tsiggss/tests.sh
+++ b/bin/tests/system/tsiggss/tests.sh
@@ -43,7 +43,7 @@ EOF
     }
 
     # Verify that TKEY response is signed.
-    tkeyout=`awk '/recvmsg reply from GSS-TSIG query/,/Sending update to/' nsupdate.out${num}`
+    tkeyout=$(awk '/recvmsg reply from GSS-TSIG query/,/Sending update to/' nsupdate.out${num})
     pattern="recvmsg reply from GSS-TSIG query .* opcode: QUERY, status: NOERROR, id: .* flags: qr; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; QUESTION SECTION: ;.* ANY TKEY ;; ANSWER SECTION: .* 0 ANY TKEY gss-tsig\. .* ;; TSIG PSEUDOSECTION: .* 0 ANY TSIG gss-tsig\. .* NOERROR 0"
     echo $tkeyout | grep "$pattern" > /dev/null || {
 	echo_i "bad tkey response (not tsig signed)"
@@ -56,8 +56,8 @@ EOF
 	return 1
     }
 
-    out=`$DIG $DIGOPTS -t $type -q $host | grep -E "^${host}"`
-    lines=`echo "$out" | grep "$digout" | wc -l`
+    out=$($DIG $DIGOPTS -t $type -q $host | grep -E "^${host}")
+    lines=$(echo "$out" | grep "$digout" | wc -l)
     [ $lines -eq 1 ] || {
 	echo_i "dig output incorrect for $host $type $cmd: $out"
 	return 1
@@ -67,7 +67,7 @@ EOF
 
 
 # Testing updates with good credentials.
-KRB5CCNAME="FILE:"`pwd`/ns1/administrator.ccache
+KRB5CCNAME="FILE:"$(pwd)/ns1/administrator.ccache
 export KRB5CCNAME
 
 echo_i "testing updates to testdc1 as administrator ($n)"
@@ -93,7 +93,7 @@ status=$((status+ret))
 
 
 # Testing denied updates.
-KRB5CCNAME="FILE:"`pwd`/ns1/testdenied.ccache
+KRB5CCNAME="FILE:"$(pwd)/ns1/testdenied.ccache
 export KRB5CCNAME
 
 echo_i "testing updates to denied (A) as a user ($n)"
@@ -141,7 +141,7 @@ zone example.nil
 update add fred.example.nil 120 cname foo.bar.
 send
 END
-output=`$DIG $DIGOPTS +short cname fred.example.nil.`
+output=$($DIG $DIGOPTS +short cname fred.example.nil.)
 [ -n "$output" ] || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
 n=$((n+1))
@@ -172,7 +172,7 @@ status=$((status+ret))
 
 [ $status -eq 0 ] && echo_i "tsiggss tests all OK"
 
-kill `cat authsock.pid`
+kill $(cat authsock.pid)
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
index 58c1d73601..9b49fbdfb2 100644
--- a/bin/tests/system/upforwd/tests.sh
+++ b/bin/tests/system/upforwd/tests.sh
@@ -196,7 +196,7 @@ if test -f keyname
 then
 	echo_i "checking update forwarding to with sig0 ($n)"
 	ret=0
-	keyname=`cat keyname`
+	keyname=$(cat keyname)
 	$NSUPDATE -k $keyname.private -- - <<EOF
 	local 10.53.0.1
 	server 10.53.0.3 ${PORT}
diff --git a/bin/tests/system/verify/tests.sh b/bin/tests/system/verify/tests.sh
index 162decd92d..d40780a236 100644
--- a/bin/tests/system/verify/tests.sh
+++ b/bin/tests/system/verify/tests.sh
@@ -26,7 +26,7 @@ status=0
 for file in zones/*.good
 do
 	n=$((n + 1))
-	zone=`expr "$file" : 'zones/\(.*\).good'`
+	zone=$(expr "$file" : 'zones/\(.*\).good')
 	echo_i "checking supposedly good zone: $zone ($n)"
 	ret=0
 	case $zone in
@@ -41,7 +41,7 @@ done
 for file in zones/*.bad
 do
 	n=$((n + 1))
-	zone=`expr "$file" : 'zones/\(.*\).bad'`
+	zone=$(expr "$file" : 'zones/\(.*\).bad')
 	echo_i "checking supposedly bad zone: $zone ($n)"
 	ret=0
 	dumpit=0
diff --git a/bin/tests/system/xfer/tests.sh b/bin/tests/system/xfer/tests.sh
index 7c2be45cb6..f012d8b3ff 100755
--- a/bin/tests/system/xfer/tests.sh
+++ b/bin/tests/system/xfer/tests.sh
@@ -256,7 +256,7 @@ status=$((status+tmp))
 n=$((n+1))
 echo_i "check that a multi-message uncompressable zone transfers ($n)"
 $DIG axfr . -p ${PORT} @10.53.0.4 | grep SOA > axfr.out
-if test `wc -l < axfr.out` != 2
+if test $(wc -l < axfr.out) != 2
 then
 	 echo_i "failed"
          status=$((status+1))
@@ -470,7 +470,7 @@ $RNDCCMD 10.53.0.7 refresh edns-expire 2>&1 | sed 's/^/ns7 /' | cat_i
 sleep 10
 
 # there may be multiple log entries so get the last one.
-expire=`awk '/edns-expire\/IN: got EDNS EXPIRE of/ { x=$9 } END { print x }' ns7/named.run`
+expire=$(awk '/edns-expire\/IN: got EDNS EXPIRE of/ { x=$9 } END { print x }' ns7/named.run)
 test ${expire:-0} -gt 0 -a ${expire:-0} -lt 1814400 || {
     echo_i "failed (expire=${expire:-0})"
     status=$((status+1))
@@ -481,13 +481,13 @@ echo_i "test smaller transfer TCP message size ($n)"
 $DIG $DIGOPTS example. @10.53.0.8 axfr \
 	-y key1.:1234abcd8765 > dig.out.msgsize.test$n || status=1
 
-bytes=`wc -c < dig.out.msgsize.test$n`
+bytes=$(wc -c < dig.out.msgsize.test$n)
 if [ $bytes -ne 459357 ]; then
 	echo_i "failed axfr size check"
         status=$((status+1))
 fi
 
-num_messages=`cat ns8/named.run | grep "sending TCP message of" | wc -l`
+num_messages=$(cat ns8/named.run | grep "sending TCP message of" | wc -l)
 if [ $num_messages -le 300 ]; then
 	echo_i "failed transfer message count check"
         status=$((status+1))
@@ -609,12 +609,12 @@ stop_server ns1
 copy_setports ns1/named3.conf.in ns1/named.conf
 start_server --noclean --restart --port ${PORT} ns1 -- "-D xfer-ns1 $NS_PARAMS -T transferinsecs -T transferstuck"
 sleep 1
-start=`date +%s`
+start=$(date +%s)
 $RNDCCMD 10.53.0.6 retransfer axfr-max-idle-time 2>&1 | sed 's/^/ns6 /' | cat_i
 tmp=0
 retry_quiet 60 wait_for_message "maximum idle time exceeded: timed out" || tmp=1
 if [ $tmp -eq 0 ]; then
-	now=`date +%s`
+	now=$(date +%s)
 	diff=$((now - start))
 	# we expect a timeout in 50 seconds
 	test $diff -lt 50 && tmp=1
diff --git a/bin/tests/system/xferquota/tests.sh b/bin/tests/system/xferquota/tests.sh
index f74402e9c1..46dfba0539 100755
--- a/bin/tests/system/xferquota/tests.sh
+++ b/bin/tests/system/xferquota/tests.sh
@@ -28,7 +28,7 @@ while [ $count != 300 ]; do
         if [ $ticks = 1 ]; then
 	        echo_i "Changing test zone..."
 		cp -f ns1/changing2.db ns1/changing.db
-                kill -HUP `cat ns1/named.pid`
+                kill -HUP $(cat ns1/named.pid)
 	fi
 	sleep 1
 	ticks=$((ticks + 1))
@@ -37,7 +37,7 @@ while [ $count != 300 ]; do
 		echo_i "Took too long to load zones"
 		exit 1
 	fi
-	count=`cat ns2/zone*.bk | grep xyzzy | wc -l`
+	count=$(cat ns2/zone*.bk | grep xyzzy | wc -l)
 	echo_i "Have $count zones up in $seconds seconds"
 done