apply records before the apex NS, so in-zone glue exists first

named rejects an apex NS pointing at an in-zone name with no address record,
so the glue has to land in an earlier transaction.

internal/bind/nsupdate_test.go

@@ -1,6 +1,9 @@
 package bind
 
-import "testing"
+import (
+	"strings"
+	"testing"
+)
 
 func TestNSUpdateScriptReplaceSemantics(t *testing.T) {
 	got := nsupdateScript("acme.unkin.net", []RecordUpdate{
@@ -40,3 +43,22 @@ send
 		t.Errorf("got:\n%s\nwant:\n%s", got, want)
 	}
 }
+
+func TestParseDigNames(t *testing.T) {
+	cases := []struct {
+		name, out, want string
+	}{
+		{"answers", "a.ns.unkin.net.\nb.ns.unkin.net.\n", "a.ns.unkin.net.,b.ns.unkin.net."},
+		{"REFUSED, SERVFAIL and NXDOMAIN all answer empty", "", ""},
+		// A zone behind a key-matched view answers an unsigned query REFUSED, and
+		// dig reports the key problem on a ';' line that happens to end in a dot.
+		{"dig diagnostics are not answers", ";; WARNING -- TSIG key was not used.\n", ""},
+		{"relative or partial lines are not names", "10.0.0.1\nns1\n", ""},
+		{"whitespace is trimmed", "  ns1.unkin.net.  \n\n", "ns1.unkin.net."},
+	}
+	for _, c := range cases {
+		if got := strings.Join(parseDigNames(c.out), ","); got != c.want {
+			t.Errorf("%s: parseDigNames(%q) = %q; want %q", c.name, c.out, got, c.want)
+		}
+	}
+}