diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml
index 435ea97..d6f6823 100644
--- a/molecule/default/molecule.yml
+++ b/molecule/default/molecule.yml
@@ -22,10 +22,10 @@
     host_vars:
       ubuntu-18.04-priv:
         ansible_python_interpreter: /usr/bin/python3
-        dns_zones:
+        dns_forward_zones:
           example.com:
             serial: 20201102
-            ip_range: 192.168.1.1/24
+            ip_range: 192.168.1.0/24
             ns:
               - gw.example.com.
             a:
@@ -37,9 +37,18 @@
               lpr: printer.example.com.
             srv: {}
             txt: {}
+        dns_reverse_zones:
+          192.168.1.0/24:
+            ns:
+              - gw.example.com.
+            ptr:
+              192.168.1.1: gw.example.com.
+              192.168.1.2: host1.example.com.
+              192.168.1.3: host2.example.com.
+              192.168.1.4: printer.example.com.
         unbound_forward_zones:
           - name: "."
             servers:
-            - "8.8.8.8"
+              - "8.8.8.8"
 verifier:
   name: ansible
diff --git a/molecule/default/prepare.yml b/molecule/default/prepare.yml
index cfec10c..8011b9d 100644
--- a/molecule/default/prepare.yml
+++ b/molecule/default/prepare.yml
@@ -6,12 +6,13 @@
 
 - name: Prepare for unbound by installing nsd for testing
   hosts: all
-  roles:
-    - nsd
 
-  tasks:
+  pre_tasks:
     - name: Add dnsutils so dig works in tests
       apt:
         name: "dnsutils"
         state: "present"
         update_cache: true
+
+  roles:
+    - nsd
diff --git a/molecule/default/verify.yml b/molecule/default/verify.yml
index 87b7bc8..99a7c6f 100644
--- a/molecule/default/verify.yml
+++ b/molecule/default/verify.yml
@@ -7,6 +7,32 @@
 - name: Verify
   hosts: all
   tasks:
-  - name: example assertion
-    assert:
-      that: true
+
+    - name: Check for A record
+      command:  # noqa 301
+        cmd: "dig +short gw.example.com @{{ ansible_default_ipv4.address }}"
+      register: a_dig
+      failed_when: "'192.168.1.1' not in a_dig.stdout"
+
+    - name: Check for NS record
+      command:  # noqa 301
+        cmd: "dig ns +short example.com @{{ ansible_default_ipv4.address }}"
+      register: ns_dig
+      failed_when: "'gw.example.com.' not in ns_dig.stdout"
+
+    - name: Check for CNAME record
+      command:  # noqa 301
+        cmd: "dig +short lpr.example.com @{{ ansible_default_ipv4.address }}"
+      register: cn_dig
+      failed_when: "'printer.example.com.\n192.168.1.4' not in cn_dig.stdout"
+
+    - name: Check for reverse IP lookup
+      command:  # noqa 301
+        cmd: "dig -x {{ item.key }} @{{ ansible_default_ipv4.address }}"
+      register: rip_dig
+      failed_when: "item.value not in rip_dig.stdout"
+      with_dict:
+        192.168.1.1: gw.example.com.
+        192.168.1.2: host1.example.com.
+        192.168.1.3: host2.example.com.
+        192.168.1.4: printer.example.com.