On Jun 13, 2009, at 4:59 AM, Erik Lotspeich wrote: > Is it normal that a validating resolver can't validate a domain it is > authoritative for? Absolutely. As Alan Clegg wrote not long ago on this list, this is why a DNSSEC validating resolver should not be authoritative for any signed zones. Chris Buxton Professional Services Men & Mice