> Isn't the "DS for the zone: ." what the "managed-keys" clause provides? > Though putting it back in didn't make the warning go away, so I must be missing something else here... Any difference with dnssec-validation auto and removing the managed-keys and root hint zone? Jeff.