On Dec 22, 2012, at 9:56 AM, Alan Clegg <alan at clegg.com> wrote: > > By setting dnssec-dnskey-kskonly, you are telling it to use the KSK as a(mother) ZSK. Stupid autocorrect. a(nother) not anything about anyone's mother. AlanC -- Alan Clegg | +1-919-355-8851 | alan at clegg.com