Hello, KEY records are currently not supported. They are like DNSKEY records but used for SIG(0) dynamic updates. The lack of support breaks dnssec-tools for zones with KEY records. Regards, Mark Szabo