> Should I use the same DNSSEC KEYs on any given label/RRset > which is visible in both the internal and external domains? Hm, we use allow-transfer and allow-query to limit access to our internal-subdomains. Best regards, Daniel