You don't submitt the initial DS until the KSK is active and any old state about the DNSKEY as clear caches. I recommend "activate" + "publish" at the same time. -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka at isc.org