<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div><blockquote type="cite"><div><div dir="ltr"><div><br></div><div><br></div><div>the keys are generated on the master but not on the slaves.<br>so I don't understand how the slaves can read their zone file which ends in ".signed" because they don't have the keys ? (but it's work with dig, i see DS with the right ZSK)</div><div><br></div><div>Regards</div><div><br></div><div>Adrien<br></div><div><br></div></div></div></blockquote></div><br><div>Because the zone is signed with DNSSEC but not encrypted. DNSSEC is only providing authentication of the source of the zone, not hiding the contents (<a href="https://www.rfc-editor.org/rfc/rfc4033">https://www.rfc-editor.org/rfc/rfc4033</a>). For the primary -> secondary zone transfer, you should setup TSIG authentication if you haven’t already to ensure that only your secondary can perform a zone transfer (<a href="https://www.rfc-editor.org/rfc/rfc2931">https://www.rfc-editor.org/rfc/rfc2931</a> and <a href="https://bind9.readthedocs.io/en/v9_18_9/chapter7.html#tsig">https://bind9.readthedocs.io/en/v9_18_9/chapter7.html#tsig</a>).</div></body></html>