Hi Anand, info: [ZONE] DNSSEC, signing zone It's as if it iterates over all signed zones and touches it lightly, but for many zones this introduces a seconds-long delay (and it seems like a waste). -Rick

Hi Daniel, Yes, you nailed it on this wicked line #666. We tested it thoroughly (after backporting to 2.6.9 to see the difference with our up-to-present setup): - Restart loads everything. Check. - Newly added zone only changes that zone. Check. - Scheduled resign only changes that zone. Check. - Scheduled resign does change that zone. Check. I'd say this exclamation mark was calling for our attention :) By the way, our problem had worsened in recent days, because we had switched to zonefile-load=difference. It then took several minutes to load our 3504 zones, of which 1695 are signed. Thanks for the great support! Rick ( for SURFnet) Roland (from SURFnet)