Hello, one more thought: Could you please check your master log file for this warning message: (log for category: zones and severity: warning has to be enabled) "Zone file for '...' changed, but serial didn't - won't create changesets."? This happens when you change the zone, but the serial remains the same. Note that Knot will change the serial when automatic DNSSEC is enabled, so before creating the zone file in the script, you have to get the current serial from server and increment that serial. Updating your zone files using this approach might help you, but it is nevertheless a bug.