<html> <head> <meta http-equiv="content-type" content="text/html; charset=utf-8"> </head> <body bgcolor="#FFFFFF" text="#000000"> Hi all, A new KSK has been auto-generated, and it's transitioned through 'published' and is now sitting in the 'ready' state, but does not appear as a DNSKEY record on the zone. I can see that ods-enforcerd has picked up the state change correctly and logged a DSChanged event with the correct output for the new DNSKEY record, and it appears as expected in localhsm, but is not published on the zone. Running FreeIPA 4.3.0-1.fc23, anyone got pointers on how to proceed with the rollover? Cheers, Pete <title>Konsole output</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </body> </html>