Hello! I'm testing periodic key rollovers in a playground running Knot DNS 3.5.4 (I am aware that 3.5.5 is out, but this message is also in the current source code) Zone transfers are not being performed, neither incoming nor outgoing (the latter occasionally to see zone content as shown below). At the completion of each signing operation (with purposely very short timings), I see the following debug output: 2026-06-19T08:39:32+0000 info: [b.net.] DNSSEC, signing zone 2026-06-19T08:39:32+0000 info: [b.net.] DNSSEC, KSK rollover started 2026-06-19T08:39:32+0000 info: [b.net.] DNSSEC, next key action, KSK tag 18749, submit at 2026-06-19T08:40:42+0000 2026-06-19T08:39:32+0000 info: [b.net.] DNSSEC, key, tag 15175, algorithm ECDSAP256SHA256, KSK 2026-06-19T08:39:32+0000 info: [b.net.] DNSSEC, key, tag 14234, algorithm ECDSAP256SHA256, public, active 2026-06-19T08:39:32+0000 info: [b.net.] DNSSEC, key, tag 60870, algorithm ECDSAP256SHA256, KSK, public, active 2026-06-19T08:39:32+0000 info: [b.net.] DNSSEC, key, tag 18749, algorithm ECDSAP256SHA256, KSK, public, active+ 2026-06-19T08:39:32+0000 info: [b.net.] DNSSEC, signing started 2026-06-19T08:39:32+0000 info: [b.net.] DNSSEC, successfully signed, serial 94, new RRSIGs 3 2026-06-19T08:39:32+0000 info: [b.net.] DNSSEC, next signing at 2026-06-19T08:40:42+0000 2026-06-19T08:39:32+0000 info: [b.net.] zone file updated, serial 93 -> 94 2026-06-19T08:39:32+0000 debug: [b.net.] disposal of old contents blocked by outstanding zone transfer 2026-06-19T08:40:42+0000 info: [b.net.] DNSSEC, signing zone 2026-06-19T08:40:42+0000 notice: [b.net.] DNSSEC, KSK submission, waiting for confirmation 2026-06-19T08:40:42+0000 info: [b.net.] DNSSEC, key, tag 15175, algorithm ECDSAP256SHA256, KSK 2026-06-19T08:40:42+0000 info: [b.net.] DNSSEC, key, tag 14234, algorithm ECDSAP256SHA256, public, active 2026-06-19T08:40:42+0000 info: [b.net.] DNSSEC, key, tag 60870, algorithm ECDSAP256SHA256, KSK, public, active 2026-06-19T08:40:42+0000 info: [b.net.] DNSSEC, key, tag 18749, algorithm ECDSAP256SHA256, KSK, public, ready, active+ 2026-06-19T08:40:42+0000 info: [b.net.] DNSSEC, signing started 2026-06-19T08:40:42+0000 info: [b.net.] DNSSEC, successfully signed, serial 95, new RRSIGs 6 2026-06-19T08:40:42+0000 info: [b.net.] DNSSEC, next signing at 2026-07-03T06:45:11+0000 2026-06-19T08:40:42+0000 info: [b.net.] zone file updated, serial 94 -> 95 2026-06-19T08:40:42+0000 debug: [b.net.] disposal of old contents blocked by outstanding zone transfer 2026-06-19T08:40:42+0000 info: [b.net.] DS check, outgoing, remote 127.0.0.2@53 TCP, key p01., KSK submission check: negative 2026-06-19T08:40:52+0000 info: [b.net.] DS push, outgoing, remote 127.0.0.2@53 TCP, key p01., success 2026-06-19T08:41:42+0000 info: [b.net.] DS check, outgoing, remote 127.0.0.2@53 TCP, key p01., KSK submission check: positive 2026-06-19T08:41:42+0000 notice: [b.net.] DNSSEC, KSK submission, confirmed The zone itself is trivially short: $ dig -p 5340 @127.0.0.1 b.net AXFR +noall +answer +onesoa | ldns-read-zone -s b.net.    60    IN    SOA    ns.b.net. root.b.net. 100 10800 3600 604800 3600 www.b.net.    60    IN    HTTPS    0 b.net. ns.b.net.    60    IN    AAAA    2001:db8:2::4444 ns.b.net.    60    IN    A    192.0.2.42 b.net.    60    IN    NSEC3PARAM    1 0 0 - b.net.    60    IN    DNSKEY    257 3 13 zmXFV/KHpRk/E6l7oiRg2f2M+YpWxGqHFJtHmsAFl4KAxZPeiL2VIFLswpGnrwxO47//vz/I1VqsLhmUz9k35A== ;{id = 18749 (ksk), size = 256b} b.net.    60    IN    DNSKEY    256 3 13 x9PPypMDeXRarFtYwxT5uvQjE/DHQd6g+NcF5FkVGDhz/+Xq2r3ZDfLXYUjW1ivoZHstnH5hSC4znp9oghlLfw== ;{id = 38612 (zsk), size = 256b} b.net.    60    IN    TXT    "DNS is innocent" b.net.    60    IN    NS    ns.b.net. and the IMO relevant bits of the configuration are: acl:   - id: all_xfr     address: [ 127.0.0.1 ]     action: [ transfer, notify ] submission:   - id: pdns_submission     check-interval: 60s     parent: pdns_remote     parent-delay: 10s template:   - id: default     storage: "/tmp/zones"     zonefile-load: difference     file: "%s" policy:   - id: autoFAST     keystore: pemstore     single-type-signing: off     manual: off     algorithm: ecdsap256sha256     ksk-shared: off     ksk-lifetime: 1h     zsk-lifetime: 2h     delete-delay: 1h     propagation-delay: 10s     nsec3: on     nsec3-iterations: 0     nsec3-salt-length: 0     nsec3-salt-lifetime: 0     cds-cdnskey-publish: rollover     zone-max-ttl: 60s     ksk-submission: pdns_submission     ds-push: pdns_remote zone:   - domain: b.net     dnssec-signing: on     dnssec-policy: autoFAST     acl: [ all_xfr ] Ought I be worried about "disposal of old contents blocked by outstanding zone transfer"? I don't think I've noticed that before. A second zone which uses the same policy shows the same behaviour. Best regards,     -JP --