> Is there not a way to set NSEC3 parameters (pdnssec set-nsec3) for all zones? No, because most people chose differing NSEC3PARAMs for their zones. pdnssec list-all-zones | grep -v '^All zonecount:' | while read z do pdnssec set-nsec3 ... done Not terribly efficient, but it may do. :) -JP