> Is there not a way to set NSEC3 parameters (pdnssec set-nsec3) for all zones?
No, because most people chose differing NSEC3PARAMs for their zones.
pdnssec list-all-zones | grep -v '^All zonecount:' | while read z
do
pdnssec set-nsec3 ...
done
Not terribly efficient, but it may do. :)
-JP