>rec_control add-nta domain.example botched keyroll > >....would set dnssec validations for domain.example. to "off"....? Correct, though the multple arguments as reason look a bit suspicious to me; I cannot test now, but it might be you have to quote the "botched keyroll" arguments. -JP