X-Mailer: MIME-tools 5.508 (Entity 5.508) Content-Type: text/plain; charset="utf-8" X-RT-Original-Encoding: utf-8 Message-ID: Content-Transfer-Encoding: binary MIME-Version: 1.0 In-Reply-To: References: Content-Disposition: inline X-RT-Interface: Web RT-Send-CC: Content-Length: 355 I fail to see why this is needed at all. Remove the DS records from the parent zone and it doesn't matter if there are DNSSEC records in the zone as there is no longer a chain of trust. This is the first step in the process of unsigning a zone. The inline signer without any keys configured for the zone will achieve this but it shouldn't be necessary.