Matthew Pounsett <matt at conundrum.com> writes: > But, right off the top I can see that your name server is returning the > NSEC record in the wrong section of the response. No, the Authority section is correct here. See: https://datatracker.ietf.org/doc/html/rfc4035#section-3.1.3.3 But the RRSIG is missing. Bjørn