> -> everytime a resign happen the serial number must be changed. this is right, but not your problem. next try for a (maybe more correct) interpretation: the secondary serve expired RRSIGs for rosenauer.org/A,AAAA,NS,MX ( shown purple at dnsviz ) and and a nonvalidatable RRSIG for rosenauer.org/SOA ( shown red at dnsviz ) -- A. Schulze DATEV eG