1; 2; This is a zone which has two DNSKEY records, one of which, 3; the KSK, has a private key. The resulting zone should be rejected as 4; it has no ZSK signatures. 5; 6$TTL 3600 7example.com. IN SOA ns hostmaster 00090000 1200 3600 604800 300 8$include Kexample.com.+005+23362.key 9$include bogus-zsk.key 10