DNSSEC tweaks