> color me confused Have you done the second part of the log message? "and use ods-ksmutil key ds-seen when the DS appears in the DNS" The enforcer will not actively query the parent and look for any changes, it is up to the user. // Rickard