In other annoyances related to TSIG keys, Hetzner's DNS interface allows you to specify a key and algorithm to authenticate zone transfers, but there's no way to specify the key _name_; instead, they generate a zone-specific name whenever you add a key. So if you just want to use a single key to authenticate transfers of several zones to Hetzner's secondary name servers (e.g., "allow-transfer { key hetzner_secondaries; }")… forget it. You need one key per zone, and you have to go back to your own configuration and update the key names before it'll work. Support confirmed that's how it's meant to work. :blobcatangry: