I concur, this command doesn't work from my server with PF running as well, so it's easily reproducible. > dig @a.ns.se se dnskey +dnssec +bufsize=4500