diff --git a/app/models/dnskey.rb b/app/models/dnskey.rb
index e3b4c8963..5dd03ae50 100644
--- a/app/models/dnskey.rb
+++ b/app/models/dnskey.rb
@@ -19,7 +19,7 @@ class Dnskey < ActiveRecord::Base
 
   ALGORITHMS = %w(3 5 6 7 8 252 253 254 255)
   PROTOCOLS = %w(3)
-  FLAGS = %w(0 256 257)
+  FLAGS = %w(0 256 257) # 256 = ZSK, 257 = KSK
 
   def epp_code_map
     {
@@ -66,6 +66,7 @@ class Dnskey < ActiveRecord::Base
   end
 
   def generate_digest
+    return if flags != 257 # generate ds only with KSK
     flags_hex = self.class.int_to_hex(flags)
     protocol_hex = self.class.int_to_hex(protocol)
     alg_hex = self.class.int_to_hex(alg)
@@ -85,6 +86,7 @@ class Dnskey < ActiveRecord::Base
   end
 
   def generate_ds_key_tag
+    return if flags != 257 # generate ds key tag only with KSK
     pk = public_key.gsub(' ', '')
     wire_format = [flags, protocol, alg].pack('S!>CC')
     wire_format += Base64.decode64(pk)
diff --git a/app/views/registrar/domains/_form.haml b/app/views/registrar/domains/_form.haml
index aff2166bc..42244a100 100644
--- a/app/views/registrar/domains/_form.haml
+++ b/app/views/registrar/domains/_form.haml
@@ -14,9 +14,10 @@
         .panel-body
           .form-group
             .col-md-3.control-label
-              = label_tag 'domain[legal_document]', t('legal_document'), class: 'required'
+              - c, fr = 'required', true if params[:domain_name].blank?
+              = label_tag 'domain[legal_document]', t('legal_document'), class: c
             .col-md-7
-              = file_field_tag 'domain[legal_document]', required: true
+              = file_field_tag 'domain[legal_document]', required: fr
     .col-md-4
       %p.domain-general-help= t(:domain_general_help).html_safe
       %p.domain-admin-contact-help= t(:domain_admin_contact_help).html_safe
diff --git a/lib/tasks/zonefile.rake b/lib/tasks/zonefile.rake
index 89fa20a10..11b7c7fe3 100644
--- a/lib/tasks/zonefile.rake
+++ b/lib/tasks/zonefile.rake
@@ -146,7 +146,7 @@ namespace :zonefile do
             )
             FROM domains d
             JOIN dnskeys dk ON dk.domain_id = d.id
-            WHERE d.name LIKE include_filter AND d.name NOT LIKE exclude_filter
+            WHERE d.name LIKE include_filter AND d.name NOT LIKE exclude_filter AND dk.flags = 257
             ),
           chr(10)
         ) INTO tmp_var;