diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 1cac1de400..f2c62b4bda 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -4556,7 +4556,11 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) {
 		if (rdataset->type != dns_rdatatype_keydata) {
 			continue;
 		}
-
+		/*
+		 * Release db wrlock to prevent LOR reports against
+		 * dns_keytable_forall() call below.
+		 */
+		dns_rriterator_pause(&rrit);
 		result = dns_keytable_find(sr, rrname, &keynode);
 		if (result != ISC_R_SUCCESS || !dns_keynode_managed(keynode)) {
 			CHECK(delete_keydata(db, ver, &diff, rrname, rdataset));