Dynamic zones with dnssec-policy could not be thawed because KASP zones were considered always dynamic. But a dynamic KASP zone should also check whether updates are disabled.
<number>