diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
index ae84a5ff67..289cad6c89 100644
--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
@@ -2523,6 +2523,9 @@ dns_zone_link(dns_zone_t *zone, dns_zone_t *raw);
 void
 dns_zone_getraw(dns_zone_t *zone, dns_zone_t **raw);
 
+bool
+dns_zone_israw(dns_zone_t *zone);
+
 isc_result_t
 dns_zone_keydone(dns_zone_t *zone, const char *data);
 
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index fd8431408e..ade8c779f8 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -22563,6 +22563,16 @@ dns_zone_getraw(dns_zone_t *zone, dns_zone_t **raw) {
 	UNLOCK(&zone->lock);
 }
 
+bool
+dns_zone_israw(dns_zone_t *zone) {
+	bool result;
+	REQUIRE(DNS_ZONE_VALID(zone));
+	LOCK(&zone->lock);
+	result = zone->secure != NULL;
+	UNLOCK(&zone->lock);
+	return (result);
+}
+
 struct keydone {
 	isc_event_t event;
 	bool all;
diff --git a/lib/ns/update.c b/lib/ns/update.c
index cf4a469e10..cf6d94ac33 100644
--- a/lib/ns/update.c
+++ b/lib/ns/update.c
@@ -3413,7 +3413,9 @@ update_action(isc_task_t *task, isc_event_t *event) {
 
 		CHECK(rollback_private(db, privatetype, ver, &diff));
 
-		CHECK(add_signing_records(db, privatetype, ver, &diff));
+		if (!dns_zone_israw(zone)) {
+			CHECK(add_signing_records(db, privatetype, ver, &diff));
+		}
 
 		CHECK(add_nsec3param_records(client, zone, db, ver, &diff));
 
@@ -3426,7 +3428,9 @@ update_action(isc_task_t *task, isc_event_t *event) {
 			 */
 			CHECK(dns_nsec3param_deletechains(db, ver, zone, true,
 							  &diff));
-		} else if (has_dnskey && isdnssec(db, ver, privatetype)) {
+		} else if (!dns_zone_israw(zone) && has_dnskey &&
+			   isdnssec(db, ver, privatetype))
+		{
 			dns_update_log_t log;
 			uint32_t interval =
 				dns_zone_getsigvalidityinterval(zone);