diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 806ffb0a49..a99becef16 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -9241,6 +9241,8 @@ zone_sign(dns_zone_t *zone) {
 
 	while (signing != NULL && nodes-- > 0 && signatures > 0) {
 		bool has_alg = false;
+
+		dns_dbiterator_pause(signing->dbiterator);
 		nextsigning = ISC_LIST_NEXT(signing, link);
 
 		ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);