The "zone-max-ttl" option inside a "dnssec-policy" is not used to cap the TTLs in a zone, only yo calculate key rollover timings.
The "zone-max-ttl" option inside a "dnssec-policy" is not used to cap the TTLs in a zone, only yo calculate key rollover timings.