diff --git a/TODO.markdown b/TODO.markdown
index 1ea01b78..72abb490 100644
--- a/TODO.markdown
+++ b/TODO.markdown
@@ -1,13 +1,11 @@
 # TODO
 
 * Support for on-the-fly-signing
-* (Re)sign zonefiles
 * TLSA support
     * create record from PEM(?) files
     * sign
     * verify
 * Use BIND10 memory efficient zone structure?
-* copy srv/mx sorting from base library
 * allow multiple edns0 options to exist in the record when converting
   from/to wireformat
 * NSEC3 support propper in the zone structure(s)
diff --git a/zone.go b/zone.go
index 5716d6ec..5fc3ac2d 100644
--- a/zone.go
+++ b/zone.go
@@ -16,13 +16,13 @@ import (
 // Zone represents a DNS zone. It's safe for concurrent use by 
 // multilpe goroutines.
 type Zone struct {
-	Origin       string   // Origin of the zone
-	olabels      []string // origin cut up in labels, just to speed up the isSubDomain method
-	Wildcard     int      // Whenever we see a wildcard name, this is incremented
-	*radix.Radix          // Zone data
+	Origin       string    // Origin of the zone
+	olabels      []string  // origin cut up in labels, just to speed up the isSubDomain method
+	Wildcard     int       // Whenever we see a wildcard name, this is incremented
+	expired      bool      // Slave zone is expired
+	mtime        time.Time // When is the zone last modified
+	*radix.Radix           // Zone data
 	*sync.RWMutex
-	expired bool // Slave zone is expired
-	// Do we need a timemodified?
 }
 
 type uint16Slice []uint16
@@ -84,6 +84,7 @@ func NewZone(origin string) *Zone {
 	z.olabels = SplitLabels(z.Origin)
 	z.Radix = radix.New()
 	z.RWMutex = new(sync.RWMutex)
+	z.mtime = time.Now().UTC()
 	return z
 }
 
@@ -202,6 +203,7 @@ func (z *Zone) Insert(r RR) error {
 
 	key := toRadixName(r.Header().Name)
 	z.Lock()
+	z.mtime = time.Now.UTC()
 	zd, exact := z.Radix.Find(key)
 	if !exact {
 		// Not an exact match, so insert new value
@@ -251,6 +253,7 @@ func (z *Zone) Insert(r RR) error {
 func (z *Zone) Remove(r RR) error {
 	key := toRadixName(r.Header().Name)
 	z.Lock()
+	m.mtime = time.Now.UTC()
 	zd, exact := z.Radix.Find(key)
 	if !exact {
 		defer z.Unlock()
@@ -312,6 +315,7 @@ func (z *Zone) Remove(r RR) error {
 func (z *Zone) RemoveName(s string) error {
 	key := toRadixName(s)
 	z.Lock()
+	z.mtime = time.Now().UTC()
 	defer z.Unlock()
 	z.Radix.Remove(key)
 	if len(s) > 1 && s[0] == '*' && s[1] == '.' {
@@ -327,6 +331,7 @@ func (z *Zone) RemoveName(s string) error {
 // Typical use of this method is when processing a RemoveRRset dynamic update packet.
 func (z *Zone) RemoveRRset(s string, t uint16) error {
 	z.Lock()
+	z.mtime = time.Now().UTC()
 	zd, exact := z.Radix.Find(toRadixName(s))
 	if !exact {
 		defer z.Unlock()
@@ -418,6 +423,7 @@ func (z *Zone) isSubDomain(child string) bool {
 //	// Admire your signed zone...
 func (z *Zone) Sign(keys map[*RR_DNSKEY]PrivateKey, config *SignatureConfig) error {
 	z.Lock()
+	z.mtime = time.Now().UTC()
 	defer z.Unlock()
 	if config == nil {
 		config = DefaultSignatureConfig