diff --git a/zone.go b/zone.go
index d22beed1..fd7fa5a0 100644
--- a/zone.go
+++ b/zone.go
@@ -300,10 +300,14 @@ func (z *Zone) Sign(keys map[*RR_DNSKEY]PrivateKey, config *SignatureConfig) err
 		keytags[k] = k.KeyTag()
 	}
 	apex, next, _ := z.FindAndNext(z.Origin)
-
 	// TODO(mg): check if it exissts
 	config.minttl = apex.RR[TypeSOA][0].(*RR_SOA).Minttl
-	signZoneData(apex, next, keys, keytags, config)
+
+	for next.Name != z.Origin {
+		signZoneData(apex, next, keys, keytags, config)
+		apex, next, _ = z.FindAndNext(z.Origin)
+	}
+
 	return nil
 }