Re: DNSSEC / BIND breakage

-> everytime a resign happen the serial number must be changed.

this is right, but not your problem.

next try for a (maybe more correct) interpretation:

the secondary serve expired RRSIGs for rosenauer.org/A,AAAA,NS,MX ( shown purple at dnsviz ) and and a nonvalidatable RRSIG for rosenauer.org/SOA ( shown red at dnsviz )