No NSEC3 closest encloser

Unbound
1

TXT IN>: no NSEC3 closest encloser from 127.0.0.1 for DS host.example.com.

could i have some advice about this concerning my domain and what it
could potentially mean ?

i recently signed my zone with a different algorithm; now signing zone
with NSEC3RSASHA1 i receive this error

2

Hi Shmick,

TXT IN>: no NSEC3 closest encloser from 127.0.0.1 for DS
host.example.com.

could i have some advice about this concerning my domain and what
it could potentially mean ?

Unbound received an invalid DNSSEC packet from the authority server.
It is missing an NSEC3 record (it indicates which one).

i recently signed my zone with a different algorithm; now signing
zone with NSEC3RSASHA1 i receive this error

I guess something went wrong with new signed zone and that NSEC3 RR is
missing from the zone, or, your authority server software fails to
include that NSEC3 RR in the response. Since the authority server
software used to work previously, I would guess the signer is at
fault, given you said you were working with that.

If you run unbound (or unbound-host) with verbosity 4 (with
unbound-host -dddd) then it prints out the packet that it receives in
a dig-style output format; that is exactly the packet that is the error.

Best regards,
   Wouter