diff --git a/DnsServerCore/WebServiceZonesApi.cs b/DnsServerCore/WebServiceZonesApi.cs
index 3f08a3d1..c4997be2 100644
--- a/DnsServerCore/WebServiceZonesApi.cs
+++ b/DnsServerCore/WebServiceZonesApi.cs
@@ -1854,13 +1854,16 @@ namespace DnsServerCore
 
                                         if (authoritativeZoneRecords)
                                         {
-                                            foreach (DnssecPrivateKey dnssecPrivateKey in zoneInfo.DnssecPrivateKeys)
+                                            if (zoneInfo.Type == AuthZoneType.Primary)
                                             {
-                                                if (dnssecPrivateKey.KeyTag == rdata.ComputedKeyTag)
+                                                foreach (DnssecPrivateKey dnssecPrivateKey in zoneInfo.DnssecPrivateKeys)
                                                 {
-                                                    jsonWriter.WritePropertyName("dnsKeyState");
-                                                    jsonWriter.WriteValue(dnssecPrivateKey.State.ToString());
-                                                    break;
+                                                    if (dnssecPrivateKey.KeyTag == rdata.ComputedKeyTag)
+                                                    {
+                                                        jsonWriter.WritePropertyName("dnsKeyState");
+                                                        jsonWriter.WriteValue(dnssecPrivateKey.State.ToString());
+                                                        break;
+                                                    }
                                                 }
                                             }