named should automatically handle errors in receive_secure_serial by generating a diff against the current raw zone and the signed zone contents sans DNSSEC records.
