diff --git a/CHANGELOG.md b/CHANGELOG.md
index b068e84f..a244899e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,7 +13,7 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 ## Fixed
 - DAV: `acl-principal-prop-set` REPORT enforced the wrong privilege.
 - JMAP: `Thread/get` did not filter by per-mailbox ACLs on shared accounts.
-
+- RFC2136 TSIG: regression related to multiplexer.
 
 ## [0.16.5] - 2026-05-11
 
diff --git a/Cargo.lock b/Cargo.lock
index 6d799f37..6e4cd77b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1937,9 +1937,9 @@ dependencies = [
 
 [[package]]
 name = "dns-update"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ab561859c5d537b185780ca8e7a501a227ed63ca2ad65560f4b41f57320b66c"
+checksum = "b70617312220ada56e308bf4a2287c942629ce36635204eb18faa74db2470514"
 dependencies = [
  "aws-lc-rs",
  "base64 0.22.1",
@@ -3951,9 +3951,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "libbz2-rs-sys"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3a6a8c165077efc8f3a971534c50ea6a1a18b329ef4a66e897a7e3a1494565f"
+checksum = "f8fc329e1457d97a9d58a4e2ca49e3be572431a7e096008efc2e3a3c19d428f4"
 
 [[package]]
 name = "libc"
@@ -5343,9 +5343,9 @@ checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
 
 [[package]]
 name = "prefix-trie"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f561214012d3fc240a1f9c817cc4d57f5310910d066069c1b093f766bb5966"
+checksum = "4cf6e3177f0684016a5c209b00882e15f8bdd3f3bb48f0491df10cd102d0c6e7"
 dependencies = [
  "either",
  "ipnet",
@@ -9969,9 +9969,9 @@ dependencies = [
 
 [[package]]
 name = "zerofrom"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
 dependencies = [
  "zerofrom-derive",
 ]
diff --git a/tests/docker/docker-compose.yml b/tests/docker/docker-compose.yml
index 7acd8a75..d8cf44bb 100644
--- a/tests/docker/docker-compose.yml
+++ b/tests/docker/docker-compose.yml
@@ -241,8 +241,7 @@ services:
     volumes:
       - ./powerdns/pdns.conf:/etc/powerdns/pdns.d/stalwart.conf:ro
       - ./powerdns/init-zone.sh:/etc/powerdns/init-zone.sh:ro
-    tmpfs:
-      - /var/lib/powerdns
+      - pdns-data:/var/lib/powerdns
 
   powerdns-init:
     image: powerdns/pdns-auth-49:latest
@@ -251,6 +250,7 @@ services:
     volumes:
       - ./powerdns/entrypoint.sh:/init.sh:ro
       - ./powerdns/init-zone.sh:/etc/powerdns/init-zone.sh:ro
+      - pdns-data:/var/lib/powerdns
     entrypoint: [ "bash", "/init.sh" ]
     network_mode: "service:powerdns"
 
@@ -272,3 +272,5 @@ volumes:
     driver: local
   fdb-config:
     driver: local
+  pdns-data:
+    driver: local
diff --git a/tests/docker/powerdns/init-zone.sh b/tests/docker/powerdns/init-zone.sh
index 890258a2..c02cc459 100755
--- a/tests/docker/powerdns/init-zone.sh
+++ b/tests/docker/powerdns/init-zone.sh
@@ -4,13 +4,20 @@ set -e
 # Wait for the SQLite database to be ready
 sleep 2
 
-# Create the zone
+# Skip if already initialized
+if pdnsutil list-zone stalwart.test >/dev/null 2>&1; then
+    echo "Zone stalwart.test already exists; skipping init."
+    exit 0
+fi
+
+# Create the zone with default SOA + NS
 pdnsutil create-zone stalwart.test ns1.stalwart.test
 pdnsutil set-kind stalwart.test native
 
+# Replace the default SOA with our own
+pdnsutil replace-rrset stalwart.test '' SOA 'ns1.stalwart.test. admin.stalwart.test. 2024010101 3600 900 604800 86400'
+
 # Add basic records
-pdnsutil add-record stalwart.test '' SOA 'ns1.stalwart.test. admin.stalwart.test. 2024010101 3600 900 604800 86400'
-pdnsutil add-record stalwart.test '' NS 'ns1.stalwart.test.'
 pdnsutil add-record stalwart.test 'ns1' A '127.0.0.1'
 pdnsutil add-record stalwart.test '' A '127.0.0.1'
 pdnsutil add-record stalwart.test '' MX '10 mail.stalwart.test.'
@@ -24,10 +31,11 @@ pdnsutil add-record stalwart.test '_25._tcp.mail' TLSA '3 1 1 000000000000000000
 # Key: stalwart-update-key / HMAC-SHA256
 # Base64 secret: c3RhbHdhcnQtdGVzdC10c2lnLXNlY3JldC1rZXkxMjM0NTY3ODkw
 pdnsutil import-tsig-key stalwart-update-key hmac-sha256 'c3RhbHdhcnQtdGVzdC10c2lnLXNlY3JldC1rZXkxMjM0NTY3ODkw'
-pdnsutil activate-tsig-key stalwart.test stalwart-update-key master
+pdnsutil activate-tsig-key stalwart.test stalwart-update-key primary
 pdnsutil set-meta stalwart.test TSIG-ALLOW-DNSUPDATE stalwart-update-key
 pdnsutil set-meta stalwart.test ALLOW-DNSUPDATE-FROM '0.0.0.0/0'
 
+
 echo "PowerDNS zone setup complete."
 echo "TSIG key name:      stalwart-update-key"
 echo "TSIG algorithm:     hmac-sha256"
diff --git a/tests/docker/powerdns/pdns.conf b/tests/docker/powerdns/pdns.conf
index fd12db81..54df2b28 100644
--- a/tests/docker/powerdns/pdns.conf
+++ b/tests/docker/powerdns/pdns.conf
@@ -1,2 +1,3 @@
 dnsupdate=yes
 allow-dnsupdate-from=0.0.0.0/0
+zone-cache-refresh-interval=0