When migrating the DNSSec Master to a replica, the setup of opendnssec is re-using the database and needs to call zonelist export. With opendnssec 1.4 this call is done with ods-ksmutil while opendnssec 2.1 uses ods-enforcer that communicates with odsenforcerd that is not started yet. Move the call after ods-enforcerd is started. Related: https://pagure.io/freeipa/issue/8214 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>