Thanks for that information. I've tested with ADP on, and it didn't change the result. The Zone is still available. Could it have anything to do with the zone being a custom zone, and also having at least one record which is using CKShare with hierarchical sharing? I still have the feeling though, that just clearing the keychain using Keychain Access app don't really reset the CloudKit encryption key.