diff --git a/bind.spec b/bind.spec
index 3bd255b..2378600 100644
--- a/bind.spec
+++ b/bind.spec
@@ -1031,6 +1031,7 @@ rm -rf ${RPM_BUILD_ROOT}
 * Mon Oct 23 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-3.P3
 - Include DNSKEY 20326 also in trusted-key.key (#1505476)
 - Fix dynamic symbols conflict with ldap (#1205168)
+- Use hmac-sha256 for new RNDC keys (#1508003)
 
 * Mon Jul 10 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-2.P3
 - Update to 9.11.1-P3
diff --git a/generate-rndc-key.sh b/generate-rndc-key.sh
index 194e65b..dde7f70 100755
--- a/generate-rndc-key.sh
+++ b/generate-rndc-key.sh
@@ -6,9 +6,10 @@
 
 if [ ! -s /etc/rndc.key -a ! -s /etc/rndc.conf ]; then
   echo -n $"Generating /etc/rndc.key:"
-  if /usr/sbin/rndc-confgen -a -r /dev/urandom > /dev/null 2>&1; then
+  if /usr/sbin/rndc-confgen -a -A hmac-sha256 -r /dev/urandom > /dev/null 2>&1
+  then
     chmod 640 /etc/rndc.key
-    chown root.named /etc/rndc.key
+    chown root:named /etc/rndc.key
     [ -x /sbin/restorecon ] && /sbin/restorecon /etc/rndc.key
     success $"/etc/rndc.key generation"
     echo