diff --git a/mdb/management/commands/zone-sync.py b/mdb/management/commands/zone-sync.py
index ea57037..bc3a838 100644
--- a/mdb/management/commands/zone-sync.py
+++ b/mdb/management/commands/zone-sync.py
@@ -59,7 +59,7 @@ class Command(BaseCommand):
         for zone in chain(Domain.objects.all(),
                           Ip4Subnet.objects.all(),
                           Ip6Subnet.objects.all()):
-            if zone.domain_serial == zone.domain_active_serial or force:
+            if zone.domain_serial == zone.domain_active_serial and not force:
                 continue
             if self.update_zone(zone):
                 self.changes[zone.domain_name]['success'] = True
diff --git a/mdb/signals.py b/mdb/signals.py
index bd91bbc..b4f20e8 100644
--- a/mdb/signals.py
+++ b/mdb/signals.py
@@ -101,6 +101,7 @@ def create_pxe_key_and_write_pxe_files_when_host_changes(sender, instance, creat
             with open(path, 'w+') as f:
                 f.write(pxe_file)
                 logger.info("Created or updated {}".format(path))
+            os.chmod(path, 0o644)  # Not writeable for all
 
             # Also set necessary fields for pxe installation
             interfaces = host.interface_set.exclude(ip4address__isnull=True)