diff --git a/bind.spec b/bind.spec
index a6357de..6293ab4 100644
--- a/bind.spec
+++ b/bind.spec
@@ -54,7 +54,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.5
-Release:  4%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  5%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      http://www.isc.org/products/BIND/
 #
@@ -159,6 +159,7 @@ Provides:       dnssec-conf = 1.27-2
 Requires(post): policycoreutils-python-utils
 Requires(post): libselinux-utils
 Requires(post): selinux-policy
+Recommends:     bind-utils bind-dnssec-utils
 BuildRequires:  gcc, make
 BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
 BuildRequires:  libidn2-devel, libxml2-devel, GeoIP-devel
@@ -299,9 +300,14 @@ Contains license of the BIND DNS suite.
 
 %package utils
 Summary: Utilities for querying DNS name servers
-Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: python3-bind = %{epoch}:%{version}-%{release}
+Requires: bind-libs%{?_isa} = %{epoch}:%{version}-%{release}
+# TODO: this is just temporary workaround until all packages depending on
+# bind-utils can be satisfied without dnssec-utils
+# It will be removed after some time, or changed to Recommends
+Suggests: bind-dnssec-utils
+# For compatibility with Debian package
+Provides: dnsutils = %{epoch}:%{version}-%{release}
 
 %description utils
 Bind-utils contains a collection of utilities for querying DNS (Domain
@@ -313,6 +319,20 @@ network addresses.
 You should install bind-utils if you need to get information from DNS name
 servers.
 
+%package dnssec-utils
+Summary: Utilities for DNSSEC keys and DNS zone files management
+Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
+Recommends: bind-utils
+Requires: python3-bind = %{epoch}:%{version}-%{release}
+
+%description dnssec-utils
+Bind-dnssec-utils contains a collection of utilities for editing
+DNSSEC keys and BIND zone files. These tools provide generation,
+revocation and verification of keys and DNSSEC signatures in zone files.
+
+You should install bind-dnssec-utils if you need to sign a DNS zone
+or maintain keys for it.
+
 %if %{with DEVEL}
 %package devel
 Summary:  Header files and libraries needed for BIND DNS development
@@ -1254,6 +1274,19 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_bindir}/nslookup
 %{_bindir}/nsupdate
 %{_bindir}/arpaname
+%if %{with DNSTAP}
+%{_bindir}/dnstap-read
+%{_mandir}/man1/dnstap-read.1*
+%endif
+%{_mandir}/man1/host.1*
+%{_mandir}/man1/nsupdate.1*
+%{_mandir}/man1/dig.1*
+%{_mandir}/man1/delv.1*
+%{_mandir}/man1/nslookup.1*
+%{_mandir}/man1/arpaname.1*
+%{_sysconfdir}/trusted-key.key
+
+%files dnssec-utils
 %{_sbindir}/ddns-confgen
 %{_sbindir}/tsig-keygen
 %{_sbindir}/genrandom
@@ -1268,16 +1301,6 @@ rm -rf ${RPM_BUILD_ROOT}
 %if %{with LMDB}
 %{_sbindir}/named-nzd2nzf
 %endif
-%if %{with DNSTAP}
-%{_bindir}/dnstap-read
-%{_mandir}/man1/dnstap-read.1*
-%endif
-%{_mandir}/man1/host.1*
-%{_mandir}/man1/nsupdate.1*
-%{_mandir}/man1/dig.1*
-%{_mandir}/man1/delv.1*
-%{_mandir}/man1/nslookup.1*
-%{_mandir}/man1/arpaname.1*
 %{_mandir}/man8/ddns-confgen.8*
 %{_mandir}/man8/tsig-keygen.8*
 %{_mandir}/man8/genrandom.8*
@@ -1292,7 +1315,6 @@ rm -rf ${RPM_BUILD_ROOT}
 %if %{with LMDB}
 %{_mandir}/man8/named-nzd2nzf.8*
 %endif
-%{_sysconfdir}/trusted-key.key
 
 %if %{with DEVEL}
 %files devel
@@ -1490,6 +1512,9 @@ rm -rf ${RPM_BUILD_ROOT}
 
 
 %changelog
+* Thu Jan 17 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-5
+- Move dnssec related tools from bind-utils to bind-dnssec-utils (#1649398)
+
 * Wed Jan 16 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.5-4
 - Reject invalid binary file (#1666814)