error: /var/named/dynamic/managed-keys.bind.jnl: create: permission denied

[Xavier Humbert]

Hi, my DNS server is working perfectly, passes all the tests, but I 
started to notice this in the logs

root at aragorn:/var/named# ll /var/named/dynamic/
total 0
root at aragorn:/var/named# systemctl restart named
root at aragorn:/var/named# systemctl status named
● named.service - BIND Domain Name Server
      Loaded: loaded (/usr/lib/systemd/system/named.service; enabled; 
preset: enabled)
      Active: active (running) since Wed 2026-08-19 20:30:55 CEST; 3s ago
        Docs: man:named(8)
    Main PID: 178757 (named)
      Status: "running"
       Tasks: 10 (limit: 2216)
      Memory: 25.5M (peak: 26.5M)
         CPU: 607ms
      CGroup: /system.slice/named.service
              └─178757 /usr/sbin/named -f -u bind

Aug 19 20:30:55 aragorn.groumpf.org systemd[1]: Started named.service - 
BIND Domain Name Server.
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
20:30:55.011 general: notice: all zones loaded
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
20:30:55.012 general: error: /var/named/dynamic/managed-keys.bind.jnl: 
create: permission denied
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
20:30:55.012 general: error: managed-keys-zone: 
sync_keyzone:dns_journal_open -> unexpected error
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
20:30:55.012 dnssec: error: managed-keys-zone: unable to synchronize 
managed keys: unexpected error
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
20:30:55.012 dnssec: error: failed to initialize managed-keys for view 
_default (unexpected error): DNSSEC validation is at risk
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
20:30:55.013 notify: info: zone amdh-reseaux.fr/IN: sending notifies 
(serial 2026028370)
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
20:30:55.013 general: notice: running
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
20:30:55.014 notify: info: zone groumpf.org/IN: sending notifies (serial 
2026010801)
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
20:30:55.014 notify: info: zone amdh-reseaux.net/IN: sending notifies 
(serial 2026010801)


root at aragorn:/var/named# ll -a /var/named/
total 12
drwxr-xr-x  3 bind bind 4096 Nov 29  2023 ./
drwxr-xr-x 16 root root 4096 Dec 24  2024 ../
drwxr-xr-x  2 bind bind 4096 Nov 29  2023 dynamic/

Here are my options :

options {
     listen-on port 53 { 127.0.0.1; any;};
     listen-on-v6 port 53 { ::1; any;};
     listen-on { 127.0.0.1; };

     directory     "/var/named";
     dump-file     "/var/named/data/cache_dump.db";
     statistics-file "/var/named/data/named_stats.txt";
     memstatistics-file "/var/named/data/named_mem_stats.txt";
     recursing-file  "/var/named/data/named.recursing";
     secroots-file   "/var/named/data/named.secroots";
     allow-query     { localhost; };
     recursion no;

     managed-keys-directory "/var/named/dynamic";

     pid-file "/run/named/named.pid";
     session-keyfile "/run/named/session.key";

     auth-nxdomain no;    # conform to RFC1035
     allow-transfer   { none; };
     allow-recursion    { xavhome; };
     version "NS.GROUMPF.ORG GROUMPF L'Internet Asocial";
};

What is the problem ? Permissions seem OK

This is an Ubuntu 22.04.4 Server LTS

Thanks,

Regards,

Xavier

-- 
Xavier Humbert
CRT Supervision et Exploitation de Niveau 1
Direction Régionale Académique des Systèmes d’Information Grand Est
Rectorat de l'Académie de Nancy-Metz
Ministère de l'Éducation Nationale, de l'Enseignement Supérieur et de la Recherche
03 83 86 27 39