Problems with dynamic updates and capitalization (and dnssec)

[Jesus Cea]

All this have working for ages, including 9.18.

I just upgraded to 9.20.26, mostly uneventful except for this deal breaker.

After four days debugging, I reached this:

I create manually a new name called "zz2" via nsupdate, and I get this 
in the logs:

26-Jul-2026 18:11:44.792 update: info: client @2222030 
127.0.0.1#6856/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': adding 
an RR at 'zz2.i.bt.jcea.es' TXT "ABC"
26-Jul-2026 18:11:44.821 general: error: dns_diff_apply: 
jcea-portatil_ASUS.i.bt.jcea.es/TXT/IN: del not exact
26-Jul-2026 18:11:44.821 general: error: zone i.bt.jcea.es/IN (signed): 
receive_secure_serial: not exact

Notice that the update is done, but it is complaining about a different 
completely unrelated register "jcea-portatil_ASUS.i.bt.jcea.es". DNS is 
suppose to be case preserving but case insensitive, when I try to delete 
the name, I have this:

$ nsupdate -y hmac-sha256:...
 > server 127.0.0.1
 > zone i.bt.jcea.es
 > update delete jcea-portatil_ASUS.i.bt.jcea.es
 > send

The logs shows:

26-Jul-2026 18:18:01.925 update: info: client @2222030 
127.0.0.1#49696/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': 
delete all rrsets from name 'jcea-portatil_ASUS.i.bt.jcea.es'
26-Jul-2026 18:18:01.946 general: error: dns_diff_apply: 
jcea-portatil_ASUS.i.bt.jcea.es/TXT/IN: del not exact
26-Jul-2026 18:18:01.946 general: error: zone i.bt.jcea.es/IN (signed): 
receive_secure_serial: not exact

It can't find the name and the dnssec machinery fails too. 
Interestingly, the nsupdate commands do not report error.

but I try to delete the name in lowercase, it works... apparently (see 
lower):

$ nsupdate -y hmac-sha256:...
 > server 127.0.0.1
 > zone i.bt.jcea.es
 > update delete jcea-portatil_asus.i.bt.jcea.es
 > send

The log:

26-Jul-2026 18:18:19.445 update: info: client @2222030 
127.0.0.1#14644/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': 
delete all rrsets from name 'jcea-portatil_asus.i.bt.jcea.es'

Fishy.

Interestingly, other mixed case names don't fail, apparently:

26-Jul-2026 18:21:08.641 update: info: client @15a3030 
51.159.34.131#51307/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': 
delete all rrsets from name 'jcea-iPhone.i.bt.jcea.es'
26-Jul-2026 18:21:08.641 update: info: client @15a3030 
51.159.34.131#51307/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': 
adding an RR at 'jcea-iPhone.i.bt.jcea.es' A 10.8.0.130
26-Jul-2026 18:21:08.641 update: info: client @15a3030 
51.159.34.131#51307/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': 
adding an RR at 'jcea-iPhone.i.bt.jcea.es' TXT "2026-07-26"
26-Jul-2026 18:21:08.720 update: info: client @1a8f030 
51.159.34.131#46375/key _.bt.jcea.es: updating zone 'e.bt.jcea.es/IN': 
delete all rrsets from name 'jcea-iPhone.e.bt.jcea.es'
26-Jul-2026 18:21:08.720 update: info: client @1a8f030 
51.159.34.131#46375/key _.bt.jcea.es: updating zone 'e.bt.jcea.es/IN': 
adding an RR at 'jcea-iPhone.e.bt.jcea.es' A 91.117.234.230
26-Jul-2026 18:21:08.720 update: info: client @1a8f030 
51.159.34.131#46375/key _.bt.jcea.es: updating zone 'e.bt.jcea.es/IN': 
adding an RR at 'jcea-iPhone.e.bt.jcea.es' TXT "2026-07-26"

But the zone transfer to the secondaries to propagate this changes 
doesn't occur at all, maybe because the dnssec system gets confused.

All of this breaks also my dnssec setup, but maybe it is a secondary 
effect, not the primary reason. Quite painful anyway.

After deleting "jcea-portatil_ASUS.i.bt.jcea.es" using the lower case 
version, as reported in the logs, more modifications STILL fails (with 
no error in nsupdate) with the same error:

26-Jul-2026 18:44:45.395 update: info: client @2222030 
127.0.0.1#39975/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': 
delete all rrsets from name 'zz2.i.bt.jcea.es'
26-Jul-2026 18:44:45.427 general: error: dns_diff_apply: 
jcea-portatil_ASUS.i.bt.jcea.es/TXT/IN: del not exact
26-Jul-2026 18:44:45.427 general: error: zone i.bt.jcea.es/IN (signed): 
receive_secure_serial: not exact

My zones have been broken for the last four days. What can I do?. Going 
back to 9.18 is not an option given the fixes in 9.20.26. I don't have 
easy control of the names and this setup worked fine in 9.18. Look like 
a bug introduced in 9.20.

Can you confirm? Any workaround? Are you going to fix it "soon"?

PS: I can patch and recompile the code myself if you provide a patch 
before an hypothetically fixed 9.20.27 a month away. This is a deal 
breaker for me.

-- 
Jesús Cea Avión                         _/_/      _/_/_/        _/_/_/
jcea at jcea.es - https://www.jcea.es/    _/_/    _/_/  _/_/    _/_/  _/_/
Twitter: @jcea                        _/_/    _/_/          _/_/_/_/_/
jabber / xmpp:jcea at jabber.org  _/_/  _/_/    _/_/          _/_/  _/_/
"Things are not so easy"      _/_/  _/_/    _/_/  _/_/    _/_/  _/_/
"My name is Dump, Core Dump"   _/_/_/        _/_/_/      _/_/  _/_/
"El amor es poner tu felicidad en la felicidad de otro" - Leibniz
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 495 bytes
Desc: OpenPGP digital signature
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20260726/18d30159/attachment.sig>