Problems with dynamic updates and capitalization (and dnssec)

Sun Jul 26 16:59:54 UTC 2026

Feels like a bug, please create a gitlab issuer this. Thanks.
--
Ondřej Surý (He/Him)
ondrej at isc.org

ADHD brain at work: I sometimes lose track of my inbox. Please feel free to send a gentle nudge if you're waiting on a reply!

My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.

> On 26. 7. 2026, at 18:54, Jesus Cea <jcea at jcea.es> wrote:
> 
> All this have working for ages, including 9.18.
> 
> I just upgraded to 9.20.26, mostly uneventful except for this deal breaker.
> 
> After four days debugging, I reached this:
> 
> I create manually a new name called "zz2" via nsupdate, and I get this in the logs:
> 
> 26-Jul-2026 18:11:44.792 update: info: client @2222030 127.0.0.1#6856/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': adding an RR at 'zz2.i.bt.jcea.es' TXT "ABC"
> 26-Jul-2026 18:11:44.821 general: error: dns_diff_apply: jcea-portatil_ASUS.i.bt.jcea.es/TXT/IN: del not exact
> 26-Jul-2026 18:11:44.821 general: error: zone i.bt.jcea.es/IN (signed): receive_secure_serial: not exact
> 
> Notice that the update is done, but it is complaining about a different completely unrelated register "jcea-portatil_ASUS.i.bt.jcea.es". DNS is suppose to be case preserving but case insensitive, when I try to delete the name, I have this:
> 
> $ nsupdate -y hmac-sha256:...
> > server 127.0.0.1
> > zone i.bt.jcea.es
> > update delete jcea-portatil_ASUS.i.bt.jcea.es
> > send
> 
> The logs shows:
> 
> 26-Jul-2026 18:18:01.925 update: info: client @2222030 127.0.0.1#49696/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': delete all rrsets from name 'jcea-portatil_ASUS.i.bt.jcea.es'
> 26-Jul-2026 18:18:01.946 general: error: dns_diff_apply: jcea-portatil_ASUS.i.bt.jcea.es/TXT/IN: del not exact
> 26-Jul-2026 18:18:01.946 general: error: zone i.bt.jcea.es/IN (signed): receive_secure_serial: not exact
> 
> It can't find the name and the dnssec machinery fails too. Interestingly, the nsupdate commands do not report error.
> 
> but I try to delete the name in lowercase, it works... apparently (see lower):
> 
> $ nsupdate -y hmac-sha256:...
> > server 127.0.0.1
> > zone i.bt.jcea.es
> > update delete jcea-portatil_asus.i.bt.jcea.es
> > send
> 
> The log:
> 
> 26-Jul-2026 18:18:19.445 update: info: client @2222030 127.0.0.1#14644/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': delete all rrsets from name 'jcea-portatil_asus.i.bt.jcea.es'
> 
> Fishy.
> 
> Interestingly, other mixed case names don't fail, apparently:
> 
> 26-Jul-2026 18:21:08.641 update: info: client @15a3030 51.159.34.131#51307/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': delete all rrsets from name 'jcea-iPhone.i.bt.jcea.es'
> 26-Jul-2026 18:21:08.641 update: info: client @15a3030 51.159.34.131#51307/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': adding an RR at 'jcea-iPhone.i.bt.jcea.es' A 10.8.0.130
> 26-Jul-2026 18:21:08.641 update: info: client @15a3030 51.159.34.131#51307/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': adding an RR at 'jcea-iPhone.i.bt.jcea.es' TXT "2026-07-26"
> 26-Jul-2026 18:21:08.720 update: info: client @1a8f030 51.159.34.131#46375/key _.bt.jcea.es: updating zone 'e.bt.jcea.es/IN': delete all rrsets from name 'jcea-iPhone.e.bt.jcea.es'
> 26-Jul-2026 18:21:08.720 update: info: client @1a8f030 51.159.34.131#46375/key _.bt.jcea.es: updating zone 'e.bt.jcea.es/IN': adding an RR at 'jcea-iPhone.e.bt.jcea.es' A 91.117.234.230
> 26-Jul-2026 18:21:08.720 update: info: client @1a8f030 51.159.34.131#46375/key _.bt.jcea.es: updating zone 'e.bt.jcea.es/IN': adding an RR at 'jcea-iPhone.e.bt.jcea.es' TXT "2026-07-26"
> 
> But the zone transfer to the secondaries to propagate this changes doesn't occur at all, maybe because the dnssec system gets confused.
> 
> All of this breaks also my dnssec setup, but maybe it is a secondary effect, not the primary reason. Quite painful anyway.
> 
> After deleting "jcea-portatil_ASUS.i.bt.jcea.es" using the lower case version, as reported in the logs, more modifications STILL fails (with no error in nsupdate) with the same error:
> 
> 26-Jul-2026 18:44:45.395 update: info: client @2222030 127.0.0.1#39975/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': delete all rrsets from name 'zz2.i.bt.jcea.es'
> 26-Jul-2026 18:44:45.427 general: error: dns_diff_apply: jcea-portatil_ASUS.i.bt.jcea.es/TXT/IN: del not exact
> 26-Jul-2026 18:44:45.427 general: error: zone i.bt.jcea.es/IN (signed): receive_secure_serial: not exact
> 
> My zones have been broken for the last four days. What can I do?. Going back to 9.18 is not an option given the fixes in 9.20.26. I don't have easy control of the names and this setup worked fine in 9.18. Look like a bug introduced in 9.20.
> 
> Can you confirm? Any workaround? Are you going to fix it "soon"?
> 
> PS: I can patch and recompile the code myself if you provide a patch before an hypothetically fixed 9.20.27 a month away. This is a deal breaker for me.
> 
> --
> Jesús Cea Avión                         _/_/      _/_/_/        _/_/_/
> jcea at jcea.es - https://www.jcea.es/    _/_/    _/_/  _/_/    _/_/  _/_/
> Twitter: @jcea                        _/_/    _/_/          _/_/_/_/_/
> jabber / xmpp:jcea at jabber.org  _/_/  _/_/    _/_/          _/_/  _/_/
> "Things are not so easy"      _/_/  _/_/    _/_/  _/_/    _/_/  _/_/
> "My name is Dump, Core Dump"   _/_/_/        _/_/_/      _/_/  _/_/
> "El amor es poner tu felicidad en la felicidad de otro" - Leibniz
> --
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.
> <OpenPGP_signature>