<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div data-marker="__QUOTED_TEXT__"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>I'm running into an odd issue with Bind 9.9.4 whereby I'm trying to run a scripted nsupdate to rotate TLSA records. I'm running nsupdate via a Bash script that executes the following nsupdate batch commands which are directed to a Bind "view" that is accessible from the wider internet:<br></div><br><div>server 1.2.3.4<br>zone example.com<br>key updatekey xyz123...<br>update delete _25._tcp.mail.example.com. TLSA<br>local 127.0.0.1<br>show<br>send<br></div><br><div>And then:<br></div><div>server 1.2.3.4<br>zone example.com<br>key updatekey xyz123...<br>update add _25._tcp.mail.example.com. 3600 IN TLSA 3 1 1 abc123...<br>local 127.0.0.1<br>show<br>send</div><br><div>I get the following output, all looks good:<br></div><br><div> + Updating DNS 1.2.3.4: for ... ok.<br> + Updating DNS 1.2.3.4: for ... ok.<br><br></div><div>I see the following in /var/log/messages, all looks good (updating the view named "remote", responsible for answering queries from off-network sources):<br></div><div>Oct 31 10:28:19 test named[106]: client 127.0.0.1#33710/key updatekey: view remote: signer "updatekey" approved<br>Oct 31 10:28:19 test named[106]: client 127.0.0.1#33710/key updatekey: view remote: updating zone 'example.com/IN': deleting rrset at '_25._tcp.mail.example.com' TLSA<br>Oct 31 10:28:19 test named[106]: zone example.com/IN/remote: sending notifies (serial 165)<br>Oct 31 10:28:19 test named[106]: client 1.2.3.4#38629: view internal: received notify for zone 'example.com'<br>Oct 31 10:28:19 test named[106]: client 127.0.0.1#56323/key updatekey: view remote: signer "updatekey" approved<br>Oct 31 10:28:19 test named[106]: client 127.0.0.1#56323/key updatekey: view remote: updating zone 'example.com/IN': adding an RR at '_25._tcp.mail.example.com' TLSA<br><br></div><div>But then when I try to do a query from remote, no TLSA record exists.</div><br><div>$ dig @8.8.8.8 TLSA _25._tcp.mail.example.com +dnssec<br><br>; <<>> DiG 9.9.4-RedHat-9.9.4-51.el7 <<>> @8.8.8.8 TLSA _25._tcp.mail.example.com +dnssec<br>; (1 server found)<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 29421<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1<br><br>;; OPT PSEUDOSECTION:<br>; EDNS: version: 0, flags: do; udp: 512<br>;; QUESTION SECTION:<br>;_25._tcp.mail.example.com. IN TLSA<br><br>;; Query time: 74 msec<br>;; SERVER: 8.8.8.8#53(8.8.8.8)<br>;; WHEN: Tue Oct 31 10:37:02 PDT 2017<br>;; MSG SIZE rcvd: 59<br></div><br><div>Oct 31 10:33:12 test named[106]: query logging is now on<br>Oct 31 10:33:33 test named[106]: client 74.125.80.69#45732 (_25._tcp.mail.example.com): view remote: query: _25._tcp.mail.example.com IN TLSA -ED (1.2.3.4)<br>Oct 31 10:33:36 test named[106]: client 1.2.3.4#39184 (74.165.37.177.in-addr.arpa): view internal: query: 74.165.37.177.in-addr.arpa IN PTR + (1.2.3.4)<br>Oct 31 10:33:39 test named[106]: received control channel command 'querylog'<br><br></div><div>I'm at a loss as to what's going on, any ideas?<br></div><br><div>-Kevin<br></div></div><br></div></div></body></html>