<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">There is no workaround that I can think of.<div><br></div><div>As an aside I’d be specifying the key in the primaries clause rather than server clause. <br><div dir="ltr">-- <div>Mark Andrews</div></div><div dir="ltr"><br><blockquote type="cite">On 10 Jun 2023, at 07:52, Frey, Rick E via bind-users <bind-users@lists.isc.org> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style>@font-face { font-family: Wingdings; }
@font-face { font-family: "Cambria Math"; }
@font-face { font-family: Calibri; }
p.MsoNormal, li.MsoNormal, div.MsoNormal { margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif; }
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph { margin: 0in 0in 0in 0.5in; font-size: 12pt; font-family: Calibri, sans-serif; }
span.EmailStyle17 { font-family: Calibri, sans-serif; color: windowtext; }
.MsoChpDefault { font-size: 12pt; font-family: Calibri, sans-serif; }
@page WordSection1 { size: 8.5in 11in; margin: 1in; }
div.WordSection1 { page: WordSection1; }
ol { margin-bottom: 0in; }
ul { margin-bottom: 0in; }</style>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">I’ve got a case where using BIND (v9.16.41) as a secondary to a third party (commercial) primary nameserver. Using TSIG for the zone transfers. Have verified zone transfers and TSIG key using dig between
hosts. BIND is configured to use TSIG for the primary server using server x.x.x.x { keys “somekey”; } directive.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Problem is that the primary server does not sign the response with TSIG for the SOA query sent by BIND to determine if update is needed. Since response to SOA query is not signed, BIND considers response
invalid:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><br>
Sample log message when SOA not signed:<br>
zone some-domain.com/IN: refresh: failure trying master x.x.x.x#53 (source 0.0.0.0#0): expected a TSIG or SIG(0)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I know that BIND is not at fault and the primary server is breaking RFC8945 as any query with TSIG is required to return a TSIG RR in the response. Working w/ vendor of the primary nameserver to resolve.
The vendor is a pretty widely used provider so I’m a bit surprised issue has not occurred before now.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Mainly wondering if there is any workaround available to allow BIND to either not send TSIG in SOA query to the primary server (but still use TSIG for zone transfer) or accept the SOA response w/o TSIG RR.
I was unable to find any means to configure this behavior in reading through BIND documentation.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoListParagraph" style="margin-left:-15.75pt;mso-list:l0 level1 lfo1">
<span style="font-size:11.0pt">Rick<o:p></o:p></span></li></ul>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
This email message and any attachments are for the sole use of the intended recipient(s). Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all
copies of the original message and any attachments. <br>
<p style="font-family:Calibri;font-size:8pt;color:#000000;margin:15pt;font-style:normal;font-weight:normal;text-decoration:none;" align="Left">
Sensitivity: Internal<br>
</p>
<span>-- </span><br><span>Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list</span><br><span></span><br><span>ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.</span><br><span></span><br><span></span><br><span>bind-users mailing list</span><br><span>bind-users@lists.isc.org</span><br><span>https://lists.isc.org/mailman/listinfo/bind-users</span><br></div></blockquote></div></body></html>