Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

How do I run a dns server with a zone for a local domain and be able to add dynamic entries to the dns zone securely from selected hosts?

I have tried to setup a domain 'rag.local' with bind9. I have tried to add a new record to that zone using TSIG. It works now. The steps are below.

Used dnssec to generate secret key for the zone

$ dnssec-keygen -r /dev/urandom -a HMAC-MD5 -b 512 -n HOST rag.local
$ ls -l 
-rw------- 1 rag rag 118 Mar  7 23:22 Krag.local.+157+26937.key
-rw------- 1 rag rag 229 Mar  7 23:22 Krag.local.+157+26937.private

Copied .key to /etc/bind

/etc/bind$ ls -lt
-rw-r--r-- 1 root bind  265 Mar  7 23:43 rag.local
-rw-r--r-- 1 root bind  435 Mar  7 23:35 named.conf.local
-rw------- 1 root bind  118 Mar  7 23:33 Krag.local.+157+26937.key


/etc/bind$ cat named.conf.local 

key "rag.local." {
  algorithm hmac-md5;
  secret "secret-key";

zone "rag.local" {
        type master;
        file "/etc/bind/rag.local";
        allow-update { key "rag.local."; };

rag.local zone definition. EDIT: this file earlier did not have a valid name server and admin email for the zone. also the zone file missed an A record for the name server.

/etc/bind$ cat rag.local
; BIND data file for local loopback interface
$TTL    604800
@   IN  SOA ns.rag.local. admin.rag.local. (
                  2     ; Serial
             604800     ; Refresh
              86400     ; Retry
            2419200     ; Expire
             604800 )   ; Negative Cache TTL
@   IN  NS  ns.rag.local.
@   IN  A
ns  IN  A
@   IN  AAAA    ::1

You may get some error like below if zone file is not valid

Mar  8 00:00:44 rag-tos-laptop named[20349]: zone rag.local/IN: journal rollforward failed: no more
Mar  8 00:00:44 rag-tos-laptop named[20349]: zone rag.local/IN: not loaded due to errors.

EDIT: after the zone file is corrected

Mar  8 00:23:43 rag-tos-laptop named[21469]: zone rag.local/IN: loaded serial 2
Mar  8 00:23:43 rag-tos-laptop named[21469]: zone localhost/IN: loaded serial 2

A sample nsupdate file

$ cat nsupdate.txt 
server localhost
debug yes
zone rag.local.
update add host1.rag.local. 3600 A

Ran update

 nsupdate -k Krag.local.+157+26937.private -v nsupdate.txt 

Requires write permissions to bind group on /etc/bind to solve a few permissions issues.


share|improve this question
You want to be able to edit zone files on your DNS server from a remote host? Does ssh not cover that? –  jordanm Mar 7 '13 at 18:01
i would like some programs to automatically add SRV entries when they become available. –  rag Mar 7 '13 at 18:50

1 Answer 1

I have solved it:

dnssec-keygen -a HMAC-MD5 -b 128 -n HOST

editing conf. file:

// TSIG Key
key "" {
algorithm hmac-md5;
zone "" IN {
  type master;
  file "";
  allow-update{ key ""; };

This is the step that you have to add

give the named authorization to the /var/named folder:

# chown -R named:named /var/named
# find . -type d -exec chmod 770 {} \;
# find . -type f -exec chmod 660 {} \;

Note: after you have use nsupdate you need to reload the zone using this steps:

rndc freeze

then reloading

rndc reload  

then allowing dynamic updates again:

rndc thaw
share|improve this answer
thank you for rndc commands –  Ilja May 16 at 0:27
@Ilja, You are Welcome –  Networker May 17 at 22:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.