Yesterday, I noticed an error in a bind zone file, and after correcting it, I tried to restart bind9, but the service refused to stop, displaying this error:

rndc: connect failed: connection refused

I found a lot of references to this error message, with no obvious fixes, but there were a lot of references to rndc.key and rndc-confgen. I noticed that the date on the existing rndc.key was exactly one year from the day before I had this problem. I knew I hadn't restarted bind in the meantime, so I thought that the key had expired. I generated a new key with rndc-confgen -a. I had to force a restart, as I couldn't stop the bind service; since then, bind has been working fine

The obvious conclusion is that rndc.key expires after a year. I have not found this mentioned in the man pages or documentation for bind9 that I've checked, and I would think it was an important point if true. Can anyone confirm if this is the standard, or if there's some way to configure the expiration date?

1 Answer 1


"Connection refused" means that the port wasn't open, so bind wasn't actually listening at that address on that port. Whatever the reason for it, it likely wasn't an expired key of any kind.

  • At this point, I'll have to write the issue off as an odd glitch that cleared up with a restart.
    – bgvaughan
    Commented May 25, 2011 at 1:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .