title: BIND9 Dynamic Update not working - NOTZONE and SERVFAIL errors
body: <p>This is on CentOS 7 with BIND9. When I run nsupdate to test ddns updating, I get a couple levels of failure. On adding the reverse zone, I get . Then on adding the forward zone entry, I get . I've reached the end of google in trying to identify what I'm doing wrong - does anyone see what's the problem here? I'm  not even getting into DHCPD yet, though I have it all configured and ready to go. </p>
  
  <pre><code>nsupdate
  &gt; server ns1.office.somecompany.com
  &gt; key rndc-key xxxxxxxxxxxxxxxxxxxxxxx==
  &gt; zone office.somecompany.com.
  &gt; update add 55.4.168.192.in-addr.arpa. 600 IN PTR stinky.office.somecompany.com.
  &gt; send
  update failed: NOTZONE
  &gt; update add stinky.office.somecompany.com. 600 IN A 192.168.4.55
  &gt; send
  update failed: SERVFAIL
  </code></pre>
  
  <p>If I put the above commands into a file (test.bind.ddns) and add the debug switch, my output, to me, is no more helpful:</p>
  
  <pre><code>[root@ns1 ~]# nsupdate -d test.bind.ddns
  Sending update to 192.168.4.25#53
  Outgoing update query:
  ;; -&gt;&gt;HEADER&lt;&lt;- opcode: UPDATE, status: NOERROR, id:   2851
  ;; flags:; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 1
  ;; ZONE SECTION:
  ;office.somecompany.com. IN    SOA
  
  ;; UPDATE SECTION:
  55.4.168.192.in-addr.arpa. 600  IN      PTR     stinky.office.somecompany.com.
  
  ;; TSIG PSEUDOSECTION:
  rndc-key.               0       ANY     TSIG    hmac-md5.sig-alg.reg.int. 1424040289 300 16 aaaaaaaaaaaaaaaaaaaaaa== 2851 NOERROR 0
  
  
  Reply from update query:
  ;; -&gt;&gt;HEADER&lt;&lt;- opcode: UPDATE, status: NOTZONE, id:   2851
  ;; flags: qr ra; ZONE: 1, PREREQ: 0, UPDATE: 0, ADDITIONAL: 1
  ;; ZONE SECTION:
  ;office.somecompany.com. IN    SOA
  
  ;; TSIG PSEUDOSECTION:
  rndc-key.               0       ANY     TSIG    hmac-md5.sig-alg.reg.int. 1424040289 300 16 bbbbbbbbbbbbbbbbbbbbbb== 2851 NOERROR 0
  
  Sending update to 192.168.4.25#53
  Outgoing update query:
  ;; -&gt;&gt;HEADER&lt;&lt;- opcode: UPDATE, status: NOERROR, id:  13185
  ;; flags:; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 1
  ;; ZONE SECTION:
  ;office.somecompany.com. IN    SOA
  
  ;; UPDATE SECTION:
  stinky.office.somecompany.com. 600 IN A 192.168.4.55
  
  ;; TSIG PSEUDOSECTION:
  rndc-key.               0       ANY     TSIG    hmac-md5.sig-alg.reg.int. 1424040289 300 16 cccccccccccccccccccccc== 13185 NOERROR 0
  
  
  Reply from update query:
  ;; -&gt;&gt;HEADER&lt;&lt;- opcode: UPDATE, status: SERVFAIL, id:  13185
  ;; flags: qr ra; ZONE: 1, PREREQ: 0, UPDATE: 0, ADDITIONAL: 1
  ;; ZONE SECTION:
  ;office.somecompany.com. IN    SOA
  
  ;; TSIG PSEUDOSECTION:
  rndc-key.               0       ANY     TSIG    hmac-md5.sig-alg.reg.int. 1424040289 300 16 dddddddddddddddddddddd== 13185 NOERROR 0
  
  Sending update to 192.168.4.25#53
  Outgoing update query:
  ;; -&gt;&gt;HEADER&lt;&lt;- opcode: UPDATE, status: NOERROR, id:  56384
  ;; flags:; ZONE: 1, PREREQ: 0, UPDATE: 0, ADDITIONAL: 1
  ;; ZONE SECTION:
  ;office.somecompany.com. IN    SOA
  
  ;; TSIG PSEUDOSECTION:
  rndc-key.               0       ANY     TSIG    hmac-md5.sig-alg.reg.int. 1424040289 300 16 ffffffffffffffffffffff== 56384 NOERROR 0
  
  
  Reply from update query:
  ;; -&gt;&gt;HEADER&lt;&lt;- opcode: UPDATE, status: NOERROR, id:  56384
  ;; flags: qr ra; ZONE: 1, PREREQ: 0, UPDATE: 0, ADDITIONAL: 1
  ;; ZONE SECTION:
  ;office.somecompany.com. IN    SOA
  
  ;; TSIG PSEUDOSECTION:
  rndc-key.               0       ANY     TSIG    hmac-md5.sig-alg.reg.int. 1424040289 300 16 gggggggggggggggggggggg== 56384 NOERROR 0
  
  [root@ns1 ~]#
  </code></pre>
  
  <p>Here are the config files:</p>
  
  <p>/etc/named.conf</p>
  
  <pre><code>options {
   directory "/var/named";
   recursion yes;
   allow-recursion { trusted; };
   listen-on { 192.168.4.25; };
   allow-query { 192.168.4/24; 127.0.0.1; };
   allow-transfer { 192.168.4/24; 127.0.0.1; };
   forwarders {
    8.8.8.8;
    8.8.4.4;
    };
   };
  
  key "rndc-key" {
   algorithm hmac-md5;
   secret "xxxxxxxxxxxxxxxxxxxxxx==";
   };
  
  acl "trusted" {
   192.168.4.0/24;
   };
  
  zone "." IN {
   type hint;
   file "named.ca";
   };
  
  # forward lookup
  zone "office.somecompany.com" {
   type master;
   file "/var/named/forward.office.somecompany.com";
   allow-update { key rndc-key; };
   };
  
  # reverse lookup
  zone "168.192.4.in-addr.arpa" {
   type master;
   file "/var/named/reverse.office.somecompany.com";
   allow-update { key rndc-key; };
   };
  </code></pre>
  
  <p>/var/named/reverse.office.somecompany.com</p>
  
  <pre><code>$TTL 604800
  @ IN SOA office.somecompany.com. tj.hooker.us. (
   2015021503     ; Serial YYYYMMDD0x
   604800         ; Refresh (1 week)
   86400          ; Retry (1 day)
   2419200        ; Expire (4 weeks)
   604800 )       ; Negative Cache TTL (1 week)
  ; name servers
   IN NS ns1.office.somecompany.com.
   IN NS ns2.office.somecompany.com.
  ; PTR records
  25 IN PTR ns1.office.somecompany.com.
  26 IN PTR ns2.office.somecompany.com.
  14 IN PTR fileserv01.office.somecompany.com.
  </code></pre>
  
  <p>/var/named/forward.office.somecompany.com</p>
  
  <pre><code>$TTL    604800
  @ IN SOA ns1.office.somecompany.com. tj.hooker.us. (
   2015021511     ; Serial YYYYMMDD1x
   604800         ; Refresh (1 week)
   86400          ; Retry (1 day)
   2419200        ; Expire (4 weeks)
   604800 )       ; Negative Cache TTL (1 week)
  ; name servers - NS records
   IN NS ns1.office.somecompany.com.
   IN NS ns2.office.somecompany.com.
  ; A records for name servers
  ns1.office.somecompany.com. IN A 192.168.4.25
  ns2.office.somecompany.com. IN A 192.168.4.26
  ; Other A records
  fileserv01.office.somecompany.com. IN A 192.168.4.14
  </code></pre>
  
  <p>named-chezkconfig and named-checkzone   are no longer reporting error, but I've been working on this for weeks and still not getting it to dynamically update the DNS. Any clues?
  Thanks,
  -Jeff</p>