All this have working for ages, including 9.18. I just upgraded to 9.20.26, mostly uneventful except for this deal breaker.
After four days debugging, I reached this:I create manually a new name called "zz2" via nsupdate, and I get this in the logs:
26-Jul-2026 18:11:44.792 update: info: client @2222030 127.0.0.1#6856/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': adding an RR at 'zz2.i.bt.jcea.es' TXT "ABC" 26-Jul-2026 18:11:44.821 general: error: dns_diff_apply: jcea-portatil_ASUS.i.bt.jcea.es/TXT/IN: del not exact 26-Jul-2026 18:11:44.821 general: error: zone i.bt.jcea.es/IN (signed): receive_secure_serial: not exact
Notice that the update is done, but it is complaining about a different completely unrelated register "jcea-portatil_ASUS.i.bt.jcea.es". DNS is suppose to be case preserving but case insensitive, when I try to delete the name, I have this:
$ nsupdate -y hmac-sha256:... > server 127.0.0.1 > zone i.bt.jcea.es > update delete jcea-portatil_ASUS.i.bt.jcea.es > send The logs shows:26-Jul-2026 18:18:01.925 update: info: client @2222030 127.0.0.1#49696/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': delete all rrsets from name 'jcea-portatil_ASUS.i.bt.jcea.es' 26-Jul-2026 18:18:01.946 general: error: dns_diff_apply: jcea-portatil_ASUS.i.bt.jcea.es/TXT/IN: del not exact 26-Jul-2026 18:18:01.946 general: error: zone i.bt.jcea.es/IN (signed): receive_secure_serial: not exact
It can't find the name and the dnssec machinery fails too. Interestingly, the nsupdate commands do not report error.
but I try to delete the name in lowercase, it works... apparently (see lower):
$ nsupdate -y hmac-sha256:... > server 127.0.0.1 > zone i.bt.jcea.es > update delete jcea-portatil_asus.i.bt.jcea.es > send The log:26-Jul-2026 18:18:19.445 update: info: client @2222030 127.0.0.1#14644/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': delete all rrsets from name 'jcea-portatil_asus.i.bt.jcea.es'
Fishy. Interestingly, other mixed case names don't fail, apparently:26-Jul-2026 18:21:08.641 update: info: client @15a3030 51.159.34.131#51307/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': delete all rrsets from name 'jcea-iPhone.i.bt.jcea.es' 26-Jul-2026 18:21:08.641 update: info: client @15a3030 51.159.34.131#51307/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': adding an RR at 'jcea-iPhone.i.bt.jcea.es' A 10.8.0.130 26-Jul-2026 18:21:08.641 update: info: client @15a3030 51.159.34.131#51307/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': adding an RR at 'jcea-iPhone.i.bt.jcea.es' TXT "2026-07-26" 26-Jul-2026 18:21:08.720 update: info: client @1a8f030 51.159.34.131#46375/key _.bt.jcea.es: updating zone 'e.bt.jcea.es/IN': delete all rrsets from name 'jcea-iPhone.e.bt.jcea.es' 26-Jul-2026 18:21:08.720 update: info: client @1a8f030 51.159.34.131#46375/key _.bt.jcea.es: updating zone 'e.bt.jcea.es/IN': adding an RR at 'jcea-iPhone.e.bt.jcea.es' A 91.117.234.230 26-Jul-2026 18:21:08.720 update: info: client @1a8f030 51.159.34.131#46375/key _.bt.jcea.es: updating zone 'e.bt.jcea.es/IN': adding an RR at 'jcea-iPhone.e.bt.jcea.es' TXT "2026-07-26"
But the zone transfer to the secondaries to propagate this changes doesn't occur at all, maybe because the dnssec system gets confused.
All of this breaks also my dnssec setup, but maybe it is a secondary effect, not the primary reason. Quite painful anyway.
After deleting "jcea-portatil_ASUS.i.bt.jcea.es" using the lower case version, as reported in the logs, more modifications STILL fails (with no error in nsupdate) with the same error:
26-Jul-2026 18:44:45.395 update: info: client @2222030 127.0.0.1#39975/key _.bt.jcea.es: updating zone 'i.bt.jcea.es/IN': delete all rrsets from name 'zz2.i.bt.jcea.es' 26-Jul-2026 18:44:45.427 general: error: dns_diff_apply: jcea-portatil_ASUS.i.bt.jcea.es/TXT/IN: del not exact 26-Jul-2026 18:44:45.427 general: error: zone i.bt.jcea.es/IN (signed): receive_secure_serial: not exact
My zones have been broken for the last four days. What can I do?. Going back to 9.18 is not an option given the fixes in 9.20.26. I don't have easy control of the names and this setup worked fine in 9.18. Look like a bug introduced in 9.20.
Can you confirm? Any workaround? Are you going to fix it "soon"?PS: I can patch and recompile the code myself if you provide a patch before an hypothetically fixed 9.20.27 a month away. This is a deal breaker for me.
-- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ [email protected] - https://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:[email protected] _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz
OpenPGP_signature
Description: OpenPGP digital signature
-- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.
