Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

First, has anyone EVER configured ISC bind 9.5.0 OR greater with support for GSS-TSIG Dynamic DNS Updates AND gotten it to work? If so, what is the configuration that was used to make that happen?

I feel close to having this working. I see that GSS cred passes w/o apparent error during the TKEY negotiation with an Active Directory DC and the BIND DNS server:

client query gss cred: "DNS/", GSS_C_ACCEPT, 4294967256 gss-api source name (accept) is DC1$@EXAMPLE.COM process_gsstkey(): dns_tsigerror_noerror client send

But, when the Update is sent, it is refused:

client update client updating zone '': update failed: rejected by secure update (REFUSED) client send

Does anyone have this working in the real world?

share|improve this question
Perhaps i should have phrased it: "Is it popular to configure ISC BIND to support GSS-TSIG Updates?" - I think I know what the answer is based upon the # of views, replies, and answers. – netlinxman Sep 9 '10 at 12:41
have you ever done the Part 2 of your guide? Your documentation about this issue related here is very good:… – Vinícius Ferrão Aug 6 '14 at 0:57

I actually managed to get dynamic updates to work using a patch provided by the samba 4 team.

There seems to be issues with the version of windows running and it's method of doing dynamic updates.

If you're trying to do the same outside of a samba4 domain... your next-best-bet is to try & follow the howto here:

I'm sorry if I don't have more info on that subject.

share|improve this answer
Good and interesting read on samba4 link. I will try bits from that such as the env variables for the keytab file. The wiki page of the first link is somewhat sketchy since it doesn't detail the version of BIND, and/or the Kerberos/GSSAPI bits that are required. When you set it up, which version of BIND did you use and what was the OS platform? RE: the second URL, I have read that FreeIPA site docs as well and found it somewhat useful in getting an example of the "update-policy " directive. Still stumped. And still looking for evidence. Thank you for your response. – netlinxman Sep 3 '10 at 22:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.