Well for the better part of the last two hours I've tried to figure out what is actually wrong, but I can't seem to find anything obvious to me.

What I'm trying to do is setup my DNS for say(per example) domain.com. This should include two NS records, namely ns1.domain.com and ns2.domain.com. With that there should be a mail record, as well as a CNAME record for www.

I've been trough roughly 20 how to's in the last two hours, rewrote everything from scratch four times and I still can't seem to find whats wrong. My only suspicion to this might be two things; the error I get from the bind9 daemon when I stop the service, and the named.conf file.

The error I get from the bind9 daemon when stopping the service is:

* Stopping domain name service... bind9                                        rndc: connection to remote host closed
This may indicate that
* the remote server is using an older version of the command protocol,
* this host is not authorized to connect,
* the clocks are not syncronized, or
* the key is invalid.

I honestly doesn't know what this means, apart from the key defined in /etc/bind/rndc.key that's not in the named.conf file(yes, I did try to add it to no avail).

Here's all the zone files, and configuration files;

If anyone could help, it would be greatly appreciated.


To stop bind, the scripts use rndc stop command. Check if you run it by hands if you have the same answer. If it is the case, check netstat -pnlt | grep 953 if bind is waiting for your connections check if your keys in /etc/bind/rndc.key are the same in /etc/bind/named.conf

If you change the keys, you must kill the process as it will not be stopped by rndc, and then restart bind

  • tcp 0 0* LISTEN 11524/named tcp6 0 0 ::1:953 :::* LISTEN 11524/named There are no keys defined in /etc/bind/named.conf? – ferdi May 12 '10 at 11:32
  • Do you use a bind version 9 ? Do you have the section key "rndc-key" { algorithm hmac-md5; secret "ddddd=="; }; somewhere ? – Dom May 12 '10 at 11:53
  • I added it, and rndc-confgen confirms the key in both files. – ferdi May 12 '10 at 12:15
  • Do you kill the process to reload the key in bind ? – Dom May 12 '10 at 12:35
  • yes, but somehow It's been fixed. Although, I won't know if the DNS is actually working until it updates. But by using dig all NS, A, MX CNAME records seems to respond fine. – ferdi May 12 '10 at 14:03

This error appeared to me during master-slave synchronization, and the problem was in different time of those machines. Try to ntpdate some timeserver.

  • "12 May 11:49:45 ntpdate[26410]: step-systime: Operation not permitted" so that's a no-go. – ferdi May 12 '10 at 11:51
  • got ntpdate working, but the error still does not go away. – ferdi May 12 '10 at 12:16
  • Try run it as root. Or use another tool to set time on machines. Time cannot be much different. – mkudlacek May 12 '10 at 12:18
  • Sorry, I wrote previous message too long. It's not time problem then. – mkudlacek May 12 '10 at 12:20

My /etc/bind/named.conf.local contains the following …

include "/etc/bind/rndc.key";

controls {
    inet allow {

    keys {

As far as I remember, this tells bind to allow rndc connections from the localhost using the key defined in /etc/bind/rndc.key.

As root, you might try executing

# rndc -V status

to get rndc debugging messages which may help you diagnose why rndc is failing to connect to bind.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.