Is there any way to make Microsoft DHCP server to securely dynamically update A and PTR records in Unix Bind DNS zone?

Microsoft supports secure update using username/password authentication. Bind9 support secure update using keys. But I couldn't find the way to make Microsoft DHCP to use key as it can be done with dhcpd.


No, not securely.

You might be able to have a single Microsoft DNS server and then do some kind of zone transfer between that and BIND?

These links may or may not help in that regard:

  • It's possible to do with GSS-TSIG (Kerberos). – Vinícius Ferrão Oct 28 '14 at 4:07
  • Thanks briantist, I've decided to move DNS zone to Microsoft DNS server and it solved my problem. – Roman_T Oct 30 '14 at 15:21

I spent some time trying to achieve something similar. In the "allow-update" statement, BIND recognizes two "Microsoft" update sources: ms-self and ms-subdomain.

My task was a temporary solution so I went with vanilla TSIG keys, but if you can get GSS-TSIG working with AD here are some useful links:



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.