System is:

Debian GNU/Linux 8.2 (jessie)

BIND 9.9.5-9+deb8u3-Debian (Extended Support Version)


options {
    directory "/var/cache/bind";
    key-directory "/etc/bind/keys";

    // If there is a firewall between you and nameservers you want
    // to talk to, you may need to fix the firewall to allow multiple
    // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

    // If your ISP provided one or more IP addresses for stable 
    // nameservers, you probably want to use them as forwarders.  
    // Uncomment the following block, and insert the addresses replacing 
    // the all-0's placeholder.

    // forwarders {
    // };

    // If BIND logs error messages about the root key being expired,
    // you will need to update your keys.  See https://www.isc.org/bind-keys
    dnssec-enable yes;
    dnssec-validation yes;
    dnssec-lookaside auto;
    dnssec-dnskey-kskonly yes;
    sig-validity-interval 21 16;
    inline-signing yes;

    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };

    // permit lookup of unknown dns names
    recursion no;

    // allow dynamicly new zones
    allow-new-zones yes;

the cache file /var/cache/bind/3bf305731dd26307.nzf has thr rights 0744 and is owned by bind:bind

everything works as expected, i can add zones, stat, load keys and everything - except:

rndc delzone {ZoneName}

If i trigger this command (as root in console) i get an rndc: 'delzone' failed: permission denied

in the log nothing is showed..

i'm really stuck here - anyone have a clue why this permission error occurs?


The Problem was, that i was modifying the original cache file /var/cache/bind/3bf305731dd26307.nzf.

I removed all entries after rndc addzone to my own file structure which i included in the named.conf. After a rndc reload, when the entry is not any more in the original cache file located, there is no way to delete the zone via rndc delzone. To gain permissions back, the configuration string of the zone file MUST be located in the original cache file /var/cache/bind/3bf305731dd26307.nzf when a rndc reload is triggered. Seems bind has a need for this internal..

So as the content of /var/cache/bind/3bf305731dd26307.nzf says itself - do not edit this file manually, only via rndc.

  • Hi could you kindly elaborate step by step how you fixed this, having the same issue and i've been using rndc throughout – Isaac Obella Dec 11 '18 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.