As of bind version 9.16.15 (~2021), it seems that bind only allows control over when RRSIG records expire when custom dnssec-policies are used:
First, a custom policy is defined with the options signatures-refresh, signatures-validity, and signatures-validity-dnskey set to the desired values.
Then, the custom policy is enabled for a given zone by setting ...
I finally found a solution: The router ("AVM Fritz!Box", very common in Germany) has a security feature "DNS-Rebind-Protection" which prevents DNS requests from within the LAN to another host inside the LAN. As you set up an exception by typing e.g. the TLD "lan" or in the case above "app" in the textbox, your local ...
In the end I used the "nuclear" option of removing the K* files for mydomain.com from /var/cache/bind/
rm -f /var/cache/bind/Kmydomain.com.*
Followed by restarting BIND
systemctl restart bind9
I had to generate a new DS record and update it on my parent DNS server, but I could not wait any longer.
If you know how to properly ask BIND ...
As @bitcloud stated in his answer, PowerDNS supports "virtual" alias records. In addition to compiling the software yourself, you can simply install it from your system's official repositories. If you use Debian or Ubuntu, installing it can be as simple as:
apt install pdns-server pdns-backend-bind
I included the bind backend package because I ...
You have listed the same zone twice in named.conf. Each zone can only appear once here.
Your comments seem to indicate that you think these are different zones, but they are exactly the same zone.
Remove the duplicate entry from named.conf.
Can there coexist a static and a dynamically created A record for the same host
A name can resolve to multiple IP addresses, that is have multiple A or AAAA records. Clients will get the whole set of them when querying for the name.
How the IP addresses are provisioned is kind of irrelevant to the above, except that in "dynamic" cases, often an ...