DNS zone transfer - dig works, BIND gives me "not implemented"

LXD
1

I can’t seem to get zone transfer rolling. What I want to do is for my container with BIND on it to transfer my zone. Dig will happily do it (10.0.1.18 being the box that runs lxd):

root@dns-box:/etc/bind# dig AXFR space.lab @10.0.1.18

; <<>> DiG 9.16.1-Ubuntu <<>> AXFR space.lab @10.0.1.18
;; global options: +cmd
space.lab.		3600	IN	SOA	space.lab. hostmaster.space.lab. 1636832465 120 60 86400 30
*.space.lab.		300	IN	A	10.0.1.51
dns-box.space.lab.	300	IN	A	10.0.1.50
lxcbr0.gw.space.lab.	300	IN	A	10.0.1.201
*.space.lab.		300	IN	A	10.0.1.51
dns-box.space.lab.	300	IN	A	10.0.1.50
lxcbr0.gw.space.lab.	300	IN	A	10.0.1.201
space.lab.		3600	IN	SOA	space.lab. hostmaster.space.lab. 1636832465 120 60 86400 30
;; Query time: 7 msec
;; SERVER: 10.0.1.18#53(10.0.1.18)
;; WHEN: Sat Nov 13 19:41:05 UTC 2021
;; XFR size: 8 records (messages 1, bytes 365)

BIND instead gives me this ominous line in syslog:

Nov 13 19:39:35 dns-box named[457]: zone space.lab/IN: refresh: unexpected rcode (NOTIMP) from master 10.0.1.18#53 (source 0.0.0.0#0)
Nov 13 19:39:35 dns-box named[457]: zone 1.0.10.in-addr.arpa/IN: refresh: unexpected rcode (NOTIMP) from master 10.0.1.18#53 (source 0.0.0.0#0)

/etc/bind/named.conf.local looks like so:

################################################################################
# Forward zone space.lab
################################################################################

zone "space.lab" IN {
        type slave;
        file "/var/cache/bind/forward.space.lab.db";
        masters { 10.0.1.18; };
};

################################################################################
# Reverse zone space.lab
################################################################################

zone "1.0.10.in-addr.arpa" IN {
        type slave;
        file "/var/cache/bind/reverse.space.lab.db";
        masters { 10.0.1.18; };
};

The configuration is copy pasted from a working setup.

What is it that I’m missing here? I suspect it could be something pretty basic, but I’m just not finding what.

2

This suggests that bind9 is trying to do an IXFR instead of AXFR.
I don’t know what the right config is to force it to do full AXFR though.

1 Like
3

Weird stuff. Switched to nsd instead, now it works - very nice!

4

By default, bind9 tries to use IXFR unless specifically disabled. You can disable it at the global/view/zone level with request-ixfr no; in which case it will simply use AXFR instead.

2 Likes