Skip to content

os-bind: Deleting an entry doesn't increase the serial #4789

@koelle25

Description

@koelle25

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug
When removing a DNS entry from a zone in the BIND plugin, the zone serial doesn't change.

When used in combination with zone transfers, the secondary server(s) therefore get(s) out of sync and the deleted entry still resolves on those.

Interestingly, the BIND of the primary nameserver (the OPNsense instance) does NOT resolve the entry anymore, although the serial didn't change.

To Reproduce
Steps to reproduce the behavior:

  1. Check zone prior to doing any changes:
    $ dig +short SOA example.com @ns1.example.com
    ns1.example.com. admin.example.com. 2507041206
    
    $ dig +short SOA example.com @ns2.example.com
    ns1.example.com. admin.example.com. 2507041206
    
  2. Go to Services > Bind > Configuration > Primary Zones
  3. Create an entry (e.g. test A 0.0.0.0) and save
  4. Check zone:
    $ dig +short SOA example.com @ns1.example.com
    ns1.example.com. admin.example.com. 2507041209
    
    $ nslookup test.example.com ns1.example.com
    Name:   test.example.com
    Address: 0.0.0.0
    
    $ dig +short SOA example.com @ns2.example.com
    ns1.example.com. admin.example.com. 2507041209
    
    $ nslookup test.example.com ns2.example.com
    Name:   test.example.com
    Address: 0.0.0.0
    
  5. Delete the test entry and save
  6. Check zone again:
    $ dig +short SOA example.com @ns1.example.com
    ns1.example.com. admin.example.com. 2507041209
    
    $ nslookup test.example.com ns1.example.com
    ** server can't find test.idial.fh-dortmund.de: NXDOMAIN
    
    $ dig +short SOA example.com @ns2.example.com
    ns1.example.com. admin.example.com. 2507041209
    
    $ nslookup test.example.com ns2.example.com
    Name:   test.example.com
    Address: 0.0.0.0
    
    See that the serial hasn't changed and the results are different for primary/secondary nameserver.

Expected behavior
Any edit to a zone should change its serial, including deleting entries.

Screenshots
...

Relevant log files
...

Additional context
...

Environment
OPNsense 25.1.10 (amd64) with os-bind 1.33_1 (containing bind920 version 9.20.10).

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions