bind-dyndb-ldap is undergoing heavy re-factoring as first step towards DNSSEC
Proof-of-concept code is available from my personal github repo:
Branch 'syncrepl' contains fork of bind-dyndb-ldap v3.5 with persistent search
replaced by RFC 4533. (It implicates that this code will not work with current
stable version of 389 DS. I use OpenLDAP at the moment.)
See commit messages to read about current limitations.
Branches with DNSSEC bits etc. will appear in the near future (hopefully).
Patches/pull requests are more than welcome :-)
Freeipa-devel mailing list