Hi, can you check in the LDAP server access logs which entry triggers this error (non-leaf entry)? Open the file /var/log/dirsrv/slapd-XXX/access, look from the bottom for a line containing DEL, note the conn=*conn_id* op= *op_id* values. Then look for the same values conn=*conn_id* op=*op_id *in a line containing *RESULT=66*. This should give you the non-leaf DN.
For instance: [03/Aug/2026:15:25:45.169601252 +0000] conn=3706 op=5 DEL dn="idnsname=12.11.10.in-addr.arpa.,cn=dns,dc=ipa,dc=test" [...] [03/Aug/2026:15:25:45.180712465 +0000] conn=3706 op=5 RESULT err=0 tag=107 nentries=0 wtime=0.000067162 optime=0.011112792 etime=0.011177407 If the DN is the one from the zone you're trying to delete, it may also be because of tombstones. Check if there are any tombstones with ldapsearch -D "cn=directory manager" -W -b *entryDN* "(|(objectclass=*)(objectclass=ldapsubentry))" flo On Tue, Aug 4, 2026 at 2:03 AM Anthony Messina via FreeIPA-users < [email protected]> wrote: > Thank you, Flo. I don't appear to have any replication conflicts > affecting this. > > # extended LDIF > # > # LDAPv3 > # base <dc=mybasedn> with scope subtree > # filter: (&(objectClass=ldapSubEntry)(nsds5ReplConflict=*)) > # requesting: * nsds5ReplConflict > # > > # search result > search: 2 > result: 0 Success > > # numResponses: 1 > > On 2026-08-03 10:36, Florence Blanc-Renaud wrote: > > Hi, > > There may be some replication conflicts that prevent the deletion of your > reverse zone. > > 1. Find the entry DN corresponding to your zone with > ipa dnszone-show <yourzone> --all --raw > > The output will display a LDAP DN similar to dn: idnsname=*zone* > ,cn=dns,dc=*yourbasedn* > > 2. Check if there are any replication conflicts below this LDAP entry: > ldapsearch -D "cn=Directory Manager" -W -b *dc=yourbasedn > *"(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))" > \* nsds5ReplConflict > > If you find any conflict entry below idnsname=*zone*,cn=dns,dc= > *yourbasedn*, you can remove them with ldapdelete -D "cn=directory > manager" -W *dn_to_remove* > > For more information on replication conflicts, you can read > https://docs.redhat.com/en/documentation/red_hat_directory_server/12/html/configuring_and_managing_replication/assembly_solving-common-replication-problems_configuring-and-managing-replication > > HTH, > flo > > On Sat, Aug 1, 2026 at 7:25 PM Anthony Messina via FreeIPA-users < > [email protected]> wrote: > > My network topology has changed and I'd like to remove a reverse DNS zone > that is no longer applicable. When I try to delete the zone, I get an > error "Not allowed on non-leaf entry." The only entry in the zone is the > "@" record name with two NS entries corresponding to my two FreeIPA name > servers. When I try to delete the "@" record, I get another error "invalid > 'del_all': Zone record '@' cannot be deleted." > > I seem to be caught between these two safety checks. What is the proper > way to completely remove a reverse DNS zone from FreeIPA > (freeipa-server-4.13.1-13.fc44.x86_64)? > -- > _______________________________________________ > FreeIPA-users mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/[email protected] > Do not reply to spam, report it: > https://forge.fedoraproject.org/infra/tickets/issues/new > > -- > _______________________________________________ > FreeIPA-users mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/[email protected] > Do not reply to spam, report it: > https://forge.fedoraproject.org/infra/tickets/issues/new >
-- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
