[04/Aug/2026:18:10:40.838241228 -0500] conn=1955 op=5 DEL
dn="idnsname=5.7.9.b.1.0.a.0.0.3.3.0.6.2.ip6.arpa.,cn=dns,dc=example,dc=com"
[04/Aug/2026:18:10:40.838665921 -0500] conn=1955 op=5 RESULT err=66
tag=107 nentries=0 wqtime=0.000132316 wtime=0.000200240
optime=0.000424587 etime=0.000624645
[04/Aug/2026:18:10:40.838865909 -0500] conn=1955 op=6 SRCH
base="idnsname=5.7.9.b.1.0.a.0.0.3.3.0.6.2.ip6.arpa.,cn=dns,dc=example,dc=com"
scope=1 filter="(objectClass=*)" attrs=""
[04/Aug/2026:18:10:40.838952674 -0500] conn=1955 op=6 RESULT err=0
tag=101 nentries=0 wqtime=0.000010644 wtime=0.000055529
optime=0.000085873 etime=0.000141334 notes=U details="Partially
Unindexed Filter"
[04/Aug/2026:18:10:40.839088735 -0500] conn=1955 op=7 DEL
dn="idnsname=5.7.9.b.1.0.a.0.0.3.3.0.6.2.ip6.arpa.,cn=dns,dc=example,dc=com"
[04/Aug/2026:18:10:40.839447788 -0500] conn=1955 op=7 RESULT err=66
tag=107 nentries=0 wqtime=0.000009731 wtime=0.000071426
optime=0.000358992 etime=0.000430161
I was unable to see any tombstones with the query you provided, it only
showed the entry I'm trying to delete. However the following query
showed a number of tombstone records, an example of which is also below.
ldapsearch -D "cn=directory manager" -W -b
idnsname=5.7.9.b.1.0.a.0.0.3.3.0.6.2.ip6.arpa.,cn=dns,dc=example,dc=com
"(objectclass=nsTombstone)"
dn:
nsuniqueid=39b27e8d-b52211f0-b1528baf-58fcce3c,idnsname=0.2.0.0.0.0.0.0.0.
0.0.0.0.0.0.0.0.c,idnsname=5.7.9.b.1.0.a.0.0.3.3.0.6.2.ip6.arpa.,cn=dns,dc=ex
ample,dc=com
idnsName: 0.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.c
pTRRecord: ipa-01.example.com.
objectClass: top
objectClass: idnsrecord
objectClass: nsTombstone
nsParentUniqueId: 5ae4ec81-0d2411ee-89fab6fb-6aee384f
nstombstonecsn: 6a6a70d90001000f0000
Shall I just wait for the tombstones to clear? Thanks again for the
guidance.
On 2026-08-04 03:56, Florence Blanc-Renaud wrote:
Hi,
can you check in the LDAP server access logs which entry triggers this
error (non-leaf entry)? Open the file /var/log/dirsrv/slapd-XXX/access,
look from the bottom for a line containing DEL, note the conn=conn_id
op=op_id values. Then look for the same values conn=conn_id op=op_id in
a line containing RESULT=66. This should give you the non-leaf DN.
For instance:
[03/Aug/2026:15:25:45.169601252 +0000] conn=3706 op=5 DEL
dn="idnsname=12.11.10.in-addr.arpa.,cn=dns,dc=ipa,dc=test"
[...]
[03/Aug/2026:15:25:45.180712465 +0000] conn=3706 op=5 RESULT err=0
tag=107 nentries=0 wtime=0.000067162 optime=0.011112792
etime=0.011177407
If the DN is the one from the zone you're trying to delete, it may also
be because of tombstones. Check if there are any tombstones with
ldapsearch -D "cn=directory manager" -W -b entryDN
"(|(objectclass=*)(objectclass=ldapsubentry))"
flo
On Tue, Aug 4, 2026 at 2:03 AM Anthony Messina via FreeIPA-users
<[email protected]> wrote:
Thank you, Flo. I don't appear to have any replication conflicts
affecting this.
# extended LDIF
#
# LDAPv3
# base <dc=mybasedn> with scope subtree
# filter: (&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))
# requesting: * nsds5ReplConflict
#
# search result
search: 2
result: 0 Success
# numResponses: 1
On 2026-08-03 10:36, Florence Blanc-Renaud wrote:
Hi,
There may be some replication conflicts that prevent the deletion of
your reverse zone.
1. Find the entry DN corresponding to your zone with
ipa dnszone-show <yourzone> --all --raw
The output will display a LDAP DN similar to dn:
idnsname=zone,cn=dns,dc=yourbasedn
2. Check if there are any replication conflicts below this LDAP entry:
ldapsearch -D "cn=Directory Manager" -W -b dc=yourbasedn
"(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))" \*
nsds5ReplConflict
If you find any conflict entry below
idnsname=zone,cn=dns,dc=yourbasedn, you can remove them with ldapdelete
-D "cn=directory manager" -W dn_to_remove
For more information on replication conflicts, you can read
https://docs.redhat.com/en/documentation/red_hat_directory_server/12/html/configuring_and_managing_replication/assembly_solving-common-replication-problems_configuring-and-managing-replication
HTH,
flo
On Sat, Aug 1, 2026 at 7:25 PM Anthony Messina via FreeIPA-users
<[email protected]> wrote:
My network topology has changed and I'd like to remove a reverse DNS
zone that is no longer applicable. When I try to delete the zone, I
get an error "Not allowed on non-leaf entry." The only entry in the
zone is the "@" record name with two NS entries corresponding to my two
FreeIPA name servers. When I try to delete the "@" record, I get
another error "invalid 'del_all': Zone record '@' cannot be deleted."
I seem to be caught between these two safety checks. What is the
proper way to completely remove a reverse DNS zone from FreeIPA
(freeipa-server-4.13.1-13.fc44.x86_64)? --
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to
[email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
--
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to
[email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new--
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
