Awesome, adding the grant line with my key (DDNS_UPDATE) did the trick. This
makes it perform exactly like old config.

Thanks for the help. Someone should put this example in the docs.

-----Original Message-----
[] On Behalf Of William Brown
Sent: Thursday, April 3, 2014 3:29 PM
Subject: Re: [Freeipa-users] DDNS with DHCPD and IPA

On Thu, 2014-04-03 at 11:02 -0700, Andy Tomlin wrote:
> That would be my preference, would then work same as bind/dhcpd before 
> switching to ipa. I just dont know how to do it correctly.

This assumes dhcp and named are on the same system. 

For an unrelated project I wrote some docs here:

And the example config files referenced are:

The important parts are:

rndc-confgen -a -r keyboard -b 256
chown named:named /etc/rndc.key

In named.conf add after the options section:

include "/etc/rndc.key";

In the zone (In ipa you will need to add this permission)

grant rndc-key wildcard * ANY;

Then in dhcpd:

include                 "/etc/rndc.key";

And to the dhcpd range:

        zone dhcp.example.lan. {
                key     "rndc-key";

        zone {
                key "rndc-key";

This should coexist peacefully with freeipa, but try to make sure your DDNS
updated zone is say rather than a zone you care about.
Consider you have a domain controller called, and you allow
DDNS to If someone set their hostname to x, they could take
over the DNS records for your DC. Better to have a second zone to prevent

William Brown <>

Freeipa-users mailing list

Freeipa-users mailing list

Reply via email to