I hope this saves someone the half a day I just wasted.
I was trying to set up dynamic dns for a client. I found a number of helpful links.
A useful script that allows you to do dynamic dns from a DD-WRT box.
http://sami.rox.fi/linux/dyndns-hack.html
A step by step howto for nsupdate.
http://www.ops.ietf.org/dns/dynupd/secure-ddns-howto.html
The problem was that I was getting an NOTAUTH error every time that I tried it from the name server itself. After regenerating keys, trying every possible variation of configs I finally decided to try it from another server, and it worked!
The problem – I had configured different views in my named.conf and I had a localhost view.
view “localhost_resolver”
{
match-clients { localhost; };
match-destinations { localhost; };
//blah-blah
};
So a nsupdate sesion looked like…
[root@foo named]# nsupdate -v -d
> key remote.testdomain.ca. fE6D3…..IklFtmj14o=
> server myserver.mydomain.com
> zone testdomain.ca
> update delete remote.testdomain.ca. A
> update add remote.testdomain.ca. 600 IN A 4.3.2.1
> show
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 0 ;; flags: ; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0 ;; UPDATE SECTION: remote.testdomain.ca. 0 ANY A remote.testdomain.ca. 600 IN A 4.3.2.1 > send
Sending update to 1.2.3.4#53
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 39822 ;; flags: ; ZONE: 1, PREREQ: 0, UPDATE: 2, ADDITIONAL: 1 ;; ZONE SECTION: ;testdomain.ca. IN SOA ;; UPDATE SECTION: remote.testdomain.ca. 0 ANY A remote.testdomain.ca. 600 IN A 4.3.2.1 ;; TSIG PSEUDOSECTION: remote.testdomain.ca. 0 ANY TSIG hmac-md5.sig-alg.reg.int. 1302047875 300 16 gBRZ…….sVeRg== 39822 NOERROR 0 Reply from update query: ;; ->>HEADER<<- opcode: UPDATE, status: NOTAUTH, id: 39822 ;; flags: qr ra ; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 1 ;; TSIG PSEUDOSECTION: remote.testdomain.ca. 0 ANY TSIG hmac-md5.sig-alg.reg.int. 1302047875 300 16 I78yRo2…….RQU50w== 39822 NOERROR 0
The status: NOTAUTH error was because the testdomain.ca was in the external view and I was running nsupdate on localhost.