GOTCHA 2026-05-11 ~3 min

BIND9 dynamic zones — why `rndc reload` lies

A `.jnl` file is all it takes

Note staged from memory. Full write-up landing soon. The outline below captures the gist — the lesson is real, the production incident is in the rear-view, the workaround works today.

If a BIND zone has a journal file, rndc reload returns "dynamic zone" and silently rejects your edit. The fix is freeze → edit → thaw — and forgetting the thaw breaks every DDNS update silently.

The note

The symptom

`rndc reload casterclub.com` returns `'reload' failed: dynamic zone`. Your zone file edit appears clean. `named-checkzone` is happy. Nothing applies.

Why it happens

Dynamic zones (those that allow DDNS via nsupdate) keep a journal `.jnl` alongside the zone file. BIND serves from memory + journal, not directly from the file. `rndc reload` refuses to clobber that with a possibly-stale disk copy.

The fix — freeze/thaw cycle

`rndc freeze zone` flushes the journal into the file. Edit the now-consistent file. `rndc thaw zone` re-reads and re-enables DDNS. Skip the thaw and DHCP-DNS / certbot-dns-rfc2136 / anything using nsupdate silently fails forever.

How to detect

Before editing, `ls /var/lib/bind/db.zone*.jnl`. If a journal exists, freeze/thaw. If not, plain reload works.

bind9dnsoperationsgotcha
All Field Notes