I'm using debian etch with bind 9.3 # - Insert the following lines into the options {} section of your named.conf # file: tkey-gssapi-credential "DNS/kerberos.net"; tkey-domain "KERBEROS.NET"; After that, if restart bind --> failed