On Thu, 2014-06-26 at 13:26 +0200, Lars Hanke wrote: > > root at samba:/# nsupdate -D -l You need: nsupdate -g Have you set the bind TSIG to point at the keytab? Can bind read it? Can your version of bind do kerberised updates? HTH, Steve