[Samba] BIND DNS Reverse Update

[basti]

Hello,

on my Samba AD with BIND DLZ backend it looks like Reverse Updates did
not work.

dig winclient.example.com resolve an IP
dig -x IP does not resolve the hostname

In the bind log I see
client 192.168.30.148#57598: update 'example.com/IN' denied

my named.conf

// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in
/etc/bind/named.conf.local

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
// samba AD
include "/var/lib/samba/private/named.conf";
// logging
include "/etc/bind/named.conf.log";

/var/lib/samba/private/named.conf look like

dlz "AD DNS Zone" {
    # For BIND 9.8.x
    # database "dlopen /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9.so";

    # For BIND 9.9.x
     database "dlopen /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_9.so";

    # For BIND 9.10.x
    # database "dlopen
/usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_10.so";
};

I have also an /var/lib/samba/private/named.conf.update with an update
policy for my zone that I have also try to include in my zonefile but
that seem not work with dlz.

How can I include an update policy to my zone?

Best Regards
Basti