[Samba] GSS-TSIG DNS update fails (BIND9_DLZ/SAMBA_INTERNAL), kea-dhcp-ddns
Anton Shevtsov
shevtsovay at basealt.ru
Mon Aug 3 08:17:43 UTC 2026
After switching Samba to the MIT-krb5 build (samba-mitkrb5), the problem
is gone. With both sides on MIT krb5, Kea reuses the same GSS-TSIG key
across multiple updates and all succeed; forward and reverse records
update correctly. So: MIT-krb5 Samba + BIND9_DLZ works as expected for
GSS-TSIG updates from a Kea/MIT client, including GSS context reuse; the
Heimdal build did not in this scenario.
More information about the samba
mailing list