Dynamic DNS Updates in Debian


There's not a lot of information on the web on how to get DHCP to automatically update your DNS server.

Most of this information relates to "Dynamic DNS" services, such as Monolith etc, or people asking questions on mailing lists.

First of all, I know no-one reads introductions, so I'll put this in bold.

Dynamic DNS updates will NOT work with ISC DHCP 2.x!

If you did `apt-get install dhcp` on etch, sarge or woody, you have DHCP 2. You will need DHCP 3 and BIND 9.

Upgrading is fairly simple:

# apt-get remove dhcp
# apt-get install dhcp3-server

Note that your DHCP 2 conf file was in /etc/dhcpd.conf. DHCP 3 keeps it's at /etc/dhcpd/dhcpd.conf. (i.e., you'll either need to copy your old one there, or start from scratch).

The Conf Files – Cutting to the chase

I know many of you are only reading this document to look at my Conf files, so here they are.

I've decided to use the domain 'foobar' instead of the typical 'example.com'.


server-identifier saturn;

# How to connect to the DNS server and update it.
ddns-update-style interim;

key FOO {
  algorithm HMAC-MD5.SIG-ALG.REG.INT;
  secret blah;

# Use what key in what zone
zone foobar. {
  key FOO;

# Subnet definition w/ accompanying options
subnet netmask {
  option subnet-mask;
  option broadcast-address;
  option domain-name "foobar";
  one-lease-per-client on;
  default-lease-time 604800;
  max-lease-time 604800;

  # Gateways and DNS servers
  option routers;
  option domain-name-servers;

## Static Host Mappings ##
host static1 {
  hardware ethernet 00:00:00:00:00:00;


// Much of the content in here has been snipped
//  because it's irrelevant

key FOO {
  algorithm HMAC-MD5.SIG-ALG.REG.INT;
  secret blah;

options {
  directory "/var/cache/bind";

  ## Put in your (internet) nameservers here
  forwarders {;;

  auth-nxdomain no;

// Tells the nameserver who to allow updates from, with what keys
controls {
  inet allow { localhost; } keys { FOO; };

// I've snipped all the useless crap you already have in your named.conf
//  Such as the "." zone, and the "localhost" zone.

zone "foobar" {
  type master;
  file "/etc/bind/db.foobar";
  allow-update { key FOO; };

zone "10.in-addr.arpa" {
  type master;
  file "/etc/bind/db.10";
  allow-update { key FOO; };


key "rndc-key" {
  algorithm hmac-md5;
  secret blah;


You'll notice I've put a couple of things in bold in the conf files above.

1. algorithm HMAC-MD5.SIG-ALG.REG.INT

In almost all of the examples you see online, you'll notice they use the 'hmac-md5' algorithm in their conf files. For some reason, my dhcp server was refusing to start up, spitting out some 'Base64' error to the syslog. This seemed to fix it. For all intents and purposes, 'HMAC-MD5.SIG-ALG.REG.INT' is the same as 'hmac-md5'.

2. allow-update { key FOO; };

Basically, make sure this line is in the correct zone in your named.conf. Didn't have any problems with it, just thought I'd emphasize it.

3. /etc/bind/rndc.key

Okay, apart from the hmac-md5 problem, this one probably caused the most problems. None of the HOWTO's or Tutorials I came across on the net mentioned this file. As far as I can tell, it's the key the rndc service uses when it actually performs the update to BIND. Notice the 'algorithm hmac-md5' line is not 'HMAC-MD5.SIG-ALG.REG.INT'. The latter refused to work for some reason.