From 512dc6b247b335c96ae5ae4f74206c3de33a9aaf Mon Sep 17 00:00:00 2001 From: Sven Luethi Date: Tue, 11 Aug 2026 12:34:12 +0200 Subject: [PATCH] Fix NOTIFY missing SOA serial by placing SOA in answer section (Fixes #26) RFC 1996 section 3.10 requires the SOA RR carrying the new zone serial to be placed in the answer section of a NOTIFY message. BIND9's notify processing looks for the SOA there and, when it is absent, logs that the NOTIFY does not contain a SOA serial. Both SendClientDNSNotify and SendNSNotify were appending the SOA RRset to the authority section instead of the answer section, which is why BIND9 reported the missing serial. Move the append to msg.answer in both handlers so receivers can correctly extract the new serial. --- netbox_dns_bridge/notify_handler.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/netbox_dns_bridge/notify_handler.py b/netbox_dns_bridge/notify_handler.py index 6dbf93b..60b625a 100644 --- a/netbox_dns_bridge/notify_handler.py +++ b/netbox_dns_bridge/notify_handler.py @@ -83,7 +83,7 @@ class SendClientDNSNotify(JobRunner): f"invalid. invalid. {soa_serial} 60 10 1209600 0", ) soa_rrset = dns.rrset.from_rdata(zone_name, 0, soa_rdata) - msg.authority.append(soa_rrset) + msg.answer.append(soa_rrset) msg.use_tsig(keyring={tsig_key.name: tsig_key}, keyname=tsig_key.name) for client in clients: @@ -165,7 +165,7 @@ class SendNSNotify(JobRunner): dns.rdatatype.SOA, f"invalid. invalid. {soa_serial} 60 10 1209600 0", ) - msg.authority.append(dns.rrset.from_rdata(fqdn, 0, soa_rdata)) + msg.answer.append(dns.rrset.from_rdata(fqdn, 0, soa_rdata)) msg.use_tsig(keyring={tsig_key.name: tsig_key}, keyname=tsig_key.name) for ip in ns_targets: