Free IPA is imperfect but pretty cool once you get to grips with it. The use of DNS Dynamic Updates (secured by GSS-TSIG) is particularly convenient for clients whose address changes as they move between networks, at least as long as your network provider doesn't interfere with the DNS protocol...

The story starts when I noticed that the A and AAAA records for one of hosts had not been updated when I connected it to the Internet. The component of FreeIPA that handles DNS updates is sssd which is not terribly verbose in its default configuration. Only once debug_level is set to 2 do we see logged (in /var/log/sssd/

Further increasing debug_level to 6 reveals:

Now we have enough data to reproduce what sssd is doing when it attempts a DNS update so that we can debug the process.

Having written the quoted nsupdate message out to a file, we authenticate using the host's Kerberos key and then send the message:

Not the most informative of errors. At this point I tried to investigate the problem on the DNS server side.

I expected to see something that would give me a clue as to why BIND didn't like the message, but nothing. Eventually I broke out tcpdump and discovered that nsupdate's queries were not even reaching my server!

Now why would that be... surely the ISP can be trusted to faithfully relay packets to their destination, with neither fear nor favour? In the case of Sky Broadband, it seems, it cannot.

CategoryTechnote SkyBroadbandDNSInterception (last edited 2019-05-11 16:51:43 by sam)

© Sam Morris <>.
Content may be distributed and modified providing this notice is preserved.