I made yum update to bind on 21.12.2019. Yum.log:
Dec 21 23:14:41 Updated: 32:bind-license-9.11.4-9.P2.el7.noarch Dec 21 23:16:43 Installed: 32:bind-export-libs-9.11.4-9.P2.el7.x86_64 Dec 21 23:16:49 Updated: 32:bind-libs-lite-9.11.4-9.P2.el7.x86_64 Dec 21 23:16:50 Updated: 32:bind-libs-9.11.4-9.P2.el7.x86_64 Dec 21 23:18:02 Updated: rpcbind-0.2.0-48.el7.x86_64 Dec 21 23:23:21 Updated: 32:bind-9.11.4-9.P2.el7.x86_64 Dec 21 23:24:44 Updated: 32:bind-utils-9.11.4-9.P2.el7.x86_64
up to this date, bind has gone 4 month with the last update to bind 9.9.4 without any problem.
Since the bold line in named.log
27-Dec-2019 23:20:21.200 general: info: zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0 27-Dec-2019 23:20:21.201 general: info: zone localhost/IN: loaded serial 0 27-Dec-2019 23:20:21.201 general: notice: all zones loaded 27-Dec-2019 23:20:21.201 general: notice: running 27-Dec-2019 23:20:21.223 notify: info: zone dyn.internet-xs.net/IN: sending notifies (serial 2018012040) 27-Dec-2019 23:20:21.226 notify: info: zone panama.int/IN: sending notifies (serial 2016121200) 27-Dec-2019 23:20:21.227 notify: info: zone ixsdns.de/IN: sending notifies (serial 2018010102) *27-Dec-2019 23:20:28.434 dnssec: info: validating ./NS: got insecure response; parent indicates it should be secure* 27-Dec-2019 23:20:28.444 general: warning: managed-keys-zone: No DNSKEY RRSIGs found for '.': success 27-Dec-2019 23:20:29.219 dnssec: info: validating ./NS: no valid signature found 27-Dec-2019 23:20:29.714 dnssec: info: validating ./SOA: got insecure response; parent indicates it should be secure 27-Dec-2019 23:20:29.957 dnssec: info: validating ./NS: no valid signature found
named needs some 1 hour to be really active. The named.log shows:
..... 7-Dec-2019 23:36:28.268 dnssec: info: validating it/DS: no valid signature found 27-Dec-2019 23:36:28.270 dnssec: info: validating net/DS: no valid signature found 27-Dec-2019 23:36:28.271 dnssec: info: validating info/DS: no valid signature found 27-Dec-2019 23:36:28.281 dnssec: info: validating net/DS: no valid signature found 27-Dec-2019 23:36:28.295 dnssec: info: validating net/DS: no valid signature found 27-Dec-2019 23:36:28.296 dnssec: info: validating it/DS: no valid signature found 27-Dec-2019 23:36:28.323 dnssec: info: validating net/DS: no valid signature found 27-Dec-2019 23:36:28.440 dnssec: info: validating it/DS: no valid signature found 27-Dec-2019 23:36:28.473 dnssec: info: validating net/DS: no valid signature found 27-Dec-2019 23:36:28.597 dnssec: info: validating it/DS: no valid signature found 27-Dec-2019 23:36:28.634 dnssec: info: validating net/DS: no valid signature found 27-Dec-2019 23:36:29.303 dnssec: info: validating org/DS: no valid signature found 27-Dec-2019 23:36:29.308 dnssec: info: validating org/DS: no valid signature found 27-Dec-2019 23:36:29.313 dnssec: info: validating org/DS: no valid signature found 27-Dec-2019 23:36:29.318 dnssec: info: validating org/DS: no valid signature found 27-Dec-2019 23:36:29.323 dnssec: info: validating org/DS: no valid signature found 27-Dec-2019 23:36:29.328 dnssec: info: validating org/DS: no valid signature found 27-Dec-2019 23:36:29.335 dnssec: info: validating org/DS: no valid signature found 27-Dec-2019 23:36:29.345 dnssec: info: validating org/DS: no valid signature found 27-Dec-2019 23:36:29.360 dnssec: info: validating org/DS: no valid signature found 27-Dec-2019 23:36:29.387 dnssec: info: validating org/DS: no valid signature found .... and really many lines as above.
This validating happens even when dnssec-enable no; and dnssec-validation and dnssec-lookaside are commented out
any idea?