Create a New rndc.key for BIND

BIND’s remote name daemon control (rndc) relies on a shared secret key to authenticate commands sent to the name server. If you are setting up a new BIND instance, rotating credentials, or troubleshooting an “authentication failed” error, you need a valid rndc.key and a matching rndc.conf. The steps below walk through generating the key and placing it where BIND expects to find it.

Generate the Key

Run rndc-confgen to create a 512-bit HMAC-MD5 key. The -a flag tells the tool to use a specific algorithm, and -b sets the key length in bits.

rndc-confgen -a -b 512

The output looks like this:

key "rndc-key" {
    algorithm hmac-md5;
    secret "P7g97CLUXt4jqIN5ZvQLcipDPImTVpHgGzH9AE+dpEgraUB16NzIdn20m0JdeI0GWCs0ASfSXUJtHLP3C+Fevw==";
}

Create rndc.conf

Place the key block and the options block into /etc/rndc.conf (or the path your distribution uses). The file ties the key to the local server address and port.

key "rndc-key" {
    algorithm hmac-md5;
    secret "P7g97CLUXt4jqIN5ZvQLcipDPImTVpHgGzH9AE+dpEgraUB16NzIdn20m0JdeI0GWCs0ASfSXUJtHLP3C+Fevw==";
};

options {
    default-key "rndc-key";
    default-server 127.0.0.1;
    default-port 953;
};

Set ownership and permissions so only the named user (or root) can read the file:

chown root:root /etc/rndc.conf
chmod 600 /etc/rndc.conf

Verify

Restart or reload BIND, then confirm the connection works:

rndc status

If you see the server version and uptime, the key is wired up correctly. If you get an authentication error, double-check that the key name, algorithm, and secret in rndc.conf match the block you generated, and that the named.conf controls stanza references the same key.

• Networking

• Dns
• SysAdmin