When I say it won't resolve, I am getting NXDOMAIN as the result of the query like this:
[root@ipa3 /]# nslookup ipa1 ipa3
Server: ipa3
Address: xxx.xxx.xxx.xxx#53
** server can't find ipa1: NXDOMAIN
Running journalctl -u named-pkcs11 shows a ton of lines like the following:
There is also some error messages that appear in the log, but only sporadically (this was the largest contiguous block of them):
May 21 12:58:58 ipa3.chem.byu.edu named-pkcs11[19021]: ldap_sync_search_entry failed: not found
May 21 12:58:58 ipa3.chem.byu.edu named-pkcs11[19021]: bug in ldap_entry_reconstruct(): protocol violation: attempt to reconstruct non-existing entry
May 21 12:58:58 ipa3.chem.byu.edu named-pkcs11[19021]: ldap_sync_search_entry failed: not found
May 21 12:58:58 ipa3.chem.byu.edu named-pkcs11[19021]: bug in ldap_entry_reconstruct(): protocol violation: attempt to reconstruct non-existing entry
May 21 12:58:58 ipa3.chem.byu.edu named-pkcs11[19021]: ldap_sync_search_entry failed: not found
May 21 12:58:58 ipa3.chem.byu.edu named-pkcs11[19021]: syncrepl_update failed for resource record DN 'idnsName=250,idnsname=105.168.192.in-addr.arpa.,cn=dns,dc=chem,dc=byu,dc=edu'
May 21 12:58:58 ipa3.chem.byu.edu named-pkcs11[19021]: ldap_sync_search_entry failed: not found
May 21 12:58:58 ipa3.chem.byu.edu named-pkcs11[19021]: bug in ldap_entry_reconstruct(): protocol violation: attempt to reconstruct non-existing entry
May 21 12:58:58 ipa3.chem.byu.edu named-pkcs11[19021]: ldap_sync_search_entry failed: not found
May 21 12:58:58 ipa3.chem.byu.edu named-pkcs11[19021]: syncrepl_update failed for resource record DN 'idnsName=136,idnsname=105.168.192.in-addr.arpa.,cn=dns,dc=chem,dc=byu,dc=edu'
May 21 12:58:58 ipa3.chem.byu.edu named-pkcs11[19021]: ldap_sync_search_entry failed: not found
The messages log has a number of messages like this one:
May 19 03:11:53 ipa3 ns-slapd: [19/May/2019:03:11:53.896464579 -0600] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=caToipa1.chem.byu.edu" (ipa1:389): Unable to acqui
re replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later.
May 19 03:13:10 ipa3 ns-slapd: [19/May/2019:03:13:10.967375303 -0600] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=ipa3.chem.byu.edu-to-ipa2.chem.byu.edu" (ipa2:389)
: Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later.