Bind seems to work fine. When queried about a record it logs the answer fine (even for external domains). However it fails to answer any ipa local zone request.

e.g. resolve it own host query: ------------------------------ 8< -------------------------- 21-Nov-2017 13:52:06.419 client: debug 3: client 127.0.0.1#58281: UDP request 21-Nov-2017 13:52:06.419 security: debug 3: client 127.0.0.1#58281: request is not signed 21-Nov-2017 13:52:06.419 security: debug 3: client 127.0.0.1#58281: recursion available 21-Nov-2017 13:52:06.419 client: debug 3: client 127.0.0.1#58281: query 21-Nov-2017 13:52:06.420 queries: info: client 127.0.0.1#58281 (freeipa.base.foo.com): query: freeipa.base.foo.com IN A +E (10.10.24.9) 21-Nov-2017 13:52:06.420 security: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): query (cache) 'freeipa.base.foo.com/A/IN' approved 21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): send 21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): sendto 21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): senddone 21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): next 21-Nov-2017 13:52:06.420 client: debug 3: client 127.0.0.1#58281 (freeipa.base.foo.com): endrequest ---------------------- >8 -------------------------------- $ dig @localhost freeipa.base.foo.com

; <<>> DiG 9.11.1-P3-RedHat-9.11.1-8.P3.fc27 <<>> @localhost freeipa.base.foo.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 16172 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: 5c26280e126505660dd1745d5a145292345cd82b68103795 (good) ;; QUESTION SECTION: ;freeipa.base.foo.com. IN A

;; Query time: 2190 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Nov 21 16:21:38 UTC 2017 ;; MSG SIZE rcvd: 83 ------------------------------ 8< --------------------------

It only happens to the ldap records. So, what can I do to debug this further?

-rsd