Recently our master DNS service began logging errors similar to this:

/var/log/messages:Jun 20 13:38:18 inet03 named[3720]: malformed transaction: 
  last serial 103538 != transaction first serial 103361

I have never before encountered this error and can find no reference to it on the usual search engines; other than my own questions. Restarting the named daemon appears to have corrected whatever caused it but my questions remain unanswered:

What does the error message mean? What is the cause?

  • Do you allow dynamic updates from clients or zone transfers from secondary servers? is your zone "secure" and have you set up Transaction Signatures? I'd start with the manual section on dynamic updates and transaction signatures here: ftp.isc.org/www/bind/arm95/Bv9ARM.ch04.html – Frank Thomas Jun 21 '18 at 20:47

This problem is caused when there are two instances of named running on the same host at the same time and DNSSEC is in use. One constantly attempts to obtain the listen port while the other has it bound but nonetheless continues to run. However, both create journal files while both use a different serial number sequence. The named instance bound to the listen ports discovers that the current journal file does not have the expected serial number and this produces the error.

The fix is to remove the extra named instance and restart the named service and ensuring that there is only one named daemon actually running.

This problem has serious consequences for DNSSEC and DANE as it results in bogus responses to queries.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.