Nsupdate, getting BADKEY error - dns

Question

I'm trying to update a name using nsupdate executed from within the name server itself but I receive the error message
; TSIG error with server: tsig indicates error.
I created a key with dnssec-keygen -a hmac-md5 -b 512 -n HOST -r /dev/urandom dyn.mydomain.com. and copied the secret into the named.conf.
My named.conf is as follows
key "dyn.mydomain.com." {
algorithm hmac-md5;
secret "T2DjtGkGAzPAVrL6zar9GpxjNQ1iOjJzWKhPsF5gu0xQbaONhK7ZmC0n WKatgbGEHqla1uoxG3FdktQPolMIjQ==";
};
zone "dyn.mydomain.com." {
type master;
file "/var/cache/bind/dyn.mydomain.com.hosts";
allow-update {
key "dyn.mydomain.com.";
};
};
The file dyn.mydomain.com.hosts looks as follows:
$ORIGIN .
$TTL 8400 ; 2 hours 20 minutes
dyn.mydomain.com IN SOA ns. root. (
2007072513 ; serial
7200 ; refresh (2 hours)
900 ; retry (15 minutes)
1857600 ; expire (3 weeks 12 hours)
8400 ; minimum (2 hours 20 minutes)
)
NS ns.dyn.mydomain.com.
$ORIGIN dyn.mydomain.com.
ns A [ip of this name server]
$TTL 60 ; 1 minute
I restadt bind9, then use
nsupdate -v -d -k /etc/bind/Kdyn.mydomain.com.+157+53489.private
> server localhost
> zone dyn.mydomain.com
> update add test.dyn.mydomain.com IN A 80.80.80.80
> send
Sending update to 127.0.0.1#53
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 50553
;; flags: ; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 1
;; ZONE SECTION:
;dyn.mydomain.com. IN SOA
;; UPDATE SECTION:
test.dyn.mydomain.com. 60 IN A 80.80.80.80
;; TSIG PSEUDOSECTION:
dyn.mydomain.com. 0 ANY TSIG hmac-md5.sig-alg.reg.int. 1325777156 300 16 5k3AkgLuCziNKtaeb39MRE== 50553 NOERROR 0
; TSIG error with server: tsig indicates error
Reply from update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOTAUTH, id: 50553
;; flags: qr ra ; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 1
;; TSIG PSEUDOSECTION:
dyn.mydomain.com. 0 ANY TSIG hmac-md5.sig-alg.reg.int. 1325777156 300 0 50553 BADKEY 0
What can be the reason?

Answer 1

secret "T2DjtGkGAzPAVrL6zar9GpxjNQ1iOjJzWKhPsF5gu0xQbaONhK7ZmC0n WKatgbGEHqla1uoxG3FdktQPolMIjQ=="
seems to be wrong.
copy a secret following "Key:" from .private file.

Answer 2

I wanted to follow up here because I had this particular problem and I can explain the solution a little better than "your secret seems to be wrong" though I mean no offense. For some reason dnssec-keygen has inserted an errant space () into the middle of my private key. When I eliminated this space (as you have here in your secret), all was well in the world. Try getting rid of only the small space there in the middle of your secret:
secret "T2DjtGkGAzPAVrL6zar9GpxjNQ1iOjJzWKhPsF5gu0xQbaONhK7ZmC0n WKatgbGEHqla1uoxG3FdktQPolMIjQ==";
... might actually be:
secret "T2DjtGkGAzPAVrL6zar9GpxjNQ1iOjJzWKhPsF5gu0xQbaONhK7ZmC0nWKatgbGEHqla1uoxG3FdktQPolMIjQ==";
I realize this is an ancient question, but this particular problem helped me to solve my issue, which was the whitespace.

Answer 3

An other common problem, the key name does not match, the generated name:
The name given with dnssec-keygen MUST be the same with the named.conf.local's key name!
For example:
dnssec-keygen -a hmac-md5 -b 512 -n HOST -r /dev/urandom dyn.mydomain.com.
will not fly with the this configuration:
key "key.mydomain.com." {
algorithm hmac-md5;
secret "T2DjtGkGAzPAVrL6zar9GpxjNQ1iOjJzWKhPsF5gu0xQbaONhK7ZmC0n WKatgbGEHqla1uoxG3FdktQPolMIjQ==";
};
Trailing . for the key name on the end, seems not generate the problem.