On Thu, Sep 24, 2026 at 11:26:10AM CEST, Daniel Salzman via knot-dns-users
<knot-dns-users(a)lists.nic.cz> said:
Hi Erwin,
Sorry, I don't understand why it breaks zone transfers when the serial is higher.
Could you show me the zone configuration? We only changed `zonefile-load:
difference'.
Daniel
On 9/24/26 11:23, Erwan David wrote:
> On Thu, Sep 24, 2026 at 10:04:28AM CEST, Erwan David <erwan(a)rail.eu.org> said:
> > Since upgrade to knot 3.6, when I restart the knot server, a new serial is
generated for the secondary zones,
> > putting them out of sync with the primary.
> >
> > Logs in 3.5
> >
> > Aug 25 10:31:50 ns knot[45038]: info: [domain.] zone will be loaded
> > Aug 25 10:31:51 ns knot[45038]: info: [domain.] zone loaded from journal,
serial 2026023115
> > Aug 25 10:31:51 ns knot[45038]: info: [domain.] zone file loaded, serial
updated 2026023115 -> 2026082500
> > Aug 25 10:31:51 ns knot[45038]: info: [domain.] loaded, serial none ->
2026082500 -> 2026023115, 21088 bytes, expires in 2137390 seconds
> >
> > Last line show the serial is set back to the serial of the journal loaded zone
> > When starting 3.6
> >
> > Sep 24 07:49:14 ns knot[23114]: info: [domain.] zone will be loaded
> > Sep 24 07:49:14 ns knot[23114]: info: [domain.] zone loaded from journal,
serial 2026023175
> > Sep 24 07:49:14 ns knot[23114]: info: [domain.] zone file loaded, serial
updated 2026023175 -> 2026092400
> > Sep 24 07:49:14 ns knot[23114]: info: [domain.] loaded, serial none ->
2026092400, 21088 bytes, expires in 2158298 seconds
> >
> > The serial is not set back to the serail from the journal. As you can see in
this case the primary does not use a date based serial number,
> > thus the secondary is then out of sync and refuses the notifications
>
> Ok, I was in zonefile-load: difference-noserial and the behaviour changed with 3.6
> I corrected it
I had
template:
- id: default
storage: "/var/db/knot"
file: "%s.zone"
serial-policy: dateserial
zonefile-load: difference-noserial
journal-content: all
global-module: mod-cookies
zone:
- domain: "domain."
master: ns.domain.
acl: acl_domain
acl: deny_transfer
acl_domain is the acl allowing notify from the master
--
Erwan David