Re: DNS Failures - All of a sudden today 20200325

[reed%reedmedia.net@localhost]

On Wed, 25 Mar 2020, yancm%sdf.org@localhost wrote:

> Another user on the ISC list suggested setting
>   dnssec-lookaside no;
> Which also feels risky.

Comment out or remove the NetBSD provided configuration for that in 
named.conf.

> And generically ISC suggested all users remove the dlv.isc.org zone from
> their configuration...because the zone is empty and if removed would not
> cause
> the expired key to fail dns...
> 
> My only problem is I do not know how to remove as I cannot find this zone in
> my configuration.

Not a zone but a managed keys (or trusted keys) configuration.
Remove the reference to it (a few lines) from your bind keys file, 
probably at /etc/namedb/bind.keys
If you have managed-keys or trusted-keys with it elsewhere remove those 
lines there too.
But be sure to keep the DNS root zone's keys.

(Looking at my old sent-mail, I tested and reported about this scenario 
in May 2014.)