0.16.5 DNS RFC2136 TSIG update fails with "TSIG key required, but packet does not contain key. Sending REFUSED"

[rheaalleen]

Topic

Running the new 0.16.5 but powerdns only says TSIG key required, but packet does not contain key. Sending REFUSED

Validating with nsupdate

nsupdate -v -d -y hmac-sha256:stalwart:key <<EOF
server dns-ip 53
zone domain.io
update add tsig-test.domain.io 60 TXT "tsig-works"
send
EOF

Record is set and I can query it, meaning key is active and authorized for the zone

Running config

Type: RFC2136 (TSIG)

Connection
  Hostname: dns-ip
  Port:     53
  Protocol: UDP

Authentication
  TSIG Algorithm: HMAC-SHA256
  Key Name:       stalwart
  Key Secret:
    Type: Secret value
    Secret
      Secret: *****

Timing
  Timeout:                   30 s
  TTL:                       5 m
  Polling Interval:          15 s
  Propagation Timeout:       1 m
  Initial Propagation Delay: <none>

Details
  Description: PDNS
  Tenant:      <none>

Tried a secret file just in case but no luck. Running dnsdist in front of the PDNS servers but since the nsupdate works from any client (other servers, laptop, etc) I dont think it´s a config related to dnsdist or powerdns.

Anything more I can do to debug?

Acknowledgement

• I have reviewed the documentation and the FAQ and confirm that my question is not addressed there.
• I understand that maintainers no longer answer support questions through GitHub Discussions, and that for an official response from the Stalwart team I need to post my question at support.stalw.art.
• I agree to follow the project's Code of Conduct.

[github-actions[bot]]

Hi @rheaalleen, thanks for posting!

Stalwart support has moved to support.stalw.art. The support portal is now the canonical place to ask questions, request help, and report issues for triage. Other community members may still reply here, but the maintainers no longer answer support questions through GitHub Discussions, so your question may go unanswered unless you also post it on the portal.

You can sign in to support.stalw.art with your existing GitHub account, so no separate registration is required. Google, Discord, LinkedIn, and email/password sign-in are also available.

Why we are unifying our support channels

Until now, Stalwart support has been spread across GitHub Discussions, Discord, Matrix, and Reddit. As the project has grown, tracking parallel inboxes and deduplicating threads has become unsustainable; the result has been slower answers, repeated work for the people helping out, and good information buried in chat scrollback where the next person with the same question would never find it.

support.stalw.art is a Discourse instance that we operate ourselves, hosted at Hetzner in Germany and GDPR-compliant.

Thank you for helping us keep the conversation in one place.