From b258cab9bd8ebbb6310868ca72ff6ff3d5e000d0 Mon Sep 17 00:00:00 2001
From: Brendan Bank <63699049+brendanbank@users.noreply.github.com>
Date: Wed, 27 Mar 2024 09:05:33 +0100
Subject: [PATCH] dns:bind: do not add the update-policy if the zone type is
 secondary (#3873)

---
 .../src/opnsense/service/templates/OPNsense/Bind/named.conf     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
index 0c091b00e..23839cf43 100644
--- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
+++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
@@ -180,7 +180,7 @@ zone "{{ domain.domainname }}" {
 {%              endfor %}
         };
 {%      endif %}
-{%      if domain.allowrndcupdate is defined and domain.allowrndcupdate == "1" %}
+{%      if domain.allowrndcupdate is defined and domain.allowrndcupdate == "1" and domain.type != 'secondary' %}
         update-policy {
 		grant rndc-key zonesub ANY;
         };