Last Modified: Jul 28, 2026
Affected Product(s):
BIG-IP Install/Upgrade, SSLO, TMOS
Known Affected Versions:
17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4, 17.1.2, 17.1.2.1, 17.1.2.2, 17.1.3, 17.1.3.1, 17.1.3.2, 17.1.3.4
Fixed In:
21.1.0.1
Opened: Oct 22, 2025 Severity: 3-Major
Named fails to start with the following error after upgrading from older versions to 17.0 or newer releases due to the dnssec-lookaside and dnssec-enable options in the named.conf configuration file, which have been deprecated and are no longer supported in the latest BIND versions. Logs in /var/log/daemon.log : Oct 22 14:08:00 localhost.localdomain err named[16313]: /config/named.conf:35: option 'dnssec-lookaside' no longer exists Oct 22 14:08:00 localhost.localdomain crit named[16313]: loading configuration: failure Oct 22 14:08:00 localhost.localdomain crit named[16313]: exiting (due to fatal error) Oct 22 14:08:00 localhost.localdomain notice systemd[1]: named.service: main process exited, code=exited, status=1/FAILURE Oct 22 14:08:00 localhost.localdomain notice systemd[1]: Unit named.service entered failed state. Oct 22 14:08:00 localhost.localdomain warning systemd[1]: named.service failed.
SSL Orchestrator will fail to resolve hostnames for the L3 Explicit topology causing end-to-end traffic to fail.
-- SSL Orchestrator System Settings >> DNS settings have been specified. -- SSL Orchestrator L3 Explicit Topology Configured using the default SSL Orchestrator DNS resolver. -- Check the BIND Version: Use the following command: Example: For example : # named -v BIND 9.11.36 (Extended Support Version) <id:68dbd5b> Notes: -- Starting with BIND 9.9, the dnssec-lookaside validation (DLV) feature was deprecated. By BIND 9.11, this feature was removed entirely. -- Beginning with BIND 9.16, the dnssec-enable option was deprecated and subsequently removed.
- Redeploy the affected L3 Explicit topology - this will use the native DNS resolver implementation and will no longer rely on BIND or named service, ensuring that end-to-end SSL Orchestrator traffic functions properly. To fix the named service: -- Remove the deprecated directives dnssec-lookaside and dnssec-enable from the BIND configuration file located at: /var/named/config/named.conf. -- After making these changes, restart the named service to apply the updated configuration by running the following command: bigstart restart named
Fix will ensure that deprecated BIND options are removed from the named.conf file during the upgrade, allowing the named service to start without any issues and ensuring that SSL Orchestrator L3 Explicit end-to-end traffic functions correctly.