Bind9 拒绝来自 nsupdate 的密钥

我有一个 Bind9 DNS 服务器正在运行（并且正在运行！）。所有区域都是手动管理的。我现在想更改要自动更新的区域。设置好之后，我尝试了 nsupdate，但它因“拒绝”而失败。我不知道为什么会这样。

配置：rndc.key 包含在 named.conf 中

// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/rndc.key";

我还在我的 named.conf.local 中添加了允许更新语句，并确保区域文件在/var/lib/bind

root@ns1:/etc/bind# cat named.conf.local
zone "somedomain.com" {
        type master;
        file "/var/lib/bind/db.somedomain.com";
        #update-policy {grant "rndc.key" zonesub ANY;} ;
        allow-update { key rndc.key;};
        allow-transfer { some IP; };
};

密钥存在：

root@ns1:/etc/bind# cat rndc.key
key "rndc-key" {
        algorithm hmac-md5;
        secret "<secret>";
};

但是当我尝试从 localhost 更新 vie nsupdate 时，它​​会拒绝它。

root@ns1:/etc/bind# nsupdate
> server localhost
> key rndc-key <secret>
> zone somedomain.com
> update add test.somedomain.com. 600 IN A someIP
> send
update failed: REFUSED

syslog 对我也没有多大帮助

May 24 22:37:20 ns1 named[30755]: client @0x7f1f8c0e3840 127.0.0.1#27482/key rndc-key: signer "rndc-key" denied
May 24 22:37:20 ns1 named[30755]: client @0x7f1f8c0e3840 127.0.0.1#27482/key rndc-key: update 'somedomain.com/IN' denied
May 24 22:38:09 ns1 named[30755]: resolver priming query complete
May 24 22:38:38 ns1 named[30755]: resolver priming query complete

我复制并粘贴了密钥，所以应该没有错字。这些都是原始终端输出，只是更改了域和 IP。