Workaround needed for TSIG Zone Transfer

I’ve got a case where using BIND (v9.16.41) as a secondary to a third party (commercial) primary nameserver. Using TSIG for the zone transfers. Have verified zone transfers and TSIG key using dig between hosts. BIND is configured to use TSIG for the primary server using server x.x.x.x { keys

Re: lame-servers: SERVFAIL unexpected RCODE resolving

The .org TLD nameservers point to ns1 – ns4.opensuse.org as the authoritative nameservers for openSUSE.org. Appears that while ns2 and and ns3.opensuse.org are working, ns1 and ns4.opensuse.org return SERVFAIL when querying for openSUSE.org records. Your first sample log entry for lists.opens