root@dc2:/home/eida# cat /etc/bind/named.conf

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

include "/var/lib/samba/bind-dns/named.conf";

root@dc2:/home/eida# cat /etc/bind/named.conf.options
acl "trusted" {
	10.5.0.0/16;
	2001:ab:cd:ef::/64;
	localhost;
	localnets;
};

acl "server" {
	10.5.5.102/32; // DC2
	10.5.5.100/32; // primární DNS
	2001:ab:cd:ef::dc2; // DC2
	2001:ab:cd:ef::a; // primární DNS
};

options {
	directory "/var/cache/bind";

	tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab";

	forwarders {
		10.5.5.100;
		2001:ab:cd:ef::a;
	};

	dnssec-validation auto;

	auth-nxdomain no;
	listen-on { 10.5.5.102; };
	listen-on-v6 { 2001:ab:cd:ef::dc2; };
};

root@dc2:/home/eida# setfacl -m u:bind:rw /var/lib/samba/private/dns.keytab
root@dc2:/home/eida# setfacl -R -m u:bind:rwx /var/lib/samba/bind-dns/