>> The /usr/home/dns/primary needs to be writable as well. > i saw and let it pass as it had not changed. but something clearly > did. found. what changed was, in the move from freebsd 10.3 to 11.1, the /etc/group uid entry for bind lost the opendnssec uid. thanks again. randy