Steps to reproduce:

• Add zone with invalid NS record to LDAP

{{{ ldapadd -v -Y GSSAPI < addbad.ldif }}}

• Named will log

  update_zone (psearch) failed for 'idnsname=e.test,cn=dns,dc=e,dc=org Zones can be outdated, run rndc reload: bad zone
  e.test/IN: NS 'xxx.e.test' has no address records (A or AAAA)
  zone e.test/IN: not loaded due to errors.

• Now delete the invalid zone from LDAP

{{{ ldapdelete -v -Y GSSAPI "idnsName=e.test,cn=dns,dc=e,dc=org" }}}

• Named will log

  update_zone (psearch) failed for 'idnsName=e.test,cn=dns,dc=e,dc=org'. Zones can be outdated, run rndc reload: not found

• Problem: Zone is still served and returns SERVFAIL

{{{ $ dig @127.0.0.1 e.test. }}}

;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 63732