The fix was already pushed upstream.

Wait until the bind-dyndb-ldap release in Fedora is done. The bind-dyndb-ldap version in the spec file should be bumped then along with the new schema.

attachment
freeipa-mkosek-195-update-schema-for-bind-dyndb-ldap.patch

How to test:

1. Create a new zone

   ipa dnszone-add example.com --name-server=hostname

2. Add some invalid record to the zone (use ldapmodify as ipa dnsrecord-add command does not allow invalid values). I used invalid MX record "foo:

   ldapsearch -h localhost -Y GSSAPI -b idnsname=example.com,cn=dns,SUFFIX

   ...

   example.com, dns, SUFFIX

   dn: idnsname=example.com,cn=dns,SUFFIX
   idnsZoneActive: TRUE
   idnsSOAexpire: 1209600
   nSRecord: ns.example.com.
   objectClass: top
   objectClass: idnsrecord
   objectClass: idnszone
   idnsSOAretry: 900
   idnsSOAminimum: 3600
   idnsSOArefresh: 3600
   idnsSOAserial: 2012250101
   idnsName: example.com
   idnsAllowDynUpdate: FALSE
   idnsSOAmName: ns.example.com.
   idnsSOArName: hostmaster.example.com.
   mXRecord: foo <=====

3. Restart named to make sure the zone is reloaded

4. Make sure it is still resolvable, for example:

   dig -t soa example.com

5. /var/log/messages should contain a message about invalid value:

   Jan 25 11:00:25 vm-068 named[17269]: Failed to parse RR entry (foo)

Moving to next month iteration.

master: 1816643[[BR]]
ipa-2-2: bd09e54