bind9 servfail /bin/named/query.c:6984

La résolution d'un domaine avec dig @localhost my.domain mx se termine par un servfail, avec le journal suivant :

20-Oct-2018 20:57:35.356 client: debug 3: client @0x7f9ed40aa0e0 127.0.0.1#59206: UDP request
20-Oct-2018 20:57:35.356 client: debug 5: client @0x7f9ed40aa0e0 127.0.0.1#59206: using view '_default'
20-Oct-2018 20:57:35.356 security: debug 3: client @0x7f9ed40aa0e0 127.0.0.1#59206: request is not signed
20-Oct-2018 20:57:35.356 security: debug 3: client @0x7f9ed40aa0e0 127.0.0.1#59206: recursion available
20-Oct-2018 20:57:35.357 client: debug 3: client @0x7f9ed40aa0e0 127.0.0.1#59206: query
20-Oct-2018 20:57:35.357 queries: info: client @0x7f9ed40aa0e0 127.0.0.1#59206 (my.domain): query: my.domain IN MX +E(0)K (127.0.0.1)
20-Oct-2018 20:57:35.357 query-errors: info: client @0x7f9ed40aa0e0 127.0.0.1#59206 (my.domain): query failed (SERVFAIL) for my.domain/IN/MX at ../../../bin/named/query.c:6984
20-Oct-2018 20:57:35.357 client: debug 3: client @0x7f9ed40aa0e0 127.0.0.1#59206 (my.domain): error
20-Oct-2018 20:57:35.357 client: debug 3: client @0x7f9ed40aa0e0 127.0.0.1#59206 (my.domain): send
20-Oct-2018 20:57:35.357 client: debug 3: client @0x7f9ed40aa0e0 127.0.0.1#59206 (my.domain): sendto
20-Oct-2018 20:57:35.357 client: debug 3: client @0x7f9ed40aa0e0 127.0.0.1#59206 (my.domain): senddone
20-Oct-2018 20:57:35.357 client: debug 3: client @0x7f9ed40aa0e0 127.0.0.1#59206 (my.domain): next
20-Oct-2018 20:57:35.357 client: debug 3: client @0x7f9ed40aa0e0 127.0.0.1#59206 (my.domain): endrequest
20-Oct-2018 20:57:35.357 client: debug 3: client @0x7f9ed40aa0e0 (no-peer): udprecv

Je n'ai pas pu trouver d'entrée sur google à ce sujet. La configuration est la suivante :

named.conf :

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/rndc.key";

named.conf.options :

options {
    directory "/var/cache/bind";
    listen-on port 53 { 127.0.0.1; };
    // allow-query { localhost; };
    allow-query { any; };

auth-nxdomain no;    # conform to RFC1035
allow-transfer { 8.9.1.2; };
};

controls {
inet 127.0.0.1 allow { localhost; } keys { my_rndcKey; };
};

logging {
channel bind_log {
    file "/var/log/bind.log" versions 1 size 100M;
    severity debug 6;
    print-time yes;
    print-severity yes;
    print-category yes;
    };
    category resolver {bind_log;};
    category default {bind_log;};
    category queries {bind_log;};
    category client {bind_log;};
    category config {bind_log;};
    category notify {bind_log;};
    category unmatched {bind_log;};
    category dispatch {bind_log;};
    category dnssec {bind_log;};
    category database {bind_log;};
    category security {bind_log;};
    category network {bind_log;};
    category rate-limit {bind_log;};
    category lame-servers {bind_log;};  
};

db.mon.domaine :

$ORIGIN my.domain.
$TTL 86400
@   IN  SOA ns1.my.domain. admin.my.domain. (
201810182   ;Serial
3600        ;Refresh
1800        ;Retry
604800      ;Expire
86400       ;Min. TTL
)
@           IN  NS  ns1.my.domain.
localhost   IN  A   127.0.0.1
ns1         IN  A   4.3.2.1
my.domain   IN  MX  10 mail.my.domain.
www         IN  A   4.3.2.1
@           IN  A   4.3.2.1
mail        IN  A   4.3.2.1
ftp         IN  CNAME   www.my.domain.  
@           IN  TXT "test"

Une aide ?