From logs after D3766 update:
Oct 18 20:54:37 dns-001 knot[24217]: warning: [nasqueron.org.] notify, outgoing, remote 216.218.130.2@53 TCP, server responded with error 'REFUSED'
It's totally unclear which DNS server to notify: HE documentation states two different information at different places:
From the log message, ns1.he.net is refusing the update.
I think configuration could actually be nice but I forgot in D3766 to bump the serial. Let's check (and do a test to detect that).
So it's definitely ns1.he.net, because if I put slave.dns.he.net the TCP connection isn't established:
Oct 18 21:50:47 dns-001 knot[24217]: warning: [nasqueron.org.] notify, outgoing, remote 216.218.133.2@53 TCP, failed (connection reset)
Oct 18 21:50:47 dns-001 knot[24217]: warning: [nasqueron.org.] notify, outgoing, remote 2001:470:600::2@53 TCP, failed (connection reset)
Oct 18 21:50:47 dns-001 knot[24217]: error: [nasqueron.org.] zone event 'notify' failed (failed)