Properly Configure RNDC Keys

I am currently attempting to configure dynamic updates to my Bind 9 name server. Both the client and the server have the same rndckey.

However, when I attempt to perform the update, I receive the following error message:

request has invalid signature: TSIG rndckey: tsig verify failure (BADKEY)

At first I thought that it was a problem with the client, but now I am beginning to think that it is a server based error.

A common mistake seems to be that people forget to include a "controls" section in named.conf. I believe I have configured this properly, but if anyone wishes to question me please do so. Here is the controls section exactly as it appears in named.conf:

controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndckey"; };
};

Thanks for your help.

I found out that the client that I was using (DirectUpdate), required a different implementation of dnssec. However, I have also read about doing zone transfers to the secondary name server via rndckey. I have attempted this, but I still receive the message "REFUSED."

Both name servers contain the same key. Any idea as to why this is happening?