domain's own a record(s)

[lejeczek]

hi everyone

I have a quick questionon possibly trivial issue.
I do:
 > update delete ddd.dom.local. 86400 in a 10.3.1.100
 > send
and that works, but when I try:
 > update add dom.local. 86400 in a 10.3.1.100
 > send
update failed: REFUSED

..and in logs:
client @0x7fd7a40f2e40 127.0.0.1#9489/key nsupdate_key: 
updating zone 'dom.local/IN': update failed: rejected by 
secure update (REFUSED)

I'm hoping that I can add another A record to dom.local.
What is the problem here? I must be something obvious, right?
many thanks, L.