diff --git a/README.md b/README.md
index 0c992b6..4aca3c6 100644
--- a/README.md
+++ b/README.md
@@ -44,7 +44,7 @@ curl -X POST -H "Content-Type: application/json" -d '{"jsonrpc": "2.0", "method"
 
 
 
-test peach-bind9 is running,
+# test peach-bind9 is running,
 ```
 # this returns version of bind running
 dig -t txt -c chaos VERSION.BIND @IP_ADDRESS_OF_SERVER 
@@ -56,4 +56,23 @@ nslookup blue.dyn.peachcloud.org YOUR_SERVER_IP_ADDRESS
 nslookup blue.dyn.peachcloud.org ns.peachcloud.org
 ```
 
+# test nsupdate is working 
+
+``` 
+/usr/bin/nsupdate -k /var/lib/peachcloud/peach-dyndns/tsig.key -v <<EOF
+server ns.peachcloud.org
+zone bluemirage889.dyn.peachcloud.org
+update delete bluemirage889.dyn.peachcloud.org
+update add bluemirage889.dyn.peachcloud.org 30 A 174.76.52.101
+send
+EOF
+```
+``` 
+cat <<EOF |  /usr/bin/nsupdate -k /var/lib/peachcloud/peach-dyndns/tsig.key -v 
+server ns.peachcloud.org
+zone bluemirage889.dyn.peachcloud.org
+update delete bluemirage889.dyn.peachcloud.org
+update add bluemirage889.dyn.peachcloud.org 30 A 174.76.52.101
+send
+EOF
 ```
diff --git a/cross_compile.sh b/cross_compile.sh
index 59d5a1c..4bf578d 100755
--- a/cross_compile.sh
+++ b/cross_compile.sh
@@ -1,2 +1,3 @@
 #!/usr/bin/env bash
 cargo build --release --target=x86_64-unknown-linux-musl
+cp target/x86_64-unknown-linux-musl/release/peach-dyndns-server devops/files/peach-dyndns-server
diff --git a/devops/files/peach-dyndns-server b/devops/files/peach-dyndns-server
index 016e6f9..effa488 100755
Binary files a/devops/files/peach-dyndns-server and b/devops/files/peach-dyndns-server differ
diff --git a/devops/templates/bindctl b/devops/templates/bindctl
index 498fd05..53273d3 100644
--- a/devops/templates/bindctl
+++ b/devops/templates/bindctl
@@ -1,12 +1,4 @@
 #
 # Allow peach-dyndns to reload bind as sudo
 #
-
-# User alias for bind-ctl which can reload bind
-User_Alias  BIND_CTRL = peach-dyndns
-
-# Command alias for reboot and shutdown
-Cmnd_Alias  RELOADBIND = /usr/bin/reloadbind
-
-# Allow BIND_CTRL users to execute RELOADBIND command without password
-BIND_CTRL  ALL=(ALL) NOPASSWD: RELOADBIND
\ No newline at end of file
+peach-dyndns ALL=(ALL) NOPASSWD: /usr/bin/reloadbind
\ No newline at end of file
diff --git a/devops/templates/named.conf b/devops/templates/named.conf
index 5134e55..139ec37 100644
--- a/devops/templates/named.conf
+++ b/devops/templates/named.conf
@@ -7,5 +7,6 @@
 // If you are just adding zones, please do that in /etc/bind/named.conf.local
 
 include "/etc/bind/named.conf.options";
+include "/etc/bind/dyn.peachcloud.org.keys";
 include "/etc/bind/named.conf.local";
 include "/etc/bind/named.conf.default-zones";
\ No newline at end of file
diff --git a/src/generate_zone.rs b/src/generate_zone.rs
index 475319d..553ffea 100644
--- a/src/generate_zone.rs
+++ b/src/generate_zone.rs
@@ -100,14 +100,26 @@ pub fn generate_zone(full_domain: &str) -> Result<String, PeachDynDnsError> {
         .append(true)
         .open(bind_conf_path)
         .unwrap_or_else(|_| panic!("failed to open {}", bind_conf_path));
+    // this commented out section, with update-policy stopped working
+    // so we are now using allow-update
+    // let zone_section_text = format!(
+    //     "\
+    //     zone \"{full_domain}\" {{
+    //         type master;
+    //         file \"/var/lib/bind/{full_domain}\";
+    //         update-policy {{
+	//             grant {full_domain} self {full_domain};
+    //         }};
+    //     }};
+    // ",
+    //     full_domain = full_domain
+    // );
     let zone_section_text = format!(
         "\
         zone \"{full_domain}\" {{
             type master;
             file \"/var/lib/bind/{full_domain}\";
-            update-policy {{
-	            grant {full_domain} self {full_domain};
-            }};
+            allow-update {{key \"{full_domain}\";}};
         }};
     ",
         full_domain = full_domain