Pfsense and Bind - configuration problem

[pepa006]

Hi guys,

I have a proxmox server with 3 VMs and another PCs on hardware LAN. The Pfsense is used as a router, firewall and DHCP. Everything goes pretty fine.

I would like to have my own domain server on Samba. So I was recommanded to have my own DNS server on VM with Samba in DC mode.

I followed these two tutorials to set it up:
https://www.digitalocean.com/community/tutorials/how-to-configure-bind-as-a-private-network-dns-server-on-debian-9
https://docs.netgate.com/pfsense/en/latest/recipes/bind-rfc2136.html

And there is my problem. If I use add this lines to named.conf, bind refuses to start after startup. This is my setting:

include "/etc/namedb/dns.keys.conf";
zone "dyn.mydomain.lan" {
type master;
file "dynamic/dyn.example.com";
update-policy { grant *.dyn.mydomain.lan. self dyn.mydomain.lan. A AAAA; };
};

The problem is probably in the last line. Named-checkconf says that the name line and identiti line are not the same. Because this error I even can not install Samba.
To addition to this bind is not able to read namedb/dns.keys.conf. I set up full entitlements (775), but the problem still remains.

Anyone know, how to solve it?