Samba AD: huge DNS files in /var/lib/samba/{bind-dns/dns,private}/sam.ldb.d/

We have a small Samba AD server with around 20 users and 70 machines (including phones, printers, etc.).

The DC=DOMAINDNSZONES... .ldb files under /var/lib/samba/private/sam.ldb.d/ and /var/lib/samba/bind-dns/dns/sam.ldb.d/, are over 600 MB and keep growing.

I tried to run samba-tool dbcheck --cross-ncs. It listed 47 "expired tombstones" and ended with "Checked 122451 objects (0 errors)".

Running samba-tool domain tombstones expunge removed these, but there are still 122400 "objects" in this file (for the 70 machines in the network!?).

So what could be wrong, and how could I fix it?

The server runs Debian 11.7 with Samba 4.13.13.

Below are some excerpts of the configuration.

# testparm -s
Load smb config files from /etc/samba/smb.conf
Loaded services file OK.
Weak crypto is allowed
Server role: ROLE_ACTIVE_DIRECTORY_DC

# Global parameters
[global]
    dns forwarder = 8.8.8.8 8.8.4.4
    passdb backend = samba_dsdb
    realm = LAN.EXAMPLE.COM
    reset on zero vc = Yes
    server role = active directory domain controller
    server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate
    template homedir = /home/users/%U
    workgroup = LAN
    rpc_server:tcpip = no
    rpc_daemon:spoolssd = embedded
    rpc_server:spoolss = embedded
    rpc_server:winreg = embedded
    rpc_server:ntsvcs = embedded
    rpc_server:eventlog = embedded
    rpc_server:srvsvc = embedded
    rpc_server:svcctl = embedded
    rpc_server:default = external
    winbindd:use external pipes = true
    idmap_ldb:use rfc2307 = yes
    idmap config * : backend = tdb
    csc policy = disable
    hide files = /._*/.DS_Store/.Spotlight-V100/desktop.ini/
    map acl inherit = Yes
    map archive = No
    vfs objects = dfs_samba4 acl_xattr

# cat /var/lib/samba/bind-dns/named.conf
dlz "AD DNS Zone" {
    # For BIND 9.11.x
     database "dlopen /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_11.so";
};

# cat /etc/bind/named.conf.local
include "/etc/bind/rndc.key";
include "/var/lib/samba/bind-dns/named.conf";

# dig -t AXFR lan.example.com | egrep '\s+A\s+' | wc -l
43

# dig -t AXFR lan.example.com | egrep '\s+A\s+'
lan.example.com.        900    IN    A    192.168.4.3
snom725-8B4089.lan.example.com. 900 IN    A    192.168.4.107
tel-2608.lan.example.com.    900    IN    A    192.168.4.107
[...etc.]
DomainDnsZones.lan.example.com. 900 IN    A    192.168.4.3
ForestDnsZones.lan.example.com. 900 IN    A    192.168.4.3

And in /etc/dhcp/dhcpd.conf, the settings copied from https://wiki.samba.org/index.php/Configure_DHCP_to_update_DNS_records_with_BIND9

on commit {
    set noname = concat("dhcp-", binary-to-ascii(10, 8, "-", leased-address));
    set ClientIP = binary-to-ascii(10, 8, ".", leased-address);
    set ClientDHCID = concat (
        suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,1,1))),2), ":",
        suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,2,1))),2), ":",
        suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,3,1))),2), ":",
        suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,4,1))),2), ":",
        suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,5,1))),2), ":",
        suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,6,1))),2)
    );
    set ClientName = pick-first-value(option host-name, config-option-host-name, client-name, noname);
    log(concat("Commit: IP: ", ClientIP, " DHCID: ", ClientDHCID, " Name: ", ClientName));
    execute("/usr/local/bin/dhcp-dyndns.sh", "add", ClientIP, ClientDHCID, ClientName);
}

on release {
    set ClientIP = binary-to-ascii(10, 8, ".", leased-address);
    set ClientDHCID = concat (
        suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,1,1))),2), ":",
        suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,2,1))),2), ":",
        suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,3,1))),2), ":",
        suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,4,1))),2), ":",
        suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,5,1))),2), ":",
        suffix (concat ("0", binary-to-ascii (16, 8, "", substring(hardware,6,1))),2)
    );
    log(concat("Release: IP: ", ClientIP));
    execute("/usr/local/bin/dhcp-dyndns.sh", "delete", ClientIP, ClientDHCID);
}

on expiry {
    set ClientIP = binary-to-ascii(10, 8, ".", leased-address);
    # cannot get a ClientMac here, apparently this only works when actually receiving a packet
    log(concat("Expired: IP: ", ClientIP));
    # cannot get a ClientName here, for some reason that always fails
    execute("/usr/local/bin/dhcp-dyndns.sh", "delete", ClientIP, "", "0");
}