I’ve spent a few times battling bind9 upgrades on Debian over the years. I run a chrooted bind9 so it complicates things a bit in troubleshooting. This time it wasn’t apparmor profiles, or config file /etc/default/bind9. I thought I’d share with you my own fix as I’ve read a lot of yours and they didn’t seem to work for me.

• Edit /lib/systemd/system/bind9.service:
  • Uder [Service], change Type=forking to Type=simple
  • Restart bind9 service
  • Profit!