Description of problem:

$ dnf install bind     # do this first, separately

$ dnf install bind-dyndb-ldap

$ restorecon -Rvvn /etc/
Would relabel /etc/named.conf.bak from system_u:object_r:named_conf_t:s0 to system_u:object_r:etc_t:s0


Version-Release number of selected component (if applicable):
RHEL-9.0.0-20220108.3
bind-9.16.23-1.el9.x86_64
selinux-policy-34.1.20-1.el9.noarch


Additional information:

This happens because the postinst script of bind-dyndb-ldap seems to back up the config before rewriting it:

$ rpm --scripts -q bind-dyndb-ldap
postinstall scriptlet (using /bin/sh):
[ -f /etc/named.conf ] || exit 0
...
while read -r PATTERN
do
    SEDSCRIPT+="$PATTERN"
done <<EOF
/^\s*dynamic-db/,/};/ {
  ...
}
EOF
sed -i.bak -e "$SEDSCRIPT" /etc/named.conf

This is actually a sed functionality I didn't know about - using the -i argument with a suffix, but the manpage does mention it.