BIND 9's nsupdate dyndns update gives: "tsig verify failure (BADKEY)"

nsupdate has some quirks and assumes some naming convention when called with -k. From the man page, I think your key name might somehow be called domain2.com.au.

Could you try the following?

nsupdate -y \
  'rndc-key:vZwCYBx4OAOsBrbdlooUfBaQx+kwEi2eLDXdr+JMs4ykrwXKQTtDSg/jp7eHnw39IehVLMtuVECTqfOwhXBm0A=='

You have to use the key name you created the key with as the name in the config. From what I can see, you have to use:

key "domain2.com.au" {
   [...]
}

From the BIND documentation:

to verify that incoming requests have been signed with a key matching this name, algorithm, and secret.