| docs

Appearance

Secondary DNS Servers ​

Secondary DNS Servers lets this server feed your own secondary nameservers, so the zones it serves are also answered by nameservers you run elsewhere. It works on a standalone server, without a hub. Available since panel 1.9.0.

Overview ​

URL: /admin/settings/dns-secondary-servers

Open it from Settings > DNS > Secondary DNS Servers. On a server running as a hub, the same page sits under DNS Cluster instead (see DNS Cluster).

AdminBolt nodes under a hub are connected automatically by their Secondary DNS role. This page is for any other nameserver: PowerDNS, BIND, or cPanel DNSOnly.

The list shows each secondary's Name, IP Address, Transfer auth (the TSIG key name, or IP only), Source (Cluster node for a hub node with the Secondary DNS role, Manual for one added here), whether it is Active, and when it was Added. A Cluster node row is managed from the node and cannot be edited or deleted here.

How a secondary gets its zones ​

For every zone this server is primary for, now and in the future, it sends NOTIFY messages to each active secondary and allows that secondary to transfer the zone.

This server also publishes a catalog zone that lists every zone it is primary for. A secondary set up with the instructions in the form follows the catalog, so new domains reach it and deleted ones leave it on their own. A secondary configured without the catalog needs each zone added by hand.

Adding a secondary ​

The form for adding a secondary DNS server, with the optional TSIG key section

  1. Configure the secondary first, using the instructions under Setting up the secondary in the form. They are filled in with this server's real address, its nameservers, the catalog zone name, and the key, for:
    • PowerDNS secondary
    • BIND secondary (also cPanel DNSonly, which runs BIND)
  2. Click the button to add a secondary and fill in:
    • Name (required) - a label for the secondary.
    • IP Address (required) - the secondary's address. NOTIFY messages are sent to it, and zone transfers are allowed from it.
    • Active - whether the secondary is in service.
    • Notes - free text.
  3. Optionally fill in the TSIG key section. With a key, the secondary proves who it is by signing its zone transfers, rather than by its address alone. Use one for a public nameserver that serves other zones too.
    • Key name - for example bolt-secondary.
    • Algorithm - the signing algorithm.
    • Secret - Base64. Generate creates one. Enter the same name, algorithm, and secret on the secondary.
  4. Save. The secondary's address may transfer zones and receives NOTIFY as soon as you save, and the TSIG key, when set, is put in place on this server at the same time.

Without a TSIG key, skip the key lines in the setup instructions.

NOTIFY and the TSIG key ​

Since panel 1.9.2 this server sends NOTIFY unsigned, to every secondary, even when a TSIG key is set. The key signs the zone transfers (AXFR) only. The TSIG key section of the form says so:

NOTIFY from this server is never signed, even when a key is set: the key authenticates the zone transfers (AXFR) only. A secondary that requires a signed NOTIFY (for example BIND with the key in allow-notify) must accept an unsigned NOTIFY from this server's address.

This way every secondary, with or without a key, hears about new and changed zones. Before 1.9.2, once any secondary had a key, NOTIFY went out signed with it, and secondaries that did not know that key, such as hub nodes with the Secondary DNS role, refused it and stopped receiving new zones.

If you configured a secondary to accept only a signed NOTIFY, change it to accept an unsigned NOTIFY from this server's address. Zone transfers keep using the key.

Updating to 1.9.2 applies this once on every server that has at least one active secondary, hub or not, so you do not need to save the list again. If that step cannot finish, the update reports it as a failed upgrade step and NOTIFY may still be signed. Correct the reason it gives, then run bolt-cli run-upgrade-steps --retry-failed (see Updating AdminBolt), or edit and save a Manual secondary on this page, which pushes the same configuration.