| docs

Appearance

Secondary DNS Servers ​

Secondary DNS Servers lets this server feed your own secondary nameservers, so the zones it serves are also answered by nameservers you run elsewhere. It works on a standalone server, without a hub. Available since panel 1.9.0.

Overview ​

URL: /admin/settings/dns-secondary-servers

Open it from Settings > DNS > Secondary DNS Servers. On a server running as a hub, the same page sits under DNS Cluster instead (see DNS Cluster).

AdminBolt nodes under a hub are connected automatically by the DNS Slave node role. This page is for any other nameserver: PowerDNS, BIND, or cPanel DNSOnly.

The list shows each secondary's Name, IP Address, Transfer auth (the TSIG key name, or IP only), whether it is Active, and when it was Added.

How a secondary gets its zones ​

For every zone this server is primary for, now and in the future, it sends NOTIFY messages to each active secondary and allows that secondary to transfer the zone.

This server also publishes a catalog zone that lists every zone it is primary for. A secondary set up with the instructions in the form follows the catalog, so new domains reach it and deleted ones leave it on their own. A secondary configured without the catalog needs each zone added by hand.

Adding a secondary ​

  1. Configure the secondary first, using the instructions under Setting up the secondary in the form. They are filled in with this server's real address, its nameservers, the catalog zone name, and the key, for:
    • PowerDNS secondary
    • BIND secondary (also cPanel DNSonly, which runs BIND)
  2. Click the button to add a secondary and fill in:
    • Name (required) - a label for the secondary.
    • IP Address (required) - the secondary's address. NOTIFY messages are sent to it, and zone transfers are allowed from it.
    • Active - whether the secondary is in service.
    • Notes - free text.
  3. Optionally fill in the TSIG key section. With a key, the secondary proves who it is by signing its zone transfers, rather than by its address alone. Use one for a public nameserver that serves other zones too.
    • Key name - for example bolt-secondary.
    • Algorithm - the signing algorithm.
    • Secret - Base64. Generate creates one. Enter the same name, algorithm, and secret on the secondary.
  4. Save. The secondary's address may transfer zones and receives NOTIFY as soon as you save, and the TSIG key, when set, is put in place on this server at the same time.

Without a TSIG key, skip the key lines in the setup instructions.