Creating a secondary zone

If you have another DNS provider and want to establish redundancy by setting up NS1 Connect as your secondary provider, you can do so by creating secondary zones. Secondary zones maintain read‑only replicas of the primary zone and keep them synchronized through DNS zone transfers (XFR).

Before you begin

  • To learn more about zone types, refer to Primary and secondary zones.

  • Refer to the primary provider documentation for details on how to enable the primary servers to receive incoming zone transfer requests over TCP and SOA queries over UDP from the NS1 Connect XFR server.

    • If the secondary zone is published to the shared Managed DNS network (network 0), the XFR server IPv4 address to specify at the primary provider is 192.135.223.10.

    • If the secondary zone is published to a different NS1 Connect DNS network, the XFR server IP address to use will be provided to you during initial setup.

Procedure

  1. Click DNS > Zones.
  2. Click Add zone.
  3. Under Domain name, enter the fully qualified domain name (FQDN) for the zone.
  4. Under DNS networks, select the NS1 Connect DNS networks on which to publish the zone.
    Depending on the network selection, a set of nameservers will be assigned to the zone and populated within the secondary zone's NS record. Later, these nameservers must be applied to the primary zone configuration as well as the nameserver delegation at the domain registrar.
  5. Under Zone settings, select Secondary zone.
  6. Under Primary DNS servers, enter the details of the primary nameserver that transfers zone data to NS1 Connect.
    1. Enter the IPv4 address, enter the IPv4 address of the primary DNS server.
    2. Enter the Port on the primary server listening for incoming requests. The default is port 53.
    3. Select the NS1 Connect Network from which XFR requests will originate. This must be a network to which the secondary zone is published.
  7. Optional: To balance AXFR queries across multiple primary nameservers, click Add primary server and provide details for an additional primary server from which NS1 Connect can request zone transfers.
  8. Optional: To indicate that a primary nameserver should send NOTIFY messages only, but not send zone transfers, click Add notify-only server and enter the nameserver information as follows:
    1. In IPv4 address or CIDR block, enter the IPv4 address or CIDR prefix of the primary nameserver.
    2. From the Network drop-down list, select the NS1 Connect network that receives the NOTIFY messages.
      When NS1 Connect receives a NOTIFY message from the primary nameserver on this network, NS1 Connect doesn't initiate AXFR or IXFR requests to this primary nameserver.
  9. Optional: To authenticate and verify the identity of a client or nameserver on incoming zone transfers, toggle the Enable TSIG switch to on and enter the following components:
    TSIG hash
    The cryptographic algorithm used to generate the TSIG key.
    TSIG key name
    Name of the TSIG key used in the domain name syntax. This must match what is configured on the primary nameserver.
    TSIG key value
    The Base64 string encoding the shared key secret. This must match what is configured on the primary nameserver.
  10. Optional: If Enable TSIG is turned on and you want to verify the authenticity of the messages and responses from the primary nameserver, select the Verify TSIG on NOTIFY checkbox.
  11. Click Save zone.

Results

The secondary zone remains in a pending state until the first zone synchronization with the primary nameserver is complete. You can monitor the status on the Zone settings page. When the synchronization is complete, all records configured on your primary nameserver appear in NS1 Connect.

What to do next

To complete the primary/secondary configuration, add NS records to the primary zone specifying the hostnames of each NS1 Connect nameserver assigned to the secondary zone. Then, update the domain registrar to ensure all nameservers are listed in the nameserver delegation.