Primary and secondary zones
NS1 Connect supports two types of DNS zones: primary and secondary. Your choice depends on your DNS provider architecture and whether you need to synchronize zone data across multiple providers.
Primary zone
A primary zone (or non-secondary zone) contains the original zone file, including all of the DNS records corresponding to the fully qualified domain name (FQDN) and any subdomains contained within the zone. When you create a primary zone inNS1 Connect, you can leverage NS1 Connect's advanced traffic steering capabilities, including the Filter Chain, and take full advantage of resource management tools, like zone versioning and monitoring.
If NS1 Connect is your only DNS provider, you will likely only need to create primary (or non-secondary) zones. If you are using multiple DNS providers, you can create a primary zone and configure outgoing zone transfers from the primary zone hosted on NS1 Connect to your secondary name server(s).
Secondary zones
If you have another DNS provider and want to establish redundancy by setting up NS1 Connect as your secondary provider, you can do so by creating secondary zones. Secondary zones maintain read‑only replicas of the primary zone and keep them synchronized through DNS zone transfers (XFR).
When creating a secondary zone, you must specify one or more primary servers from which NS1 Connect will request incoming zone transfers and maintain it through recurring zone transfer requests based on the SOA refresh interval or immediately when the primary server sends a notification (DNS NOTIFY message) to NS1 Connect indicating a change to the primary zone data. Upon receiving the NOTIFY message, the NS1 Connect XFR server will request a zone transfer immediately.
The primary servers must be configured to receive zone transfer requests from the NS1 Connect XFR server. The IP address of the XFR server varies depending on the NS1 Connect network from which the XFR request originates. The requesting network is selected during secondary zone configuration and must be a network to which the secondary zone is published.
Optionally, you can also specify "notify-only" primary servers, which are responsible for notifying NS1 Connect of an update to the zone data, but not responsible for the zone transfer itself. When the primary zone is updated, the "notify-only" servers send a NOTIFY message, prompting NS1 Connect to send an XFR request to one of the other primary servers. A notify-only server can be specified using a single IPv4 address or CIDR block.
When the secondary zone is configured and published to one or more NS1 Connect networks, it is automatically assigned DNS nameservers that you must add to the primary provider as additional NS records. You must also apply the secondary nameservers to the nameserver delegation at the domain registrar to ensure all provider nameservers are recorded as authoritative for the domain, making them findable during the DNS lookup process.
Zone transfers
NS1 Connect supports two types of incoming zone transfers from a primary nameserver:
- Authoritative transfers (AXFR), which include the entire zone file.
AXFR does not support the transfer of advanced configurations, including features such as failover and GeoIP routing from your primary provider.
- Incremental transfers (IXFR), which include only new or modified zone data.
A secondary zone receives updates from the primary nameserver based on the zone's start of authority (SOA) refresh value or when the primary nameserver sends a NOTIFY message. The SOA refresh interval determines the amount of time between each request from secondary nameservers for updated zone data. If the SOA refresh interval is set to 43200 seconds, then the secondary zone requests new data from the primary nameserver every 12 hours. If the serial number of the SOA record on the primary nameserver changed, NS1 Connect updates the secondary zone data.
If the primary nameserver sends NOTIFY messages to the secondary nameserver when the zone data changes, NS1 Connect requests new zone data immediately instead of waiting for the end of the current SOA refresh interval.
If the zone from the primary nameserver is signed, then NS1 Connect answers queries with the correct Domain Name System Security Extensions (DNSSEC) information.
Zone transfer alerts
To be informed of issues that might occur when DNS data is transferred from the primary nameserver to the secondary nameserver, you can create alerts for zones.
Secondary zone capabilities
Because secondary zones maintain read-only copies of primary zone data, configuration options are limited compared to primary zones. The following capabilities are available:
- Publishing to multiple NS1 Connect DNS networks
- Multiple primary servers for redundancy
- TSIG authentication for secure zone transfers and message verification
- ALIAS records at the zone apex for CNAME-like functionality
- Outgoing zone transfers to other secondary providers for hidden primary configurations, where the authoritative source does not serve public traffic directly
- Conversion from secondary to primary zone
Secondary zone limitations
Secondary zones have the following restrictions:
- Record-level changes must be made at the primary DNS provider, except for ALIAS records, which can be added to the zone apex in NS1 Connect.
- Advanced traffic steering features, such as the Filter Chain, are not available.
- NS1 Connect-specific features, including ALIAS records, are not included in outgoing zone transfers to third-party providers.
Zone transfer considerations
Record limits: Zone transfers may fail if the incoming zone file exceeds your plan's record limit. To resolve this, either delete existing records to free up capacity or upgrade your plan to accommodate more records.
Zone file size limits: Although most zone transfers use TCP to handle large zone files, NS1 Connect enforces soft limits to protect against malicious imports of excessively large zone files.