Secondary DNS

Secondary DNS for the DNS servers you already run

Keep editing zones on your own server. We copy every change and answer for your domains from our nameservers, so a problem with your server or network no longer takes your domains offline. From $3 a month for 10 zones.

Request early access Setup guides

What secondary DNS is

Your server stays the primary: the one place where you edit records. Secondary nameservers keep a copy of each zone, updated with standard zone transfers whenever your server sends a NOTIFY. A domain can list nameservers from more than one provider, and resolvers ask the next one if one doesn't answer, so as long as one set answers, your domain stays online. Secondary DNS is sometimes called backup DNS or slave DNS.

Stay online when your server isn't

If your server, its network or its data center has a problem, our nameservers keep answering for your domains.

Keep your server private

List only our nameservers and your server never has to answer the public. Only our transfer server needs to reach it.

Keep the way you work

Keep your tools, scripts and control panel. Changes reach our nameservers within seconds of your server's NOTIFY.

How to set it up

Send us your zones and your server's address. We'll send you a TSIG key for each zone, named xfr. plus the zone name.
Allow zone transfers to our transfer server, signed with that key, or by IP address if your server can't use TSIG.
Send NOTIFY to our transfer server when a zone changes.
List our nameservers at your registrar, next to yours or instead of them.

Transfer server: xfr.rtpdns.com (157.151.212.132)
Nameservers: ns1.rtpdns.com and ns2.rtpdns.com
TSIG key: HMAC-SHA256, named xfr. plus your zone, like xfr.example.com
Change checks: On every NOTIFY, and on your zone's SOA refresh schedule

Setup guides

Replace example.com with your zone, and the secret with the key we send you. Each example allows zone transfers only to our transfer server with that key, and sends it NOTIFY when the zone changes.

BIND PowerDNS Knot DNS NSD Windows DNS Server

BIND 9

In named.conf, then run rndc reload:

key "xfr.example.com" {
    algorithm hmac-sha256;
    secret "the key we send you";
};
zone "example.com" {
    type primary;
    file "example.com.zone";
    allow-transfer { key "xfr.example.com"; };
    also-notify { 157.151.212.132; };
};

On older versions of BIND, write type master;.

PowerDNS Authoritative

Turn on sending NOTIFY in pdns.conf with primary=yes (master=yes before PowerDNS 4.5) and restart PowerDNS. Then, for each zone:

pdnsutil set-kind example.com primary
pdnsutil import-tsig-key xfr.example.com hmac-sha256 'the key we send you'
pdnsutil set-meta example.com TSIG-ALLOW-AXFR xfr.example.com
pdnsutil set-meta example.com ALSO-NOTIFY 157.151.212.132

Knot DNS

In knot.conf, then run knotc reload:

key:
  - id: xfr.example.com
    algorithm: hmac-sha256
    secret: the key we send you

remote:
  - id: rtpdns
    address: 157.151.212.132
    key: xfr.example.com

acl:
  - id: rtpdns-transfer
    address: 157.151.212.132
    key: xfr.example.com
    action: transfer

zone:
  - domain: example.com
    notify: rtpdns
    acl: rtpdns-transfer

NSD

In nsd.conf, then run nsd-control reconfig:

key:
    name: "xfr.example.com"
    algorithm: hmac-sha256
    secret: "the key we send you"

zone:
    name: "example.com"
    zonefile: "example.com.zone"
    provide-xfr: 157.151.212.132 xfr.example.com
    notify: 157.151.212.132 xfr.example.com

Windows DNS Server

Windows DNS Server can't sign zone transfers with TSIG, so tell us your server's public address and we'll accept transfers from it by IP address instead. In PowerShell:

Set-DnsServerPrimaryZone -Name "example.com" `
    -SecureSecondaries TransferToSecureServers -SecondaryServers "157.151.212.132" `
    -Notify NotifyServers -NotifyServers "157.151.212.132"

Or in DNS Manager, open the zone's properties. On the Zone Transfers tab, allow transfers only to 157.151.212.132, and under Notify, add the same address.

Check that it works

Once your zone is set up on our side, both nameservers should report the same serial number as your server:

dig +short @ns1.rtpdns.com example.com SOA
dig +short @ns2.rtpdns.com example.com SOA

Using cPanel, Plesk or another control panel? Tell us which one and we'll help you set it up.

Questions

Can my own server stay one of the public nameservers?

Yes. List it at your registrar next to ns1.rtpdns.com and ns2.rtpdns.com, or list only ours and keep your server private.

What if my server can't use TSIG?

We can accept zone transfers from your server's IP address instead. Allow transfers to 157.151.212.132, and send NOTIFY from the address you give us.

How quickly do changes reach your nameservers?

Within seconds of your server sending NOTIFY. If a notification goes missing, we still check your zone's serial on its SOA refresh schedule.

I already use a DNS provider. Can you be an extra one?

Yes, that's tertiary DNS. The setup is the same: allow zone transfers to us from whichever server holds the master copy of your zone, your own or your provider's. Not every provider allows zone transfers, so tell us who you use and we'll check.

What does it cost?

Starter is $3 a month for 10 zones and 10 million queries, with secondary DNS included. See pricing for more zones and your own nameserver names.

Ready to add a second set of nameservers?

Tell us about your zones and your DNS server, and we'll set it up with you.

Request early access