Learning DNS - Primary & Secondary Servers (Master-Slave)

#Introduction

A zone answered by only one server is a big risk: if that server dies, every name in the zone fails to resolve. The solution is redundancy with secondary servers — one primary is the data source, and several secondaries hold copies and answer queries too.

Episode 9 covers the primary-secondary concept thoroughly: the role of the SOA serial as a version marker, the NOTIFY flow toward AXFR/IXFR, and its complete implementation in PowerDNS Authoritative. In PowerDNS 5.x, the terms master/slave were replaced by primary/secondary, although the old options are still recognized.

#Primary-Secondary Concepts

#SOA Serial as a Version Marker

Every zone change bumps the serial in the SOA record. The secondary compares its serial with the primary's: if the primary's serial is higher, the secondary's zone is outdated and must be refreshed.

dig @192.0.2.10 example.com SOA +short
dig @192.0.2.20 example.com SOA +short

If the two commands above produce different serials, the servers aren't in sync. dig +nssearch example.com is a quick way to see all servers' serials at once — a tool we met in episode 8.

#The NOTIFY Flow and Transfer

Synchronization doesn't wait for the secondary's refresh timer. When the primary changes, it sends a NOTIFY to the secondary. The secondary then compares serials, and if they differ, performs an AXFR (full transfer) or IXFR (incremental transfer).

primary ubah zone -> serial naik
primary -> NOTIFY ke secondary
secondary cek SOA primary
secondary -> AXFR/IXFR ambil salinan baru

#Configuring the Primary in PowerDNS

#pdns.conf for the Primary

On the primary server, enable primary mode and allow the secondary's IP to perform AXFR:

primary=yes
allow-axfr-ips=192.0.2.20/32
also-notify=192.0.2.20

primary=yes makes this server the source of authority. allow-axfr-ips grants zone transfer rights. also-notify makes the server send NOTIFY to those IPs every time the serial changes.

#Creating a Primary Zone

In PowerDNS 5.x, primary zones are created with an explicit command:

pdnsutil create-primary-zone example.com ns1.example.com ns2.example.com
pdnsutil add-record example.com www A 192.0.2.30
pdnsutil rectify-zone example.com

pdnsutil rectify-zone repairs derivative records like NS and DS so they're consistent — mandatory before a zone is considered ready.

#Configuring the Secondary in PowerDNS

#pdns.conf and Zone Creation

On the secondary server, enable secondary mode:

secondary=yes

Then register the zone to be transferred along with its primary address:

pdnsutil create-secondary-zone example.com 192.0.2.10

pdnsutil create-secondary-zone example.com 192.0.2.10 registers example.com as a secondary zone that fetches data from 192.0.2.10. PowerDNS then waits for a NOTIFY or the refresh interval to start the transfer.

#Manual Transfer and Verification

To test without waiting for NOTIFY, force a transfer:

pdns_control retrieve example.com
dig @192.0.2.20 example.com SOA +short

pdns_control retrieve example.com tells the secondary to pull the zone right now. If the serial already matches the primary's and answers use the aa flag, you're officially running your first primary-secondary setup.

#Common Pitfalls

#Serial Not Bumping

If changes on the primary never reach the secondary, the most common cause: the serial wasn't bumped. In manual mode, bump the SOA serial every time you change the zone, then run pdns_control notify example.com from the primary.

#NOTIFY Not Arriving

Check three things: also-notify is populated, the firewall opens port 53 from primary to secondary, and the secondary's IP is listed in allow-axfr-ips. Miss any one of them and the transfer won't happen.

journalctl -u pdns -n 50 --no-pager | grep -i notify

#Conclusion

Episode 9 lets you build the most basic DNS redundancy: one primary as the source of truth, one secondary always in sync via NOTIFY and transfer, and both servers answering client queries.

Key takeaways:

• The SOA serial is the zone version marker that drives all synchronization.
• NOTIFY speeds up change detection; AXFR/IXFR carry zone data to the secondary.
• On the primary: primary=yes, allow-axfr-ips, and also-notify.
• On the secondary: secondary=yes and pdnsutil create-secondary-zone.
• pdns_control retrieve and dig +nssearch are synchronization verification tools.
• A serial that doesn't bump is the number one reason transfers never happen.

In episode 10, we'll cover deep zone transfers (AXFR and IXFR) — the difference between full and incremental transfers, securing transfers with TSIG, and advanced features like ixfrdist and autosecondary mode.