Network Engineer

Welcome to my little blog. I am mostly techie over here, blogging about networking and system administration topics, but there will also be some Travel Reports from time to time…

How to Set up a ‘hidden primary’ DNS

February 27, 2011Christian Kildau0 Comments

I just had to guide a friend of mine trough the setup of a ‘hidden primary’ or ‘hidden master’ via mail, so I thought I’d also post a quick summary here to keep my blog alive

First off: A ‘hidden primary’ setup, uses one server for all zone-file changes that isn’t listed anywhere and doesn’t get any queries from clients,¬† and two or more ‘slaves’ that do the actual work. Have a look at this example zone-file:

                                         201102111       ; serial
                                         3h              ; refresh
                                         1m              ; retry
                                         1w              ; expire
                                         1m)             ; minimum


The host is my ‘hidden primary’. As you can see, it’s not listed as NS, so it won’t get queries from actual client resolvers. ns[2,3] are my name-servers for this zone, configured as slaves.

The ‘hidden primary’ config looks like:

zone "" {
        type master;
        file "master/";
        allow-transfer { unixhosts; inwx; };
        also-notify {;;; };

Whereas a ‘slave’ config looks like:

zone "" {
        type slave;
        file "slave/";
        masters {; };
        allow-transfer { clients; };

If your Infrastructure isn’t large enough to take responsibility for 3 public DNS servers, you might want to have a look at InterNetworX. I’m running their servers as ‘slaves’ for a few months now. Their support team is great and I haven’t had any issue within years!

Leave a Reply