Take the 2-minute tour ×

If I have a master DNS that is not bind - can bind still slave to it? (ie does it use the DNS protocol or something else?).

Kind of related - but do people still do this or do they use some other form of data replication to keep DNS records in sync to the slaves (ie file/database copying)? I would like to have the slaves refreshed as fast as possible so I am thinking normal slaving with is expiry/poll based might not be optimal?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

You're looking for DNS zone transfers. This mechaism copies DNS zones between DNS servers as either a complete transfer, or an incremental transfer of updated records (to save bandwidth and reduce update latency). DNS NOTIFY allows the master server to inform secondaries that updates are available. With NOTIFY, polling isn't necessary.

Virtually every DNS server implementation supports zone transfers. BIND will happily act as as secondary DNS server for any primary DNS server that can supply it with transfers of the DNS zone data.

share|improve this answer
hmm... also looking at djbdns - I suppose it would as well. –  Michael Neale Jan 21 '10 at 0:06
I thought djb said rsync is the one method, and AXFR/IXFR isn't written for that. –  Michael Graff Jan 21 '10 at 4:45
You use axfrdns in the djbdns suite to perform zone transfers or otherwise answer dns requests over TCP. –  chris Jan 21 '10 at 12:01
add comment

You should consider using djbdns( http://cr.yp.to/djbdns.html ). It is one of the most secure and stable DNS servers available. It uses a local db file that can easily be synced using SCP. This is generally considered preferred over Zone transfers for security purposes(zone transfers are sent in plain text). The install can be a little difficult for beginners to compiling software but it is well worth it. Also there is a very nice web front end that has been developed for it: http://vegadns.sourceforge.net/

share|improve this answer
The records in my Internet-facing DNS servers, at least, are supposed to be public knowledge. DNS queries are, after all, sent in plain text. IPSEC sounds like a smarter answer to me than using application-level tunneling for each and every protocol... –  Evan Anderson Jan 21 '10 at 0:11
Some of your DNS records you may not want to be public knowledge. If you read most penetration test/security books one of the first investigating steps is to attempt a zone transfer to find potential targets. Obviously you can block zone transfers by IP but I'd rather not let this info get out. –  einstiien Jan 21 '10 at 0:23
thanks yes, someone else recommended that. I have zone files, and found a script to convert them to djbdns format: qmail.jms1.net/djbdns –  Michael Neale Jan 21 '10 at 0:53
I'm well aware of the ol' "do a zone transfer to find potential targets", and my response to that would be "don't put those records in a public DNS server, then". DNS queries are plain-text. If you ever query for these "secret records" then they're not "secret" anymore. Hiding secrets in plain sight is silly. Assume your attacker can monitor all your DNS queries and responses. –  Evan Anderson Jan 21 '10 at 0:56
The published data is public but I don't want my dns "slave" servers to get updates from a spoofed address. That trust issue is avoided if I use ssh/rsync to synchronize the dns data between my dns servers. –  chris Jan 21 '10 at 1:32
show 5 more comments

Your Answer


