Check the selected backend's secondary-zone capability and the package's secondary-zone permission. The primary must permit the required transfer to the secondary, and network rules must allow the provider's transfer mechanism. Public DNS resolution working on port 53 does not by itself establish that AXFR or IXFR is authorised.

1. Identify the primary source and the secondary provider that will serve the zone.
2. Configure the primary's transfer permissions for the intended secondary addresses and any supported authentication arrangement.
3. Create the secondary zone through the module's supported zone workflow, using the exact source values requested by the provider.
4. Request a secondary transfer where the action is available, then inspect its result.
5. Query the secondary directly and compare the SOA serial and representative records with the primary.

A secondary zone can exist before it is publicly delegated. Add it to the authoritative nameserver arrangement only after it serves the complete intended zone. Check all delegated servers for consistent records and DNSSEC behaviour.

Do not edit a secondary copy as if it were an independent primary unless the provider's documented workflow explicitly supports that. Changes usually belong at the primary and are distributed by transfers.

API-based package replication and secondary-zone transfers solve related but different tasks. The current package policy disables the secondary/AXFR arrangement when using the API replication mode. Do not enable both through separate tools and expect automatic conflict resolution.

Provider-specific DNSSEC and transfer settings require their own plan. Copying ordinary records is not a substitute for a valid signing chain or transfer authorisation.

Check the primary SOA serial, transfer allowlist, source address, authentication, firewall and provider logs. Confirm that the secondary is contacting the right primary. If one nameserver is stale, cached answers from that server can make the problem appear intermittent.

Retain the working primary while diagnosing a secondary failure. Removing the source or changing registrar delegation before the secondary is current can turn a synchronization issue into a public outage.

• Create a secondary DNS zone when your package supports it
• Synchronize a DNS package across multiple servers and select its master
• Add a DNS provider connection and prove that it can manage zones
• Operate DNSSEC from zone signing through parent DS verification

• PowerDNS: Zones API