A secondary DNS zone obtains its records from a primary DNS server through a zone-transfer arrangement. Use it when you already operate an authoritative primary and want an additional server to answer the same zone. It is different from importing a one-time copy of records.
IN THIS ARTICLE
01 Confirm the prerequisites
Your package and DNS provider must allow secondary zones. The primary server must permit zone transfers to the intended secondary, and any required transfer authentication must be configured correctly. You also need the primary server's reachable IP addresses and permission to publish the zone on both services.
Ask the operator for the correct transfer addresses and supported authentication procedure. Do not enable unrestricted zone transfers to the entire internet just to make a setup test pass.
02 Set up the zone
- Open the account DNS zones view and start setup for an eligible domain.
- Choose the secondary-zone option when it is offered.
- Enter the primary or master IP addresses in the requested format.
- Complete any ownership verification needed for the domain.
- Submit the setup and wait for the transfer task to complete.
- Inspect the secondary's records and its SOA serial, and compare them with the primary.
03 Know where edits belong
Update the records at the primary server. A secondary follows the primary's data; it is not normally a separate place to make unrelated record edits. After a change, verify that the secondary receives the newer zone and answers consistently. The transfer mechanism and schedule determine how quickly this happens.
Changing the list of public nameservers at the registrar is a separate action. Add only authoritative servers that are ready to answer for the zone. For DNSSEC, signing and transfer compatibility need a coordinated design; do not assume a second provider automatically shares the primary's signing configuration.
Why is secondary DNS unavailable or failing to refresh?
A package that uses API replication across selected providers may not offer secondary-zone creation. Those are different synchronisation methods. If a transfer fails, check the primary address, transfer permissions, firewall reachability, zone serial and authentication with the server operator. Include the domain and transfer error when contacting support. Do not recreate the zone as an unrelated primary unless you intentionally want to maintain separate copies yourself.