Documentation
Everything you need to set up and manage your hidden-primary DNS infrastructure.
Getting Started
Create your account, add your first zone, configure transfers, and go live in under 10 minutes.
ReferenceAPI Docs
Full REST API reference with all endpoints, request/response schemas, and authentication.
AutomationTerraform Provider
Manage zones as code. Provider configuration, resources, data sources, and import.
SecurityDNSSEC Guide
Enable inline signing, retrieve DS records, and manage key rollovers.
SecurityTSIG Setup
Secure zone transfers with HMAC authentication. Configs for BIND, Knot DNS, and NSD.
OperationsMigration Guide
Move your zones to hiddenprimary.ch from another provider with zero downtime.
SecurityZone Validation
Automatic syntax, semantic, and best-practice checks on every transfer. Issue codes, severity levels, and webhook events.
OperationsTeams & Multi-User
Invite colleagues, assign roles (Owner, Admin, Viewer), and manage access across your DNS infrastructure.
AutomationWebhooks
Receive real-time HTTP notifications for zone transfers, DNSSEC changes, validation, and account events.
OperationsVanity Nameservers
Use your own NS hostnames instead of ns1.hiddenprimary.ch. Setup, Glue Records, and validation.
SetupBIND as a Hidden Primary
allow-transfer, notify explicit, TSIG, firewall, and serials for a BIND primary behind your firewall.
SetupPowerDNS: AXFR to a Secondary
Primary mode, zone kind, AXFR permissions, and NOTIFY for PowerDNS Authoritative.
SetupKnot DNS and NSD
Remotes, ACLs, provide-xfr, and notify for Knot DNS or NSD as a hidden primary.
TroubleshootingZone Transfer Errors
What Transfer failed, REFUSED, NOTAUTH, BADKEY, and timeouts mean, and how to fix each one.
AutomationLet's Encrypt DNS-01
Wildcard certificates with certbot or acme.sh via RFC 2136 on your hidden primary.
SetupWindows Server DNS
Zone transfers and NOTIFY from Windows DNS, without exposing your Active Directory zone.
SetupPrimary on a Changing IP
Run your primary at home: we follow the new address from your signed NOTIFY.
SetupTechnitium DNS Server
Zone transfer ACL, notify, and TSIG in Technitium's web console and API.
SetupOPNsense and pfSense
The BIND plugin on your firewall as a hidden primary, with the serial and notify pitfalls.
SetupPlesk, cPanel, DirectAdmin
Zone transfers, NOTIFY, and nameserver templates for the common hosting panels.
SecurityDNSSEC on the Secondary
Keep your primary unsigned and let the secondary sign. No keys on your server.
SecurityChange a DS Record Safely
Remove DNSSEC, change signers, or roll a KSK without SERVFAIL for validating resolvers.