Getting Started

Set up your first zone on hiddenprimary.ch in under 10 minutes.

1. Create an Account

Register for a free 14-day trial. After registration, verify your email address.

2. Create an API Key

Go to Account → API Keys in the portal and create a key with zones:write scope. Save the key securely — it is shown only once. The key starts with hp_, followed by 64 hexadecimal characters.

terminal
$ export HP_KEY="hp_..."

3. Add a Zone

You can add zones via the portal or the API. Here is how to do it with curl:

terminal
$ curl -X POST https://hiddenprimary.ch/v1/zones \
  -H "Authorization: Bearer $HP_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"example.ch","primary_ips":["192.0.2.1"]}'

4. Configure Your Hidden Primary

On your authoritative DNS server, allow zone transfers (AXFR/IXFR) from our transfer addresses. Two hosts can connect to your primary: the transfer node and the standby that takes over when it is unavailable, each with an IPv4 and an IPv6 address. Allow all four — if you leave the standby out, your zone stops updating while the transfer node is unavailable. The rest of our nameservers never contact your primary; they take the zone from us. For BIND:

named.conf
zone "example.ch" {
  type master;
  file "/etc/bind/zones/example.ch";
  allow-transfer {
    // hiddenprimary.ch transfer addresses
    159.69.29.118;
    2a01:4f8:1c0c:63c4::118;
    // standby transfer node
    45.131.252.44;
    2a11:8b80:1000:1::18;
  };
  also-notify {
    159.69.29.118;
    45.131.252.44;
  };
};

For extra security, use TSIG authentication for zone transfers.

Step-by-step setups for other servers: BIND, PowerDNS, Knot DNS and NSD, Windows Server DNS, Technitium, OPNsense and pfSense, and Plesk, cPanel, and DirectAdmin. Something not working? See zone transfer errors.

5. Trigger the First Transfer

terminal
$ curl -X POST https://hiddenprimary.ch/v1/zones/1/transfer \
  -H "Authorization: Bearer $HP_KEY"

6. Update Your NS Records

NS records exist in two places and both have to name us: the apex of your own zone, on your hidden primary, and the delegation at your registrar. Change the zone first.

Resolvers prefer the NS records they find inside your zone over the ones the registry hands out (RFC 2181, section 5.4.1), so a zone that still names your old provider keeps sending queries there even after the delegation points at us. We report this after every transfer as NS_MISSING_OURS or NS_INCOMPLETE_OURS.

Use these in both places:

DNS records
example.ch. IN NS ns1.hiddenprimary.ch.
example.ch. IN NS ns2.hiddenprimary.ch.
example.ch. IN NS ns3.hiddenprimary.ch.
example.ch. IN NS ns4.hiddenprimary.ch.

Propagation takes up to 48 hours, but typically completes within a few hours.

7. Check Zone Validation

After the first transfer, hiddenprimary.ch automatically validates your zone content. Go to your zone's Records tab to see the validation results.

How deep the check goes depends on your plan, during the trial too — the trial runs on the plan you signed up with. Every plan gets the syntax checks: parse errors, a missing SOA, missing apex NS records, and whether your apex NS records name us. Plans with the zone_validation feature add the semantic checks (a CNAME at the apex, for example) and the best-practice checks (SPF, DMARC, TTL). The validation guide lists which plans those are, and every check we run.

8. Enable DNSSEC (Optional)

Once the zone is syncing, you can enable DNSSEC with one click in the portal or via the API. See the DNSSEC Guide for details.

Next Steps