PowerDNS: AXFR to an External Secondary

Let an external secondary pull your zones from the PowerDNS Authoritative Server with AXFR.

Why PowerDNS needs extra settings

Many PowerDNS installations replicate zones through the database, not through DNS. Out of the box, PowerDNS therefore sends no NOTIFY messages and allows zone transfers only from localhost. To feed an external secondary, you change three things: the zone type, the transfer permission, and the notify target.

The commands below use the syntax of PowerDNS 4.x. PowerDNS 5 groups the same commands differently, for example pdnsutil zone set-kind instead of pdnsutil set-kind. The settings are the same.

1. Turn on primary operation

In pdns.conf, set primary=yes. Versions before 4.5 call this setting master=yes. With it, PowerDNS watches the serials of its primary zones and sends NOTIFY messages when a serial changes.

pdns.conf
primary=yes

2. Set the zone type to primary

A zone of type NATIVE never sends NOTIFY messages, because PowerDNS assumes that the database does the replication. Change it to MASTER:

terminal
$ pdnsutil set-kind example.ch MASTER

3. Allow the transfer

You have two options. Use one of them.

Option A: by TSIG key (recommended)

A TSIG key authenticates every transfer. PowerDNS lets any host that has the key transfer the zone, whatever its address. This also covers every host of your secondary without an address list.

terminal
# create the key and print its secret
$ pdnsutil generate-tsig-key example-transfer hmac-sha256
 
# allow transfers that carry this key
$ pdnsutil set-meta example.ch TSIG-ALLOW-AXFR example-transfer

Enter the same key name, algorithm, and secret at your secondary. On hiddenprimary.ch, the TSIG guide shows where.

Option B: by address

Set the ALLOW-AXFR-FROM metadata on the zone. PowerDNS allows these addresses in addition to the global allow-axfr-ips setting, so keep that setting narrow. Its default only allows localhost.

terminal
$ pdnsutil set-meta example.ch ALLOW-AXFR-FROM \
  159.69.29.118 2a01:4f8:1c0c:63c4::118 45.131.252.44 2a11:8b80:1000:1::18

These are the transfer addresses of hiddenprimary.ch. Allow all four: two hosts can connect to your primary, the transfer node and the standby that takes over when the transfer node is unavailable.

4. Send NOTIFY to the secondary

PowerDNS sends NOTIFY messages to the servers in the zone's NS records. With a hidden primary, those are your secondary's public nameservers, and they are not the hosts that transfer the zone. Add the transfer hosts explicitly:

terminal
$ pdnsutil set-meta example.ch ALSO-NOTIFY 159.69.29.118 45.131.252.44

To notify these hosts for every zone, use the global setting instead:

pdns.conf
also-notify=159.69.29.118,45.131.252.44

Restart PowerDNS after you change pdns.conf.

5. Make sure the serial goes up

A secondary pulls a new copy only when the SOA serial increases. If you change records through the PowerDNS API or a web front end, set the SOA-EDIT-API metadata so the serial is raised on every change. DEFAULT is a good value. If you write to the database directly, your tooling must raise the serial itself.

terminal
$ pdnsutil set-meta example.ch SOA-EDIT-API DEFAULT
$ pdnsutil increase-serial example.ch

6. Test the transfer

From any host you allowed, or with the TSIG key, request the zone:

terminal
$ dig AXFR example.ch @192.0.2.1 -y hmac-sha256:example-transfer:<secret>

Replace 192.0.2.1 with the address of your PowerDNS server. The answer must start and end with the SOA record. Transfer failed means the permission in step 3 does not match.

If PowerDNS signs the zone

If you secured the zone with pdnsutil secure-zone, the transfer contains your DNSKEY and RRSIG records. hiddenprimary.ch recognises a signed zone and serves your signatures unchanged. Keys and signing then stay with PowerDNS, and you keep your DS record as it is. Do not turn on signing on the secondary as well: a zone can have only one signer in this setup.

If you would rather not manage keys at all, leave the zone unsigned in PowerDNS and let the secondary sign it. See DNSSEC signing on the secondary.

Next Steps