Technitium DNS Server as a Hidden Primary

Keep your zones in Technitium DNS Server at home or in your lab, and let an external secondary serve them to the internet.

Why this setup

Technitium DNS Server is easy to run on a small machine and has a good web console. Exposing it to the whole internet is another matter: every query flood and scan then hits your home connection. As a hidden primary, it only talks to your secondary. The secondary pulls the zone and answers all public queries.

1. Create a primary zone

In the web console, open Zones and click Add Zone. Enter the zone name and choose Primary Zone. Technitium raises the SOA serial on every record change, so you do not have to manage it. If you prefer dates as serials, check Use SOA Serial Date Scheme.

2. Allow zone transfers to the secondary

Open the zone, choose Options → Zone Options, and go to the Zone Transfer tab. Choose Use Specified Network Access Control List (ACL) and enter the transfer addresses of your secondary in Network Access Control List (ACL), one per line. For hiddenprimary.ch:

Network Access Control List (ACL)
159.69.29.118
2a01:4f8:1c0c:63c4::118
45.131.252.44
2a11:8b80:1000:1::18

Allow all four: two hosts can connect to your primary, the transfer node and the standby that takes over when the transfer node is unavailable, each with IPv4 and IPv6.

Do not add these addresses under Settings → General → Zone Transfer Allowed Networks. That global list allows transfers of every zone on the server, without TSIG.

3. Send NOTIFY to the secondary

On the Notify tab, choose Specified Name Servers and enter the two notify addresses:

Specified Name Servers
159.69.29.118
45.131.252.44

4. Add a TSIG key (recommended)

Go to Settings → TSIG and add a key. Leave the shared secret empty to let Technitium generate a strong one, and choose hmac-sha256. Then enter the key name in the zone's Zone Transfer TSIG Key Names field.

With both an ACL and a key, Technitium requires both: the request must come from a listed address and carry the key. Enter the same key name, algorithm, and secret on hiddenprimary.ch (see the TSIG guide).

The same with the HTTP API

terminal
$ curl -H "Authorization: Bearer $TECHNITIUM_TOKEN" \
  "http://localhost:5380/api/zones/options/set?zone=example.ch\
&zoneTransfer=UseSpecifiedNetworkACL\
&zoneTransferNetworkACL=159.69.29.118,2a01:4f8:1c0c:63c4::118,45.131.252.44,2a11:8b80:1000:1::18\
&zoneTransferTsigKeyNames=example-transfer\
&notify=SpecifiedNameServers\
&notifyNameServers=159.69.29.118,45.131.252.44"

5. Point the NS records at the secondary

A new zone names your Technitium server as its nameserver. Replace those NS records with the secondary's nameservers, both in the zone and at your registrar. Resolvers prefer the NS records inside the zone. The migration guide explains the order.

6. Router and firewall

  • Forward TCP and UDP port 53 from your router to the Technitium server. Transfers run over TCP.
  • If your connection has no public IPv4 address of its own (carrier-grade NAT or DS-Lite), use IPv6.
  • If your address changes, see a hidden primary on a changing IP address.

DNSSEC

Technitium can sign zones itself. If you do that, the transfer contains your signatures and we serve them unchanged. Or leave the zone unsigned and let us sign it: DNSSEC signing on the secondary.

Next Steps