Configuring NS1 as a secondary provider (Creating secondary zones)

If you are using multiple DNS providers, you have the option to configure NS1 to be your secondary provider—acting as a "child" to your primary DNS server. Below are some important considerations before configuring NS1 as secondary provider.

• You must have an existing primary DNS provider or server.
• Your primary server must allow AXFR queries over TCP for NS1 server IPs.
• With NS1 configured as a secondary provider, you will not be able to use the advanced features and functionality—such as Filter Chains—for record management. You must use your primary DNS provider's tools to manage zone records.

Step 1: Create the secondary zone.

1. Configure your primary DNS server to allow AXFR queries over TCP (and SOA queries over UDP) from 192.135.223.10.

2. In the NS1 portal, navigate to the Zones section, and click Add Zone.

3. Select Secondary Zone.
   
   

4. Enter the domain name and the IPv4 address (not the hostname) of your primary DNS server. If necessary, adjust the primary port setting (if not running on port 53).

5. Optionally, click the checkbox next to Enable Additional Primaries. Note that if you choose to include multiple primary services, NS1 will balance AXFR queries among all servers and retry failed queries with alternative servers.
6. Optionally, click the checkbox next to Enable TSIG. See below for details.

7. Click Save Zone. 
   
   The secondary zone is created, but in a "pending" state. It may take a few minutes for the first synchronization against your primary server. You can monitor the status of the server under the Zone Settings tab. Note: This is also where you can also update the primary IP or port, if necessary. Once all zones are synced, all records configured on your primary server will appear in the NS1 portal. 

Enabling TSIG on your DNS network*

NS1 offers authentication using TSIG (transaction signature) for instances where NS1 is configured as the secondary (not primary) DNS provider. During initial configuration, you must enter:

• Type of hash selected from the dropdown menu,
• TSIG key name (or hash) for the key being created, and
• TSIG key which as a password to authenticate communication between the two DNS servers (AXFR) to transfer changes to zone records securely.

Step 2: Point DNS traffic to the NS1 servers.

After setting up the secondary zone, you must direct DNS traffic to the NS1 servers.

1. In the NS1 portal, navigate to the list of zones, and double-click the secondary zone you just created.

2. Click the Nameservers tab, and then record the URLs listed for the NS1 servers.

3. Using the configuration tools provided by your primary DNS provider, add NS records to the zone for each NS1 nameserver.

4. Using the configuration tools provided by your domain registrar, modify the nameserver for your domain.