Enabling outgoing zone transfers

You can configure outgoing zone transfers from primary or secondary zones hosted by NS1 to secondary IPs hosted by third-party DNS providers. Typically, zone transfers occur upon changes to zone data or in response to the secondary's periodic SOA refresh request. NS1 supports outgoing zone transfers via AXFR.

When changes are made to the primary zone, NS1 will send a DNS notification (i.e., “NOTIFY”) to the secondary zone server. In response, the secondary server sends an SOA/AXFR query to NS1, requesting the new zone data. Then, NS1 transfers the new zone data to the requesting secondary. Note that the “NOTIFY” messages are optional and may be automatically disabled based on your settings. If NOTIFY is disabled, the zone transfer will not occur until the next SOA request from the secondary servers based on the refresh TTL.

It is important to understand that certain NS1 functionality — such as ALIAS records, answer metadata, and Filter Chain™ configurations — are not supported by third-party DNS providers and will not transfer to secondary DNS servers.

Note that you can also enable outgoing transfers from secondary zones hosted by NS1 to other secondary IPs (hosted externally). This type of configuration can create redundancy in public DNS by using a "hidden primary" configuration whereby the source of truth doesn't serve public traffic directly. Instead, the zone data is copied to the secondary zone hosted by NS1 which acts as a primary to the specified secondary IP(s).

This article overviews the process for enabling outgoing zone transfers on a primary or secondary zone including the option to enable DNS notifications (i.e., NOTIFYs) upon changes to the zone data and enabling TSIG authentication for the outbound NOTIFY messages. You can do this via the NS1 portal or API.

Follow the steps below to enable outgoing zone transfers on a primary or secondary zone using the NS1 portal. Alternatively, you can do this via API.

curl -X POST -H "X-NSONE-Key: $NSONE_API_KEY" -d '
{
  "primary": {
    "enabled": true,
    "secondaries": [
      {
        "ip":"<secondary_IP>",
        "notify": false
        }]
    }
  }
' https://api.nsone.net/v1/zones/<zone_name>

curl -X POST -H "X-NSONE-Key: $NSONE_API_KEY" -d '
{
  "primary": {
    "enabled": true,
    "secondaries": [
      {
        "ip":"<secondary_IP>",
        "notify": true,
        "port":<secondary_port>,
        "network": 0
        }]
    }
  }
' https://api.nsone.net/v1/zones/<zone_name>

curl -X POST -H "X-NSONE-Key: $NSONE_API_KEY" -d '
{
  "primary": {
    "enabled": true,
    "secondaries": [
      {
        "ip":"<secondary_IP>",
        "notify": true,
        "port":<secondary_port>,
        "network": 0,
        "tsig": {
          "enabled": true,
          "hash": "<tsig_hash>",
          "name": "<tsig_name>",
          "key": "<tsig_key>"
          }
        }]
    }
  }
' https://api.nsone.net/v1/zones/<zone_name>