A secondary DNS server provides redundancy for your domain's DNS — if your primary nameserver becomes unreachable, the secondary continues answering queries, keeping your domain resolvable.
Why Redundant DNS Matters
If your only DNS server goes down, your entire domain becomes unreachable — not just your website, but email and any other service relying on DNS resolution for that domain; a secondary server eliminates this single point of failure.
How Primary/Secondary DNS Works
The secondary server automatically pulls a copy of your zone data from the primary via a "zone transfer" — both servers then answer queries independently, with clients/resolvers using whichever nameserver responds, providing both redundancy and some load distribution.
Prerequisites
- A primary DNS server (self-hosted BIND, or your DNS provider's primary)
- A second server (different VPS, ideally in a different location) to run as secondary
Step 1 — Configure the Primary Server to Allow Zone Transfers
zone "yourdomain.com" {
type master;
file "/etc/bind/zones/yourdomain.com.zone";
allow-transfer { SECONDARY_SERVER_IP; };
};Restrict allow-transfer specifically to your secondary server's IP — never leave this open to any source, since it would let anyone download your complete zone data.
Step 2 — Configure the Secondary Server
zone "yourdomain.com" {
type slave;
file "/etc/bind/zones/yourdomain.com.zone";
masters { PRIMARY_SERVER_IP; };
};Step 3 — Restart BIND on Both Servers
sudo systemctl restart bind9Step 4 — Verify the Zone Transfer Succeeded
sudo journalctl -u bind9 | grep transferCheck for a successful transfer log entry on the secondary; also verify the zone file was actually created/updated on the secondary server.
Step 5 — Add Both Nameservers at Your Registrar
Register both your primary and secondary nameserver addresses with your domain registrar, so resolvers know to query either one.
Using TSIG for Secure Zone Transfers (Recommended)
key "transfer-key" {
algorithm hmac-sha256;
secret "GENERATED_SECRET_KEY";
};Adds cryptographic authentication to zone transfers, ensuring only servers with the correct key can pull zone data, beyond just IP-based restriction.
Verifying Both Servers Answer Correctly
dig @PRIMARY_IP yourdomain.com
dig @SECONDARY_IP yourdomain.comBoth should return identical, correct results.
Using a Managed Secondary DNS Service (Alternative)
Rather than self-hosting a secondary, some DNS providers offer secondary DNS as a service, automatically pulling from your primary — a simpler option if you don't want to manage the secondary server infrastructure yourself.
Common Errors
Zone transfer fails — verify the primary's allow-transfer setting includes the secondary's correct IP, and check for firewall rules blocking port 53 (both TCP and UDP) between the two servers.
Continue Reading
- DNS Fundamentals: A, AAAA, CNAME, MX, TXT & NS Records Explained
- How to Set Up DNS Load Balancing and Failover
- How to Migrate DNS to a New Provider Without Downtime
Browse more articles in Networking & DNS.
