PowerDNS calls a DNS “slave” a secondary in current releases. To configure one, enable secondary mode, define each replicated zone with its primary address, permit AXFR/IXFR and NOTIFY traffic on the primary, and verify that the secondary can write the transferred data. The secondary then learns about changes through NOTIFY and periodic SOA checks, retrieving a full AXFR or an incremental IXFR when available.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The old slave server setting was renamed in PowerDNS 4.5.0 and removed in 4.9.0. A zone database row may still use the legacy SLAVE value for compatibility, but follow the configuration syntax supported by the version you have installed.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat PowerDNS DNS replication actually does
A PowerDNS secondary does not replicate a database in the way a database cluster does. It maintains a copy of an authoritative DNS zone by requesting DNS zone transfers from a primary. A full transfer is AXFR; an incremental transfer is IXFR. The primary remains responsible for publishing the zone and increasing its SOA serial when records change.
When the primary sends DNS NOTIFY, the secondary performs an immediate freshness check instead of waiting for its normal SOA polling interval. If the serial at the primary is newer, the secondary requests the zone data. Without NOTIFY, periodic SOA checks still detect changes, but updates can take longer to appear.
#1 Best Overall
PowerDNS can retrieve IXFR updates, but it cannot serve IXFR updates itself. If another server requests an incremental transfer from a PowerDNS secondary, plan for the secondary’s supported transfer behavior rather than assuming it can act as an IXFR source.
Check the design before changing configuration
Confirm that the backend supports secondary operation
Secondary and primary behavior is implemented by the selected PowerDNS backend, not by every backend automatically. Confirm that the backend in use supports zone transfers before diagnosing a missing setting. Backend names, schemas, and migration procedures differ, so do not copy an SQL example into a BIND-backend deployment or assume that a backend’s zone table has identical columns.
Choose one or more primaries
A secondary zone can point to one primary address or a comma-separated list of primary addresses. Multiple primaries provide alternate transfer sources, but every listed address must be reachable, authorized, and serving the same zone data. A single primary is simpler and can be appropriate when the primary itself is redundant elsewhere.
Decide how transfers are protected
- Unauthenticated transfers: rely on source-address ACLs and network policy. This is simpler but requires careful access control.
- TSIG-authenticated transfers: use a named shared key and configure both sides to require or accept it. This adds key-management work but authenticates the transfer request.
Decide whether to request IXFR
AXFR transfers the complete zone. IXFR requests only changes when the primary has the required history. Set the zone’s IXFR metadata to 1 when incremental retrieval is desired. Keep a full-transfer recovery path because some DNSSEC transitions and NSEC3-mode changes are not fully represented by IXFR.
Enable secondary mode on the PowerDNS server
Secondary support is disabled by default. On the server that will receive the zones, add the current setting to /etc/powerdns/pdns.conf or to the equivalent configuration mechanism used by the deployment:
secondary=yesRestart or reload PowerDNS according to the service-management method used by the installation. Check the startup log after the change; a configuration typo or an obsolete setting name should be corrected before adding zones. On releases from 4.9.0 onward, do not use the removed slave setting as a replacement for secondary.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- Linux
- Linux DNS
Define each secondary zone
Enabling secondary mode only permits the role. Every zone still needs a per-zone declaration that identifies it as secondary and names the primary source.
SQL-backed deployments
In an SQL-backed deployment, the zone’s row in the domains table uses type=SLAVE or the current SECONDARY representation, depending on the PowerDNS release and backend. The master field contains the primary address, or a comma-separated list of addresses.
name = example.com
type = SLAVE
master = 192.0.2.10,198.51.100.10This is a conceptual record, not a universal SQL statement. The exact schema, backend name, and migration behavior are backend-specific. Prefer supported pdnsutil or API operations when the installed backend provides them, and verify the resulting zone type and primary list through the backend’s current documentation.
BIND-backend deployments
The BIND backend uses supported BIND-style zone configuration. Define the zone as secondary and provide its masters or primaries directive with the address or addresses of the source server. Use the syntax accepted by the BIND backend version installed on the secondary; do not mix SQL-table fields with a BIND-backend file.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsLegacy labels and current terminology
PowerDNS changed the server setting name from “slave” to “secondary” in version 4.5.0 and removed the old setting in 4.9.0. The legacy SLAVE zone value can remain in database records for compatibility, so seeing that value does not necessarily indicate an obsolete zone. Check the installed release before changing existing rows or automation.
Prepare the primary server
Enable primary operation
The source server must be configured to operate as a primary for the zone. It must also permit the secondary to request AXFR and, when used, IXFR. A secondary declaration without a matching primary-side transfer policy will normally result in a refused or timed-out transfer.
Publish the secondary in the NS set
The zone’s NS RRset should contain the secondary nameserver name. The zone must also provide the corresponding A and/or AAAA record for that nameserver. These records are part of a functional authoritative setup, not merely descriptive metadata; clients and operators need a resolvable address for every listed nameserver.
Increase the SOA serial for every change
After editing records on the primary, increase the zone’s SOA serial. NOTIFY can prompt an immediate check, but the secondary still compares serials to decide whether it needs new data. A changed record with an unchanged serial is therefore not a reliable replication event.
Allow DNS, transfers, and NOTIFY through the network
Permit normal DNS queries between the relevant clients and servers, and permit the TCP traffic used for zone transfers between the primary and secondary. Permit NOTIFY delivery from the primary to the secondary as well. The exact firewall syntax depends on the operating system, firewall manager, container network, and address family, so apply rules appropriate to that environment rather than copying a universal command.
When troubleshooting, test both directions that matter: the secondary must be able to reach the primary’s transfer service, and the primary must be able to deliver NOTIFY to the secondary. A server that answers UDP queries but blocks transfer TCP traffic can appear healthy while never receiving a zone.
Authenticate transfers with TSIG when required
For authenticated transfers, create the same named TSIG key on both servers. Associate the key with the secondary’s zone using the AXFR-MASTER-TSIG per-zone metadata, and configure the primary’s transfer ACL or metadata to allow the corresponding key. The key name, algorithm, and secret must match exactly.
TSIG-ALLOW-AXFR is another per-zone control used in transfer authorization. Treat ACLs and TSIG as complementary: an address may be reachable but unauthorized, while a valid key is useless if the firewall blocks the transfer connection.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →AXFR-SOURCE can select the source address that the secondary uses for AXFR and IXFR requests. This matters on multihomed servers where the primary’s ACL expects a particular source address. After setting it, confirm that routing and the primary’s allow-list agree with the selected address.
Configure IXFR retrieval deliberately
Set the zone’s IXFR metadata to 1 when the secondary should attempt incremental retrieval. PowerDNS may fall back to a full AXFR when the primary cannot provide a usable IXFR history, so enabling IXFR does not eliminate the need for AXFR permissions.
Pay special attention after DNSSEC or NSEC3 changes. The documentation warns that a non-DNSSEC-to-DNSSEC transition, or a change in NSEC3 mode, may not be completely represented by IXFR. If the secondary shows stale or inconsistent DNSSEC state after such a transition, delete the zone contents through the supported administrative method and force a fresh retrieval rather than relying on another incremental update.
PowerDNS retrieves IXFR but does not serve IXFR updates itself. This distinction matters when planning a chain of authorities: a PowerDNS secondary can be an update target without being a complete incremental-transfer source for downstream servers.
Make the transfer destination writable
The service account must be able to persist the transferred zone data through the selected backend or transfer destination. Packaged systemd units may use ProtectSystem=full, which can prevent writes under /etc or /home. A secondary can therefore receive a transfer successfully yet fail to retain it if the backend is placed in a protected, read-only path.
Check the effective unit hardening settings, the ownership and mode of the backend files or database, and any container or volume mount that overlays the destination. Change the deployment layout or hardening policy deliberately; do not broadly disable system protection just to hide a permissions error.
Best Value
- Standard size: 6 pink server note pads, Each Book Comes with 50 bound order slips - that's 300 ticket sheets total! Check Pads Size 6.75 x 3.5 inch.
- Convenient Work: These guest check books for servers have a tear-free dotted line that is easy to rip off. You can give as a customer copy or keep for record keeping. We've provided extra rows on the back for additional note taking.Perfect For Restaurants, Lounges, Hotels, Cafes, And Waiters To Use.
- Record Important Information: These server note pads can record important information.Each ticket has a unique serial number printed at the top, dates, order details, number of guests, order amount, table numbers etc. They are lightweight, small and can fit most aprons. They can be used on-demand and can help decrease errors in orders, while improving work efficiency.
- High Quality: Sturdy, Not Drop Powder, It's Thick, You Can Write On The Back And Front Easily.Their whole page printing has clear handwriting and a reasonable layout. On the customer retention part of each guest check, "THANK YOU" on the back to make customers feel appreciated.
- Contact Us: We're confident that the quality of the server note pads will go beyond your expectation. If you experience an issue, feel free to contact us, we'll appreciate it to learn from your experience, and we'll make it better
Trigger and verify the first transfer
- Confirm the zone declaration. Verify the zone name, secondary type, and primary address list in the backend or supported configuration interface.
- Confirm the primary policy. Check that the secondary address is allowed to request AXFR/IXFR and that any TSIG key is accepted.
- Check the NS data. Ensure the zone’s NS RRset includes the secondary name and that its A/AAAA record points to the intended address.
- Check connectivity. Verify DNS query reachability, transfer TCP connectivity, and the path for NOTIFY.
- Request an immediate retrieval. Run
pdns_control retrieve <zone>on the secondary, replacing<zone>with the authoritative zone name. - Read the PowerDNS logs. Look for authorization failures, connection timeouts, TSIG errors, backend write errors, and a message indicating whether AXFR or IXFR was attempted.
- Compare SOA serials. Query the primary and secondary for the zone’s SOA record and confirm that the secondary eventually reports the newer serial.
- Test an ordinary record. Query the secondary for a known record changed on the primary. A matching SOA serial and record response confirms that the transfer is visible through the serving path.
A primary NOTIFY should cause an immediate freshness check. If NOTIFY is unavailable, the secondary’s normal SOA polling remains the fallback mechanism. The manual pdns_control retrieve request is useful for separating transfer-policy problems from waiting-time issues.
Troubleshoot common failure modes
“Secondary support disabled”
Check that secondary=yes is present in the active PowerDNS configuration, not merely in an unused file or an environment variable that the service does not load. Confirm the release: the old slave setting is not valid on PowerDNS 4.9.0 and later. Restart or reload as required, then inspect startup logs.
Free tools Windows power users keep installed
One-click scans. No signup required.
No transfer after a record change
Verify all three update triggers: the primary increased the SOA serial, the primary sent NOTIFY, and the secondary is present in the zone’s NS set. Then run pdns_control retrieve <zone> and compare SOA serials directly. If manual retrieval works but automatic updates do not, focus on NOTIFY routing and the primary’s notification configuration.
Transfer refused
Inspect the primary’s AXFR ACL and any TSIG requirements. Confirm that the secondary’s source address is the one permitted by the primary, especially when AXFR-SOURCE is configured. Check that TCP transfer traffic is allowed and that the key named by AXFR-MASTER-TSIG matches the primary-side authorization. A refusal generally indicates policy; a timeout more often points to reachability or firewall handling.
The zone never persists
If logs show that data arrived but the zone disappears after a restart, inspect backend write permissions and systemd hardening. ProtectSystem=full can block writes under /etc or /home. Ensure the service account can write to the actual database, journal, or transfer destination used by the deployment.
IXFR leaves stale DNSSEC data
For a DNSSEC enablement change or NSEC3-mode change, force a clean retrieval. Delete the affected zone contents through the supported backend or administrative interface, then request a new transfer. Do not assume that repeated IXFR requests will reconstruct a state transition that the incremental history does not fully encode.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The secondary still answers for a deleted primary zone
This is expected. The AXFR protocol has no zone-deletion operation. Removing a zone from the primary does not instruct secondaries to remove their local copy. Delete the retired zone explicitly on the secondary through its supported backend or an administrative cleanup process, and remove its NS publication where appropriate.
Operate one PowerDNS instance in both roles
A single PowerDNS instance may be both primary and secondary when both settings are enabled and individual zones are assigned accordingly. Keep the per-zone roles clear: some zones can be served from locally managed primary data while others retrieve from remote primaries. Apply transfer ACLs, TSIG policies, storage permissions, and monitoring for each role rather than assuming that enabling one role configures the other.
Quick Recap
Deployment comparison
| Decision | Option | Operational effect |
|---|---|---|
| Zone representation | SQL backend | Use a zone row with a secondary type and a primary address list; schema and migration details are backend-specific. |
| Zone representation | BIND backend | Use supported BIND-style configuration with type and masters or primaries. |
| Primary sources | Single primary | One transfer source; simpler policy and troubleshooting. |
| Primary sources | Multiple primaries | Comma-separated source addresses; each source must be reachable and authorized. |
| Transfer authentication | Address-based policy | Relies on transfer ACLs and network controls. |
| Transfer authentication | TSIG | Uses a shared named key with AXFR-MASTER-TSIG and matching primary authorization. |
| Update retrieval | AXFR | Retrieves the complete zone. |
| Update retrieval | IXFR | Requests incremental changes when enabled and available; PowerDNS retrieves but does not serve IXFR. |
| Change detection | NOTIFY | Prompts an immediate freshness check after a primary update. |
| Change detection | SOA polling | Provides periodic detection when NOTIFY is delayed or unavailable. |
| Storage layout | Writable destination | Allows the service account and backend to persist transferred data. |
| Storage layout | Hardened read-only path | Requires an intentional writable exception or a different backend location; ProtectSystem=full may block writes under /etc or /home. |
Final verification checklist
- The installed PowerDNS version uses
secondary=yes, and the backend supports secondary operation. - Each zone is marked as secondary and lists the correct primary address or addresses.
- The primary’s SOA serial increases whenever records change.
- The secondary appears in the zone’s NS RRset with valid A/AAAA data.
- AXFR/IXFR TCP traffic and NOTIFY delivery are permitted by the network policy.
- Primary-side transfer ACLs and, when used, TSIG settings match the secondary.
- The transfer destination is writable despite systemd or container hardening.
pdns_control retrieve <zone>completes without authorization or backend errors.- SOA serials and representative records match on the primary and secondary.
- Retired zones are removed manually from the secondary because AXFR does not propagate deletion.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
