Troubleshoot Secondary DNS Zone Transfers

Table of Contents

• Before starting
• Start by comparing SOA serials
• Fix a secondary that is behind DNSimple
• Fix a secondary zone that is not updating at DNSimple
• Find a single missing record
• Check for ALIAS records when records change on their own
• Related topics
• Have more questions?

Secondary DNS usually fails quietly. The zone keeps resolving, because the secondary continues to serve the last copy it received, so the only visible symptom is that a record you changed does not appear everywhere. This article covers how to find out where the transfer stopped and what to do about it.

Before starting

Work out which direction you are troubleshooting, because the checks are different:

• DNSimple as primary (outbound). You edit the zone at DNSimple and another provider pulls it. Set up in the Secondary DNS card on the domain DNS page. See Add a secondary DNS server to DNSimple.
• DNSimple as secondary (inbound). Another provider holds the zone and DNSimple pulls it. Set up under Secondary DNS zone (with DNSimple as follower). See Add DNSimple as a secondary DNS server.

If you keep two providers in sync by hand or with the API rather than with zone transfers, no transfer is involved and this article does not apply. See Using DNSimple alongside other DNS providers.

Start by comparing SOA serials

The SOA serial tells you whether a transfer happened at all. Every provider serving the zone should converge on the same serial shortly after a change.

Query each set of name servers directly rather than through a resolver, so you see what each provider is actually serving:

dig +short SOA example.com @ns1.dnsimple-edge.com
dig +short SOA example.com @ns.your-other-provider.net

Read the result as follows:

• Serials match. The transfer is working. If a specific record is still missing, skip to find a single missing record.
• Serials differ. The secondary is behind. Continue with the section for your direction below.
• The secondary returns nothing, or refuses the query. The secondary is not serving the zone at all. Check that the zone still exists at that provider before looking at transfers.

Fix a secondary that is behind DNSimple

When DNSimple is the primary, DNSimple reports what it can see from each of your secondary name servers on the Secondary DNS card.

Read the status DNSimple reports

The Name servers row lists each name server in the configuration with an icon next to it. A check mark means DNSimple considers that name server synchronized. A warning icon means it does not. Hover over the icon to see the details:

• Serial: <number>; Refresh: <number> - DNSimple read an SOA from that name server. Compare the serial with the one DNSimple is serving.
• No information yet - DNSimple has not been able to read an SOA from that name server at all. The name server is not serving the zone yet, or it is not reachable.

DNSimple treats a secondary as synchronized only when the serial, the refresh value, and the SOA primary name server field all match the zone as published at axfr.dnsimple.com. A secondary that copied the zone but rewrites the SOA primary field will keep showing as out of sync even though the records are correct. Raise that with your secondary provider rather than changing the configuration at DNSimple.

A warning above the table may also show one of these messages:

• “The domain is suspended due to registrant verification.” The domain is registered at DNSimple and suspended until the registrant contact is verified. The configuration does not take effect until that is resolved. See Domain Validation Requirements.
• “DNS resolution is disabled for this domain.” Enable DNS resolution for the domain, then check the card again.
• “The domain is not resolving through one or more primary or secondary name servers.” At least one name server in the configuration is not answering for the zone.
• “The configuration update is propagating to the primary name server.” A change is still being applied. This clears on its own.
• “One or more of the secondary name servers for this configuration are serving stale data.” The secondary answered, but with an older zone. Continue with the checks below.
• “The registry is missing one or more name servers for this configuration.” The transfer may be fine, but the delegation is not. The message names the name servers to add. Update them at your registrar, or at DNSimple if the domain is registered here, then allow time for the change to propagate.

Check the IP whitelist, which also controls NOTIFY

The whitelisted IP addresses in your configuration do two separate jobs. They permit AXFR from those addresses, and they are also the addresses DNSimple sends NOTIFY to when the zone changes.

That second job is easy to miss. If your provider transfers from one set of addresses but receives NOTIFY on another, and only the first set is whitelisted, transfers still work but nothing tells the secondary to start one. The secondary then updates only when its own refresh timer expires, which can be hours. Providers usually surface this as a message about the primary not sending NOTIFY and the serials being out of sync.

A configuration accepts up to 6 name servers and up to 35 whitelisted IP addresses. Both IPv4 and IPv6 addresses are accepted.

Confirm the provider can reach the transfer endpoint

Your secondary provider pulls the zone from axfr.dnsimple.com. Some providers ask for a hostname and others for an IP address:

If the provider allows outbound transfers by address, make sure both are permitted.

Fix a secondary zone that is not updating at DNSimple

When DNSimple is the secondary, open the domain, select DNS, and select Configure on the Secondary DNS card to see the zone’s transfer state.

Read the transfer state

The Records card shows one of these:

• Last transferred <time> ago - a transfer succeeded then. Compare that against when you changed the record.
• No zone records have been transferred yet - no transfer has ever completed. This is a setup problem, not a sync problem. Recheck the primary server IP address and port number, and confirm your primary allows transfers from DNSimple.

Check the primary allows the transfer

Your primary must permit zone transfers from DNSimple and should notify DNSimple when the zone changes. The DNSimple AXFR client IP addresses to allow are listed in Add DNSimple as a secondary DNS server.

Confirm on your own primary that the transfer is being offered:

dig AXFR example.com @your-primary.example.net

A primary that refuses this from its own network will refuse it from DNSimple as well.

Relink the primary server

If the primary is reachable, offers transfers, and DNSimple is still showing an old copy, unlinking and relinking the primary server restarts the transfer.

If that was the only primary server linked to the zone, the Records card shows “No zone records have been transferred yet” until the next transfer completes. That is expected after a relink.

Find a single missing record

If the serials match and the zone transferred, but one record never appears, that record was handled individually rather than the whole transfer failing. Where to look depends on the direction.

DNSimple as secondary. DNSimple records per-record failures, both for records it could not add and for records it could not remove after they were deleted at your primary. The reason for each failure is visible only to DNSimple staff, and retrying the transfer usually does not clear it. Contact support with the zone name, the exact record name and type, and where you can see it on your primary. Support can read the failure reason and tell you what to change.

DNSimple as primary. If the record is at DNSimple but missing at your secondary provider, the secondary rejected or dropped it. DNSimple has no record of that, so check with your secondary provider. Records that providers answer for differently, such as empty non-terminals, can also look like a missing record.

Check for ALIAS records when records change on their own

If you monitor your zone, you may see the serial increase and records change with no edit on your side. When DNSimple is the primary and the zone has an ALIAS record, this is expected: ALIAS cannot be transferred as a record type, so DNSimple resolves it to A and AAAA records and refreshes them on a schedule. Each refresh that changes an address changes the zone your secondary pulls.

See How ALIAS Records Resolve with Secondary DNS for how this works.

Related topics

• What is Secondary DNS? - primary and secondary roles, and how zone transfers work
• Why DNSSEC and Secondary DNS May Not Work Together - resolution failures that look like transfer failures
• What Are Empty Non-Terminals (ENT)? - a difference in behavior between providers that can look like a missing record

Have more questions?

If you have any questions about secondary DNS, contact support, and we will be happy to help.