How to Set Up Secondary (Slave) DNS for Redundancy

Secondary DNS keeps a synchronised copy of your zone on additional nameservers, so your domain keeps resolving even if the primary server goes down. Since DNS being unreachable takes your whole domain offline, this redundancy is worth setting up properly. Here is how.

Why you need it

If you run a single nameserver and it fails, nothing about your domain resolves — website, email, everything. Multiple nameservers on different systems (ideally different networks) remove that single point of failure. Most registries require at least two nameservers for exactly this reason.

How it works

The secondary pulls the zone from the primary via a zone transfer and serves an identical copy. You still make all edits on the primary; the secondary stays in sync automatically.

Setting it up

1. On the primary: allow zone transfers to the secondary's IP only, ideally authenticated with TSIG, and enable NOTIFY so the secondary is told of changes promptly.
2. On the secondary: configure it as a secondary/slave for your zone, pointing at the primary as its source.
3. Add NS records for both nameservers at your zone apex.
4. Delegate at the registrar — list both nameservers for the domain, adding glue records if the nameservers are within your own domain.

Options for the secondary

• A second server you run — full control; make sure it is on separate infrastructure so a single outage does not take out both.
• A managed secondary DNS service — a provider hosts the secondary for you, often on an anycast network for extra resilience.

Verify redundancy

Query each nameserver directly with dig to confirm both return the same, current data. Change a record and check the secondary picks it up. Keep serials in mind — if the secondary is stale, the SOA serial was likely not incremented.

Frequently asked questions

How many nameservers should I run?

At least two, and ideally on separate networks or providers so one outage cannot take out all of them. Registries generally require a minimum of two, and more can add resilience for important domains.

Do I edit records on the secondary?

No — always edit on the primary. The secondary pulls changes automatically via zone transfer. Editing the secondary directly would put it out of sync and be overwritten on the next transfer.

My secondary is serving old data.

Usually the SOA serial was not incremented, so the secondary sees no change to pull — or transfers/NOTIFY are misconfigured. Bump the serial and confirm the primary allows transfers to the secondary's IP.