iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Configure PowerDNS replication by enabling secondary mode, defining each zone as SECONDARY (or legacy SLAVE) with one or more primary addresses, and permitting authenticated or unauthenticated AXFR/IXFR and NOTIFY traffic. The primary must also list the secondary in the zone’s NS records, allow transfers, and increment the SOA serial whenever data changes. This guide covers SQL and BIND backends, TSIG, IXFR, systemd permissions, verification, and the failure cases that most often leave a secondary stale.
PowerDNS terminology and replication model
Current PowerDNS Authoritative Server releases call the former “slave” role secondary. The slave configuration setting was renamed in version 4.5.0 and removed in 4.9.0. Database rows may still use the legacy SLAVE value for compatibility, but check the syntax supported by the release installed on each server.
A secondary does not edit the authoritative zone data. It obtains a complete zone with AXFR or a delta with IXFR from a primary, stores the result in its configured backend, and answers queries for that copy. A primary can send DNS NOTIFY immediately after a serial change; without NOTIFY, the secondary discovers changes by periodically checking the SOA serial. AXFR has no operation for deleting a zone, so deleting a zone on the primary does not automatically remove answers from a secondary.
Prerequisites and design choices
- Two reachable PowerDNS Authoritative Server installations: one primary and one secondary. They may be separate hosts or the same instance with both roles enabled.
- A backend that implements zone-transfer support. Not every PowerDNS backend can act as a primary or secondary; verify the backend’s current capability before changing configuration.
- A zone whose SOA serial is managed on the primary and incremented for every change.
- Network policy allowing DNS queries, TCP zone-transfer connections, and NOTIFY delivery between the hosts. The exact firewall syntax depends on your operating system and network appliance.
- A service account and storage location where the secondary backend can write transferred data.
Choose the transfer behavior before implementation. The following choices are independent and can be combined.
#1 Best Overall
- Watchguard T145 Firebox with 1 Year Standard Support License (WGT145001) - The Firebox T145 delivers enterprise-grade protection for branch offices and retail sites. With a blend of 2.5Gb, 1Gb, and SFP/SFP+ ports, it supports high throughput, AI-driven malware protection, and DNS filtering for robust network defense.
- Standard Support covers software updates and round-the-clock emergency help. Add a Basic or Total Security Suite to activate IPS, gateway antivirus, and web filtering so threats are blocked before they reach users.
- Standard Support provides reliable technical assistance and software updates for WatchGuard Firebox appliances. Offering 24x7 help for emergencies and business-hours support for routine needs, it ensures your network stays secure and operational.
- Interfaces and deployment: 2.5Gb and 1Gb Ethernet with SFP or SFP+ fiber for clean aggregation and segmented backhaul at the edge.
- Performance and scale: UTM up to 710 Mbps with inspection on; flexible VPN topologies for hub and spoke or mesh designs.
| Decision | Option 1 | Option 2 | When to choose |
|---|---|---|---|
| Zone representation | SQL backend row | BIND-style zone configuration | Use the representation native to the backend already deployed. |
| Primary sources | One address | Comma-separated list of addresses | Use multiple primaries for redundancy when the backend and design support it. |
| Authentication | Unauthenticated transfer restricted by ACL | TSIG-authenticated transfer | Use TSIG when transfer identity must be cryptographically verified. |
| Update retrieval | AXFR only | Attempt IXFR, falling back as supported | IXFR can reduce transfer size; AXFR is the full-zone method. |
| Change detection | SOA polling | NOTIFY plus polling fallback | NOTIFY reduces convergence time; polling remains the safety net. |
| Local storage | Writable standard path | Hardened read-only system layout | Hardened layouts require an explicitly writable backend destination. |
1. Confirm backend and release support
Identify the PowerDNS Authoritative Server version and backend on both hosts. Read the release-matched backend documentation for secondary operation and zone-transfer support. Do not assume that a backend which serves zones can also receive AXFR or IXFR.
Also check the terminology accepted by that release. Use secondary=yes in current configurations. If an older deployment still contains slave=yes, plan a version-appropriate migration rather than copying that setting into a 4.9.0-or-newer installation, where it has been removed.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall2. Enable secondary mode
On the secondary, edit the main PowerDNS configuration (commonly /etc/powerdns/pdns.conf) and add:
secondary=yes
# Configure the backend connection separately.Secondary support is disabled by default. After saving the file, restart or reload PowerDNS using the service procedure appropriate to your deployment, then confirm that the daemon starts without an unknown-setting or backend error. A configuration reload is sufficient only when your packaging and release document reload support for this setting; otherwise perform a controlled restart.
3. Define the zone on the secondary
SQL-backed deployments
Create or change the zone’s row in the backend’s domains table. The conceptual values are:
name = example.com
type = SLAVE # or the current SECONDARY representation
master = 192.0.2.10[,198.51.100.10]master contains the primary address or a comma-separated list of primary addresses. The exact schema, backend name, column types, and migration behavior vary, so use the schema supplied for your backend. Prefer supported pdnsutil or API operations when your backend exposes them instead of hand-editing tables.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSome releases and tools display SLAVE even though the product documentation now says secondary. Treat the value as a compatibility label unless your installed backend explicitly requires another spelling.
BIND backend deployments
Use the BIND backend’s supported zone configuration and mark the zone as secondary with its type and masters (or primaries) directive. Keep the file in the path and syntax expected by the exact BIND backend version; a generic BIND server configuration is not automatically valid for PowerDNS.
Rank #2
- Watchguard T145 Firebox with 3 Year Total Security Suite License (WGT145643) - The Firebox T145 delivers enterprise-grade protection for branch offices and retail sites. With a blend of 2.5Gb, 1Gb, and SFP/SFP+ ports, it supports high throughput, AI-driven malware protection, and DNS filtering for robust network defense.
- The Total Security Suite is WatchGuard’s most comprehensive security package, bundling every advanced service into one subscription. It delivers layered defense with AI-driven malware detection, DNS filtering, cloud sandboxing, and security correlation. Ideal for organizations that demand maximum protection and visibility across their network.
- The Total Security Suite equips your WatchGuard Firebox with the full set of advanced defenses. It adds AI powered malware detection, DNS filtering, cloud sandboxing, threat correlation, and automated response, all managed in WatchGuard Cloud. Ideal for organizations that need maximum protection, compliance ready reporting, and end to end visibility.
- Interfaces and deployment: 2.5Gb and 1Gb Ethernet with SFP or SFP+ fiber for clean aggregation and segmented backhaul at the edge.
- Performance and scale: UTM up to 710 Mbps with inspection on; flexible VPN topologies for hub and spoke or mesh designs.
Do not define the same zone simultaneously as a native primary and a secondary in conflicting backend records. If the instance is intentionally dual-role, make each zone’s role explicit.
4. Prepare the primary server
Replication is a two-sided configuration. On the primary:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Enable primary operation using the setting required by your PowerDNS release and deployment.
- Permit the secondary’s address to request AXFR and IXFR. Restrict this permission to the required secondary addresses.
- Ensure the zone’s NS RRset contains the secondary nameserver name.
- Publish an A and/or AAAA record for that nameserver name, as appropriate. The PowerDNS setup requirements call for correct NS and address records for every secondary.
- Increment the SOA serial whenever zone data changes. A secondary will not retrieve a change whose serial is unchanged.
- Configure the primary to send NOTIFY to the secondary, either through the zone’s normal authoritative behavior or your deployment’s explicit notification settings.
An NS record alone does not grant transfer access, and a transfer ACL alone does not make the secondary an authoritative nameserver. Both the delegation data and the transfer policy must be correct.
5. Open the required network paths
Permit the following flows between the hosts, limiting source and destination addresses where possible:
- DNS query traffic so clients and the secondary can reach the authoritative service.
- TCP traffic for AXFR and IXFR. Zone transfers use TCP even when ordinary DNS queries commonly use UDP.
- NOTIFY traffic from the primary to the secondary. NOTIFY causes an immediate freshness check; it does not itself carry the zone data.
Check host firewalls, cloud security groups, load balancers, and any network ACLs. There is no universal firewall command in PowerDNS documentation because the correct syntax depends on the operating system and deployment.
6. Secure transfers with TSIG when required
For authenticated transfers, create the same named TSIG key (name, algorithm, and secret) on both servers using your organization’s secret-management procedure. On the secondary, associate the key with the zone using the per-zone AXFR-MASTER-TSIG metadata. On the primary, configure the transfer ACL or per-zone metadata to allow that corresponding key; TSIG-ALLOW-AXFR is the relevant per-zone control in PowerDNS deployments that use it.
Keep the key name and algorithm exactly consistent, protect the secret from world-readable configuration and backups, and verify that the primary’s ACL permits the secondary’s source address as well as the key. A key mismatch commonly appears as a transfer refusal or authentication failure rather than a simple connection error.
If the secondary has multiple network interfaces, AXFR-SOURCE can select the source address used for AXFR and IXFR requests. Choose an address that the primary’s ACL and firewall actually permit.
Rank #3
- 4x Intel i226-V 2.5G LAN: Upgraded with 4 genuine Intel i226-V 2.5GbE ports, offering up to 2.5x faster throughput than standard gigabit. Delivers low latency, high stability, and native driver support for modern pfSense, OPNsense, OpenWrt, and Linux distributions.
- High-End Core i7 Powerhouse: Equipped with the premium Intel Core i7-4500U processor (4M Cache, up to 3.00 GHz), delivering maximum single-thread compute power and processing speed for deep packet inspection (IDS/IPS like Suricata/Snort), intensive VPN tunnels, and complex multi-device network management.
- Fanless Aluminum Silent Chassis: Engineered with a rugged aluminum alloy casing that acts as a passive heatsink. The 100% silent, fanless design eliminates dust buildup and moving-part failures, maximizing hardware longevity.
- Flexible Memory & Storage Storage: Features 1x DDR3L SO-DIMM RAM slot, 1x mSATA SSD slot, and 1x 2.5-inch SATA drive bay, allowing flexible expansion for extensive network logging, packet capturing, or caching.
- Industrial & Essential I/O: Equipped with 1x RS232 COM port for serial console access or industrial control, 1x HD Port for direct display output, and 4x USB ports, offering robust enterprise capabilities in a compact footprint.
7. Select IXFR or AXFR retrieval
PowerDNS can retrieve IXFR updates, but it cannot serve IXFR updates itself. Set the zone’s IXFR metadata to 1 when the secondary should attempt incremental retrieval. If an incremental history is unavailable or unusable, the transfer may require a full AXFR according to the primary and secondary capabilities.
IXFR needs careful handling around DNSSEC changes. The documentation warns that a transition from non-DNSSEC to DNSSEC, or a change in NSEC3 mode, may not be fully represented by IXFR. When such a transition occurs and the secondary has stale DNSSEC state, delete the zone contents through the supported administrative process and force a fresh retrieval rather than relying on an incremental delta.
Use the metadata command supported by your release and tooling. PowerDNS documents pdnsutil metadata set for per-zone metadata; releases before 5.0 used the older set-meta spelling. Confirm the exact command with the installed version before running it.
8. Make the secondary’s storage writable
A transfer can succeed on the wire and still fail to persist. The packaged systemd unit uses ProtectSystem=full, which can prevent writes under /etc or /home. Verify that the backend’s database, journal, or transfer destination is writable by the PowerDNS service account.
For a hardened host, deliberately choose one of these approaches:
- Place writable backend data in a directory permitted by the unit’s sandbox.
- Add a narrowly scoped systemd filesystem exception for the intended path, then reload systemd and restart PowerDNS.
- Use a database service whose network endpoint is writable while keeping local configuration read-only.
Do not make the entire filesystem writable merely to test replication. Check ownership, mode bits, mandatory access controls, container mounts, and disk capacity.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →9. Trigger and verify the first transfer
- Confirm that the primary serves the intended zone and has a current SOA serial.
- Confirm that the secondary backend contains the zone with the secondary type and correct primary address list.
- From the secondary host, request an immediate retrieval with
pdns_control retrieve example.com, replacing the name with the exact zone. - Watch the PowerDNS service log while the retrieval runs. Look for connection, ACL, TSIG, serial, backend, and permission errors.
- Query the secondary directly for the SOA record and compare its serial with the primary. Query an ordinary record as a second check that the transferred data is present.
- Change a record on the primary, increment the SOA serial, and observe whether NOTIFY causes a prompt check. If NOTIFY is unavailable, wait for the normal SOA polling interval and compare serials again.
A successful TCP connection does not prove that a zone transferred. The decisive checks are a completed AXFR or IXFR in the log, persisted data in the backend, and matching SOA serials.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failures and targeted fixes
“Secondary support disabled”
Set secondary=yes on the intended secondary, restart or reload using the release-supported method, and confirm that the running process read the file you edited. Check for a second configuration file, container-mounted configuration, or a command-line override.
Rank #4
- 4x Intel i226-V 2.5G LAN: Upgraded with 4 genuine Intel i226-V 2.5GbE ports, offering up to 2.5x faster throughput than standard gigabit. Delivers low latency, high stability, and native driver support for modern pfSense, OPNsense, OpenWrt, and Linux distributions.
- Upgraded Turbo i5 Performance: Powered by the Intel Core i5-4200U processor (3M Cache, up to 2.60 GHz with Turbo Boost), providing enhanced multi-tasking capability and faster clock speeds to handle heavy cryptographic workloads, VPN routing, and basic virtualization.
- Fanless Aluminum Silent Chassis: Engineered with a rugged aluminum alloy casing that acts as a passive heatsink. The 100% silent, fanless design eliminates dust buildup and moving-part failures, maximizing hardware longevity.
- Flexible Memory & Storage Storage: Features 1x DDR3L SO-DIMM RAM slot, 1x mSATA SSD slot, and 1x 2.5-inch SATA drive bay, allowing flexible expansion for extensive network logging, packet capturing, or caching.
- Industrial & Essential I/O: Equipped with 1x RS232 COM port for serial console access or industrial control, 1x HD Port for direct display output, and 4x USB ports, offering robust enterprise capabilities in a compact footprint.
No transfer after a primary change
Check the primary’s SOA serial first. If it did not increase, the secondary correctly sees no new version. Then verify NOTIFY delivery, the secondary’s NS record and address, TCP reachability, and the secondary log. Use pdns_control retrieve <zone> to separate an automatic-notification problem from a transfer or backend problem.
Transfer refused or TSIG failure
Inspect the primary’s AXFR ACL and TSIG settings, including AXFR-MASTER-TSIG and TSIG-ALLOW-AXFR where used. Confirm the key name, algorithm, secret, source address, and zone name match exactly. Ensure TCP transfer traffic is allowed in both directions required by the connection.
Recommended Free Tools
Zone never persists
Review the systemd ProtectSystem=full restriction and service-account permissions. A successful transfer followed by an unchanged secondary usually indicates a backend write, path, mount, or permission problem rather than DNS protocol failure.
IXFR leaves stale DNSSEC data
For a non-DNSSEC-to-DNSSEC transition or an NSEC3-mode change, remove the secondary’s zone contents through the supported backend or administrative tool and force a new full retrieval. Do not repeatedly retry the same IXFR history when the history cannot represent the transition.
A deleted primary zone still answers on the secondary
This is expected: AXFR has no zone-deletion operation. Remove the retired zone explicitly from the secondary using the backend’s supported deletion method, then verify that queries no longer return authoritative data from that server.
Primary and secondary roles are mixed unintentionally
One PowerDNS instance may legitimately be both primary and secondary when both settings are enabled. For every zone, however, define one clear role and one authoritative source path. Conflicting records or metadata can make an instance answer locally while also attempting transfers, obscuring which copy is current.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Operational checklist
- Installed release uses
secondary=yes; legacyslavesyntax is not copied into a release where it was removed. - Selected backend explicitly supports secondary operation and transfers.
- Every secondary zone has the correct type and primary address list.
- Primary SOA serial increases for each change.
- Secondary nameserver appears in the zone’s NS RRset with matching A/AAAA data.
- TCP transfer, DNS query, and NOTIFY paths are permitted.
- TSIG settings match on both sides when authentication is required.
- IXFR metadata is enabled only when desired and compatible with the DNSSEC change history.
- PowerDNS can write its backend or transfer destination despite systemd hardening.
- Logs, SOA serials, and direct queries confirm the transfer and persistence.
- Retired zones are explicitly removed from secondaries.
What a correct final state looks like
The secondary starts with secondary mode enabled, has a backend record identifying each replicated zone and its primary address or addresses, and can write the received data. The primary recognizes the secondary as an authorized transfer client, publishes the secondary in the NS set, and sends NOTIFY after serial changes. A manual pdns_control retrieve completes, the secondary log records AXFR or IXFR success, and direct SOA queries show the same serial on both servers. Subsequent changes converge through NOTIFY when available and through SOA polling as a fallback.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
