Primary vs Secondary DNS
What Primary and Secondary DNS Servers Do
Secondary DNS is a setup in which one or more secondary nameservers hold a copy of a zone that is maintained on a primary server. The primary is where the zone is edited, and the secondaries answer queries from their copy and stay synchronized with it. The copying process is called a zone transfer.
The primary server, sometimes called the master, holds the authoritative version of the zone file, which is the text file listing the zone's records. When an administrator changes a record, the change is made on the primary. In a normal setup the secondaries do not accept edits. They only receive the zone and serve it to the outside world. Older documentation calls them slaves.
How Zone Transfers Keep Copies in Sync
A secondary learns about changes through the zone's SOA serial number, a version number that increases each time the zone is edited. The secondary checks the serial at intervals set in the SOA record, and when the primary's number is higher, it requests a new copy.
The primary can also speed this up. With NOTIFY, it tells the secondaries when the zone changes, so they check for updates without waiting for the next scheduled check.
Two transfer types exist. AXFR copies the entire zone, while IXFR copies only the changes since the last serial, which saves bandwidth on large zones. Transfers run over TCP, because the data can be too large for a single UDP reply. They are normally restricted to listed secondaries using access control lists or signed keys, so outsiders cannot download the full zone.
Why Redundancy Across Providers Matters
Secondary nameservers exist mainly for resilience. If the primary is unreachable, the secondaries keep answering from their copy until the zone's expire timer runs out, so the domain stays online during a short outage. This is why a zone is usually served by several nameservers in different networks.
Placing secondaries with a different provider adds protection against an outage at a single company. Spreading them across providers reduces that single point of failure, although it adds coordination work, because each provider must receive the zone correctly. A managed DNS provider can often act as a secondary, which keeps that work small.
Frequently asked questions
Is a secondary DNS server the same as a backup?
Partly. A secondary is a live copy that answers queries, so it works as a backup that is already in service. It is not a snapshot for restoring data after a mistake. If an incorrect record is saved on the primary, the secondaries copy it too, so keeping separate backups of the zone file is still useful.
Can a secondary DNS server be changed directly?
Usually not. In a standard setup the zone is edited only on the primary, and secondaries overwrite their copy with the version they receive. A change made directly on a secondary is either blocked or temporary, because the next transfer replaces it. Changes should always be made on the primary.