====== Ubuntu - Bind - Configure Bind9 - Secondary Nameserver ======

A Secondary Server is highly recommended in order to maintain the availability of the domain should the Primary become unavailable.

**IMPORTANT:**  On the Primary server, the zone transfer needs to be allowed.

Add the **allow-transfer** option to the example Forward and Reverse zone definitions in **/etc/bind/named.conf.local**:

<file bash /etc/bind/named.conf.local>
zone "example.com" {
    type master;
    file "/etc/bind/db.example.com";
    allow-transfer { 192.168.1.11; };
};
    
zone "1.168.192.in-addr.arpa" {
    type master;
    file "/etc/bind/db.192";
    allow-transfer { 192.168.1.11; };
};
</file>

<WRAP info>
**NOTE:**  Replace 192.168.1.11 with the IP Address of your Secondary nameserver.
</WRAP>


Restart BIND9 on the Primary server:

<code bash>
sudo systemctl restart bind9.service
</code>

----

===== Configure Bind9 =====

On the Secondary server.

Edit the **/etc/bind/named.conf.local** and add the following declarations for the Forward and Reverse zones:

<file bash /etc/bind/named.conf.local>
zone "example.com" {
    type slave;
    file "db.example.com";
    masters { 192.168.1.10; };
};        
          
zone "1.168.192.in-addr.arpa" {
    type slave;
    file "db.192";
    masters { 192.168.1.10; };
};
</file>

<WRAP info>
**NOTE:**  Replace 192.168.1.10 with the IP Address of your Primary nameserver.
</WRAP>


Restart BIND9 on the Secondary server:

<code bash>
sudo systemctl restart bind9.service
</code>

<WRAP info>
**NOTE:**  In **/var/log/syslog** you should see something similar to the following:

<code bash>
client 192.168.1.10#39448: received notify for zone '1.168.192.in-addr.arpa'
zone 1.168.192.in-addr.arpa/IN: Transfer started.
transfer of '100.18.172.in-addr.arpa/IN' from 192.168.1.10#53:
 connected using 192.168.1.11#37531
zone 1.168.192.in-addr.arpa/IN: transferred serial 5
transfer of '100.18.172.in-addr.arpa/IN' from 192.168.1.10#53:
 Transfer completed: 1 messages, 
6 records, 212 bytes, 0.002 secs (106000 bytes/sec)
zone 1.168.192.in-addr.arpa/IN: sending notifies (serial 5)

client 192.168.1.10#20329: received notify for zone 'example.com'
zone example.com/IN: Transfer started.
transfer of 'example.com/IN' from 192.168.1.10#53: connected using 192.168.1.11#38577
zone example.com/IN: transferred serial 5
transfer of 'example.com/IN' from 192.168.1.10#53: Transfer completed: 1 messages, 
8 records, 225 bytes, 0.002 secs (112500 bytes/sec)
</code>
</WRAP>



<WRAP info>
**NOTE:**  A zone is only transferred if the Serial Number on the Primary is larger than the one on the Secondary.

If you want to have your Primary DNS notifying other Secondary DNS Servers of zone changes, you can add **also-notify { ipaddress; };** to **/etc/bind/named.conf.local** as shown in the example below:

<file bash /etc/bind/named.conf.local>
zone "example.com" {
    type master;
    file "/etc/bind/db.example.com";
    allow-transfer { 192.168.1.11; };
    also-notify { 192.168.1.11; }; 
};

zone "1.168.192.in-addr.arpa" {
    type master;
    file "/etc/bind/db.192";
    allow-transfer { 192.168.1.11; };
    also-notify { 192.168.1.11; }; 
};
</file>


</WRAP>

<WRAP info>
**NOTE:**  The default directory for non-authoritative zone files is **/var/cache/bind/**.

This directory is also configured in [[https://ubuntu.com/server/docs/security-apparmor|AppArmor]] to allow the named daemon to write to it.

</WRAP>