Search... ⌘ K
Get Started Contact Sales

Add DNSimple as a secondary DNS server

Table of Contents

This guide covers inbound secondary DNS: an external primary holds the zone, and DNSimple is the secondary (follower). For concepts, see What is Secondary DNS?. If your primary should stay off public NS records, see Add DNSimple as Secondary DNS with a Hidden Primary.

For the opposite direction (DNSimple as primary), see Add a secondary DNS server to DNSimple.

Video walk-through

Requirements

  1. A primary DNS provider that supports AXFR.
  2. A DNSimple account on a plan that includes DNSimple as secondary DNS (Teams or Enterprise).
  3. Ability to allow DNSimple’s AXFR client IPs on your primary provider ACL.
  4. Ability to change domain delegation at your registrar if you want both providers in the public NS set.

Warning

Do not add DNSimple as a secondary DNS server to domains with DNSSEC. DNSimple does not import external RRSIG records, which produces resolution failures from DNSSEC-aware resolvers. See Why DNSSEC and Secondary DNS May Not Work Together.

Add a secondary zone

Create a secondary zone
  1. Log in to DNSimple with your user credentials.
  2. If you have more than one account, select the relevant one.
  3. In the top header, click . Secondary DNS tab
  4. On the Domain Names page, click (upper right, next to ).
  5. Choose . Add new Secondary DNS Zone
  6. Enter the domain name for which you want DNSimple as the secondary DNS provider. Secondary Zone form
  7. Create the zone.

Add a primary server

Primary server entries can be reused across all the secondary zones you set up. If you need to add a new entry, fill in the form with an alias name, and the IP address and port number provided by your primary DNS provider. For the limits on each field, see Secondary DNS Field Reference.

Create a primary server
  1. Open the secondary zone you created.
  2. Add a primary server.
  3. Enter an alias name, the IP address, and the port from your primary DNS provider. Primary Server form
  4. Save the primary server.

Configure AXFR at your primary DNS provider

Allow DNSimple’s AXFR client IPs on your primary provider ACL before you link the zone. Zone transfers fail until the ACL allows these clients.

Production

  • 3.12.234.2
  • 2600:1f16:ae2:e900:f05c:9438:865f:64a0

Note

Confirm these client IPs still match production before relying on them in a change window. If a transfer fails after ACL updates, contact support.

API documentation: Secondary DNS API.

Linking a secondary zone to a primary server enables zone transfers (AXFR) that keep your domain at DNSimple in sync with your primary DNS provider.

  1. Open the secondary zone by clicking the zone name.
  2. Select . Secondary Zone view
  3. Choose the primary server you want to pull the zone file from. You can choose more than one primary server. Link Secondary Zone to Primary Server

DNSimple attempts the first zone transfer after linking to sync the zone with DNS records from the primary. This can take a few minutes, especially if you just added DNSimple’s AXFR client IPs to the primary ACL.

Note

If you added DNSimple to the primary ACL after linking, or more than 10 minutes have passed and no records appear, confirm the AXFR client IPs are on the access-control list (ACL) at your primary. This allows DNSimple to carry out zone transfer via AXFR. After confirming the IPs are present, use and again. Allow another 10 minutes for the initial zone transfer. For more checks, see Troubleshoot Secondary DNS Zone Transfers. If it still fails, contact support.

Delegate through both providers

Update the NS set at your primary

Include some of DNSimple’s name servers in the zone NS set at the primary, for example:

  • NS example.com ns1.primary.com
  • NS example.com ns2.primary.com
  • NS example.com ns3.primary.com
  • NS example.com ns1.dnsimple-edge.com
  • NS example.com ns2.dnsimple-edge.net
  • NS example.com ns3.dnsimple-edge.io
  • NS example.com ns4.dnsimple-edge.org

Update registrar delegation

Update the delegation at the domain registrar with a mix of name servers from both your primary DNS provider and DNSimple. The list of name servers should match those used for the NS record set (see previous step).

Once this is in place, DNS queries for that domain will be randomly answered by either of the two providers, which provides greater redundancy.

Example:

  • ns1.primary.com
  • ns2.primary.com
  • ns3.primary.com
  • ns1.dnsimple-edge.com
  • ns2.dnsimple-edge.net
  • ns3.dnsimple-edge.io
  • ns4.dnsimple-edge.org

Remove an inbound secondary zone

If you created a secondary zone by mistake, or you no longer want DNSimple as a secondary for that domain, move delegation away from DNSimple, unlink the primary server, then delete the domain from your account.

Warning

Deleting a domain permanently removes its records from your DNSimple account. This is irreversible. If the domain still resolves through DNSimple, resolution stops as soon as the records expire according to their TTL, so move delegation away from DNSimple first. Deleting a domain from your account does not cancel a registration held at DNSimple. See Delete a Domain.

  1. If your registrar delegation lists DNSimple name servers for this domain, update the delegation first so it no longer points at DNSimple for that zone. Wait for the old NS records to expire according to their TTL.
  2. In the top header, click , then open the secondary zone.
  3. In the list, click for each linked primary (trash icon). Confirm when prompted.
  4. On the left tabs for that domain, click .
  5. On the card, click , then confirm.
  6. Optionally, open the primary server entry and, on the card, click if no other secondary zones use it.

After you delete the domain, DNSimple no longer answers queries for that zone. Resolution continues on whatever name servers remain in the public delegation and at your primary.

Outbound secondary DNS (DNSimple as primary) uses a different teardown path, including a staged wait before zone transfers stop. See Disable secondary DNS in Add a secondary DNS server to DNSimple.

Have more questions?

If you have any questions about inbound secondary DNS, contact support, and we will be happy to help.