Secondary DNS: A Faster, More Resilient Way to Serve Your DNS Records
DNS records are served by nameservers. A primary server is where a zone's DNS records are managed and edited. Relying on a single primary server introduces a single point of failure: if that server goes down or its provider experiences an outage, your website becomes unreachable. For an online storefront, that is the digital equivalent of locking the doors during business hours — a costly scenario.
Secondary DNS nameservers solve this by holding a read-only replica of your zone's records. Running both a primary and one or more secondary servers keeps DNS available even if one fails, distributes query load, and reduces latency. Major providers and large enterprises are increasingly spreading DNS across multiple vendors specifically to protect against DDoS attacks that could take down any single provider. Cloudflare, for instance, operates authoritative DNS in over 200 cities, achieving globally average lookup times around 11ms. Extending that service to secondary DNS lets customers use multiple providers or keep their on-premise primary server while leveraging Cloudflare's network for delivery and resilience.
Toward a Simpler Setup
Initially, Cloudflare's secondary DNS offering was built as an API-only product, aimed at a small set of Enterprise customers assumed comfortable with command-line management. Demand proved far broader. The original setup flow required a string of API calls: create the zone, define the primary server's IP and settings, link the primary server to the zone, and then initiate the zone transfer. This process left ample room for errors — missteps included forgetting to link the server or debugging typos that could take hours to resolve.
Cloudflare has since listened to that feedback and redesigned the onboarding experience. Enterprise customers entitled to secondary DNS can now configure zones through the Cloudflare Dashboard. The flow from entering a domain name to seeing records populate takes under two minutes. New safeguards stop users from adding a zone until at least one primary server is configured. Notably, users can now review transferred records before finalizing onboarding, providing immediate visibility without juggling API calls or support documentation.
How Zone Transfers Work
For a secondary server to serve a primary's records, the two must synchronize. This communication is called a zone transfer. Primary servers track zone updates using SOA (Start of Authority) records. Whenever a zone file changes, the SOA serial number increments, signaling that secondary servers should fetch a fresh copy.
On a zone change, a primary can send a NOTIFY message to its secondary servers. The secondary then performs an SOA check against the primary and proceeds with a transfer if the serial has increased. Transfers are executed via two request types:
- AXFR — a full zone transfer, typically used when a secondary is configured for the first time.
- IXFR — an incremental transfer. Here, the secondary tells the primary which version it holds, and the primary responds with only the changes needed to update to the latest version.
Many primary servers do not support NOTIFY. In those cases, the secondary periodically polls the primary's SOA record to check for a changed serial before initiating a transfer.
Securing Transfers with TSIG
Zone transfers are unauthenticated by default. TSIG (Transactional Signatures) add authentication to the DNS protocol, particularly for zone transfers. TSIG uses a shared secret and a one-way keyed hash function attached as a record on DNS messages, providing mutual authentication between primary and secondary servers:
- Only secondaries holding the correct TSIG can pull transfers from a primary.
- Secondaries will only accept transfers from primaries that attach the proper TSIG.
TSIG also provides data integrity, ensuring DNS messages are not modified in transit. Cloudflare supports TSIG and strongly recommends its use when configuring a primary server.
Analytics and Performance
Once configured, secondary zones served by Cloudflare benefit from the same DNS analytics available to authoritative DNS customers. These analytics break down DNS traffic by record type, response code, and geographic region, giving customers insight into how queries are distributed across their DNS providers. This visibility is valuable for balancing traffic and tracking performance across a multi-provider DNS architecture.
Big Cartel, an e-commerce platform that has helped users sell $2.5 billion in goods since 2005, relies on Cloudflare's secondary DNS to maintain its resilience:
"At Big Cartel, we provide an online storefront for our customers. We need to be always available and avoid any chances of downtime — eliminating all single points of failure is critical for us. With Cloudflare's Secondary DNS, we can do just that! It keeps our DNS infrastructure more resilient while allowing our customers to benefit from fast query times. Additionally, using Cloudflare's Secondary DNS analytics provides granular insights into how our traffic is balanced between our DNS providers" - Lee Jensen, Technical Director
Availability
Secondary DNS is currently available on Cloudflare's Enterprise plan. Customers interested in the service should contact their account team. Documentation on setup and management is available via Cloudflare's support articles.
