Saphira Linux dnsDragon

Resilience comes from having more than one nameserver. A primary (master) holds the zone; one or more secondaries (slaves) copy it over a zone transfer (AXFR) and answer too. BIND handles this with TSIG keys for authenticated transfers, an ACL listing permitted secondaries, and notify so the primary tells secondaries to pull changes the moment the serial increases.

The configuration below is a redacted anatomy of a real Saphira authoritative nameserver. Secrets and internal addresses are replaced with placeholders; the structure — control channel, slave ACL, TSIG keys, restricted transfers, explicit notify — is exactly how ns0.zerodns.co.uk operates with its secondary ns1.

// ZeroDNS Authoritative Nameserver Configuration (anatomy — redacted)
// Generated by tools/assemble_bind9live.py
//
// Deploy:  cp etc/bind/*  /etc/bind/
//          cp var/bind/*  /var/bind/
// Run:     named -c /etc/bind/named.conf.zerodns.authoritative

include "/etc/bind/rndc.key";

controls {
        inet 127.0.0.1 port 953
                allow { 127.0.0.1; }
                keys { "rndc-key"; };

        inet ::1 port 953
                allow { ::1; }
                keys { "rndc-key"; };
};

acl "authorised-slaves" {
    216.218.133.2;        // example external secondary (HE.net tunnelbroker anycast)
    2001:470:600::2;      // example external secondary (HE.net, IPv6)
    2001:db8:example::53; // your secondary address (replace with your own)
};

key "he-axfr-20260620" {
    algorithm hmac-sha256;
    secret "<base64 TSIG secret>";
};

key "ns0-ns1-axfr-20260625" {
    algorithm hmac-sha256;
    secret "<base64 TSIG secret>";
};

options {
    directory "/var/bind";

    listen-on port 53 { 127.0.0.1; };
    listen-on-v6 port 53 {
        ::1;
#        2001:db8:example::53;   // this server's external IPv6
    };

    recursion no;
    allow-query { any; };

    allow-transfer {
        key "ns0-ns1-axfr-20260625";
        2001:db8:example::53;
    };

    notify explicit;
    also-notify {
        2001:db8:example::53 key "ns0-ns1-axfr-20260625";
    };

    dnssec-validation no;

    pid-file "/var/run/named/named.pid";
    session-keyfile "/var/bind/session.key";
};

include "/etc/bind/named.conf.zerodns.zones";
include "/etc/bind/named.conf.production.zones";

• controls / rndc.key — the localhost control channel used by rndc to reload and query the server.
• acl authorised-slaves — the addresses permitted to receive zone transfers.
• key (TSIG) — a shared secret that authenticates transfers so only your secondary can pull the zone.
• allow-transfer — restricts who may copy the zone; here, the TSIG key plus the secondary address.
• notify explicit / also-notify — the primary pushes a notification to the secondary when the serial changes, prompting a transfer.

Authoritative DNS, like every Saphira service, is better with IPv6 — and many registrars and resolvers now expect it. If your access provider has not caught up, Hurricane Electric (HE.net) provides a free IPv6 tunnel broker that gives a suitable machine or network real IPv6 connectivity. That lets you run Saphira services, including your nameserver, on IPv6 even where the underlying link is IPv4-only.

• Hurricane Electric
• HE.net IPv6 Tunnel Broker

Where you register a domain determines who publishes the DS record that completes your DNSSEC chain of trust. For UK users we recommend UK2.net. One practical reason is that UK2.net can handle the registrar and parent side of DNSSEC setup — the DS record that ties your signed zone to the .uk parent at Nominet. That matters precisely because, as the DNSSEC page explains, you do not control the parent yourself.

• UK2.net

BIND can do far more than this first guide covers, and dnsDragon may eventually grow into management tooling that removes the repetitive parts: creating zones, adding and removing records, maintaining serials, DNSSEC signing and key rotation, checking delegation, and managing secondaries. None of that exists today. For now, dnsDragon is BIND 9 on Saphira and a guide that makes running authoritative DNS yourself approachable — without pretending it is trivial.

• BIND 9 Administrator Reference Manual
• ISC BIND