Setup manual

Service addresses

Each nameserver below is an independent secondary with its own transfer address — allow AXFR/IXFR from both, not just one.

Setup

1. Add the zone in the panel. Give the primary address, or leave it blank and we derive it from your zone's SOA MNAME. A primary that answers AXFR on a non-standard port goes in the optional port field; blank means 53.
2. Allow AXFR/IXFR from 45.33.10.30 and 45.33.10.40 on your primary — both addresses, not just one.
3. Add ns1.staging.otterdns.internal and ns2.staging.otterdns.internal to the zone apex NS set and the registrar delegation. At least one is required; we recommend delegating both for full redundancy.
4. Optional: configure NOTIFY to both transfer addresses so updates propagate in seconds.

No TSIG: our published source addresses authorize the transfer.

Configuration examples

BIND (named.conf)

zone "example.com" {
    type primary;
    file "example.com.zone";
    allow-transfer { 45.33.10.30; 45.33.10.40; };
    also-notify { 45.33.10.30; 45.33.10.40; };
};

PowerDNS Authoritative (pdns.conf)

allow-axfr-ips=45.33.10.30/32,45.33.10.40/32

also-notify=45.33.10.30,45.33.10.40

Knot DNS (knot.conf)

remote:
  - id: otterdns-ns1
    address: 45.33.10.30
  - id: otterdns-ns2
    address: 45.33.10.40
acl:
  - id: otterdns-ns1-transfer
    address: 45.33.10.30
    action: transfer
  - id: otterdns-ns2-transfer
    address: 45.33.10.40
    action: transfer
zone:
  - domain: example.com
    acl: [otterdns-ns1-transfer, otterdns-ns2-transfer]
    notify: [otterdns-ns1, otterdns-ns2]

NSD (nsd.conf)

zone:
    name: "example.com"
    zonefile: "example.com.zone"
    provide-xfr: 45.33.10.30 NOKEY
    notify: 45.33.10.30 NOKEY
    provide-xfr: 45.33.10.40 NOKEY
    notify: 45.33.10.40 NOKEY

Delegation

We remove zones that go 30 days without at least one of ns1.staging.otterdns.internal / ns2.staging.otterdns.internal in their delegation. The zone page shows the exact removal date whenever that countdown is running. Delegating only one of the two still counts, but we recommend both for full redundancy.