Private Masters

Private Masters relay selected zones from a DNS server you operate to echo reply’s authoritative network. Your server remains the primary. Echo reply pulls zone transfers from it and serves the enabled zones. This is an Enterprise feature, available to members with domain-edit permission in an Enterprise organisation.

Before you add a Private Master

Make sure the primary DNS server:

  • has a stable public IP address reachable for zone transfers
  • can serve AXFR over plain TCP with TSIG, or XFR-over-TLS with TSIG
  • can send DNS NOTIFY to the IP addresses shown by the application, if you want changes to be picked up sooner than the SOA refresh interval

The application shows the exact transfer-source and NOTIFY-target IP addresses for your Private Master. They are different address lists. Use the transfer-source addresses in your firewall rules to allow inbound transfers; configure the NOTIFY-target addresses as destinations on your primary.

Add a Private Master

  1. Open Private Masters and choose Add Private Master.
  2. Select the Enterprise organisation, give the primary a name, and enter its public IP address.
  3. Choose Plain TCP + TSIG or XFR-over-TLS. The default ports are 53 for plain TCP and 853 for XFR-over-TLS; change the port only if your primary listens elsewhere.
  4. Use the automatically generated TSIG key unless you need to use an existing key. If you enter one manually, the name, algorithm, and secret must match the key configured on your primary.
  5. Add any other public addresses the primary may send NOTIFY from. Leave Accept unsigned NOTIFY off if your primary can sign notifications with the configured TSIG key. Enable it only when needed; unsigned notifications are accepted only from the listed source addresses. Zone transfers remain TSIG-authenticated.
  6. Save the master.

The success page shows the generated TSIG secret once. Copy it and store it securely before leaving the page; it cannot be viewed again. If it is lost, the application does not reveal it again. Its recovery instruction is to delete and recreate the Private Master to issue another key; coordinate a replacement before doing this on a relay that is serving production zones.

Configure the primary and add zones

After saving, follow the Next Steps and connection details on the Private Master page:

  1. Configure the TSIG key and allow transfers from every transfer-source IP shown by the application, including in any cloud or host firewall.
  2. Configure the primary to send NOTIFY to the displayed NOTIFY target IPs. The primary must send from one of the Private Master’s allowed NOTIFY source addresses. Add an address if the server sends from another interface. Follow any transport warning shown on the page: some DNS servers send NOTIFY over IPv4 UDP, which is not supported on every listed path. Use the supported target address or allow the SOA refresh timer to detect updates.
  3. Under the Private Master, declare each zone to relay. You can add zones individually or use Bulk Add Zones for a list.
  4. Enable the declared zones when the primary is ready to serve them.

Use the SOA primary nameserver shown by echo reply as the MNAME in the zone’s SOA record, and publish the listed authoritative nameservers as NS records at the zone’s parent when delegation is required. The detail page also shows whether the desired configuration has been applied and any deployment error that needs attention.

Manage status and capacity

An enabled Private Master zone is relayed and served by echo reply. Disabling the master requests removal of its enabled zones while keeping the declared zone list, so it can be re-enabled later. Wait for the detail page to show the result before treating a requested change as complete.

Enabled Private Master zones share the organisation’s zone allowance with hosted DNS zones. Review usage in Billing before enabling more zones or reducing plan capacity. A reduction cannot leave the organisation serving more zones than the new allowance supports.

Check a relayed zone

Open the zone under its Private Master to check status and, when available, view DNS query telemetry. A transfer or NOTIFY problem is usually on the path between your primary and the relay. Recheck the IP addresses, port, transport, TSIG name, algorithm, secret, firewall rules, and NOTIFY source addresses against the values shown by the application.