Enable secondary DNS

Overview

• PrivateZone uses secondary DNS to synchronize DNS data from your data center to Alibaba Cloud.

• After you enable secondary DNS for a private zone, you cannot manually modify DNS records in the DNS settings. All DNS records must be synchronized from the primary DNS.

• The primary DNS in your data center must have a public IP address for data synchronization and have TCP/UDP port 53 open.

Prerequisites

To enable secondary DNS, you first need to configure your primary DNS server. Then, you can enable secondary DNS for your private zone in the Alibaba Cloud DNS console. Because DNS implementations can vary, this guide uses a self-managed DNS server with BIND 9.9.4 or later as an example to show how to configure the primary DNS.

1. Add the following configuration to the named.conf file on your BIND 9 server:

zone "example.com" IN {
    type master;
    allow-update { 127.0.0.1; };
    allow-transfer {key test_key;};
    notify explicit;
    also-notify {39.107.XXX.XXX port 53 key test_key;39.107.XXX.XXX port 53 key test_key;};
    file "zone_file";
};

Parameter description

• zone: The domain name of the zone. In this example, replace example.com with your actual domain name.

• allow-transfer: The name of the key that allows the server to perform zone transfers by using Transaction Signature (TSIG). TSIG is supported for secure communication between the primary and secondary DNS.

  Note: To secure DNS messages in compliance with RFC standards, use Transaction Signature (TSIG). TSIG uses a shared secret key and a one-way hash function to authenticate DNS messages, which helps ensure the security of data synchronization between the primary and secondary DNS. You can generate a TSIG key with the MD5, SHA-256, or SHA-1 algorithm and configure the key on both your primary and secondary DNS servers.

• also-notify: The IP addresses of the secondary DNS servers to notify when the zone is updated. Multiple IP addresses are supported. Set this parameter to the IP addresses of the Alibaba Cloud secondary DNS servers. You can find these IP addresses on the secondary DNS configuration page in the console.

Secondary DNS servers: 39.107.XXX.XXX, 39.107.XXX.XXX

Note: After you change the configuration in the named.conf file, you must restart the application.

Restart command: rndc reconfig

Generate a TSIG key

1. Use the dnssec-keygen tool to generate a TSIG key. The command is as follows:

dnssec-keygen -a HMAC-SHA256 -b 128 -n HOST test_key

Command output:

Generating key pair
test_key.+157+64252

Command:

• -a: Specifies the encryption algorithm. Valid values: HMAC-MD5, HMAC-SHA1, and HMAC-SHA256.

• -b: Specifies the key size in bits. The key size depends on the algorithm used. For HMAC keys, the size must be between 1 and 512 bits.

• -n: Specifies the owner type of the key file. Valid values: ZONE, HOST, ENTITY, and USER. Typically, you use HOST or ZONE.

• test_key: Specifies the name of the key file. This name is used for the allow-transfer parameter when you configure the primary DNS in BIND and for the TSIG Key Name parameter when you add the primary DNS information.

After you run the command, a .key file and a .private file are generated in the current directory, such as Ktest_key.+157+64252.key and Ktest_key.+157+64252.private. The .key file contains the DNS KEY record. This record is the value you will enter for TSIG Key Value when you add the primary DNS information. The .private file contains fields specified by the encryption algorithm.

2. Add the generated key to the named.conf file.

• Paste the key into the named.conf file in the following format:

key "test_key" {        algorithm hmac-sha256;       secret "your-secret-key-string";};

• Alternatively, use an include file:

You can add the key to the named.conf file by using an include statement. For example:

include "/etc/named/dns-key";

The /etc/named/dns-key file uses the following format:

key "test_key" {
        algorithm hmac-sha256;
        secret "your-secret-key-string";
};

Procedure

1. Log in to the Alibaba Cloud DNS console.

2. In the left-side navigation pane, choose Secondary DNS. Then, click Add Secondary DNS and select the domain for which you want to enable secondary DNS.

3. On the secondary DNS page, complete the following configurations: Primary DNS Information, Server IP Addresses of Notification Senders, and Failure Notification.

   

• Primary DNS information: Click Add on the right to add a primary DNS record.

Parameters:

IP Address: Enter the public IP address of your primary DNS server. This address must be accessible from the internet.
TSIG Key Type: Select the encryption algorithm. Valid values: SHA1, SHA256, and MD5.
TSIG Key Name: Enter the name of the generated TSIG key.
TSIG Key Value: Enter the value of the generated TSIG key.

• Server IP addresses of notification senders: Click Add on the right and enter the IP address or IP address range of the server that sends notifications.

IP Address: When a DNS record on the primary DNS changes, the primary DNS server sends a NOTIFY request to the secondary DNS. To prevent these requests from being rejected, you must add the IP addresses of the servers that send the notifications.

• Enable failure notification to receive a text message when the connection between the primary and secondary DNS is interrupted.

4. After you complete the configuration, you can view the connection status on the Secondary DNS page.

• If the secondary DNS sync switch is Enabled, the secondary DNS feature is active for your domain in PrivateZone.

• If the connection status is disconnected, check for configuration errors on the secondary DNS page. Also, verify that your primary DNS server is running correctly and that its public IP address is reachable. After you fix the issue, click Connect to Primary DNS to reconnect.