---
title: "Secondary DNS"
type: "page"
post_id: "173"
slug: "secondary-dns"
canonical: "https://www.zoneedit.com/secondary-dns/"
markdown_url: "https://www.zoneedit.com/secondary-dns.md"
json_url: "https://www.zoneedit.com/secondary-dns.json"
txt_url: "https://www.zoneedit.com/secondary-dns.txt"
published: "2026-08-06T17:04:04+00:00"
modified: "2026-08-06T17:04:41+00:00"
author: "markjr"
categories:
tags:
site_name: "ZoneEdit"
publisher: "Zoneedit.com"
language: "en-US"
generator: "easyPress AI Discoverability"
generator_version: "2.0.12"
---
Secondary DNS

Redundancy for a primary you run.
=================================

Keep your existing primary DNS server — BIND, PowerDNS, Windows DNS, or anything that speaks standard zone transfers — and let ZoneEdit serve your zones as a secondary across our anycast network.

[Get started](https://www.zoneedit.com/signup/) [Our network](https://www.zoneedit.com/network/)



How it works
------------

Your server stays the source of truth. ZoneEdit pulls each zone from your primary with a standard transfer (AXFR) and answers queries for it worldwide. When you change a zone, your primary sends a NOTIFY and we re-transfer right away — otherwise we refresh on the timers in your SOA record.



Three steps to set it up
------------------------

### 1. Allow transfers

On your primary, permit zone transfers to `64.68.198.91` and add the same address to your notify list.



### 2. Add the zone

Add the domain in your ZoneEdit account as a secondary zone, pointing at your primary server’s IP.



### 3. Publish

Add the ZoneEdit nameservers for the zone at your registrar so resolvers can use them.







Example: BIND
-------------

On the primary side, allow transfers to and notify `64.68.198.91`:

```
zone "example.com" {
        type master;
        file "example.com.zone";
        allow-transfer { 64.68.198.91/32; };
        also-notify { 64.68.198.91; };
};
```

Not running BIND? Any authoritative server works the same way: allow AXFR from `64.68.198.91` and send NOTIFYs to it.

**Firewall note**Transfer requests originate from `64.68.198.91` — make sure TCP port 53 from that address can reach your primary.





Add resilient secondaries
-------------------------

Your primary, our anycast edge.

[Get started](https://www.zoneedit.com/signup/)

[About Managed DNS →](https://www.zoneedit.com/managed-dns/)