Primary vs Secondary DNS Explained
Key Points
- DNS translates human‑readable domain names (e.g., ibm.com) into IP addresses by routing queries from a resolver to authoritative name servers, which return the correct IP to the user’s computer.
- As an administrator, you configure an authoritative zone on a primary name server (ns1.ibm.com) with records such as A, NS, and MX to define the domain’s services.
- To ensure resilience, a secondary name server (ns2.ibm.com) must hold an exact copy of the primary zone so traffic can still be resolved if the primary server fails.
- Manually replicating zone data across multiple servers is error‑prone and creates synchronization delays, highlighting the need for automated zone transfer mechanisms.
- Primary and secondary DNS servers address this need: the primary hosts the master copy, while secondary servers automatically pull updates, providing reliable, consistent DNS service.
Sections
- Primary vs Secondary DNS Overview - The speaker explains DNS fundamentals, the lookup process, and how administrators configure primary and secondary name servers for resilient domain resolution.
- DNS Redundancy vs Advanced Load Balancing - The speaker explains that while configuring multiple name servers (primary/secondary) ensures reliable DNS redundancy, this setup cannot support advanced features such as global server load balancing or traffic steering, which are proprietary and not transferable via zone transfers.
Full Transcript
# Primary vs Secondary DNS Explained **Source:** [https://www.youtube.com/watch?v=qhiyTH5B21A](https://www.youtube.com/watch?v=qhiyTH5B21A) **Duration:** 00:15:15 ## Summary - DNS translates human‑readable domain names (e.g., ibm.com) into IP addresses by routing queries from a resolver to authoritative name servers, which return the correct IP to the user’s computer. - As an administrator, you configure an authoritative zone on a primary name server (ns1.ibm.com) with records such as A, NS, and MX to define the domain’s services. - To ensure resilience, a secondary name server (ns2.ibm.com) must hold an exact copy of the primary zone so traffic can still be resolved if the primary server fails. - Manually replicating zone data across multiple servers is error‑prone and creates synchronization delays, highlighting the need for automated zone transfer mechanisms. - Primary and secondary DNS servers address this need: the primary hosts the master copy, while secondary servers automatically pull updates, providing reliable, consistent DNS service. ## Sections - [00:00:00](https://www.youtube.com/watch?v=qhiyTH5B21A&t=0s) **Primary vs Secondary DNS Overview** - The speaker explains DNS fundamentals, the lookup process, and how administrators configure primary and secondary name servers for resilient domain resolution. - [00:11:45](https://www.youtube.com/watch?v=qhiyTH5B21A&t=705s) **DNS Redundancy vs Advanced Load Balancing** - The speaker explains that while configuring multiple name servers (primary/secondary) ensures reliable DNS redundancy, this setup cannot support advanced features such as global server load balancing or traffic steering, which are proprietary and not transferable via zone transfers. ## Full Transcript
today we're going to be talking about
secondary vers
primary
DNS we'll be covering what they are why
they're different and how you would use
one or the other so to start I'm going
to do a brief review of DNS what it is
and how it works so if you recall if I'm
a user if I have a user on the internet
and he wants to access
ibm.com uh his computer is going to use
the DNS system to look up the IP address
what'll happen is his computer will talk
to a DNS resolver out on the internet
the resolver will know how to navigate
the DNS system it will make its way to
an authoritative name server which will
have the IP address for dubdub du.
ibm.com it will send it back send that
IP address back to the user and now my
user uh can actually make his way to the
IBM website and he can browse and see
all of our products and services life is
good but now you're the administrator
and your job is to set up the DNS so
that this user can make it to ibm.com
and you want to do it in such a way that
it's resilient and uh ensures that if if
a server is down the user can still make
it to ibm.com so what I'm going to do as
an administrator is I'm going to go to
my name server
uh we'll say uh this name server is
ns1
ibm.com common name for a name server
and I'm going to this is for the zone
ibm.com and I'm going to set up the
records in my zone so I might have the
record for dub dub dub it's going to be
an a record and the IP address is
9.9.9 do1
and then it's going to have a uh name
server record for ibm.com which is going
to point at ns.
ibm.com and then I might also have a
mail record uh for the name mail it'll
be an MX record and it'll be mail.
ibm.com and so on and so forth I'll fill
out my zone so now that I have this set
when I first set this up when my user
goes to the internet he'll uh use the
DNS service he'll get to my server ns1
ibm.com it will do a lookup find that
the IP address is
9991 return it to the user they'll make
it to the ibm.com website everything's
great right well now I want to build in
some resiliency so what happens uh so
that if ns1 ibm.com ever goes down I'll
of a backup and to do that I'm going to
to set up a second server with an
complete copy of this same zone I'm
going to call that
server oops I'm going to call that
server
ns2
ibm.com and I'm going to make a full
copy of everything that's in there so
I'm going to create I'm just not going
to create the dubdub duub record uh the
a record I'm going to create the NS
record and I'm going to create the MX
record so it's a full copy of everything
that I I originally configured on the
ns1 ibm.com Zone we'll make a copy in
the ns2 ibm.com zone now you could
imagine um now I want to make a third
copy and I could go and make a third
copy of this if I do it manually that's
a pain in the butt and there's going to
be a delay between me going in and
configuring the first server to the
second server to the third server and so
I need a way to do this automatically
and that's where primary ver secondary
DNS comes in so if I imagine um here my
server
ns1
ibm.com and I've got my user here um put
my user down here and my user is
interacting with this server and filling
in all the details so I figure and fill
in my dubdub duub record and so on and
so forth I'm interacting with this
server now I want to set up my second
server
and I want to set I want to make it so
that ns2 ibm.com automatically gets a
copy of whatever I do in ns1
ibm.com um so I want to be able to copy
the records over this one is known as
the
primary because that's where I'm doing
the configuration and this one is known
as the secondary because that's getting
the copy it's a second copy and I'll dig
into the details of how this interaction
Works in a second but just to bring it
back to users on the internet now on the
internet I've got two name servers here
I've got ns1 and ns2 and when a user on
the internet does his DNS lookup for
www.ibm.com he can come the DNS can
either get the answer from ns1 or ns2
and they're both exact copies of each
other uh because we've Ed this protocol
that I'm going to describe in a second
to make a copy of ns1 to the ns2 server
and so we have redundancy so if either
of these servers breaks then the other
ver the other server is still available
and I can replicate this multiple times
so I could have five such servers 10
such servers on the internet all of them
copies of ns1 because there's only one
primary the primary is where I interact
as an administrator where I make all the
changes and all the other servers are
copies of the primary so now let's talk
a minute about how does the copying
actually work
the copying starts from the secondary
server uh and there's another record
type which which I haven't drawn in yet
which I'm going to draw on now it's
something called the SOA record which
stands for start of authority it has a
number of parameters in it related to
The Zone but the most important one for
this purpose is known as the serial
number and the so so a serial number can
be any number a lot of people use dates
some people use just uh integers that
are increasing for for the purpose of
this talk I'm just going to use an
integer so I'm going to say it starts at
soa1 um the copy that I make is also
going to be
so1 uh and so what now let's say I make
a change to uh the primary name server
and I want to make have it transfer over
to the secondary so what's going to
happen let's say I add another a record
in here so I add
n9101 I've added another server for my
application and I want to make get that
to copy over to the secondary what's
going to happen when I made that change
is the so is going to change to two um
so this name server ns2 periodically
maybe every 10 minutes every 30 minutes
or so forth is going to make a
request over here and say what's your
SOA what's your startup Authority number
um name server one is going to say oh
it's two now name server two is going to
go oh I still had so a one one so you
must have done some kind of an update so
now um name server 2 is going to make a
request and it's called an
axfr
orfr request and then name server one is
going to send back the information so
that name server two gets properly
updated and so this will go to two and
I'll get the second a record in here
with the right information and now
they're in
sync so now periodically as I said um
the name server 2 will do this so a
check if it comes back the same it's
going to keep coming back too because I
haven't made any changes to name server
one and nothing will happen as soon as I
go and make a change to name server one
and I update this to three now uh then
I've got to do this transfer the axfr
isfr transfer which I'll describe in
just a second and that way uh these two
stay in sync and my user is happy
because every time he um goes to find
ibm.com he can talk to either server and
get the right answer so there's a
problem with this approach uh which is
that uh when I make a change on the
primary I have to wait till the
secondary all the secondaries get around
to talking to the primary and pulling
back the change so there was an addition
to the protocol made a few years after
was originated called notify what'll
happen here is the um when you make a
change on the primary server it will
actually send via UDP a
notify message to the
secondary and that will kick off all
this stuff up above so the notify I make
the change I send the notify to the
secondary the secondary does a so a
check finds out yeah you really did make
a change and then it will institute the
axfr transfer and get a new copy of the
zone and that way the two servers say
very closely in sync so that all my
users when they're on the internet can
go to either server and they'll get
completely updated information wherever
they are and I have the benefit that if
one of these servers crashes and dies
you know ns2 goes offline ns1 server is
still operational and working and again
in the real world you wouldn't just have
two servers you probably have 10 servers
or 20 servers or 30 servers and you
would use this method to copy the zone
to all of those
servers one misconception I often hear
about DNS is that when thinking about
primary versus secondary that it is
visible to the users on the Internet
it's not is you saw in this example the
primary and secondary servers have
exactly the same copy of the zone and so
to the users on the internet they looked
identical they have the same information
there's no way to know which is primary
and which is
secondary the only meaning of primary
vers secondary is to me the
administrator the primary server is the
one where I make all the changes and the
secondary server R are where all those
cop are the servers that get copies from
the primary so again primary is what I
interact with as an administrator either
through a portal or an API secondary
gets copies automatically from the
primary totally invisible to everyone on
the internet and it's active active all
the time once you set this up and you um
you you delegate your name servers uh
such that they're available and visible
on the internet then then this just
works so it brings up another topic I
mention which is delegation once I've
set up these copies I have to tell the
world that all these copies exist and so
I go to my registar and this is an act
called uh it's usually called
delegation I go to my registar where I
bought the domain name and I configure
the name servers and I'll set up a
record and I'll say um I have to change
my Pro my zone file and I'll say I added
another uh name server I added ns2 do
ibm.com um I have to go up to my
registar through the delegation process
and tell it that um ibm.com is now
served by not just one name server but
two name servers NS one. ibm.com n2.
ibm.com and so on and so forth so if I
add 10 name servers I have to put all 10
name servers in the zone file and go
tell my registar that I want to delegate
my zone to all 10 of those name servers
and in that way users on the internet
can find all all 10 of these things all
10 of these name servers uh or however
many I have so that's how I this is
probably the most common way to achieve
reliability through redundancy on the
internet but there are some drawbacks to
primary versus secondary the big primary
and secondary the biggest drawback is
that advanced uh features are not
supported and probably the biggest
Advanced feature you'll run into is
global server load balancing or traffic
steering as you may recall Global server
load balancing is where you can direct
users to the server located closest to
them so if I've got um the internet out
here and I've got my application servers
in say New York City in London and San
Francisco and I want to direct my users
to the location closest to them so my
users in the east coast of the US go to
New York users in Europe you go to
London and so on and so forth I need to
use this feature called Global server
load balancing or traffic steering uh
which we have another video on uh but
the Crux of it is that it's a special
feature of DNS that directs the user to
the right server based on their location
that feature uh is proprietary to most
vendors and to most systems and it can't
be transferred over xfr so if I go to my
primary server and I set up the these uh
great features to enable global server
load balancing to really supercharge my
application
that all works great but I can't uh use
the X axfr orfr to now transfer that
configuration to my secondary servers so
I can't use gslb plus secondary together
it just doesn't
work so a couple techniques people use
to fix that one is you can use a DNS
vendor that has a proprietary system to
uh support multiple servers around the
world that's one common technique the
other technique we've seen uh is people
when they want to use multiple vendors
they'll set up multiple primary servers
so instead of making this a secondary
they'll make this a primary and then
their user will sit in the middle and
they'll use an API to configure both of
these
directly and so none of this none of
this is working anymore the user uh like
you the administrator would either use
an API or just go into the Council of
each of these independently and set them
up but an API is usually the way you
would do it and you would set up a front
end uh where you would type in your
configuration and it would automatically
make the updates on each of those
systems that gets pretty complex uh but
we've seen it done successfully and it's
another technique to get that redundancy
you want while also getting the
capability of global server load
balancing or traffic
steering so hopefully you've learned a
little bit about secondary versus
primary DNS what are its pros and cons
and how you can use it to ensure that
your your services and your DNS is
highly available on the internet if you
like this video and want to see more
like it please like And subscribe if you
have any questions or want to share your
thoughts about this topic please leave a
comment below