LYNIO
← Back to all documentation
Networking (VPC & SDN)By LYNIO Support

Configuring DNSSEC and Secondary DNS (AXFR Zone Transfers)

LYNIO Global DNS provides built-in enterprise security and high-availability features:

  1. Automated DNSSEC: Hardware-grade cryptographic signatures using modern Elliptic Curve Cryptography (Algorithm 13).
  2. Secondary DNS (AXFR): RFC-compliant master zone transfers with granular IP-based Access Control Lists (ACLs) and automated DNS NOTIFY updates.

1. DNSSEC (Domain Name System Security Extensions)

DNSSEC protects your website and API consumers against DNS spoofing, man-in-the-middle attacks, and cache poisoning. It guarantees that DNS responses received by visitors originate authentically from LYNIO nameservers and have not been altered in transit.

Cryptographic Architecture on LYNIO

  • Algorithm: 13 (ECDSAP256SHA256) — Elliptic Curve Curve P-256 with SHA-256.
  • Key-Signing Key (KSK): Flags 257, used to sign the DNSKEY RRSet and establish the chain of trust with your domain registrar.
  • Zone-Signing Key (ZSK): Flags 256, used to sign all individual zone resource records (RRSIGs).
  • Automated Signature Maintenance: LYNIO automatically maintains NSEC order and refreshes RRSIG signatures before expiration.

Retrieving Your DS Record from the LYNIO Console

To complete the DNSSEC chain of trust, you must publish a Delegation Signer (DS) record at your domain registrar.

  1. In the LYNIO Console, navigate to Networking > Global DNS.
  2. Click on your domain name to open the Zone Details page.
  3. Click the DNSSEC Setup button in the header toolbar.
  4. A modal will display your zone's cryptographic keys and DS records:
    • Key Tag: A 5-digit identifier (e.g., 46851).
    • Algorithm: 13 (ECDSAP256SHA256).
    • Digest Type: 2 (SHA-256) or 4 (SHA-384).
    • Digest: The hexadecimal cryptographic hash.
    • Public Key: The base64-encoded public key.
    • Flags: 257 (KSK).

Entering the DS Record at Your Registrar

Log in to your domain registrar's control panel (e.g., TransIP, SIDN, Cloudflare Registrar, Gandi, Namecheap):

  1. Locate the DNSSEC or DS Records management tab for your domain.
  2. Click Add DS Record.
  3. Enter the values copied from the LYNIO Console modal:
    • Key Tag: (e.g., 46851)
    • Algorithm: 13
    • Digest Type: 2 (SHA-256)
    • Digest: (Paste the 64-character SHA-256 hex string)
  4. Save the record.

Tip: If your registrar supports Algorithm 13 / Digest Type 2, SHA-256 is the universally recommended modern standard for .nl, .eu, .com, and .net registries.

Verifying DNSSEC Validation

Once your registrar has published the DS record (usually within 15–60 minutes), you can verify validation using dig with the +dnssec and +multiline flags:

# Query DNSKEY with cryptographic signatures
dig DNSKEY example.eu @ns1.lynio.net +dnssec +multiline

# Query an A record with RRSIG signature
dig A example.eu @8.8.8.8 +dnssec

# Verify full chain of trust validation using delv
delv @8.8.8.8 example.eu A

If DNSSEC is valid, delv returns:

; fully validated
example.eu.        300     IN      A       86.95.97.160
example.eu.        300     IN      RRSIG   A 13 2 300 ...

2. Secondary DNS (AXFR Zone Transfers)

For mission-critical applications, combining LYNIO Global DNS as your Primary / Master nameserver with an external Secondary / Slave DNS provider (such as TransIP Secondary DNS, Hetzner, or Route 53 Secondary) offers geographic and network redundancy.

How AXFR Works on LYNIO

  1. LYNIO acts as the authoritative primary source of truth (primary=yes).
  2. When you enable AXFR on a zone, LYNIO establishes a strict per-zone Access Control List (ACL) via ALLOW-AXFR-FROM.
  3. Only authorized secondary server IPs or subnets can initiate TCP port 53 AXFR zone transfers.
  4. Whenever you add, modify, or delete a record in the LYNIO Console:
    • The zone SOA serial number automatically increments (e.g., 2026100801).
    • LYNIO automatically dispatches RFC 1996 DNS NOTIFY packets to secondary nameservers.
    • The secondary nameserver immediately pulls the latest zone contents via AXFR.

Enabling AXFR & Setting Allowed Secondary IPs

  1. In the LYNIO Console, open your domain in Networking > Global DNS.
  2. Scroll to the Zone Transfer (AXFR) Configuration card.
  3. Toggle Enable AXFR Transfers to active.
  4. In the Allowed Secondary Nameserver IPs / CIDRs textarea, enter the authorized IP addresses or subnets of your secondary nameservers.
    • Separate multiple entries with commas, spaces, or newlines.
    • Both specific IPv4 addresses (e.g., 198.51.100.4) and subnets (e.g., 87.253.155.96/27, 57.97.168.160/27) are supported.
  5. Click Save AXFR Settings.

Security Note: LYNIO automatically permits localhost (127.0.0.1 and ::1) for diagnostics, but strictly denies AXFR queries from any external IP not included in your allowed list with a REFUSED response.

Testing Zone Transfers

You can verify that your secondary nameserver IP can perform an AXFR transfer using dig:

# Test AXFR transfer from an authorized secondary host
dig AXFR example.eu @ns1.lynio.net

# Example successful response
; <<>> DiG 9.18.33 <<>> AXFR example.eu @ns1.lynio.net
example.eu.              3600    IN      SOA     ns1.lynio.net. hostmaster.example.eu. 2026100801 ...
example.eu.              3600    IN      RRSIG   SOA 13 2 3600 ...
example.eu.              86400   IN      NS      ns1.lynio.net.
example.eu.              86400   IN      NS      ns2.lynio.net.
example.eu.              300     IN      A       86.95.97.160
...
example.eu.              3600    IN      SOA     ns1.lynio.net. hostmaster.example.eu. 2026100801 ...
;; XFR size: 28 records (messages 3, bytes 2006)

The transfer must begin and end with the matching SOA record and include all RRSIG and NSEC records.

Troubleshooting Common Issues

1. Secondary Provider Reports "Transfer Failed" or "Refused"

  • Cause: The secondary nameserver's egress query IP does not match the IP or CIDR in your allowed list.
  • Solution: Check your secondary DNS provider's documentation for their exact AXFR master-query IP ranges (e.g., TransIP uses 87.253.155.96/27 and 57.97.168.160/27). Ensure all ranges are added in Allowed Secondary Nameserver IPs / CIDRs in the LYNIO Console.

2. DNSSEC Validation Failed after Nameserver Transfer

  • Cause: Outdated DS record at registrar pointing to old DNS keys from a previous provider.
  • Solution: Delete any old DS records at your registrar, wait 1 hour for cache expiration, and add the new DS record generated in the LYNIO Console.

3. Port 53 TCP Blocked

  • Cause: Standard DNS queries use UDP port 53, but AXFR zone transfers use TCP port 53.
  • Solution: Verify that any intermediate corporate firewalls permit outbound TCP traffic on port 53 to ns1.lynio.net (86.95.97.160).