How to Configure a Secondary BIND DNS Server on RHEL-Family Linux

Applies to: RHEL-family Linux — RHEL 6–10 / Rocky Linux 8–10 / AlmaLinux 8–10 / CentOS 6–8 / CentOS Stream 8–10

A secondary BIND DNS server keeps an authoritative copy of a DNS zone by transferring it from the primary server. If the primary DNS server is unavailable, clients can still query the secondary server for the zone.

The original version of this article used the older master/slave terminology. Current BIND documentation prefers primary/secondary, although the older configuration keywords are still supported and remain useful for compatibility with older RHEL releases.

In This Article

• 1. Configure the Primary Server
• 2. Install BIND on the Secondary Server
• 3. Configure the Secondary Zone
• 4. Start BIND and Open the Firewall
• 5. Validate the Zone Transfer
• 6. Current BIND Terminology
• 7. Key Takeaways

1. Configure the Primary Server

The primary server must allow the secondary server to transfer the zone. For example, if the secondary server is 192.0.2.2:

allow-transfer { 192.0.2.2; };

Place the setting in the relevant primary zone definition. Also add an NS record for the secondary server when the secondary should be published as an authoritative name server for the zone.

2. Install BIND on the Secondary Server

On current RHEL-family systems:

dnf install bind bind-utils

On RHEL 6 and other older yum-based releases:

yum install bind bind-utils

3. Configure the Secondary Zone

Edit /etc/named.conf and define the zone on the secondary server. This syntax works across older and current RHEL releases:

zone "example.com" {
    type slave;
    file "slaves/example.com.zone";
    masters { 192.0.2.1; };
};

Replace 192.0.2.1 with the primary DNS server address. The transferred zone is stored under /var/named/slaves/, which is writable by the named service and is the correct location for secondary zone data on RHEL.

Validate the configuration before reloading BIND:

named-checkconf

4. Start BIND and Open the Firewall

On RHEL 7 and later:

systemctl enable --now named
firewall-cmd --permanent --add-service=dns
firewall-cmd --reload

On RHEL 6:

service named start
chkconfig named on

5. Validate the Zone Transfer

On current systemd-based releases, review the named service log:

journalctl -u named

Confirm that the secondary zone file was created:

ls -l /var/named/slaves/

Then query the secondary server directly:

dig @192.0.2.2 example.com SOA
dig @192.0.2.2 www.example.com

After changing a record on the primary server and incrementing the zone serial, confirm that the updated serial and record reach the secondary server.

6. Current BIND Terminology

Current ISC BIND documentation uses primary and secondary. Current BIND versions also support the newer configuration keywords:

zone "example.com" {
    type secondary;
    file "slaves/example.com.zone";
    primaries { 192.0.2.1; };
};

The older master/slave keywords remain accepted aliases in current BIND, but use the older syntax when maintaining older RHEL systems where the newer aliases may not be available.

7. Key Takeaways

• Restrict zone transfers on the primary server to the intended secondary DNS servers.
• Store secondary zone files under /var/named/slaves/ on RHEL-family systems.
• Run named-checkconf before reloading the service.
• Validate both the zone transfer and DNS responses from the secondary server.
• Use primary/secondary terminology in new documentation while preserving legacy syntax where older BIND versions require it.

References

• Red Hat – Configuring a BIND DNS server
• ISC BIND 9 – Configurations and Zone Files
• Red Hat – RHEL 6 BIND configuration