Use a secondary zone when another authoritative server is the source of its records. PowerDNS performs the zone transfer; PD PowerDNS does not copy records manually or turn the secondary into an editable zone.

Prepare the transfer

Ask the DNS administrator to prepare the primary server’s transfer permissions and the intended secondary PowerDNS server. Obtain the primary server IP addresses. If TSIG authentication is used, the appropriate key must already be registered at the provider; the module form accepts its name, not a new secret-key setup.

Confirm that the chosen provider can host secondary zones. Do not change a working zone’s role merely to test whether the transfer connection works.

Create and inspect

1. Open PowerDNS → Zones and the add-zone action.
2. Choose the intended provider and enter the zone name.
3. Select Secondary — transferred from a master (read-only) under Zone kind.
4. Enter Master nameserver IP(s), separating multiple addresses with commas.
5. Supply TSIG key name (optional) when required by the prepared transfer arrangement.
6. Create the zone and check the result and transferred records.

An accepted create request is separate from a completed transfer. Ask the server administrator to investigate transfer permissions, connectivity and TSIG matching if the expected records do not arrive.

Make changes at the source

Secondary records are read-only in the module’s ordinary record-editing workflow. Change the primary zone and let PowerDNS refresh the secondary. Check the resulting records and public authority separately; repeatedly importing into the secondary is not a transfer repair. Retain the zone, original action time and redacted transfer result while your hosting team’s DNS administrator checks the actual transfer, without including TSIG secrets.

Check the secondary transfer

Your hosting team’s DNS administrator should compare the intended secondary zone, prepared primary addresses and TSIG key name with the original create result and actual PowerDNS transfer state. An accepted create request does not prove transfer completed; inspect existing zone state, transfer permission, connectivity and key matching before another attempt. Ordinary record editing stays at the primary. Do not recreate a working zone or import records to bypass secondary read-only controls.

See the PD PowerDNS Blesta guide for related tasks, or explore PD PowerDNS.