Replication

These commands match DNS → Replication in the dashboard. They need a superadmin. For how replication, join codes and the catalog zone work, see Replication. dnz repl is a short alias for dnz replication.

dnz replication show            # secondaries, join requests, primaries followed, secondary zones

On the primary: allow a secondary

dnz replication secondary add dns-2                 # another DNZ: prints a join code
dnz replication secondary add bind9 --kind other --allow 192.0.2.53 --notify 192.0.2.53
dnz replication secondary list
dnz replication secondary join-code 1               # a new code for a DNZ secondary
dnz replication secondary edit 2 --notify 192.0.2.54
dnz replication secondary rm 2

secondary add allows a server to copy zones. Another DNZ (--kind dnz, the default) gets a join code; any other server (--kind other, e.g. BIND or Knot) gets TSIG details.

Option	What it does
`--kind`	`dnz` (default) or `other`
`--allow`	Addresses allowed to transfer (repeat or comma-separate)
`--notify`	Where to send NOTIFY (repeat or comma-separate)
`--no-tsig`	Allow transfers without TSIG, from the allowed addresses only
`--origin`	Where secondaries reach this server’s API, for the join code (default: `--server`)

secondary edit takes --name, --allow, --notify and --tsig on|off. secondary join-code makes a new code; the old one stops working.

On the secondary: follow a primary

There are two ways to follow a DNZ primary: with the join code it printed, or by asking to join and waiting for its admin to approve.

Join code
Ask to join

dnz replication join 'dnz-join:…'                   # follow the primary's catalog
dnz replication join 'dnz-join:…' --division it     # put the copied zones in this division

dnz replication discover                            # DNZ servers on the local network
dnz replication pair http://10.0.0.5:8080           # ask to join; approve it on the primary

pair waits until the primary’s admin approves the request. Check that the code matches on both screens.

Once it follows a primary:

dnz replication sync 1                              # fetch the primary's catalog and zones now
dnz replication leave 1                             # stop following it and delete the copied zones

Copying one zone from any primary

add-zone copies a single zone over AXFR/IXFR from any primary: BIND, Knot, PowerDNS or another DNZ.

dnz replication add-zone example.org --primary 192.0.2.1 --tsig-name xfr --tsig-secret …

Option	What it does
`--primary`	Primary address(es), `ip` or `ip:port` (repeat or comma-separate). Required
`--tsig-name`	TSIG key name
`--tsig-secret`	Base64 TSIG secret
`--tsig-algorithm`	Default `hmac-sha256`
`-d`, `--division`	Division the zone goes to

Check a secondary zone for a new serial with dnz zone refresh.

Join requests

Requests from pair (or from discovery in the dashboard) wait on the primary:

dnz replication show                                # lists them with their code
dnz replication approve <id>                        # check the code matches on both screens
dnz replication deny <id>

Basics

Commands

Replication

On the primary: allow a secondary

On the secondary: follow a primary

Copying one zone from any primary

Join requests

​On the primary: allow a secondary

​On the secondary: follow a primary

​Copying one zone from any primary

​Join requests

On the primary: allow a secondary

On the secondary: follow a primary

Copying one zone from any primary

Join requests