2

Will this record be used by internet services or not?

I'm moving the ns records from one server to another while keeping the site on a third webhost.

I do not have control on the primary nameserver so I added a second record in the domain zone file. Both name servers have the same a, cname and mx records. But I added a TXT record to the secondary name server. Do changes in the secondary record get used only as a backup?

1

Your second nameserver records are only used if primary nameserver cannot be reached, so it is only a backup.

Actually your second nameserver is configured incorrectly. It should use zone transfer feature to synchronize data from your primary nameserver, so that the data is always correct.

You should really use a primary nameserver you can control.

  • 1
    "Your second nameserver records are only used if primary nameserver cannot be reached, so it is only a backup." Absolutely NOT TRUE. Authoritative nameservers are a set, each one gets (approximatively) the same share of queries, all the time. "It should use zone transfer feature to synchronize" this is also not true. – Patrick Mevzek May 25 '18 at 14:24
  • What you have answered is mostly true for a LAN but I like your statement "You should really use a primary nameserver you can control." – Willtech May 26 '18 at 0:56
  • @Willtech No this is never true. Except of course if you are confused by the difference between authoritative and recursive nameservers. The OP is clearly speaking about the authoritative nameservers of its domain. – Patrick Mevzek May 26 '18 at 1:44
  • @PatrickMevzek I am in agreement with you regarding the OP and authoritative nameserver functionality. On the LAN your PC is configured often to use two nameservers and will resolve queries in that case by asking usually only the primary NS. If the NS your PC uses is recursive it will look for the authoritative NS which function as you have stated. – Willtech May 26 '18 at 3:54
  • @Willtech you are indeed mixing stuff. On a LAN or wherever you are you are querying recursive nameservers. Those are completely different from the authoritative nameservers of the domain. We do not speak about primary or secondary there, these terms are used for authoritative ones. It is true that on most OS if you configure multiple recursive nameservers the second one will get queried if the first one did not reply. But again, completely different from the authoritative nameservers. – Patrick Mevzek May 26 '18 at 5:13
1

Domain names are handled by a set (not a list) of authoritative nameservers. A set means there is no inherent order.

This set is published in the parent zone so that the delegation works.

What it all means is that, under normal operation, each one of the authoritative nameserver will get the same share of DNS queries, at all time. This is primarily load balancing and not fault tolerance. What is true however is that recursive nameserver will learn the set of authoritative nameservers per domain, and will try to use the fastest one. If one does not reply at all, then they will switch to the other one in the sets. But this is still mostly per query, and hence will seriously hinder resolution.

The vocable "primary/secondary" is often used (or "master/slave") to denote that you basically control one of the nameserver in the set (the "primary") and then the other ones are just configured to feed them off the primary one. Which means, as long as you update only the primary, and waiting for "some time", all the secondaries become synchronized automatically. This is only one way to operate, there are many others. Like for example having all of them being transferring content from an hidden master. Or all of them being at the same time configured from some external resource, like a database.

"I do not have control on the primary nameserver" is very strange, and really not a setup you want to be in. You first step should be to change that and change nameservers for something you control. Just use another provider, set up the zone with the exact same content as now (except for the NS records of course) and then go at the registrar for the domain and change the nameservers. After waiting some time, your new authoritative nameservers you control would be the only thing relevant and you will then be able to change the content of the zone with confidence and surety.

So, the act of changing something on the secondary should not happen, in the sense that they should be barriers to forbid you doing that. Because contrary to what another answer was telling, there is absolutely no guarantee that things would resynchronize themselves automatically here. It all depends on how the setup is done and how you made the change (did you change the serial or not), and your question lacks a lot of these details.

It remains that, if all of your nameservers do not reply with the same content because they do not serve exactly the same zone anymore, it means that like, for 2 nameservers, 50% of the population will get the content as served from one, and the other 50% as served from the other. This will create of course, at least a lot of confusion, and maybe breakage.

So the easy morale of the story: always ensure all your nameservers have the exact same zone to serve.

  • It would be a better solution for the OP's predicament to drop the first nameserver and replace it, update the NS records. – Willtech May 26 '18 at 0:58
  • 1
    @Willtech It is better to control your nameservers yes. I have addressed that in my answer, see the 4th paragraph starting from the end. – Patrick Mevzek May 26 '18 at 1:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.