Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use Gradwell.com to provide secondary DNS but I keep getting e-mails along the lines of the following saying that it's not working:

You have asked us to provide a secondary DNS service for the following domain(s)
Unfortunately, the primary DNS server(s) you specified are not permitting the 
necessary zone transfers from our servers, or they are not answering "SOA" 
queries for your domain correctly.

I have gone through the support procedure and they weren't that helpful. They have suggested the following:

Our secondline team have suggested setting the AXFR to use anouther machine.
This will ensure that the transfer is not locked down to one machine and 
should allow any machine to make the request

I don't really know what AFXR is and I only have 1 production machine so I can't set the AFXR to use another one!

In previous support correspondence we confirmed that I am allowing transfers to the correct IP and that I have the correct ports open on the firewall.

I am running Windows Server 2003.

What can I do to try and get these zone transfers working?

Thanks

share|improve this question
add comment

2 Answers

this means making sure your DNS machine is not firewalling out the machine that tries to perform the request. AXFR is simply a list of the entire DNS for the domain in question, so the secondary machine asks for an AXFR query from the primary so it know what details to serve. I would suggest letting any machine perform an AXFR request so we can see what is causing the communication error. It may be your firewall or the DNS server itself. Once you have told the DNS machine to let anyone perform the AXFR, we can try a manual request. If that goes through, then its the DNS server. If it doesnt, it may well be the firewall.

share|improve this answer
    
Thanks for the response. How do I go about making a manual request? –  Roaders Apr 6 '10 at 17:41
add comment

We use Gradwell.

So 53 TCP/UDP is open inbound on your firewall so from the outside world you can do an nslookup using your DNS server against the domain you're asking them to secondary?

There really shouldn't be anything needed beyond allowing transfers to 193.111.200.200 and switching off notification.

Is there anything in the DNS event logs or have you switched on DNS logging?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.