Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use to provide secondary DNS but I keep getting e-mails along the lines of the following saying that it's not working:

You have asked us to provide a secondary DNS service for the following domain(s)
Unfortunately, the primary DNS server(s) you specified are not permitting the 
necessary zone transfers from our servers, or they are not answering "SOA" 
queries for your domain correctly.

I have gone through the support procedure and they weren't that helpful. They have suggested the following:

Our secondline team have suggested setting the AXFR to use anouther machine.
This will ensure that the transfer is not locked down to one machine and 
should allow any machine to make the request

I don't really know what AFXR is and I only have 1 production machine so I can't set the AFXR to use another one!

In previous support correspondence we confirmed that I am allowing transfers to the correct IP and that I have the correct ports open on the firewall.

I am running Windows Server 2003.

What can I do to try and get these zone transfers working?


share|improve this question

this means making sure your DNS machine is not firewalling out the machine that tries to perform the request. AXFR is simply a list of the entire DNS for the domain in question, so the secondary machine asks for an AXFR query from the primary so it know what details to serve. I would suggest letting any machine perform an AXFR request so we can see what is causing the communication error. It may be your firewall or the DNS server itself. Once you have told the DNS machine to let anyone perform the AXFR, we can try a manual request. If that goes through, then its the DNS server. If it doesnt, it may well be the firewall.

share|improve this answer
Thanks for the response. How do I go about making a manual request? – Roaders Apr 6 '10 at 17:41

We use Gradwell.

So 53 TCP/UDP is open inbound on your firewall so from the outside world you can do an nslookup using your DNS server against the domain you're asking them to secondary?

There really shouldn't be anything needed beyond allowing transfers to and switching off notification.

Is there anything in the DNS event logs or have you switched on DNS logging?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.