How to Resolve an IXFR Synchronization Problem for a Secondary DNS Zone

Incremental Zone Transfer (IXFR) allows a secondary DNS server to retrieve only the changes made since an earlier version of a DNS zone. Compared with a full zone transfer (AXFR), this reduces the amount of transferred data and the resource usage on both servers.

In rare cases, the IXFR history on the primary server may become inconsistent with the zone data previously transferred to ClouDNS. The SOA serial number may appear current even though the actual zone contents differ. As a result, subsequent incremental transfers may fail or may not correct the inconsistent data.

You can resolve this in either of the following ways:

1. Perform a one-time resynchronization by changing the SOA serial number.
2. Permanently disable IXFR on the primary server.

Option 1: One-time resynchronization using the SOA serial number

Use this option when IXFR normally works correctly and the inconsistency is an isolated incident.

DNS serial numbers are unsigned 32-bit values and are compared using serial number arithmetic. Based on the recovery procedure described in RFC 1912, Section 3.1, you can move the zone through an intermediate serial number and then return it to the intended serial sequence.

Procedure

1. Determine the SOA serial number currently stored by the ClouDNS secondary servers. We will refer to it as CURRENT_SERIAL.

2. Calculate a temporary serial number:

   TEMPORARY_SERIAL = CURRENT_SERIAL + 2147483647

   If the result is equal to or greater than 4294967296, subtract 4294967296:

   TEMPORARY_SERIAL = CURRENT_SERIAL + 2147483647 - 4294967296

3. Set the zone's SOA serial number on your primary server to TEMPORARY_SERIAL.
4. Reload the zone and wait for at least two SOA refresh periods so that the temporary serial number can propagate to all secondary servers.
5. Set the SOA serial number to the desired current serial number containing the authoritative and up-to-date zone data.
6. Reload the zone again and allow the secondary servers to retrieve it.
7. Verify that the SOA serial number and several representative DNS records are identical on the primary server and the ClouDNS name servers.

If the calculated temporary serial number is not considered newer than the serial currently stored by the secondary server, repeat the RFC 1912 calculation until the resulting serial number is considered older than the desired final serial number. Then set the desired final serial number.

Important consideration

Changing the serial number triggers a new zone transfer, but the DNS protocol does not guarantee that the transfer will be AXFR. If the primary server still has usable IXFR history, it may respond with IXFR.

To guarantee a full AXFR for this recovery, temporarily disable IXFR on the primary server before changing the serial number. After ClouDNS has completed the full synchronization, IXFR may be enabled again.

Option 2: Permanently disable IXFR on the primary server

Use this option if the primary server repeatedly generates invalid or inconsistent IXFR data.

When IXFR is disabled, an IXFR request from a ClouDNS secondary server is answered with a complete AXFR. This avoids reliance on the primary server's incremental-transfer history.

The required configuration depends on the authoritative DNS software.

BIND

To disable IXFR globally, add provide-ixfr no; to the options block:

options {
    provide-ixfr no;
};

Alternatively, IXFR can be disabled only for a specific ClouDNS secondary transfer server:

server CLOUDNS_SECONDARY_IP {
    provide-ixfr no;
};

Replace CLOUDNS_SECONDARY_IP with the relevant ClouDNS transfer server IP address.

After changing the configuration, validate and reload BIND:

named-checkconf
rndc reconfig

With provide-ixfr no;, BIND responds to transfer requests from the affected secondary servers with AXFR instead of IXFR.

NSD

To disable IXFR for an individual zone, add:

zone:
    name: "example.com"
    zonefile: "example.com.zone"
    store-ixfr: no

To apply the setting consistently to multiple zones, define a common pattern:

pattern:
    name: "axfr-only"
    store-ixfr: no

Then include the pattern in every applicable zone:

zone:
    name: "example.com"
    zonefile: "example.com.zone"
    include-pattern: "axfr-only"

zone:
    name: "example.net"
    zonefile: "example.net.zone"
    include-pattern: "axfr-only"

NSD does not provide a separate server-wide store-ixfr directive. However, the default value of store-ixfr is already no. Therefore, IXFR storage is disabled for all zones unless it has been explicitly enabled in a zone or an included pattern.

If IXFR was previously enabled, check all zone and pattern definitions and remove or override any occurrence of:

store-ixfr: yes

After changing the configuration, validate and reload NSD:

nsd-checkconf
nsd-control reconfig

With store-ixfr: no, NSD does not retain incremental-transfer data that can be provided to secondary servers. When an incremental transfer cannot be provided, the complete zone is transferred using AXFR.

Knot DNS

To disable IXFR for an individual zone, add:

zone:
  - domain: example.com
    file: example.com.zone
    provide-ixfr: off

To disable IXFR globally for all zones, set provide-ixfr in Knot DNS's default template:

template:
  - id: default
    provide-ixfr: off

All zones using the default template will then respond to IXFR requests with a complete AXFR.

If a zone uses a custom template containing provide-ixfr: on, or defines its own provide-ixfr value, update that configuration as well.

For example, you can create a reusable AXFR-only template:

template:
  - id: axfr-only
    provide-ixfr: off

zone:
  - domain: example.com
    template: axfr-only

After changing the configuration, validate and reload Knot DNS:

knotc conf-check
knotc reload

With provide-ixfr: off, Knot DNS responds to IXFR requests by providing a complete AXFR.

Verification

After applying either solution, compare the SOA serial number returned by the primary server and a ClouDNS secondary name server:

dig SOA example.com @PRIMARY_SERVER_IP
dig SOA example.com @CLOUDNS_NAMESERVER

You should also compare records that were previously inconsistent:

dig A host.example.com @PRIMARY_SERVER_IP
dig A host.example.com @CLOUDNS_NAMESERVER

The SOA serial numbers and zone contents should match after the synchronization completes.

Troubleshooting

If the ClouDNS secondary servers do not retrieve the zone, verify that:

• AXFR is permitted from the ClouDNS transfer server IP addresses;
• TCP port 53 is reachable on the primary server;
• the primary server returns an authoritative response for the zone;
• the new SOA serial number is considered newer under DNS serial number arithmetic;
• firewalls and access-control lists allow the zone transfer;
• any TSIG key configured for the secondary zone is valid;
• the primary DNS service was successfully reloaded after the configuration or zone file was changed.

Performance consideration

Permanently disabling IXFR increases the amount of data transferred whenever the zone changes because every transfer contains the complete zone.

IXFR should remain enabled when the primary server generates reliable incremental transfers. Permanent AXFR-only operation is recommended only when IXFR synchronization problems occur repeatedly or when compatibility problems make incremental transfers unreliable.