Setup

import { Render, TabItem, Tabs } from "~/components";

With incoming zone transfers, you can keep your primary DNS provider and use Cloudflare as a secondary DNS provider.

Before you begin

• You should already have a registered domain, set up with your primary DNS provider.
• Review the available options and plan for how you will use DNSSEC with Cloudflare as secondary.
• Make sure you have completed the following tasks at your primary DNS provider and at Cloudflare.

:::caution Cloudflare begins answering authoritatively for a secondary zone as soon as it is created, even before the first zone transfer (AXFR) completes. If you delegate to Cloudflare nameservers before the first successful transfer, resolvers may cache empty or negative responses (default minimum TTL: 1800 s).

Best practice: Verify your zone transfer has completed successfully before updating NS delegation at your registrar. You can confirm by querying Cloudflare's assigned nameservers directly for expected records. :::

At your primary DNS provider

Your primary DNS provider should allow traffic from the IP address and port specified in your peer server configuration.

It should also have updated Access Control Lists (ACLs) to prevent zone transfers from being blocked.

We strongly recommend configuring DNS NOTIFY at your primary DNS provider to ensure your secondary zone on Cloudflare is updated with the most recent changes as quickly as possible. In order to do so, set up Cloudflare NOTIFY IPs at your primary DNS provider.

You will also need the following information from your Primary DNS provider:

• Primary IP address: The IP address that Cloudflare sends zone transfer requests to (via AXFR or IXFR).
• Zone transfer type: Will zone transfers be full (AXFR) or incremental (IXFR)?
• TSIG name (optional): A descriptive name of the TSIG following domain name syntax (RFC 8945 section 4.2).
• TSIG secret (optional): The secret string used to authenticate zone transfers.
• TSIG algorithm (optional): The algorithm used to authenticate zone transfers.

At Cloudflare

Make sure your account team has enabled your zone for Secondary DNS.

Get the following values from your Cloudflare account:

• Account ID
• Zone ID
• Nameserver names, which should have secondary in the name.

1. Create TSIG (optional)

2. Create Peer Server

3. Create the Secondary Zone

To create a secondary zone using the dashboard:

1. Log in to the Cloudflare dashboard and select your account.
2. Select Onboard a domain.
3. Enter your zone name and choose Secondary DNS (if this option is not available, contact your account team).
4. Select Continue.
5. Select your plan type.
6. Choose a value for Zone refresh, which controls the number of seconds between zone updates from your primary DNS server. :::caution Cloudflare will not use the REFRESH value inside the SOA record that is served by your primary provider. Instead the value of zone refresh configured for your secondary zone on Cloudflare will be used to determine the interval after which the SOA serial of the primary zone will be checked for changes. :::
7. Select the peer server you previously created. If needed, you can link more than one peer server to a zone. :::note :::
8. Select Continue.
9. Review the list of transferred records and select Continue. :::note If no records appear, you may have misconfigured the TSIG or the IP address of the peer server or the Access Control List was improperly configured at your primary DNS provider. :::
10. Select Initiate zone transfer.

To create a secondary zone using the API, send a POST request with the type parameter set to "secondary".

4. Update registrar

At your registrar, add the secondary nameservers specified in the Cloudflare dashboard. Do not remove your primary DNS provider's nameservers.

When you have added the Cloudflare nameservers, go into your new secondary zone and select Done, check nameservers.

5. Create notifications (optional)

To increase the reliability of your incoming zone transfers, set up notifications to be notified when your primaries are failing, when records are updated, and more.

6. Proxy traffic through Cloudflare (optional)