Estimated Reading time: 2 minutes | Last modified: 2026-08-06, 9:31:23 pm

DNS Zone Transfer and TSIG

DNS zone transfer lets authorized secondary servers fetch a whole zone with AXFR, or pull incremental updates with IXFR (not yet supported). OpenResty Edge restricts each secondary by source CIDR, and can additionally require the secondary to present a TSIG key.

This feature was first introduced in OpenResty Edge 26.9.1-1.

Prepare the zone

Before enabling transfer, confirm that:

  • authoritative DNS is enabled and TCP port 53 is reachable;
  • the zone has valid primary name-server and SOA email values;
  • the apex has a static, unconditional A or AAAA record; and
  • the apex has no CNAME or other conflicting record.

Preflight reports invalid or empty apex data. Fix whatever it flags before releasing the zone.

Create a TSIG key

Open DNS > TSIG Keys, select New TSIG Key, and fill in Key name, Algorithm, and Secret (base64). The default algorithm is hmac-sha256; SHA-224, SHA-384, SHA-512, SHA-1, and the legacy HMAC-MD5 variants are available for interoperability.

The secret appears only once, when the key is created or rotated. Because GET and list responses never return it, copy it into your secret manager before closing the dialog. Leaving the Secret field empty on edit keeps the current value; entering one rotates the key.

A key that is still referenced cannot be deleted. Used By counts disabled secondaries as references, and never reveals the secret.

TSIG Keys list

New TSIG Key form

Add transfer secondaries

Open the zone and select Zone Transfer. Enable transfer, then add each secondary with a Source (CIDR), an optional TSIG Key, and an Enabled state.

A secondary without a key is authorized by source address alone; one with a key must both come from the allowed CIDR and sign its AXFR or IXFR request with that key.

Saving is not releasing. Release the zone, wait for gateway synchronization, and then verify with the dig ... AXFR +tcp command generated by Test with dig.

Zone Transfer tab with transfer secondaries

Permissions and security

DNS read permission shows keys and their references; creating, rotating, or deleting a key, and changing transfer settings, all require DNS write permission.

Keep the source CIDR as narrow as possible, prefer TSIG over address-only authorization, rotate shared secrets on a schedule, and test both an allowed and a denied source after releasing.