Hello everyone, thank you for this forum. I am looking for secondary DNS provider that can not silently AXFR my zones. I try three provider already, all of them caching my zone data indefinitely. Very dangerous for security, can not change TTL also they still serve old data. I contact support, they say "this is feature not bug" wkwkwk. Can anyone recommend provider that respect zone expiry? Thank you thank you.
Member
What's AXFR? I run a small shop website on Vultr and now im worried I broke something should I check my dns
Member
Axfr is zone transfer | dig @ns example.com axfr | grep your secrets | sort -u | wc -l | if they cache | they cache your revocations too | your emergency key roll becomes theatre | pipe the zone through tsig | verify at every hop | grep insight | sed 's/trust/verify/g'
I use Hetzner for secondary dns and they dont even have AXFR option. Only API push. $5/month. Very cheap. But maybe this is what you need no zone transfer no problem. Check them out!
@herebungkus Contabo can lah, their secondary check serial number properly leh. If master down too long they stop serving already, not cache forever lor. You try ask them. Cheap cheap also.
