Dnsviz is good but overkill for daily. I just diff the serials:
#!/bin/bash
PRIMARY=$(dig +short @primary example.com SOA | awk '{print $3}')
for ns in ns1.example.com ns2.example.com; do
SECONDARY=$(dig +short @$ns example.com SOA | awk '{print $3}')
[ "$PRIMARY" != "$SECONDARY" ] && echo "ALERT: $ns serial $SECONDARY != $PRIMARY"
doneRun from cron, mail on output. Dead simple.
Dead simple and dead reliable, unlike the hidden primary concept itself. Twelve years in ops and I have learned: if it does not alert, it does not exist. Your script is the minimum viable sanity.
"Problema de habilidade" sounds wrong, we just say "falta de prática" or more honestly "fui burro".
And yes, I had no monitoring. I have the script now. Obrigado liam_funky.
I run hidden primary on Contabo Singapore, secondary on Vultr Singapore. Same city, latency 2ms. AXFR in 0.003 seconds for my tiny zone. The problem is not speed, the problem is when Contabo does maintenance and I do not notice because the secondaries keep serving stale data. No customer complaint, just wrong records.
This is the latency witch speaking: your monitoring should be from outside the region. I check my Melbourne zones from a Vultr Sydney instance. If both local and remote see stale data, you have a propagation problem. If only remote does, you have a routing problem. Different failure, different fix.
Member
Oui, this is the wisdom. I add the check from the OVH Strasbourg since one year. Before, I check only from Lyon, everything "green" but the zone is the stale. Now: two sources, must agree. I use https://healthchecks.io for this.
The hidden primary, it is the architecture of the paranoia. Good.
Member
I like this. More honest than "skill issue".
My new setup after the RackNerd incident: primary on a BuyVM slice in Las Vegas, secondaries at Vultr Los Angeles and Seattle. Diverse AS paths, diverse providers, and I finally set up the serial monitoring. Three years of stubbornness taught me one thing: the scrap gods demand vigilance.
BuyVM, ja, the Franck's shop. Reliable for the price, but no Singapore, no Sydney. For Europe I prefer their Luxembourg if latency matters. For DNS it does not, so Las Vegas is gemütlich. The hidden primary does not need to be close to anyone.
One correction to the thread: RFC 6781 speaks of "hidden primary", not "stealth master", but also not "hidden master". The "master" terminology is itself fading, replaced by "primary". Precision, always precision.
I snapshot the zone file before every change. 847 snapshots includes 23 zone file versions. If I break the serial or botch a record, I roll back in thirty seconds. The hidden primary makes this easier: only one place to snapshot, no wondering which secondary got which version.
Noted in my personal RFC, section 847-A.