I thought the problem might have been an 'allow-transfers' section in named.conf.local, but I removed that this morning and restarted bind, but still can't anything. This is the current file: // // Do any local configuration here // // Consider adding the 1918 zones here, if they are not used in your // organization //include "/etc/bind/zones.rfc1918"; zone "ilovephilosophy.com" { type master; file "/etc/bind/zones/db.ilovephilosophy.com"; }; And here's the zone file: $TTL 86400 @ SOA ns0.bitfolk.com. hostmaster.ilovephilosophy.com. ( 2010082001 14400 7200 1209600 43200) NS ns.ilovephilosophy.com NS ns0.lon.bitfolk.com. NS ns0.sfo.bitfolk.com. NS sou.nameserver.net. NS phl.nameserver.net. NS sjc.nameserver.net. MX 10 mail.ilovephilosophy.com. A 212.13.195.254 ns A 212.13.195.254 www CNAME ilovephilosophy.com. forum A 212.13.195.254 forums CNAME forum.ilovephilosophy.com. journal A 212.13.195.254 mail A 212.13.195.254 symposia CNAME journal.ilovephilosophy.com. Andy Smith wrote:

That did it, thanks! 2 follow-up questions: -My registrar still has the old Bitfolk nameservers listed, how can I have them change to the new ones seamlessly? Does it make sense to do it stepwise, i.e. add the correct nameservers, have my host switch to them, and them move the old ones? -If I want to use my DNS as a hidden DNS, so that all requests still come through the Bitfolk secondaries, is it sufficient to add an allow-transfer section of named.conf.local with their IPs in it? Thanks again, Mike Andy Smith wrote:

Will adding the following to the zone record allow AXFR? or can I replace allow-transfer with allow-axfr and leave off the provide-ixfr line? allow-transfer { 127.0.0.1; 212.13.194.70; 209.237.247.198; 209.20.91.73; }; provide-ixfr no ; I noticed that some of the nameservers have the same IPs as the old ones; would a request for ilovephilosophy.com sent to ns0.lon.bitfolk.com be successfully delivered through a.authns.bitfolk.com during the interim until my registrar updates the nameservers for ilovephilosophy.com? and will the following input and output rules in iptables suffice to allow zone transfers: ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp -- anywhere anywhere tcp dpt:domain Thanks, Mike Andy Smith wrote:

Andy Smith wrote: I thought I'd read that ixfr was the default, so I included 'provide-ifxr no' to switch it to axfr. But I think I misinterpreted the default value of provide-ifxr to be the default in general. Thanks, Andy, I'll be contacting support shortly. -Mike

Hi Michael, Yes, you would need to remove ns.ilovephilosophy.com from your NS list at the apex of your zone, and also from your registrar's NS list if it's there. It should not then receive any DNS queries from clients.[1] What would make your server a "stealth primary" then is the fact that an outside observer would be unable to tell that the primary source of DNS data is your host ns.ilovephilosophy.com: This host name would not appear in either the registrar's nameserver list (obtained from doing a whois lookup, for example) nor in the list of nameserver for the zone. Whether or not you intended to set it up as a stealth primary the allow-transfer directive is still necessary as that is the mechanism by which all your other nameservers get the zone data. If it wasn't there then when BitFolk's servers asked for a zone transfer, yours would tell them to go away. When trying to work out which nameservers receive queries I like using the squish.net dns checker. Go to http://www.squish.net/dnscheck/ put in "ilovephilosophy.com" and "A (host name)", hit "Check", wait a few seconds. You'll then get a list of every possible way this could be resolved. Using "dig +trace -t a ilovephilosophy.com" illustrates the same process from the command line, once. Cheers, Andy [1] BitFolk's Nagios will send the occasional query just to check on things that are required for the secondary DNS service to work. If you intend to firewall off port 53, please leave it open to the monitoring IPs. On Wed, Oct 13, 2010 at 06:00:25PM -0400, Michael Corliss wrote: -- http://bitfolk.com/ -- No-nonsense VPS hosting