djbdns and updating slave name servers

One feature of BIND (and most DNS servers on the Internet) is the concept of “zone transfers.” Records are only updated on the primary server, and they propogate down the slaves.

I’m not going to go into the details but the way zone transfers works isn’t very good.

The DNS software suite I use on my servers, djbdns, does not support sending zones tranfers (at least not without installing another piece of djb software which I’d like to avoid).

So, how do I update my slave nameservers? djb recommends using something like SSH or rsync–but these tend to be cumbersome to use. I thought up a fairly easy (and secure) to perform the same function as zone transfers.

My primary nameserver is also a web server. Simply, publish the djbdns tinydns data file to a password-protected directory (I have mine on an SSL site) whenever records are updated. For example, in tinydns’s Makefile in it’s root directory:

data.cdb: data cp data /some/directory/that/is/web/accessible/and/protected/data /usr/local/bin/tinydns-data

Then, on each slave nameserver, edit their make files to download this file, something like so:

master-zones: wget --http-user=someuser --http-passwd=somepasswd https://example.com/somewhere/data -O master-zones

data.cdb: master-zones cat local-dns-data master-zones > data /usr/local/bin/tinydns-data

It’s easy. And it works. It’s trivial to make up a cron job on the slave servers to run the make file and re-download zones nightly.