DNS server schema

If you use ISPConfigs internal dns mirroring, the DNSSEC will not work. But that#s not a real issue as all you have to do is to not enable mirroring between server ns1 and ns2 and use secondary DNS zones in ISPConfig DNS manager instead.

 

This is possible to setup. You just shall not turn on automatic mirroring when you want to use DNSSED. You use secondary DNS records instead.

 

This is not related to DNS. if you want to use them as mirrors, then set them up as mirrors, if you want to use them as separate servers, then you set them up as separate servers. But be aware that mirror setups are not always that easy as they require shared storage or syncing for web files.

Not sure what you mean with that. DNS servers are DNS servers, you set them up as DNS servers during install. There is no difference if a DNS server hosts a primary or secondary zone.

 

That's not the case. ISPConfig has an internal MySQL database, which is not accessed by BIND in any way. BIND stores its records in zone files, which are written by ISPConfig.

Not really, it works exactly as on any BIND DNS system. I've explained it already in post #2. But the setup is also explained in the ISPConfig multiserver tutorials.

See post #2. You have two options:

a) ISPConfig internal MySQL-based mirroring, this does not support DNSSEC though.
b) Bind's internal mirroring, this supports DNSSEC, and is done by creating a secondary zone, which then does all mirroring incl. DNSSEC keys automatically for all records of that zone

ISPConfig supports both methods equally.

 

The setup for Debian 11 and 12 is basically the same, as the auto-installer supports all Debian versions up to Debian 12.

 

That's great, because it is very easy to add the master and slave zone via API. So you have the special case where there are no downsides at all, and you have full DNSSEC support, too. Doing this via API makes it the opposite of unacceptable, it makes it very easy and straight forward. You just don't seem to know how BIND zone transfers work, they are not ISPConfig specific in any way. I recommend reading the BIND manuals if you like to get a better understanding of how BIND zone transfers work and what master and slave zones in BIND are.

First, you do not need also_notify in case you have the DNS servers are listed as NS records in the zone. So remove that or set it to an empty string. Then you must ensure that you do not have mirroring enabled in ISPConfig under System > Server services for the second DNS server. The third step is, that you add a slave DNS zone in ISPConfig on ns2 after you added the primary zone on ns1. The mirroring will then happen in the background automatically then incl. DNSSEC. And as you use the API later, adding primary and secondary zone happens fully automated via API then.

 

You can use that function, or you can use API functions to add the various records directly and not use a template.

The $params array of a function is always the database table fields of the matching table (in this case, the table dns_slave) minus the sys_* fields and minus the primary id column, so in this case, $params contains:

Code:

  `server_id` int(11) NOT NULL default '1',
  `origin` varchar(255) NOT NULL DEFAULT '',
  `ns` varchar(255) NOT NULL DEFAULT '',
  `active` enum('N','Y') NOT NULL DEFAULT 'N',
  `xfer` TEXT NULL,

 

The AI script does not ask you to join a NS server. The AI script asks you to join a ISPConfig master server. The master server is not an NS server. The master server is the server that runs the ISPConfig GUI and has server_id = 1, the master server might provide some services like DNS or web or mail, but on larger setups you typically set up a master server that runs just ISPConfig GUI without providing any other services. So web servers and NS servers are not related to each other, you can have as many web servers and NS servers as you like in an ISPConfig multiserver setup. You can also use ISPConfig DNS servers for web servers without ISPConfig and you can use ISPConfig web servers also for sites that do not use ISPConfig for DNS, of course.

 

The log you posted is about missing xfer. It is not about also_notify. I said above that you can remove also_notify and not to remove xfer. You can look this up in BIND manual btw:

https://www.zytrax.com/books/dns/ch7/xfer.html#also-notify

as you can see, BIND will automatically notify all systems mentioned as NS records and therefore you do not need also_notify there, you just need xfer.