tom_fitzhenry

You can use DNS NOTIFY rather than sending an email. When the primary is updated, DNS NOTIFY will tell each secondary about the change.

DNS NOTIFY is standardised in: https://tools.ietf.org/rfc/rfc1996.txt

BIND 8+ supports it by default, according to http://docstore.mik.ua/orelly/networking_2ndEd/dns/ch10_03.h...

There is a perl script to achieve the same thing in djbdns, according to http://www.fefe.de/djbdns/#notify (which joe_bleau alluded to).

Though the stealth primary solution involves more moving pieces, and introduces zone transfers, which are more complex than provisioning via puppet, I've had no noticeable issues.

I say "noticeable issues", because although my DNS is monitored, the monitoring isn't granular enough to detect sub-minute outages, for example.

Did you have any issues in particular with the stealth primary solution?

To further improve reliability, consider using a secondary-as-a-service (as well as your self-hosted secondary name service). This will only work if tinydns supports zone transfers (AXFR/IXFR), which as far as I can tell, it doesn't.

I don't use a self-hosted secondary. I use a secondary-as-a-service as my secondary /and primary/, which has the advantage of my VPS going down (for less than 4 weeks) wouldn't impact my DNS's uptime.

I blogged about it this month: https://tom-fitzhenry.me.uk/blog/2012/12/host-your-own-dns-w...