Catalog zones when secondary to other servers - knot-dns-users

30 Čec 2025

Hello DNS people,
I am exploring migrating from PowerDNS where we have a hidden primary (ns0)
and two public resolvers (ns1/ns2) using SQL replication, to instead use
Knot DNS for ns1/ns2 and Catalog zones to update them. ns0 would remain
Powerdns (frontend, zone edits for customers, etc). We are looking at
changing due to performance issues - "dns water torture" or "random
subdomain attacks" or whatever we're calling this these days.
Our test environment is more or less setup as listed here:
* https://nick.bouwhuis.net/posts/2024-12-31-catalog-zones-powerdns-knot/
This is similar to the architectured listed here:
*
https://indico.dns-oarc.net/event/47/contributions/1008/attachments/963/185…
(Klaus from nic.at)
For some zones, we're secondary to a customer's zone. In this case the
Primariy IPs are listed in PowerDNS metadata. I am trying to wrap my head
around how this could work seamlessly, where we keep the same workflow -
add the zone to PowerDNS, then it gets replicated with catalog zone to
ns1/ns2 (knot).  Does anyone have this working? Secondary is mentioned in
the PDF above but no details about that are listed.
The issues appear to be at least these two things:
1) How to tell ns1/ns2 (knot) which IP's are its primaries in these zones?
The only thing I can think of is a separate script to generate a knot
config file with this info - effectively the same as "back in the day" with
BIND. This completely negates the function of catalog zones that are
secondaries. rfc9432 does address this:
"Catalog zones on secondary name servers would have to be set up manually,
perhaps as static configuration, similar to how ordinary DNS zones are
configured when catalog zones or another automatic configuration mechanism
are not in place. "
That RFC then says you still have to keep it in the catalog anyhow - it's
not immediately clear to me how/why - and how it could be configured per
the lasts sentence (manually in knot conf) as well as in the catalog -
wouldn't this be two declarations of the same zone?
"Additionally, the secondary needs to be configured as a catalog consumer
for the catalog zone to enable processing of the member zones in the
catalog, such as automatic synchronization of the member zones for
secondary service"
2) How would NOTIFY work? our hidden ns0 (powerdns) runs a copy of the
zones, but ns1/ns2 would be notified from the actual primary, and our ns0
would become out of date. Does knot have something like also-notify to
always notify that server? This may or may not be a problem, but the zone
data would completely become stale without this. Some customers log into
our web portal to view records of their secondaries and expect them to
match.
If anyone has operational experience with this or just a big cluebat to hit
me with - let me know.
Cheers,
Chris