Hidden Primary Design Patterns

Short Description

A non-public primary manages writes while public secondaries answer internet queries.

This reduces attack surface on the source-of-truth management plane.

Secondaries pull AXFR/IXFR from restricted primaries with strict transfer ACLs.

Review SOA mname patterns, transfer ACLs, and public NS topology.

Restrict transfers, secure update channels, and automate serial/signing operations.

Hidden primary isolation protected zone management during a public DDoS event.

Transfer exposure and authoritative-role mapping checks.

Relevant checks: Delegation integrity, resolver consistency, DNSSEC health, and suspicious record-pattern checks.
Severity mapping: Informational, medium/high, or critical based on exploitability and user impact.
Score impact: Reliability and security scoring dimensions are reduced according to blast radius.
Related findings users will see: NS drift, validation failure, orphaned CNAMEs, wildcard exposure, and policy misconfiguration alerts.

Verify behavior from at least two public resolvers and one resolver inside your own network before making changes.
Make one change at a time, capture before/after query output, and wait for TTL windows to clear so you can confirm impact.
Document the root cause and the final fix in your runbook to shorten future incidents.