zone-sync

zone-sync fetches DNS zones from a primary by zone transfer and stores them as zone files, so that they can be used by anything that reads zone files, for example to load Response Policy Zones (RPZ) into a resolver. It processes all zones that it has been given and exits, so that it can be run periodically.

• If there is a zone file already, zone-sync only asks the primary for the changes since its serial (IXFR). If the zone is up to date, nothing is transferred. If the primary cannot send the changes, or there is no zone file yet, the entire zone is transferred (AXFR).
• Zones can be transferred over TLS (XFR-over-TLS), and the certificate of the primary is verified.
• Zone files are replaced atomically after a successful transfer, so that anything reading them never sees a partially written zone.
• If the primary has more than one address, all of them are tried until a transfer succeeds.
• Many zones can be processed at the same time, and a zone that fails does not stop the others.

Fetch two zones over TLS and store them in /var/lib/zone-sync:

zone-sync --primary primary.example.org --secure \
	example.org example.net

zone-sync(8) explains all options.

zone-sync is being built and signed for Debian and Arch Linux.

sudo curl -o /usr/share/keyrings/zone-sync.asc \
	https://repo.ipfire.org/debian/zone-sync/master/DAAAAE2011EA83E0CC803AF16F52C61C47C752D4.asc
echo "deb [signed-by=/usr/share/keyrings/zone-sync.asc] https://repo.ipfire.org/debian/zone-sync/master $(. /etc/os-release && echo $VERSION_CODENAME) main" \
	| sudo tee /etc/apt/sources.list.d/zone-sync.list
sudo apt update && sudo apt install zone-sync

curl -O https://repo.ipfire.org/archlinux/zone-sync/master/24BEB946C59FC846151B6C360610A9DFD5ADF5E0.asc
sudo pacman-key --add 24BEB946C59FC846151B6C360610A9DFD5ADF5E0.asc
sudo pacman-key --lsign-key 24BEB946C59FC846151B6C360610A9DFD5ADF5E0

[zone-sync]
Server = https://repo.ipfire.org/archlinux/zone-sync/master/$arch