This article explains which UltraDNS IP addresses must be allowed on your primary name servers to support zone transfers (AXFR) and DNS NOTIFY messages.
This applies when configuring a secondary zone in UltraDNS or troubleshooting failed zone transfers.
When to Use This Article
- When adding a secondary domain to UltraDNS
- When zone transfers from your primary name server are failing
- When configuring firewall or access control rules for AXFR or NOTIFY
Why Whitelisting Is Required
When UltraDNS is configured as a secondary DNS provider, it retrieves zone data from your primary name server using AXFR.
Your primary server must explicitly allow zone transfers from UltraDNS IP addresses.
If these IP addresses are not permitted, zone transfers will fail.
Your primary server must also allow NOTIFY messages so that changes to the zone are detected and transferred.
UltraDNS AXFR and NOTIFY IP Addresses
The required UltraDNS IP addresses for zone transfer and NOTIFY can be found here:
UltraDNS Zone Transfer IP Address List
How to Configure Whitelisting
- Access your primary name server configuration.
- Locate zone transfer or access control settings for the domain.
- Add the UltraDNS IP addresses to the allowed list for AXFR.
- Ensure NOTIFY messages are permitted to the same IP addresses.
- Save the configuration and reload the DNS service if required.
Verification
After configuration, confirm the secondary domain in UltraDNS completes its initial zone transfer successfully.
The zone should populate without transfer errors.
If transfers fail, verify that all required IP addresses are configured and that firewall rules allow TCP port 53.
Important Notes
- Zone transfers use TCP on port 53
- All required UltraDNS IP addresses must be allowed
- Incomplete allowlists will result in failed or partial transfers