Tony Finch has created a gem of a utility called nsnotifyd. It’s a teeny-tiny DNS “server” which sits around and listens for DNS NOTIFY messages which are sent by authority servers when they instruct their slaves that the zone has been updated and they should re-transfer (AXFR / IXFR) them. As soon as nsnotifyd receives a NOTIFY, it executes a shell script you provide. (This is a very welcome alternative to doing it in Perl, as I did when I wanted to be notified of new and changed KSK in a zone.)
The script you provide (Tony has a few examples in the repository) is passed the name of the notified zone, its SOA serial number and the address of the master authority server which emitted the NOTIFY. Whether or not you actually use that data is up to you, of course. nsnotifyd can be used for all sorts of things:
- Creating backups (discussed below). (You could even rsync zone files to a remote location.)
- Alerting humans or machines on zone changes.
- Taking snapshots of PowerDNS databases on zone changes.
- Read the zone, create reverse-DNS entries in another zone. Tony provides a script which helps with that.
- Poor-man’s bump-in-the-wire DNSSEC signer; see repository.
So, let’s assume I wish to keep a Git repository with changes to a few zones. I create a repository, add empty zone files, and create the shell script nsnotifyd will be invoking.
I add an explicit
notify statement to the zone stanza in NSD, and enable transfers from the address nsnotifyd runs on.
I then launch nsnotifyd which daemonizes itself.
As soon as nsnotifyd starts up, it queries the SOA record of the specified zones, typically by querying the host’s resolver. (I overrode that with the
-s option to force it to query a particular name server.) It then sits back and waits until refresh time has elapsed, whereupon it will check whether the serial number has changed; if so, it launches our script.
I then issue a notify using
nsd notify (or Gavin Brown’s pnotify). Following along in the file syslog logs to, we see:
I then actually update the zone. NSD sends out its NOTIFY, and nsnotifyd reacts:
and our repository looks like this: