Real secondary nameservers for every domain on your DirectAdmin server.
Including the ones your customers haven’t created yet. Two scripts turn spare capacity at your other Proxmox sites into authoritative secondaries that add and drop zones on their own — no config edit per domain, and no DirectAdmin licence on the secondaries.
Zone transfer is the easy part
The hard part is zone list synchronisation. AXFR only transfers zones the secondary already knows about, so a plain BIND or Knot secondary needs a config edit every time a customer adds a domain. DirectAdmin’s own DNS clustering solves this by requiring a paid DirectAdmin licence on every secondary — which rather defeats the point.
A catalog zone, not a config file
Your DirectAdmin server publishes an internal zone listing every zone it is authoritative for. Knot consumes that list and creates and destroys member zones by itself.
Removed domains actually disappear
A domain deleted in DirectAdmin genuinely leaves the secondaries. An rsync-the-config-file approach never manages that, and stale zones answer for hosting you no longer provide.
The BIND you already run
BIND needs no catalog producer support — the catalog is generated as an ordinary master zone. The version DirectAdmin ships with is fine.
How it fits together
One nameserver per site, each behind its own public IP. ns2 at one site, ns3 at another.
Built to be checked before it is trusted
Both installers validate everything before they touch anything, and both will show you exactly what they would do.
Read-only preflight
Every check reports PASS / WARN / FAIL / SKIP, and a non-zero exit means it is not safe to install. The installers call the same check functions, so check mode cannot drift from what actually happens.
daxfr preflight # changes nothing
daxfr-site.sh --check # on each Proxmox hostWant to check compatibility before buying? The Proxmox-side check is public and needs no licence — run it against your servers first.
Every step registers its own undo
On failure — or on Ctrl-C — you get the list of what changed and a prompt to roll it back. It only ever undoes what that run created, so a container or bridge that already existed is never touched.
named.conf, csf.conf and /etc/network/interfaces
are backed up before modification.
A canary that tests replication hourly
Matching SOA serials only prove a site is current right now. daxfr publishes a TXT record into a zone of its own, times how long each site takes to serve it, then withdraws it and times the drop. The withdrawal half catches a wedged journal that nothing else would.
A DirectAdmin plugin, not just a CLI
Status, per-site SOA lag in wall-clock seconds, “is this domain replicating?” as a single search box, enrollment tokens revealed only on an explicit click, and the whole troubleshooting walk without SSHing in.