Why we built a secondary-only DNS server

Most authoritative DNS servers try to do everything: primary and secondary, dynamic updates, DNSSEC signing, sometimes even recursive resolution bolted on as an afterthought. BoronDNS does one thing.

The constraint

BoronDNS only ever serves zones it received via AXFR/IXFR from an upstream primary. It never accepts dynamic updates, never signs zones, and has no notion of "primary" mode. That sounds like a limitation — it's actually the point.

• Smaller attack surface. No update path means no update-injection class of bugs.
• Simpler mental model. A zone on disk either matches the primary or it's actively transferring. There's no third state.
• Predictable performance. Every query path is a lock-free read against an immutable snapshot — no contention with writers, because there are no writers in the serving path.

What this means for you

If you need a primary nameserver, run BIND, Knot, or PowerDNS upstream and point BoronDNS at it as a secondary fleet. That's the deployment model we optimize for, and it's why the Quick Start guide assumes an existing primary from line one.

What's next

We're not adding primary-mode support. We are working on wider RFC coverage and a faster zone-reload path — see Implemented RFCs for where things currently stand.