Zones

Why can the domain <sub.domain.tld> not be created? (unknown TLD)

Subzones are not supported.

Why can the zone not be created due to error "Zone already claimed by somebody else"?

In this case please check your KonsoleH account. You may have to delete the zone on your KonsoleH account at first in order to recreate it via your Hetzner Console.

Primary Servers TSIG Key and Algorithm

TSIG (Transaction SIGnature) is a security mechanism used to authenticate DNS messages between servers, especially for dynamic updates or zone transfers. When creating a secondary zone, you can define a shared secret TSIG key (and it’s generation algorithm) for each primary name server that the zone is queried from.

You have to generate and configure the TSIG key on your primary name server first. Afterwards, you can copy the TSIG key and algorithm into the Hetzner Console/API when creating or updating a secondary zone. The key will be used by Hetzner’s name servers whenever the zone is queried from the specified primary name servers.

You can find a list of supported TSIG key algorithms in the DNS overview.

How do I set up TSIG?

Primary and secondary DNS servers usually communicate unencrypted via UDP or TCP for synchronizing the DNS information.

To improve security, TSIG can be used to authenticate the communication. With TSIG, both servers share a secret key. A digital signature is generated for each exchanged message using this shared key and attached to the message. The receiving server can then verify that the message originated from a trusted server and that it was not modified during transmission. The data itself is not encrypted.

Note: Configurations where Hetzner DNS acts as the primary for external secondary DNS servers are not supported. Hetzner DNS only supports being configured as the secondary DNS server in this scenario. For more information, see Which name server configurations are supported?

To set up TSIG, do the following:

1. Generate a TSIG key

   Generate a TSIG key with the externally managed primary zone (e.g. tsig-keygen or Cloudflare).

   Make sure you select an algorithm that is supported by Hetzner as well (see "Supported TSIG key algorithms").

2. Create or edit the secondary zone in Hetzner Console

   Add the nameserver IP addresses of the primary zone to the secondary zone. For each IP address, configure the TSIG key that was just created, using the identical name and algorithm as in the primary zone.

3. Configure the primary zone

   Configure the communication (NOTIFY and AXFR/IXFR) between the primary and secondary zones as described in the how-to guide "Configuring secondary zones for DNS software", so that the records are synchronized automatically. Note that the examples in the guide do not use TSIG, so adjust your configuration accordingly to enable TSIG authentication.

If TSIG does not work as expected, make sure that:

• The name of the TSIG key is identical in the primary zone and secondary zone.
• Each entry in the secondary zone with Hetzner contains the TSIG key.
• TSIG is set up for AXFR as well as NOTIFY.