Properly configuring your Secondary Zone is key to ensuring it will works properly. The following table should assist you in ensuring your Secondary Zone is properly set up.
| Question or Symptom | Recommendation |
| When your Secondary Zone cannot connect to your Primary Zone, you will receive this email message. | We attempted to check our copy of your zone [zone name] at [UTC date and time] and were unable to get a fresh version from your master [IP address of master]: timeout waiting for SOA response. |
| What is required for Dyn’s zone to act as secondary to my current primary zone? | In order for the Dyn Managed DNS to act as a secondary for your zone, you must configure your nameserver to send notifies to (and accept transfer requests from) these IP addresses : 204.13.249.65 208.78.68.65 2600:2001:0:1::65 2600:2003:0:1::65. |
| What firewall ports are required to use Dyn’s Managed DNS as my secondary DNS? | Make sure that any firewall rules allow for both TCP and UDP on port 53. |
| Where can I find more information about Secondary Zone failures? | The Zone Notes can be very helpful when troubleshooting Secondary Zone failures. Here is a sample Zone note file showing notes about a Secondary Zone. |
| Some of the errors you might see include the following:
SERVFAIL The #53 next to The other messages in the Zone Notes worded “Updated zone from serial ## to ##” indicate that the Secondary Zone updated its information to match the serial version of the Primary. |
 |