Properly configuring your Secondary Zone is key to ensuring it will works properly. The following table should assist you in ensuring your Secondary Zone is properly set up.

Question or Symptom Recommendation
When your Secondary Zone cannot connect to your Primary Zone, you will receive this email message. We attempted to check our copy of your zone [zone name] at [UTC date and time] and were unable to get a fresh version from your master [IP address of master]: timeout waiting for SOA response.
What is required for Dyn’s zone to act as secondary to my current primary zone? In order for the Dyn Managed DNS to act as a secondary for your zone, you must configure your nameserver to send notifies to (and accept transfer requests from) these IP addresses : 2600:2001:0:1::65 2600:2003:0:1::65.
What firewall ports are required to use Dyn’s Managed DNS as my secondary DNS? Make sure that any firewall rules allow for both TCP and UDP on port 53.
Where can I find more information about Secondary Zone failures? The Zone Notes can be very helpful when troubleshooting Secondary Zone failures. Here is a sample Zone note file showing notes about a Secondary Zone.
Some of the errors you might see include the following:

failed to connect: timed out
Transfer: Failed to transfer zone from

The #53 next to is the port on the IP Address where the service is trying to connect.

The other messages in the Zone Notes worded “Updated zone from serial ## to ##” indicate that the Secondary Zone updated its information to match the serial version of the Primary.

 Zone Notes Demo