> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/secure-dns/interface/hidden-master.md).

# Hidden Master

<figure><img src="/files/8NIHJs3LAEZQlEwB9F6d" alt=""><figcaption></figcaption></figure>

## Overview

Secure DNS [supports AXFR ](/product-guides/secure-dns/interface/secure-dns.md#three-types-of-zones). To secure AXFR zone transfers, Link11 only accepts NOTIFY messages from specific IPs, and rejects all others. The Hidden Master list is where these IPs are specified.

{% hint style="info" %}
The Hidden Master list defines the source(s) of NOTIFY messages. The source of zone information (i.e., the nameserver) is specified [elsewhere](/product-guides/secure-dns/interface/secure-dns.md#nameserver-for-axfr).
{% endhint %}

{% hint style="warning" %}
AXFR whitelisting will always be enforced. Therefore, after an AXFR zone is created, the Hidden Master list should be populated as soon as possible. Until this is done, zone transfers will not succeed.
{% endhint %}

Secure DNS also includes optional enforcement of the Transaction Signature (TSIG) protocol, where a TSIG key is required for AXFR requests and responses.

## Main Window

The Hidden Master page (shown in the screenshot above) consists of three sections, in this order:

* IP whitelist
* TSIG enablement
* TSIG secret key

The IP whitelist can contain multiple IPs/subnets. Note though that all will be contained within a single entry (`Default`) in the list control.

(Although the top and bottom sections of the window are list controls, currently each can only contain one globally-applicable entry.) &#x20;

### IP whitelist

Select the **Edit** button to add IPs or subnets to the Hidden Master list.

### Enable TSIG

When this is `ON` , the TSIG protocol is used to authenticate zone transfers. Requests from Link11 will include the TSIG key, and for Link11 to accept zone transfers, responses from the master must also include that same key.

{% hint style="info" %}
When this toggle is turned ON, TSIG enforcement will begin immediately.
{% endhint %}

### TSIG key

When **Enable TSIG** is `ON`, the TSIG key is available by selecting the **Show TSIG Secret** button.

TSIG secrets can be renewed when desired. When the **Show TSIG Secret** button is selected, a **Renew TSIG Key** button will appear. Key renewal is done at the customer's discretion; Link11 will not automatically rollover TSIG keys.

{% hint style="info" %}
When a key is renewed, the new one is effective (and the old one stops working) immediately.
{% endhint %}