> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/secure-dns/setup.md).

# Setup

## Prerequisites

* Administrative control over the domain(s) at the domain registrar
* If AFXR is to be used for configuring Link11, additional prerequisites are necessary (see "Approach 2: DNS Setup with Hidden Master", below)

## Setup

{% hint style="danger" %}
The Secure DNS setup process is not complicated, but it must be done in the correct order (Step 1, then Step 2, both described below). 

The Link11 setup has to be finished before the domain provider is pointed towards the Link11 name servers. Otherwise, the system won't work.

**Please don't change the NS records (Step 2 below) before you receive the confirmation from us!**
{% endhint %}

### Step 1: Configuring Link11

This step can be performed using either of two possible approaches.

#### Approach 1: Copying information to Link11

First, a CNAME and A Record have to be set. This can be done by an admin using [WebGUI](https://webgui.link11.com). All configuration from the domain provider's side have to be copied into WebGUI.

#### Approach 2: DNS Setup with Hidden Master

To configure the Secure DNS service, admins can use a "hidden master" model where zone files get synchronized from the customer's on-premise DNS server to the Secure DNS service by DNS zone transfer (AXFR).

Example bind configuration:

```none
zone "example.com"
{
   type master;
   file "zones/example.com.db"; allow-
   transfer { 1.2.3.4; };
};
```

For this setup, Link11 needs to be provided with a protected IP and name from the DNS server, so Link11 can import the zone via AXFR.

This means that the AXFR server has to be whitelisted, and the DNS server needs to be configured to accept AXFR requests from Link11 IP (`85.131.129.5`).

### Step 2: Setting the Name Servers

After all settings have been copied or transferred to the WebGUI, the admin has to point to the Link11 DNS by editing the domain's configuration at the registrar. 

The available name servers are:

* ns1.link11.de
* ns2.link11.de
* ns3.link11.de

The name server to use is set in the WebGUI settings.