regen

diff --git a/FAQ b/FAQ
index 912a2f8f53373f873cbeeac7249ddf39012c86d0..2e93100737ffb004071e9ecb8c28718d27bc91eb 100644 (file)
--- a/FAQ
+++ b/FAQ
@@ -375,7 +375,51 @@ A: When reloading a zone named my have multiple copies of the zone in
    other errors in the master file as it still has an in-core copy of the
    old contents.
 
-3. General Questions
+3. Operations Questions
+
+Q: How to change the nameservers for a zone?
+
+A: Step 1: Ensure all nameservers, new and old, are serving the same zone
+   content.
+
+   Step 2: Work out the maximum TTL of the NS RRset in the parent and
+   child zones. This is the time it will take caches to be clear of a
+   particular version of the NS RRset. If you are just removing
+   nameservers you can skip to Step 6.
+
+   Step 3: Add new nameservers to the NS RRset for the zone and wait until
+   all the servers for the zone are answering with this new NS RRset.
+
+   Step 4: Inform the parent zone of the new NS RRset then wait for all
+   the parent servers to be answering with the new NS RRset.
+
+   Step 5: Wait for cache to be clear of the old NS RRset. See Step 2 for
+   how long. If you are just adding nameservers you are done.
+
+   Step 6: Remove any old nameservers from the zones NS RRset and wait for
+   all the servers for the zone to be serving the new NS RRset.
+
+   Step 7: Inform the parent zone of the new NS RRset then wait for all
+   the parent servers to be answering with the new NS RRset.
+
+   Step 8: Wait for cache to be clear of the old NS RRset. See Step 2 for
+   how long.
+
+   Step 9: Turn off the old nameservers or remove the zone entry from the
+   configuration of the old nameservers.
+
+   Step 10: Increment the serial number and wait for the change to be
+   visible in all nameservers for the zone. This ensures that zone
+   transfers are still working after the old servers are decommissioned.
+
+   Note: the above procedure is designed to be transparent to dns clients.
+   Decommissioning the old servers too early will result in some clients
+   not being able to look up answers in the zone.
+
+   Note: while it is possible to run the addition and removal stages
+   together it is not recommended.
+
+4. General Questions
 
 Q: I keep getting log messages like the following. Why?
 
@@ -541,9 +585,9 @@ A: No. The BIND 9 bug database is kept closed for a number of reasons.
    that have been fixed post release. That is as close as we can get to
    providing a bug database.
 
-4. Operating-System Specific Questions
+5. Operating-System Specific Questions
 
-4.1. HPUX
+5.1. HPUX
 
 Q: I get the following error trying to configure BIND:
 
@@ -559,7 +603,7 @@ A: You have attempted to configure BIND with the bundled C compiler. This
 
    ./configure CC=<compiler> ...
 
-4.2. Linux
+5.2. Linux
 
 Q: Why do I get the following errors:
 
@@ -729,7 +773,7 @@ A: This is usually due to "/proc/net/if_inet6" not being available in the
    proc /proc           proc defaults 0 0
    proc /var/named/proc proc defaults 0 0
 
-4.3. Windows
+5.3. Windows
 
 Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail.
    Why?
@@ -755,7 +799,7 @@ A: This is the service manager saying that named exited. You need to
            Directory "C:\windows\dns\etc";
    };
 
-4.4. FreeBSD
+5.4. FreeBSD
 
 Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there.
 
@@ -768,7 +812,7 @@ A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to
 
    See also <http://people.freebsd.org/~dougb/randomness.html>.
 
-4.5. Solaris
+5.5. Solaris
 
 Q: How do I integrate BIND 9 and Solaris SMF
 
@@ -776,7 +820,7 @@ A: Sun has a blog entry describing how to do this.
 
    <http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris>
 
-4.6. Apple Mac OS X
+5.6. Apple Mac OS X
 
 Q: How do I run BIND 9 on Apple Mac OS X?