Authority zones in the Domain Name System must be declared to have one or more authoritative name servers, usually consisting of one primary name server and several secondary name servers. These name servers are expected to synchronize zone data using DNS's zone transfer protocols, but the configuration of these synchronization relationships depends upon out of band information and manual processes. This paper describes a way to create name service federations such that a varying set of zones offered by a primary name server can be automatically configured for synchronization by secondary name servers. A sample implementation based on ISC BIND and Perl is described.

The DNSSECbis data model has key introduction follow the delegation chain, thus requiring a zone's parent to become secure before a zone itself can be secured. Ultimately this leads to non-deployability since the root zone will probably not be secured any time soon. We describe an early deployment aid for DNSSECbis whereby key introduction can be done via cooperating third parties.