What options should be given to bind9 to make it stealth?

Question

linux

Hello. There is a need for own DNS hosting. I want to manage zones using a wizard that does not appear in DNS records. In other words, the master is hidden behind a firewall, and 2 slave servers pull zones from it.

Answer 1

You yourself are in the question and gave one of the answers - hide the master behind a firewall
:) changes are not pushed (the master can only notify slaves that the zone has been updated if they are specified in the also-notify directive of this zone), but is pulled by the slave from the master (if the slave appears in allow-transfer). So yes, you have to forward port 53 tcp / udp for the slaves