Wilfried,

Some call it "hidden master", others call it "hidden primary" and
others call it "stealth master"...

This URL may help and I'm sure there is much more thorough source of
documentation: http://www.dns.net/dnsrd/servers/

(just look up "hidden master" in the web page...)

You may also visit this page:
https://www.isc.org/software/bind/documentation/arm95

I think as for the XFR config, amha, the slave run by NCC should be
configured to feed from the other NS listed (and run on-site).

Hope that helps,

Mohsen.

 On 20 Nov, Wilfried Woeber, UniVie/ACOnet wrote:
 | Another question regarding v6 reverse delegation, but possibly also
 | applicable to v4 reverse...
 |
 | One of our customers has a somewhat complex DNS setup which makes us
 | face the situation that in the SOA record the name of the NS where
 | the zone originates is not in the set of responses to NS queries.
 |
 | While this is not the common case, I presume, it seems to NOT be "illegal".
 |
 | The domain has to on-site name servers and is configured to have a slave
 | at the NCC.
 |
 | For this zone we received an alert that the ZXFR has failed from the
 | machine with the name given in the SOA. That box will never be serving
 | external zone transfer requests.
 |
 | So - this may just be a glitch in the alerting script, but I am still
 | left with the question: how does the robot at the NCC's end determine
 | the "appropriate" host to try zone transfers from?
 |
 | Any recommendations?
 |
 | Thanks,
 | Wilfreid.