Input Free script: automatically clean up stale slave zones on Slave DNS Manager secondaries

[Tobias Sorensson]

Server operating system version

ubuntu 22.04 to 26.04

Plesk version and microupdate number

18.0.82 #2

Hi all,

If you use Slave DNS Manager, you probably know this: when a domain is deleted in Plesk, DNS is switched off for it, or the domain moves to another server, the zone often stays on the secondary nameservers. BIND keeps retrying, the log fills up with "refresh: retry limit for primary ... exceeded" and "unexpected rcode (REFUSED)", and the secondaries keep answering with old data for domains that are long gone.

We got tired of cleaning that up by hand, so we wrote dns-zone-cleanup. It's a single Bash script, MIT licensed. You install it once on each secondary and it takes care of itself from then on.

What it does

• Finds stale secondary zones in named's log (primary no longer answers, or answers REFUSED/NOTAUTH)
• Checks every zone live against all of its primaries before removing anything. A domain that is active on one Plesk server and disabled on another is kept.
• Once a day, checks the delegation at the TLD. Zones whose domain no longer points to the server, or no longer exists, are removed after 7 days in a row.
• Removes zones with rndc delzone (Slave DNS Manager zones), or comments them out in named.conf on older setups. The config is backed up first, checked with named-checkconf and rolled back automatically if the check fails.
• On a Plesk server itself (the primary) it changes nothing, but it reports zones whose domain has moved elsewhere or expired, with the "plesk bin dns --off" command to run

Safety

• dryrun shows exactly what would happen
• Zones the server is primary for are never touched
• If a primary seems to be down (many zones timing out at once), its zones are held back instead of removed
• If more than half of the zones look "not delegated here", it assumes something is wrong and removes nothing
• Zone files can be deleted, kept or archived

Install (as a sudo user, no root login needed):

wget -qO- https://raw.githubusercontent.com/weconnect-tobias/Plesk-Scripts/main/dns-zone-cleanup/dns-zone-cleanup.sh | sudo bash -s install
dns-zone-cleanup dryrun

That sets up an hourly systemd timer (or cron). It can also update itself and send a daily mail report when something happened:

sudo dns-zone-cleanup install --auto-update --report-email [email protected] --smtp smtps://smtp.example.com:465 --smtp-user [email protected]

Works with new and old BIND versions (also without rndc showzone/zonestatus). Tested on Ubuntu; the installer also handles Debian, RHEL/Alma/Rocky, openSUSE, Arch and Alpine. Full documentation is in the README, and on the server with "man dns-zone-cleanup" or "dns-zone-cleanup help".

GitHub: Plesk-Scripts/dns-zone-cleanup at main · weconnect-tobias/Plesk-Scripts

The repo also has a few other scripts we use on our Plesk servers (load triage, compromise check, WordPress integrity, orphaned crontab cleanup).

Feedback, bug reports and pull requests are welcome. Please run it with dryrun first and tell me if it does anything unexpected on your setup.

Tobias
We Connect Nordic AB