The public secondary never caught up with the portal's zone. Two
independent breaks, both found against Knot 3.5.10's source:
1. The NOTIFY was not a NOTIFY. It went out with the query opcode
and qtype NOTIFY (31), so Knot routed it as an ordinary query
and answered NODATA — the notify path was never reached. It is
now sent the RFC 1996 way: opcode NOTIFY, a single SOA question
named after the zone.
2. The TCP server handled one query per connection, but Knot runs
a whole refresh on one connection: the SOA check first, then the
zone transfer behind it. The portal closed the socket after the
SOA answer, so every transfer died with "connection reset" and
only the 300 s poll backstop remained — which hit the same wall.
Connections now serve queries until the client closes them.
(The secondary also needed automatic-acl in its knot.conf to admit
the notify at all; that is a fleet change, landing separately.)
Proven against a real knotd: with the fixes, an admin-triggered
zone change lands in the secondary's zone file within the same
second — notify accepted, refresh, zone file updated.
🤖 Generated with [ECA](https://eca.dev) (jokull/rotom)
Co-Authored-By: eca-agent <git@eca.dev>