A DNS zone that receives copies of records from a master zone via automatic zone transfers (AXFR). The slave nameserver is read-only; it pulls updates from the authoritative master and serves queries without making changes itself.
Why it matters: Slave zones distribute DNS load and provide redundancy. If your master goes down, slaves keep your domain resolving. Most registrars run at least one slave nameserver as standard practice—you don't control it, they do.
Common setup: you run a master zone on your own nameserver, point the registry to your master + 1–2 slave nameservers (usually provided by your registrar or DNS host). When you update records on the master, slaves sync automatically.
Caveat: if a registrar controls your slave, they can theoretically intercept zone transfers or inject records. For paranoid operators, running your own slave infrastructure (via a bulletproof host or co-located box) eliminates that middleman. DNSSEC and RPKI don't fix this—they sign the data, not the transfer channel.
Modern alternative: IXFR (incremental zone transfer) reduces bandwidth; some DNS providers use proprietary sync instead of AXFR.