diff --git a/Propellor/Attr.hs b/Propellor/Attr.hs
index fb94dc3..05ea3ff 100644
--- a/Propellor/Attr.hs
+++ b/Propellor/Attr.hs
@@ -49,10 +49,21 @@ alias domain = pureAttrProperty ("aka " ++ domain)
 addDNS :: Record -> SetAttr
 addDNS record d = d { _dns = S.insert record (_dns d) }
 
+-- | Adds a DNS NamedConf stanza.
+--
+-- Note that adding a Master stanza for a domain always overrides an
+-- existing Secondary stanza, while a Secondary stanza is only added
+-- when there is no existing Master stanza.
 addNamedConf :: NamedConf -> SetAttr
-addNamedConf conf d = d { _namedconf = S.insert conf (_namedconf d) }
+addNamedConf conf d = d { _namedconf = new }
+  where
+	m = _namedconf d
+	domain = confDomain conf
+	new = case (confType conf, confType <$> M.lookup domain m) of
+		(Secondary, Just Master) -> m
+		_  -> M.insert domain conf m
 
-getNamedConf :: Propellor (S.Set NamedConf)
+getNamedConf :: Propellor (M.Map Domain NamedConf)
 getNamedConf = asks _namedconf
 
 sshPubKey :: String -> Property
diff --git a/Propellor/Property/Dns.hs b/Propellor/Property/Dns.hs
index e47d6c3..4c93799 100644
--- a/Propellor/Property/Dns.hs
+++ b/Propellor/Property/Dns.hs
@@ -70,6 +70,9 @@ primary hosts domain soa rs = withwarnings (check needupdate baseprop)
 				in z /= oldzone || oldserial < sSerial (zSOA zone)
 
 -- | Secondary dns server for a domain.
+--
+-- Note that if a host is declared to be a primary and a secondary dns
+-- server for the same domain, the primary server config always wins.
 secondary :: [Host] -> Domain -> HostName -> Property
 secondary hosts domain master = pureAttrProperty desc (addNamedConf conf)
 	`requires` servingZones
@@ -95,7 +98,7 @@ servingZones = property "serving configured dns zones" go
 		zs <- getNamedConf
 		ensureProperty $
 			hasContent namedConfFile $
-				concatMap confStanza $ S.toList zs
+				concatMap confStanza $ M.elems zs
 
 confStanza :: NamedConf -> [Line]
 confStanza c =
diff --git a/Propellor/Types/Attr.hs b/Propellor/Types/Attr.hs
index f64b048..8b7d3b0 100644
--- a/Propellor/Types/Attr.hs
+++ b/Propellor/Types/Attr.hs
@@ -4,6 +4,7 @@ import Propellor.Types.OS
 import qualified Propellor.Types.Dns as Dns
 
 import qualified Data.Set as S
+import qualified Data.Map as M
 
 -- | The attributes of a host. For example, its hostname.
 data Attr = Attr
@@ -11,7 +12,7 @@ data Attr = Attr
 	, _os :: Maybe System
 	, _sshPubKey :: Maybe String
 	, _dns :: S.Set Dns.Record
-	, _namedconf :: S.Set Dns.NamedConf
+	, _namedconf :: M.Map Dns.Domain Dns.NamedConf
 
 	, _dockerImage :: Maybe String
 	, _dockerRunParams :: [HostName -> String]
@@ -42,6 +43,6 @@ instance Show Attr where
 		]
 
 newAttr :: HostName -> Attr
-newAttr hn = Attr hn Nothing Nothing S.empty S.empty Nothing []
+newAttr hn = Attr hn Nothing Nothing S.empty M.empty Nothing []
 
 type SetAttr = Attr -> Attr
diff --git a/config-joey.hs b/config-joey.hs
index b22f0e0..7fadd8b 100644
--- a/config-joey.hs
+++ b/config-joey.hs
@@ -90,7 +90,6 @@ hosts =               --                  (o)  `
 		& Ssh.hostKey SshEcdsa
 		& Apt.unattendedUpgrades
 		& Apt.serviceInstalledRunning "ntp"
-		& myDnsSecondary
 		& Postfix.satellite
 	
 		& Apt.serviceInstalledRunning "apache2"
@@ -122,6 +121,7 @@ hosts =               --                  (o)  `
 		& alias "nntp.olduse.net"
 		& JoeySites.oldUseNetServer hosts
 		
+		& myDnsSecondary
 		& Dns.primary hosts "olduse.net"
 			( Dns.mkSOA "ns1.kitenet.net" 100
 				[ NS (AbsDomain "ns1.kitenet.net")