DNS Zone Transfer Exposed
A DNS zone transfer (AXFR) replicates the entire DNS zone file from a primary to secondary nameserver. When zone transfers are not restricted, anyone can request a full dump of all DNS records, revealing internal subdomains, server names, IP addresses, and infrastructure layout. This information disclosure is a significant security risk used in reconnaissance for further attacks.
Symptoms
- Anyone can retrieve the complete list of subdomains
- Internal hostnames and IP addresses are publicly discoverable
- Security scanners flagging unrestricted AXFR
- Penetration test reports citing zone transfer vulnerability
Common Causes
- AXFR not restricted to authorized secondary nameservers
- Default nameserver configuration allowing transfers from any IP
- Firewall rules not blocking port 53 TCP from unauthorized sources
- Managed DNS provider misconfiguration
Step-by-Step Troubleshooting
- 1
- 2
Test for open zone transfers
Attempt a zone transfer against each nameserver to determine if AXFR is restricted.
Use DNS Records Dump → - 3
Restrict AXFR in nameserver config
Configure allow-transfer in BIND or equivalent to only permit known secondary nameserver IPs.
- 4
Verify TSIG authentication
Implement TSIG (Transaction Signature) for authenticated zone transfers between nameservers.
- 5
Re-test after changes
Verify zone transfers are now blocked from unauthorized sources.
Use DNS Records Dump →
Recommended Diagnostic Tools
Monitor DNS Security
Continuously check for zone transfer vulnerabilities and DNS misconfigurations.