DNS Zone Transfer (AXFR)

A DNS zone transfer replicates all records of a zone between nameservers. AXFR (RFC 5936) is the full transfer, sent over TCP port 53, and IXFR is the incremental version that sends only changes. It is how a secondary server stays in sync with its primary.

Why it matters

Zone transfers should only be allowed to your own secondary servers. If a server answers AXFR requests from anyone, an attacker can download the complete list of hostnames, including internal and forgotten ones, which makes reconnaissance trivial. Restrict transfers by IP address, and preferably authenticate them with TSIG keys. Many providers offer automatic secondary DNS without exposing AXFR to the public.

Example

Testing whether a server is misconfigured:

dig AXFR example.com @ns1.example.net

A properly locked server replies Transfer failed or REFUSED. In BIND, limit it with:

zone "example.com" {
  type master;
  allow-transfer { 198.51.100.2; };
};

Common mistakes

Leaving allow-transfer { any; } enabled after testing.
Blocking TCP port 53 so legitimate transfers fail.
Forgetting to bump the SOA serial, so secondaries never request a transfer.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.