DNS Zone Transfers: Why an Open AXFR Hands Over Your Whole Network

A DNS zone transfer copies an entire zone file from one name server to another. It exists so that secondary servers can stay synchronized with the primary without anyone editing records twice. Configured correctly it is invisible infrastructure. Left open to the internet it is one of the most generous disclosures a network can make, which is why it remains a standard early check in any assessment.

AXFR and IXFR

AXFR is the full transfer: the secondary asks, and the primary sends every record in the zone. IXFR is the incremental version, sending only what changed since the secondary's current serial number, which is far more efficient on large or frequently updated zones.

Both run over TCP rather than UDP, because a zone can easily exceed what a single UDP datagram carries. That detail shows up on the Network+ exam: ordinary lookups use UDP 53, zone transfers use TCP 53.

The process is driven by the serial number in the zone's SOA record. Secondaries poll on the refresh interval, compare serials, and pull if the primary's is higher. A NOTIFY message from the primary can trigger this immediately rather than waiting for the poll.

Why an open transfer is critical

The zone file is a complete map. Every hostname the organization has published internally or externally, the IP address behind each one, mail routing through MX records, name servers, service locations advertised in SRV records, and the text records used for verification and email authentication — all of it in one response.

Normal enumeration is guesswork: an attacker brute-forces common names against the resolver and finds whatever they thought to guess. A successful zone transfer replaces that with the authoritative list, including the hosts nobody would guess. Names like vpn-test, oldmail, jenkins-internal, and backup-dc02 are exactly the forgotten systems that make good targets, and they describe the environment's structure as clearly as a network diagram.

Split-horizon mistakes make this worse. If an internal zone containing private addressing is served by a name server reachable from outside, a transfer discloses the internal topology too. Knowing which DNS record types carry which information makes it obvious how much is in a single zone file.

Testing for it

The check is one command. Identify the zone's authoritative name servers with an NS query, then request a transfer from each of them with dig AXFR example.com @ns1.example.com. A correctly configured server refuses. A misconfigured one returns the zone.

Test every authoritative server, not just the first. It is common for a primary to be locked down while a secondary, or a server left running after a migration, still answers. The finding lives on whichever host is weakest.

Note that this is active reconnaissance — you are querying the target's infrastructure directly and it will appear in their logs — so it belongs inside an authorized scope.

Locking it down

Restrict transfers by address. In BIND, an allow-transfer statement listing only the legitimate secondary servers, applied globally and per zone, turns the answer into a refusal for everyone else. Equivalent settings exist in every major DNS implementation, and modern versions increasingly default to denying transfers, though inherited configurations often do not.

Address-based control is spoofable, so authenticate the transfer as well. TSIG signs transfer requests and responses with a shared secret, so a request from the right address but without the key is rejected. Using both is the recommended posture.

Keep internal and external zones genuinely separate, on servers that are not reachable from the same places, so an internal zone is never exposed even if a transfer succeeds. Prune records for hosts that no longer exist, since stale entries disclose history and sometimes point at addresses now used by someone else. And monitor for transfer attempts — a refused AXFR from an unexpected source is a clean, low-noise reconnaissance signal to feed into your SIEM.

Exam angles

Know that AXFR is a full zone transfer, IXFR incremental, and both use TCP 53 while queries use UDP 53. Recognize that an unrestricted zone transfer is an information disclosure finding whose impact is complete host enumeration. Name allow-transfer address restrictions and TSIG authentication as the mitigations, and recognize the SOA serial number as the mechanism that decides whether a transfer happens at all.