What is Zone Transfer?

A DNS zone transfer (AXFR) replicates DNS records between servers, but misconfigurations allowing unauthorized transfers expose complete network infrastructure to attackers.

What is a DNS zone transfer?

A DNS zone transfer (AXFR/IXFR) is a mechanism for replicating DNS zone data between authoritative name servers. The primary server transmits its complete zone file containing all DNS records to secondary servers for redundancy and load distribution. While essential for DNS infrastructure operation, misconfigured zone transfers allowing queries from unauthorized sources expose complete DNS inventories including internal hostnames, IP addresses, and network architecture to attackers.

Why are unauthorized zone transfers a security risk?

Unauthorized zone transfers expose the complete DNS zone file containing all hostnames, IP addresses, mail server records, service records, and potentially internal naming conventions. This information significantly accelerates attacker reconnaissance by revealing the full network topology, identifying high-value targets, discovering internal services not intended for public access, and providing a comprehensive map for planning targeted attacks against specific infrastructure components.

How do attackers exploit zone transfers?

Attackers exploit misconfigured zone transfers by sending AXFR requests to DNS servers using tools like dig, nslookup, or dnsrecon. If the server responds with the complete zone file, attackers obtain a comprehensive inventory of the target's DNS infrastructure. This reveals internal server names suggesting their function, network addressing schemes, development and staging environments, partner integration points, and services that may have known vulnerabilities to target.

How do you test for zone transfer vulnerabilities?

Test for zone transfer vulnerabilities using the command 'dig axfr @nameserver domain.com' against each authoritative name server. Tools like dnsrecon, fierce, and dnsenum automate testing across multiple servers. Penetration testers include zone transfer checks in reconnaissance phases. Successful transfers returning zone data indicate misconfiguration. Testing should cover all authoritative servers as configurations may vary between primary and secondary name servers.

How do you secure DNS zone transfers?

Secure zone transfers by restricting AXFR queries to authorized secondary server IP addresses through access control lists, implementing TSIG (Transaction Signature) authentication requiring cryptographic keys for transfer authorization, deploying DNS firewalls blocking unauthorized AXFR requests, monitoring DNS query logs for zone transfer attempts, and regularly auditing DNS server configurations to ensure transfer restrictions remain properly configured across all authoritative servers.

What is TSIG authentication for zone transfers?

Transaction Signature (TSIG) authentication uses shared secret keys to cryptographically authenticate DNS zone transfer requests and responses. Both primary and secondary servers must possess the same TSIG key to complete transfers. TSIG prevents unauthorized transfers even from IP addresses that might pass access control checks through spoofing. It provides mutual authentication ensuring both transfer parties are legitimate and data integrity verification for transferred records.

What information does a zone transfer reveal?

A complete zone transfer reveals all A records mapping hostnames to IP addresses, MX records identifying mail servers, CNAME records showing aliases and relationships, SRV records exposing service locations and ports, TXT records potentially containing SPF, DKIM, and verification information, NS records identifying all name servers, and internal naming conventions that reveal server functions, environments, and organizational structure to attackers conducting reconnaissance.

How does zone transfer security fit into overall DNS security?

Zone transfer security is one component of comprehensive DNS security that also includes DNSSEC for response authenticity and integrity validation, DNS over HTTPS/TLS for query privacy, response rate limiting against amplification attacks, DNS monitoring for tunneling and exfiltration detection, registrar account security preventing domain hijacking, and DNS firewall services blocking queries to known malicious domains. Each layer addresses different DNS-related threat vectors.