⚠️ Zone Transfer Test

Test if your DNS servers allow unauthorized zone transfers (AXFR).

What is a DNS Zone Transfer?

A zone transfer (AXFR) is a mechanism to replicate DNS databases across servers. While essential for DNS redundancy, allowing unauthorized zone transfers exposes your entire DNS structure.

Security Risks of Open Zone Transfers

  • Information Disclosure: Reveals all subdomains and internal hostnames Reveals all subdomains and internal hostnames
  • Attack Surface Mapping: Helps attackers identify targets Helps attackers identify targets
  • Network Topology Exposure: Shows internal IP addresses Shows internal IP addresses
  • Compliance Issues: May violate security policies May violate security policies

How to Secure Zone Transfers

  • Restrict AXFR to authorized secondary nameservers only
  • Use TSIG (Transaction Signatures) for authentication
  • Configure firewall rules to block port 53 TCP from unauthorized IPs
  • Regularly audit DNS server configurations

Frequently Asked Questions

Is zone transfer always bad?

No, zone transfers between your own authorized servers are necessary for DNS redundancy. Only unauthorized transfers are a security risk.

What if my test shows "vulnerable"?

Configure your nameserver to restrict AXFR requests to specific IP addresses or use TSIG authentication.

Tests whether DNS servers allow unauthorized zone transfers (AXFR), which expose all DNS records — a significant security vulnerability.

Key Facts

  • ~5% of domains allow public zone transfers
  • In OWASP testing guidelines
  • IXFR transfers only changed records
  • Zone transfers use TCP port 53

Frequently Asked Questions

What is a zone transfer?

Copies entire DNS zone from one nameserver to another. Meant for replication, dangerous if publicly accessible.

Why is open zone transfer dangerous?

Exposes all DNS records: subdomains, internal hostnames, IPs, mail servers. Attackers use for reconnaissance.

How to disable public zone transfers?

Configure DNS to allow transfers only to specific secondary IPs. BIND: allow-transfer { ip; };