Zone Transfer Vulnerabilities (AXFR): Why Restricting Secondary DNS Still Matters
What is an AXFR Zone Transfer?
The AXFR (Asynchronous Transfer Full Range) protocol is a DNS mechanism designed for replication. When configured properly, a primary authoritative nameserver uses AXFR to replicate its entire zone database over TCP port 53 to secondary nameservers for redundancy.
However, if an authoritative nameserver is misconfigured to allow AXFR requests from any arbitrary IP address, anyone on the internet can download the entire DNS zone file in a single query.
The Attacker's Perspective: Instant Reconnaissance
In typical penetration testing or offensive cyber operations, reconnaissance takes days of brute-force subdomain enumeration. A single open AXFR query bypasses all defensive barriers, revealing:
- Internal staging and development environments (
staging-db.corp.example.com) - Direct origin IP addresses that bypass Cloudflare or AWS CloudFront DDoS protections
- Deprovisioned services and legacy endpoints vulnerable to subdomain takeovers
- Proprietary naming conventions and internal VPN gateways
How to Test for AXFR Exposure
You can test your nameservers from the command line using dig:
- Query Syntax:
dig @ns1.yourdomain.com yourdomain.com AXFR
If the query returns a list of records rather than an error such as Transfer failed or REFUSED, your nameserver is vulnerable to complete zone leakage.
How to Remediate AXFR Vulnerabilities
- Disable Public Transfers: In BIND, set
allow-transfer { none; };globally or specify only the IP addresses of authorized secondary nameservers:allow-transfer { 198.51.100.4; };. - Implement TSIG (Transaction Signatures): Use shared secret cryptographic keys (RFC 2845) to authenticate zone transfer transactions between primary and secondary servers.
- Audit Nameservers Regularly: Run the DomainAfterCare DNS Inspector across all your nameserver delegations to verify that zone transfer requests are strictly refused.