Zone Transfer (AXFR) Test
Test every nameserver of a domain for an unrestricted AXFR zone transfer, the misconfiguration that hands your complete DNS zone, internal hostnames included, to anyone who asks.
About Zone Transfer (AXFR) Test
The Zone Transfer (AXFR) Test asks each of a domain's own nameservers for a full copy of the zone and reports which of them agreed. An AXFR is meant to be a private conversation between a primary and its secondaries. When a server answers it for any client on the internet, your entire zone becomes public reading: every internal hostname, every staging and development name, every service record and every host you never intended to publish, all returned in a single request. The test shows which server is leaking and a sample of what it handed over.
AXFR is specified in RFC 5936 and runs over TCP port 53, because a whole zone rarely fits in a UDP datagram. It exists so a secondary can pull the zone after an RFC 1996 NOTIFY or when its refresh timer fires. The standard is explicit that a server should control who may request a transfer, but the default on older installations and appliances was to allow it, which makes the failure mode silent: nothing breaks, and there is rarely a log entry anyone reads. Attackers try AXFR first because it is quicker and quieter than brute-forcing subdomain names.
Targets are derived only from the domain's own NS records, never from a host you type, so the test cannot be aimed at an arbitrary server. Each nameserver is contacted over TCP, sent one AXFR request for the zone, and only the first response message is read, which is enough to establish whether the transfer was permitted without pulling down a full zone. You get a per-server verdict of refused or transfer allowed with the IP address and response code, plus a sample of the records returned by any server that complied. Up to eight nameservers are tested.
How to use it
- 1Enter the domain to test, for example example.eu, using the zone apex rather than a subdomain.
- 2Select Test zone transfer; the targets are taken from the domain's own NS records.
- 3Read the verdict banner, where no nameserver allowed a zone transfer is the correct result.
- 4Work through the per-nameserver list, each marked refused or transfer allowed with its IP address and response code.
- 5For any server marked transfer allowed, read the sample records to see what is exposed, restrict AXFR to your secondaries by IP address or TSIG, then re-run the test.
Common use cases
- -Auditing your own zones for an open AXFR before an external penetration test finds it for you.
- -Verifying a newly added secondary came with a proper allow-transfer list rather than a permissive default.
- -Confirming a DNS appliance upgrade or hosting migration did not reintroduce an unrestricted transfer.
- -Checking acquired or inherited domains whose nameserver configuration you have never seen.
- -Demonstrating the exposure concretely to a team that is unsure why AXFR restrictions matter.
Frequently asked questions
- What is an AXFR zone transfer?
- AXFR is the DNS mechanism, specified in RFC 5936, by which a secondary nameserver downloads a complete copy of a zone from its primary over TCP port 53. It is a normal and necessary part of running more than one nameserver. The problem arises only when a server accepts an AXFR request from clients other than its own secondaries.
- Why is an open zone transfer a security risk?
- Because it returns the whole zone in one answer. An attacker obtains every hostname you have published, including internal, staging, VPN, backup and management names that were never linked anywhere, plus the SRV and TXT records describing your services. It turns reconnaissance from slow guesswork into a single query and maps your attack surface for you.
- How do I disable zone transfers?
- Restrict them rather than disabling them, since your secondaries still need them. In BIND, set allow-transfer to your secondary addresses or a TSIG key, both globally and per zone. In NSD, list each secondary under provide-xfr; in Knot, use an acl entry with action transfer. TSIG (RFC 8945) is stronger because it authenticates the requester with a shared key instead of trusting a source address.
- Can I test a nameserver I do not own?
- This test only contacts the nameservers that a domain's own NS records point to, and only requests that domain's zone. It is a read-only query the server is free to refuse, and it is the same request the domain's secondaries make routinely. You cannot direct it at an arbitrary IP address, which keeps it a configuration audit rather than a scanning tool.