🗂️

DNS Zone Transfer Test (AXFR)

Attempts an AXFR request against every authoritative nameserver for a domain to check whether it hands the full zone to any anonymous client.

RFC: RFC 5936 (AXFR), 1995 (IXFR)
TRANSPORT: TCP port 53
RISK: Full zone disclosure

What is DNS Zone Transfer Test (AXFR)?

A zone transfer, or AXFR, is the mechanism secondary nameservers use to pull a complete copy of a DNS zone from the primary. The protocol carries no authentication of its own, so a nameserver must be explicitly configured to restrict who may request one — otherwise it will hand the entire zone to anyone who asks.

How it Works

The tool resolves every authoritative nameserver for the domain and attempts an AXFR transfer against each one in turn, reporting whether the request was correctly refused or, critically, accepted.

Key Use Cases

Confirming an internal audit finding that all authoritative nameservers correctly reject anonymous transfers.

Checking a newly added secondary nameserver was configured with the same restrictions as the existing ones.

Verifying remediation after a previous zone-transfer exposure has actually been fixed on every server.

Advanced Details

A single permissive nameserver exposes the whole zone even if every other authoritative server correctly refuses — an attacker only needs the one that accepts. Restriction must be applied consistently across every server, not just the primary.

Cybersecurity Pros & Cons

Security Advantages
  • Detects one of the highest-severity DNS misconfigurations in a single request per nameserver.
  • An open zone transfer hands over the complete internal naming inventory instantly — this test finds that exposure before an attacker does.
  • Checks every authoritative nameserver individually, catching the common case where only one server was left permissive.
  • Requires no credentials and runs in seconds.
Security Limitations
  • Only testing your own domain is legitimate — AXFR attempts against third-party infrastructure without authorisation may be unlawful.
  • A refused transfer does not mean individual records are unguessable; certificate transparency and brute-force enumeration remain possible.
  • The test cannot detect a zone transfer that is restricted by IP allowlist to addresses this tool does not run from.
Ready to Test?

Use our professional-grade tool to perform a real-time check for this module.

Run Module Now
Related Docs