Zone transfer protection (AXFR)
A DNS zone transfer (AXFR) allows a secondary server to copy all DNS records. If a server accepts this request from anyone (not just authori…
Analyse my site for freeUnderstanding "Zone transfer protection (AXFR)"
A DNS zone transfer (AXFR) is a mechanism originally designed to synchronise legitimate secondary DNS servers with the primary server, transferring the entire set of DNS records for a domain in a single request — every subdomain, every internal record, every associated IP.
This mechanism must be strictly restricted to authorised secondary servers. A misconfigured DNS server that answers an AXFR request from anyone hands over a complete map of the domain's network infrastructure in plaintext — a textbook misconfiguration that remains surprisingly common.
How TheSiteFuse checks "Zone transfer protection (AXFR)"
TheSiteFuse retrieves the domain's nameserver (NS) list, then attempts a real AXFR zone-transfer request against each of the first 2 servers found (3-second timeout). If a transfer succeeds and returns zone data, the check fails with the most severe status (error) — this is a direct, immediately exploitable information leak. If the transfer is refused by every tested server (the expected, secure behaviour), the check passes.
Why "Zone transfer protection (AXFR)" matters
- Complete, instant network mapping — a successful zone transfer reveals in a single request every existing subdomain (including ones never linked from the public site), internal servers, email infrastructure IP addresses, and often clues about the full technical architecture.
- Easier reconnaissance for a targeted attack — unlike the "Exposed subdomains" check, which only tests a limited list of common prefixes, an open AXFR reveals absolutely everything, including test environments or services never meant to be discovered.
- Signal of neglected DNS configuration — an open AXFR is almost always a leftover default-configuration oversight rather than a deliberate choice, revealing DNS management that hasn't been audited in a long time.
Fix "Zone transfer protection (AXFR)" step by step
BIND
// named.conf.options or specific zone
options {
allow-transfer { 203.0.113.10; 203.0.113.11; }; // legitimate secondary servers' IPs only
};
PowerDNS
# pdns.conf allow-axfr-ips=203.0.113.10,203.0.113.11
Managed DNS hosts (Cloudflare, OVH, Gandi…)
These platforms disable AXFR by default for standard users — if you use a third-party managed DNS server rather than a self-hosted one (BIND, PowerDNS), this risk generally doesn't concern you.
Manual verification
dig axfr yourdomain.com @ns1.yourhost.com # Should return "Transfer failed" or a refused connection
Reference resource
To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.
Wikipedia — Zone transfer protection (AXFR)Does your site pass this check?
Run the free full audit (120 checks) and instantly discover what needs fixing.