DNS zone transfers using the AXFR protocol are the simplest mechanism to replicate DNS records across DNS servers. To avoid the need to edit information on multiple DNS servers, you can edit information on one server and use AXFR to copy information to other servers. However, if you do not protect your servers, malicious parties may use AXFR to get information about all your hosts.
How DNS Works
DNS (Domain Name System) is like an Internet phonebook. It is responsible for resolving human-readable hostnames into machine-readable IP addresses. The system includes authoritative DNS servers that provide information and DNS caches that store that information temporarily for client lookups. A typical DNS query is very simple: a client provides a human-readable hostname and in response receives an IP address. However, the system assumes that the querying client knows the hostname.
DNS servers host zones. A DNS zone is a portion of the domain name space that is served by a DNS server. For example, example.com with all its subdomains may be a zone. However, second.example.com may also be a separate zone.
Why Is DNS Zone Transfer Needed
DNS is a critical service. If a DNS server for a zone is not working and cached information has expired, the domain is inaccessible to all services (web, mail, and more). Therefore, each zone should have at least two DNS servers. For more critical zones, there may be even more.
However, a zone may be large and may require frequent changes. If you manually edit zone data on each server separately, it takes a lot of time and there is a a lot of potential for a mistake. This is why DNS zone transfer is needed.
You can use different mechanisms for DNS zone transfer but the simplest one is AXFR (technically speaking, AXFR refers to the protocol used during a DNS zone transfer). It is a client-initiated request. Therefore, you can edit information on the primary DNS server and then use AXFR from the secondary DNS server to download the entire zone.
How To Initiate a DNS Zone Transfer
Initiating an AXFR zone-transfer request from a secondary server is as simple as using the following dig commands, where zonetransfer.me is the domain that we want to initiate a zone transfer for. First, we need to get the list of DNS servers for the domain:
$ dig +short ns zonetransfer.me
nsztm1.digi.ninja.
nsztm2.digi.ninja.
Now, we can get initiate an AXFR request to get a copy of the zone from the primary server:
$ dig axfr zonetransfer.me @nsztm1.digi.ninja.
; <<>> DiG 9.8.3-P1 <<>> axfr zonetransfer.me @nsztm1.digi.ninja.
;; global options: +cmd zonetransfer.me. 7200 IN SOA nsztm1.digi.ninja. robin.digi.ninja. 2017042001 172800 900 1209600 3600
(...)
AXFR Vulnerability and Prevention
AXFR offers no authentication, so any client can ask a DNS server for a copy of the entire zone. This means that unless some kind of protection is introduced, an attacker can get a list of all hosts for a domain, which gives them a lot of potential attack vectors.
In order to prevent this vulnerability from occurring, the DNS server should be configured to only allow zone transfers from trusted IP addresses. The following is an example of how this can be accomplished in the BIND DNS server.
# /etc/named.conf
acl trusted-nameservers {
192.168.0.10; //ns2
192.168.1.20; //ns3
};
zone zonetransfer.me {
type master;
file "zones/zonetransfer.me";
allow-transfer { trusted-nameservers; };
};
Additionally, it’s also recommended to use transaction signatures (TSIG) for zone transfers to prevent IP spoofing attempts.
Frequently asked questions
A DNS zone is a set of DNS records for a given domain. It is a unit used by DNS servers to store DNS information.
A DNS zone transfer is a procedure that lets two DNS servers exchange their zones. This is needed for redundancy. There are several zone transfer methods but the most common one uses the AXFR protocol.
If DNS zone transfers are done using the AXFR protocol, there is no encryption and there is no authentication. Anyone can get the whole zone using the AXFR protocol. Malicious hackers may use the information contained in zones to conduct attacks.
The simplest way to secure zone transfers is to restrict AXFR requests to trusted IP addresses. You can do it in your DNS server configuration or on your firewall. You can additionally use transaction signatures.
Learn how to use transaction signatures in the BIND DNS server.
Get the latest content on web security
in your inbox each week.
THE AUTHOR
Principal Cybersecurity Writer
