CertaDNS
Skip to lesson

Zone Transfer · lesson 2 of 2

An open transfer

After this lesson you can

Test a nameserver for open transfer and say what one hands to anyone who asks.

Assumes you have read How a secondary stays current.

A nameserver that answers AXFR from anyone hands over every record in the zone in one query. It is a one-line test, it is still found on real infrastructure, and it is the cheapest reconnaissance there is.

The test

$ for ns in $(dig +short NS certadns.com); do dig AXFR certadns.com @$ns; done
; Transfer failed.
; Transfer failed.
Checked 2026-09-15. Both nameservers refuse, which is correct.

Every nameserver in the delegation has to be tested. A zone is only as closed as its most permissive server, and configuration drift across a fleet is the normal state of things rather than the exception.

What one hands over

  • Every hostname. Including the ones not published anywhere, not linked from anything, and assumed private.
  • Internal naming conventions. db-prod-03, legacy-billing, jenkins — a map of the estate and its age.
  • Every address. Which is a scan target list, in order, with labels.
  • Every CNAME target. Which is a takeover shortlist, since dangling ones are now trivially findable.
  • TXT records. Verification tokens naming every SaaS platform the organisation uses.

Hostnames are not secrets

Worth saying plainly: a name being known is not a vulnerability, and anything relying on a hostname being unguessable is already broken. The harm from an open transfer isaggregation — it converts reconnaissance that would take a long noisy scan into a single quiet query, and it makes dangling records as easy to find for an attacker as for you.

Test it whenever the fleet changes

The usual cause is a nameserver added to the fleet without the transfer ACL the others carry. That makes it a per-change test rather than a one-off — and it belongs in the same check that confirms every nameserver serves the same serial.

Last reviewed