A nameserver that answers AXFR from anyone hands over every record in the zone in one query. It is a one-line test, it is still found on real infrastructure, and it is the cheapest reconnaissance there is.
The test
; Transfer failed. ; Transfer failed.
Every nameserver in the delegation has to be tested. A zone is only as closed as its most permissive server, and configuration drift across a fleet is the normal state of things rather than the exception.
What one hands over
- Every hostname. Including the ones not published anywhere, not linked from anything, and assumed private.
- Internal naming conventions.
db-prod-03,legacy-billing,jenkins— a map of the estate and its age. - Every address. Which is a scan target list, in order, with labels.
- Every CNAME target. Which is a takeover shortlist, since dangling ones are now trivially findable.
- TXT records. Verification tokens naming every SaaS platform the organisation uses.
Hostnames are not secrets
Worth saying plainly: a name being known is not a vulnerability, and anything relying on a hostname being unguessable is already broken. The harm from an open transfer isaggregation — it converts reconnaissance that would take a long noisy scan into a single quiet query, and it makes dangling records as easy to find for an attacker as for you.
Test it whenever the fleet changes
The usual cause is a nameserver added to the fleet without the transfer ACL the others carry. That makes it a per-change test rather than a one-off — and it belongs in the same check that confirms every nameserver serves the same serial.