DNS Zone Transfer Test (AXFR)

What is a DNS zone transfer test?

Reviewed by Prabath Thalangama · Last updated October 23, 2026

A zone transfer (AXFR) copies every record in a DNS zone from one name server to another. Name servers should only allow it to their own secondaries. This test asks each of the domain's authoritative name servers, up to eight, for a full transfer and flags any that hand the zone over.

An open zone transfer gives anyone a complete map of your domain: every subdomain, internal host name and mail or VPN server. It is a common finding in security assessments because it is easy to miss on self-hosted BIND or Windows DNS servers.

Managed DNS providers refuse public AXFR by default, so this problem is almost always on name servers you run yourself.

How do I test for an open zone transfer?

Enter the domain, for example example.com.
Check each name server's result. Refused or failed is the healthy answer.
If any server allowed the transfer, restrict AXFR on it to your secondary servers' IPs or a TSIG key.

How to read the results

Name server: Each authoritative server from the domain's NS records.
Transfer allowed: Whether that server returned the zone, and how many records it contained. Any allowed transfer is critical.
Error: Why a transfer did not happen, such as refused, timed out, or the name server couldn't be resolved.

How to close an open zone transfer

BIND allows AXFR to anyone

Set allow-transfer to your secondaries only, or none if there are no secondaries.

options {
    allow-transfer { 198.51.100.53; key "xfr-key"; };
};

Windows DNS allows transfers

In DNS Manager, open the zone's Properties, Zone Transfers tab, and choose Only to the following servers, or clear Allow zone transfers.

Examples and command-line equivalents

Test AXFR by hand

Transfer failed. means the server refused, which is what you want.

dig +short NS example.com
dig @ns1.example.com example.com AXFR

Frequently asked questions

Is an open zone transfer a vulnerability?

It's an information disclosure: it doesn't break anything by itself, but it hands attackers a list of targets they would otherwise have to guess. Fix it whenever you find it.

Is running this test against someone else's domain allowed?

An AXFR request is an ordinary DNS query that a properly configured server refuses. Still, only test domains you are responsible for or have permission to assess.