---
title: "DNS Zone Transfer Vulnerability"
canonical: "https://kb.cynergy.app/space/MD/899416331/DNS%20Zone%20Transfer%20Vulnerability"
format: markdown
---
**Description **

DNS zone transfer, also known as DNS query type AXFR, is a process by which a DNS server passes a copy of part of its database to another DNS server. The portion of the database that is replicated is known as a zone.

The DNS server contains a Zone file which it uses to replicate the map of a domain. in a good state, it is configured so that only the replicating DNS-server can access it, but sometimes it is misconfigured so anyone can request the zone file, and thereby receive the whole list of subdomains. This can be done the following way:

A zone transfer uses the Transmission Control Protocol (TCP) and takes the form of a client-server transaction.

The client requesting a zone transfer may be a slave server or secondary server, requesting data from a master server or a primary server to get the whole list.

**Hacker's View**

As a hacker, I can run tools such as [dnsrecon ](https://github.com/darkoperator/dnsrecon)or [dnsenum](https://github.com/fwaeytens/dnsenum) to identify if a Zone Transfer vulnerability exists. Since  XFR offers no authentication, I can ask a DNS server for a copy of the entire zone. This means that unless some kind of protection is introduced, I can get a list of all hosts for a domain, which opens up my attack vectors and attack surface. 

**Mitigation**

In order to prevent this vulnerability from occurring, the DNS server should be configured to only allow zone transfers from trusted IP addresses. The following is an example of how this can be accomplished in the BIND DNS server.

```
# /etc/named.conf 
acl trusted-nameservers {
  192.168.0.10; //ns2 
  192.168.1.20; //ns3 
}; 
zone yourdomain.com{ 
  type master; 
  file "zones/yourdomain.com"; 
  allow-transfer { trusted-nameservers; };
};

```

it’s also recommended to [use transaction signatures (TSIG) for zone transfers](https://www.slashroot.in/secure-zone-transfer-bind-using-tsigtransaction-signatures) to prevent IP spoofing attempts.

**Cynergy’s View**

Cynergy allows you to detect zone transfer vulnerbilities 

**Reference**

AWS (PDF) - [https://pages.awscloud.com/rs/112-TZM-766/images/Day4 Protect your Network from DNS Exfiltration Attacks.pdf](https://pages.awscloud.com/rs/112-TZM-766/images/Day4%20Protect%20your%20Network%20from%20DNS%20Exfiltration%20Attacks.pdf) 

GCP - [https://cloud.google.com/dns/docs/best-practices](https://cloud.google.com/dns/docs/best-practices) 

Azure - [https://docs.microsoft.com/en-us/services-hub/health/remediation-steps-ad/configure-all-dns-zones-only-to-allow-zone-transfers-to-specified-ip-addresses](https://docs.microsoft.com/en-us/services-hub/health/remediation-steps-ad/configure-all-dns-zones-only-to-allow-zone-transfers-to-specified-ip-addresses) 

Cloudflare - [https://www.cloudflare.com/learning/dns/dns-security/](https://www.cloudflare.com/learning/dns/dns-security/) 

Digi Ninja - [https://digi.ninja/projects/zonetransferme.php](https://digi.ninja/projects/zonetransferme.php)