DNS Protocol – AXFR – Zone transfers

  DNS, DNS theory, Domains and DNS

So-called zone transfer is designed to transfer the entire contents of a domain zone, ie. all its DNS records, from one DNS server to another. This mechanism used by secondary servers for downloading data from the primary server, if the content of the domain zone is changed. AXFR is connecting via TCP.

AXFR has a disadvantage – always transfers the entire contents of the zone, although it should be changed only one record. This is solved by IXFR(Incremental Zone Transfer, RFC 1995), which transfers only the changed records.

AXFR should not be publicly available, it should be permitted only between a group of authoritative DNS servers. If anybody will have the opportunity to download so easily all domain records, could be compromised some private records, that would have otherwise been accessible only by direct inquiry – for example, list of computers in the domain, subdomain name for access to internal administration, etc..