AXFR

AXFR, short for authoritative zone transfer, is a DNS protocol used to transfer an entire zone file from a primary DNS server to a secondary DNS server. It enables redundancy and consistency by ensuring all authoritative servers for a zone possess identical data.

AXFR transfers use TCP, typically on port 53, rather than UDP to accommodate large zone data and provide reliable delivery. When a secondary server is configured as a slave for a zone, it requests a zone transfer for that zone. The primary responds with all resource records in the zone in DNS wire format, usually beginning with the zone’s Start of Authority (SOA) records and continuing through all RRsets, and ending with a final SOA. The transfer may occur in one or more TCP messages depending on the zone size. Once complete, the secondary updates its copy of the zone and begins serving clients with that data, typically at the configured serial number.

Because a complete copy of the zone is exposed, AXFR transfers are commonly restricted to authorized secondary servers by IP allowlists and/or cryptographic authentication such as TSIG. Misconfigured or publicly accessible AXFR can enable zone enumeration. Some operators disable AXFR in favor of tighter controls or alternative methods to mitigate exposure, especially for zones with sensitive data.

AXFR is distinct from IXFR, which transfers only differences since a previous serial, reducing bandwidth. AXFR remains widely supported by major DNS software including BIND, NSD, Knot DNS, and PowerDNS, though some providers disable it to limit exposure. In modern deployments, secure transfer methods and access controls are used in conjunction with careful zone management practices.