dotvitals

A nameserver hands out the whole zone to anyone who asks

HighConfirmeddns.health.zone-transfer-open

What this check looks for

One of your nameservers gave us a complete copy of your DNS zone, without being asked to prove who we are. Anyone can do the same and get a list of every hostname you have.

Why it matters

A zone transfer is a map of your infrastructure: staging servers, admin panels, VPN endpoints, internal names you assumed nobody would guess. It converts an attacker's reconnaissance from hours of guesswork into a single command, and it is the first thing an automated scanner tries.

When the check passes, your report says: “Nameservers refuse to hand the zone to a stranger”.

What it costs your score

When this check fails it removes 20 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.

It shares the dns.health.exposure family ceiling of 25 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.

Severity
high
Default confidence
confirmed
Status when triggered
fail
Deduction
20 points
Family cap
dns.health.exposure · 25
Category
DNS
Module
Dns health
Fix owned by
dns host
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Restrict zone transfers to your own secondary nameservers.

An open transfer publishes every hostname in your zone to anyone who asks for it.

  1. On the primary, set the transfer ACL to the addresses of your secondaries only (allow-transfer in BIND, allow-axfr-ips in PowerDNS, provide-xfr in NSD/Unbound).

  2. Better, authenticate transfers with a TSIG key shared only with those secondaries.

  3. Apply the same restriction on every nameserver, not only the one reported — the others may be refusing us for an unrelated reason.

  4. Assume the zone contents are already public: review any hostname that was only protected by being unguessable.

How to confirm it worked

  • dig AXFR ‹domain› @‹nameserver› — expect "Transfer failed"

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

Linux host
BIND:   allow-transfer { key xfr-key; };
PowerDNS: allow-axfr-ips=203.0.113.10,198.51.100.20
NSD:      provide-xfr: 203.0.113.10 xfr-key
Knot:     acl: [ { address: 203.0.113.10, action: transfer } ]
Technical detail

These nameservers accepted an AXFR request from our probe host and began transferring the zone: ‹server list›. RFC 5936 §8 requires transfers to be restricted to authorised secondaries, by source address, by TSIG key, or both. This is not a subtle finding: the transfer happened, from a machine with no relationship to your domain at all.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the dns health checkerBuild the fix

Other dns health checks