Skip to content
whois.me.uk
Menu
Sign in

DNS-AXFR-OPEN

A nameserver allows zone transfers to anyone

What it means

AXFR hands the entire zone to whoever asks: every host name, internal names included. Attackers use it to map infrastructure and find forgotten hosts.

How to fix it

  1. 1BIND: set allow-transfer { <secondary IPs>; }; in the zone or options block.
  2. 2PowerDNS: set allow-axfr-ips. Knot/NSD: restrict the transfer ACL.
  3. 3Hosted DNS: open a ticket with the provider; most restrict transfers by default.
  4. 4Re-run the DNS facet; the test is repeated on every lookup.

Re-check after the change

DNS changes can take up to the record's TTL to be seen; use Re-run on the result page to bypass our 10-minute cache.