Zone transfer (AXFR) test
Do your nameservers hand the whole zone to anyone who asks?
What this check does
Asks each authoritative nameserver for a full zone transfer. An open AXFR gives attackers every host name in your zone in one request; the DNS facet reports the result per server.
- AXFR attempted against every delegated nameserver over TCP
- Refused or closed is the correct answer
- Open transfers flagged as a failure