Zone transfer check

None.

Integrity.

All nameserver IP addresses.

Every 5 minutes.

None.

None.

Purpose

The Zone transfer check attempts to retrieve the zone content by a zone transfer (AXFR).

Zone transfers should be strictly enforced to only allow zone transfers to secondary/slave servers. A zone transfer is the standardised way for authoritative name servers to transfer copies of a zone between each other.

Security best practices dictate that no or very limited information should be made available to the public. By allowing zone transfers to the world the entire zone content and with that a great deal of information about your Internet infrastructure is exposed.

Most DNS servers can be configured with Access control lists and to require authentication to only allow zone transfers to authorised entities.

Event severities and messages

Zone transfer was correctly refused.

Zone transfer failed with RCODE message.
Check the Generic DNS response code page for further information.

Zone transfer attempt timed out.

Transfer request was allowed but no data was received.
The zone transfer response contained no zone data. Although no data was received the name server allowed the transfer request. This might indicate a configuration flaw and should be remedied.

Zone transfer request was allowed, # resource records were transferred.
The zone transfer was successful, which means that anyone can transfer the zone and analyse its content. This is a serious security flaw that need to be addressed. Check the documentation of your DNS server software for how to set up your server to only allow zone transfers to trusted parties.

​

Unable to perform check due to input data failure.
When this message appears, it is usually one of the queries leading up to the final query has received an empty or garbled query response. Please report this through the normal support channel.

Solutions, tips & tricks