Skip to content
HackIndex logo

HackIndex

DNS Zone Transfer (AXFR)

1 min read May 15, 2026

Misconfigured servers allow full zone dumps. Test all discovered NS records; behavior varies per server.

Basic AXFR with dig

┌──(kali㉿kali)-[~]
└─$ dig AXFR $DOMAIN @$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ dig +tcp AXFR $DOMAIN @$TARGET_IP

Force TCP when UDP blocked.

First enumerate NS records:

┌──(kali㉿kali)-[~]
└─$ dig NS $DOMAIN +short

Then target each:

┌──(kali㉿kali)-[~]
└─$ for ns in $(dig NS $DOMAIN +short); do dig AXFR $DOMAIN @$ns +short; done

AXFR with host

┌──(kali㉿kali)-[~]
└─$ host -l $DOMAIN $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ host -t AXFR $DOMAIN $TARGET_IP

Sometimes succeeds when dig fails.

Automated Attempts

Dnsrecon

┌──(kali㉿kali)-[~]
└─$ dnsrecon -d $DOMAIN -t axfr
┌──(kali㉿kali)-[~]
└─$ dnsrecon -d $DOMAIN -t axfr -n $TARGET_IP

Dnsenum

┌──(kali㉿kali)-[~]
└─$ dnsenum $DOMAIN
┌──(kali㉿kali)-[~]
└─$ dnsenum --dnsserver $TARGET_IP $DOMAIN

Fierce

┌──(kali㉿kali)-[~]
└─$ fierce --domain $DOMAIN

Includes AXFR attempts plus traversal.

A successful zone transfer reveals internal hostnames for targeted enumeration — feed results into Object Enumeration for AD context. If AXFR is blocked, check ADIDNS Poisoning and Hijacking for AD-integrated DNS attack paths.