Skip to content
HackIndex.io

DNS Zone Transfer (AXFR)

4 min read Created Jan 3, 2026 Last updated Aug 17, 2026

AXFR is a DNS zone transfer request, designed to replicate zone data between nameservers. When a server responds to AXFR from arbitrary sources, it returns every record in the zone: internal hostnames, IP mappings, mail servers, VPN gateways, and staging environments that brute-force enumeration would miss entirely. The zone file effectively maps the full infrastructure of a target from a single query. Not every nameserver will respond. Primary servers are typically locked down. Secondary and tertiary nameservers, especially those managed by third-party DNS providers, are more often misconfigured. Test each NS record individually before concluding the zone is protected.

  • dig / host AXFR send zone transfer requests to each nameserver individually and collect the full zone file.
  • NS enumeration first primary servers are often locked down, but secondaries managed by third-party providers may not be.
  • dnsrecon automatically queries all NS records and reports which respond to AXFR with labeled output.
  • dnsenum combines zone transfer with brute-force subdomain discovery and reverse lookups in one pass.
  • fierce includes AXFR attempts alongside subdomain traversal and adjacent IP range scanning.

Basic AXFR with dig

┌──(kali㉿kali)-[~]
└─$ dig AXFR $DOMAIN @$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ dig +tcp AXFR $DOMAIN @$TARGET_IP

AXFR uses TCP by default. The +tcp flag forces it explicitly when UDP is filtered or when the response exceeds the UDP packet size limit. A successful transfer prints the complete zone file. Focus on A records that expose internal hostnames and their IPs. CNAME records reveal service aliases and third-party integrations. MX records expose mail routing and mail providers. TXT records often contain SPF entries listing every authorized sending IP, revealing cloud services and external infrastructure. Subdomain names like dev, staging, admin, vpn, internal, and backup are direct targets for follow-up enumeration.

First enumerate NS records:

┌──(kali㉿kali)-[~]
└─$ dig NS $DOMAIN +short

A domain often has multiple NS records pointing to different servers. Transfer permissions are configured per server, not per domain. A primary nameserver might reject AXFR while a secondary managed by a third-party provider has no restriction. Loop every NS record and collect all that respond.

Then target each:

┌──(kali㉿kali)-[~]
└─$ for ns in $(dig NS $DOMAIN +short); do dig AXFR $DOMAIN @$ns +short; done

The host command provides a simpler interface for zone transfers and uses a slightly different request format than dig.

AXFR with host

┌──(kali㉿kali)-[~]
└─$ host -l $DOMAIN $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ host -t AXFR $DOMAIN $TARGET_IP

The host tool can bypass server-side filters or firewall rules that specifically block dig-style queries. If dig returns a transfer failed or connection refused response, try host before moving on. Output from host is more compact and easier to scan quickly for high-value entries.

Automated Attempts

Dnsrecon

┌──(kali㉿kali)-[~]
└─$ dnsrecon -d $DOMAIN -t axfr
┌──(kali㉿kali)-[~]
└─$ dnsrecon -d $DOMAIN -t axfr -n $TARGET_IP

Dnsrecon automatically queries all discovered NS records and reports which ones respond to AXFR. It labels output by record type, making it fast to identify A, CNAME, and TXT entries without parsing raw zone file syntax. Use the -n flag to target a specific server when the domain resolves to a resolver rather than an authoritative nameserver.

Dnsenum

┌──(kali㉿kali)-[~]
└─$ dnsenum $DOMAIN
┌──(kali㉿kali)-[~]
└─$ dnsenum --dnsserver $TARGET_IP $DOMAIN

Dnsenum attempts zone transfer as part of a broader enumeration sweep that includes brute-force subdomain discovery and reverse lookups. Run it when you want a combined pass rather than isolated AXFR testing. The --dnsserver flag directs all queries to a specific authoritative server.

Fierce

┌──(kali㉿kali)-[~]
└─$ fierce --domain $DOMAIN

Fierce includes AXFR attempts alongside subdomain brute-forcing and DNS traversal. It also walks adjacent IP ranges to identify other hosts in the same network block, which extends discovery beyond the zone file itself.

A successful zone transfer is significant intelligence. Every hostname in the zone is a potential target. Map the A records against open ports in your target scope to prioritize follow-up. Internal naming conventions often reveal service roles directly: db, redis, jenkins, k8s, and bastion are common patterns. Feed discovered hostnames into active service enumeration. For AD-integrated environments, zone transfer results feed directly into Object Enumeration for AD context. If AXFR is blocked across all NS records, check ADIDNS Poisoning and Hijacking for AD-integrated DNS attack paths.