# DNS Zone Transfer (AXFR)

> Exploit misconfigured DNS servers to perform AXFR zone transfers, extracting complete DNS records to map target infrastructure and discover hidden subdomains.

- **URL:** https://hackindex.io/services/dns/enumeration/dns-zone-transfer-axfr
- **Path:** DNS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/dns/enumeration.md)
- **Published:** 2026-01-03
- **Updated:** 2026-08-17

AXFR is a DNS zone transfer request, designed to replicate zone data between nameservers. When a server responds to AXFR from arbitrary sources, it returns every record in the zone: internal hostnames, IP mappings, mail servers, VPN gateways, and staging environments that brute-force enumeration would miss entirely. The zone file effectively maps the full infrastructure of a target from a single query. Not every nameserver will respond. Primary servers are typically locked down. Secondary and tertiary nameservers, especially those managed by third-party DNS providers, are more often misconfigured. Test each NS record individually before concluding the zone is protected.

- **dig / host AXFR** send zone transfer requests to each nameserver individually and collect the full zone file.
- **NS enumeration first** primary servers are often locked down, but secondaries managed by third-party providers may not be.
- **dnsrecon** automatically queries all NS records and reports which respond to AXFR with labeled output.
- **dnsenum** combines zone transfer with brute-force subdomain discovery and reverse lookups in one pass.
- **fierce** includes AXFR attempts alongside subdomain traversal and adjacent IP range scanning.

## Basic AXFR with dig

```bash
dig AXFR $DOMAIN @$TARGET_IP
dig +tcp AXFR $DOMAIN @$TARGET_IP
```

AXFR uses TCP by default. The +tcp flag forces it explicitly when UDP is filtered or when the response exceeds the UDP packet size limit. A successful transfer prints the complete zone file. Focus on A records that expose internal hostnames and their IPs. CNAME records reveal service aliases and third-party integrations. MX records expose mail routing and mail providers. TXT records often contain SPF entries listing every authorized sending IP, revealing cloud services and external infrastructure. Subdomain names like dev, staging, admin, vpn, internal, and backup are direct targets for follow-up enumeration.

First enumerate NS records:

```bash
dig NS $DOMAIN +short
```

A domain often has multiple NS records pointing to different servers. Transfer permissions are configured per server, not per domain. A primary nameserver might reject AXFR while a secondary managed by a third-party provider has no restriction. Loop every NS record and collect all that respond.

Then target each:

```bash
for ns in $(dig NS $DOMAIN +short); do dig AXFR $DOMAIN @$ns +short; done
```

The host command provides a simpler interface for zone transfers and uses a slightly different request format than dig.

## AXFR with host

```bash
host -l $DOMAIN $TARGET_IP
host -t AXFR $DOMAIN $TARGET_IP
```

The host tool can bypass server-side filters or firewall rules that specifically block dig-style queries. If dig returns a transfer failed or connection refused response, try host before moving on. Output from host is more compact and easier to scan quickly for high-value entries.

## Automated Attempts

### Dnsrecon

```bash
dnsrecon -d $DOMAIN -t axfr
dnsrecon -d $DOMAIN -t axfr -n $TARGET_IP
```

Dnsrecon automatically queries all discovered NS records and reports which ones respond to AXFR. It labels output by record type, making it fast to identify A, CNAME, and TXT entries without parsing raw zone file syntax. Use the -n flag to target a specific server when the domain resolves to a resolver rather than an authoritative nameserver.

### Dnsenum

```bash
dnsenum $DOMAIN
dnsenum --dnsserver $TARGET_IP $DOMAIN
```

Dnsenum attempts zone transfer as part of a broader enumeration sweep that includes brute-force subdomain discovery and reverse lookups. Run it when you want a combined pass rather than isolated AXFR testing. The --dnsserver flag directs all queries to a specific authoritative server.

### Fierce

```bash
fierce --domain $DOMAIN
```

Fierce includes AXFR attempts alongside subdomain brute-forcing and DNS traversal. It also walks adjacent IP ranges to identify other hosts in the same network block, which extends discovery beyond the zone file itself.

A successful zone transfer is significant intelligence. Every hostname in the zone is a potential target. Map the A records against open ports in your target scope to prioritize follow-up. Internal naming conventions often reveal service roles directly: db, redis, jenkins, k8s, and bastion are common patterns. Feed discovered hostnames into active service enumeration. For AD-integrated environments, zone transfer results feed directly into [Object Enumeration](https://hackindex.io/platforms/active-directory/enumeration/active-directory-object-enumeration) for AD context. If AXFR is blocked across all NS records, check [ADIDNS Poisoning and Hijacking](https://hackindex.io/services/dns/exploitation/adidns-poisoning-and-hijacking) for AD-integrated DNS attack paths.