Уроки модуля (2/3)
AXFR, IXFR e TSIG
AXFR, IXFR, and TSIG
AXFR transfers a complete zone. IXFR can transfer only the changes since a known serial when the server has the required history. These mechanisms let authorized secondaries keep their copies current; they are not intended as public downloads of internal zone data.
Restrict transfers to known secondary servers using network controls and server configuration. TSIG adds a shared-key authentication mechanism for DNS messages such as transfers. Protect the secret, rotate it carefully, and monitor failed or unexpected transfer requests. Hiding the primary’s name is not an access-control measure.
References: RFC 5936 — AXFR · RFC 1995 — IXFR · RFC 8945 — TSIG
Check your understanding
Choose the best answer. The examples use training names and do not send real DNS queries.
Which combination best describes a secure zone transfer?