AXFR, IXFR e TSIG

AXFR, IXFR, and TSIG

AXFR transfers a complete zone. IXFR can transfer only the changes since a known serial when the server has the required history. These mechanisms let authorized secondaries keep their copies current; they are not intended as public downloads of internal zone data.

Restrict transfers to known secondary servers using network controls and server configuration. TSIG adds a shared-key authentication mechanism for DNS messages such as transfers. Protect the secret, rotate it carefully, and monitor failed or unexpected transfer requests. Hiding the primary’s name is not an access-control measure.

References: RFC 5936 — AXFR · RFC 1995 — IXFR · RFC 8945 — TSIG

Check your understanding

Choose the best answer. The examples use training names and do not send real DNS queries.

Quiz#dns.m11.l2.e1

Which combination best describes a secure zone transfer?

Open AXFR and a low TTLAuthorize secondaries, restrict the network, and authenticate with TSIGHide the primary server name