Top 5 Commands to Test DNS Zone Transfer in 2 minutes

dns zone transfer

DNS is referred to as an internet directory, just like a phone directory. It helps in resolving domain names into corresponding IP addresses.

DNS zone transfer is a method of copy DNS-related databases across different DNS servers. It is a type of DNS transaction.  Vulnerability in DNS configuration led to the release of sensitive data by responding to global Asynchronous Transfer Full Range (AXFR) requests. This technique may reveal new subdomains that are helpful to increase the attack surface of the target.

Below are the Top 5 Commands to Test Zone Transfer. It is very easy and just a  matter of writing one or two-line commands to test DNS zone transfer.

(1) dig

  • stands for domain information groper
  • DNS lookup utility
  • Use for troubleshooting DNS problems
  • can also be used to test zone transfer
#dig +short ns <url>
#dig axfr <url> @<name-server>

Click Here for More Examples of Linux dig Command

(2) fierce

  • Perl script
  • Recon tool
  • pre-installed on Kali Linux
  • Can be used to test zone transfer
#fierce -dns <domain>

(3) host 

  • DNS lookup tool
  • Convert names to IP addresses and vice versa
  • One line command used to test zone transfer
#host -t axfr <test-url> <name-server>

Use the below command to try zone transfer by one of the name server

host -l <test-url> <name-server>

(4) nslookup

  • stands for "name server lookup"
  • DNS recon tool
  • Used by network administrators
  • preinstalled on Windows machines
>nslookup
>server <name-server>
>set type=any
>ls -d <test-url>

Click Here for Top 10 CMD commands used by Security Experts

(5) dnsrecon

  • DNS recon script preinstalled on Kali Linux
  • Able to check ns records for a zone transfer
#dnsrecon -d zonetransfer.me -t axfr

How to mitigate DNS zone transfer vulnerability?

To mitigate this vulnerability, DNS servers should be configured with trusted IP addresses.

You can also use transaction signatures (TSIG) for zone transfers. This helps in preventing IP spoofing efforts.

Subscribe us to receive more such articles updates in your email.

If you have any questions, feel free to ask in the comments section below. Nothing gives me greater joy than helping my readers!

Disclaimer: This tutorial is for educational purpose only. Individual is solely responsible for any illegal act.

You may also like...

4 Responses

  1. Ajay says:

    I didn’t know these tests.. thanks

  2. Anonymous says:

    These techniques are wonderful…

  3. smile says:

    i am not able to any of the info with these commads ?! instead the message was transfer failed

Leave a Reply

Your email address will not be published. Required fields are marked *

10 Blockchain Security Vulnerabilities OWASP API Top 10 - 2023 7 Facts You Should Know About WormGPT OWASP Top 10 for Large Language Models (LLMs) Applications Top 10 Blockchain Security Issues