DNS Zone Transfer Test
Test authoritative nameservers for open AXFR zone transfer and review a public DNS zone preview.
DNS Zone Transfer Test checks whether a domain’s authoritative nameservers allow AXFR zone transfer. Public AXFR is usually a DNS security misconfiguration because it can expose the full zone contents to anyone.
The tool also builds a zone-file style preview from public DNS records so administrators can review common SOA, NS, A, AAAA, MX, TXT, and CAA data without relying on AXFR.
DNS Zone Transfer Test
Enter a domain to test authoritative nameservers for AXFR exposure and optionally build a public DNS zone preview.
Recommended Next Checks
Continue the same task with related tools. When possible, your current input is carried to the next page.
DNS Lookup
Look up common DNS records for any domain.
DNS Propagation Checker
A DNS Propagation Checker verifies how recent DNS changes have spread across multiple DNS...
DNS Leak Test
Check whether your DNS requests are using unexpected resolvers outside your VPN or secure...
NS Lookup
Lookup NS (name server) records for the domain name in the DNS system.
What Is DNS Zone Transfer?
DNS zone transfer is the process of copying DNS zone data from one authoritative DNS server to another. Full zone transfer uses the AXFR query type. It is a normal administrative feature when used between authorized primary and secondary nameservers.
Why Public AXFR Is Risky
If AXFR is open to the public, an attacker or unauthorized visitor may be able to download the full DNS zone. That can reveal hostnames, subdomains, mail routing, TXT records, service names, and infrastructure naming conventions that were not intended to be enumerated in bulk.
How This Tool Works
The test discovers the domain’s public NS records and sends a bounded AXFR request to each selected authoritative nameserver. It classifies each response as allowed, refused, timed out, or inconclusive. It also provides a public DNS zone preview built from ordinary DNS lookups, which is different from a true AXFR response.
How to Fix Open AXFR
Restrict zone transfers to known secondary nameserver IP addresses, use TSIG where supported, and review DNS provider settings for transfer ACLs. After closing public AXFR, retest from an external network and review logs for previous unauthorized transfer attempts.
DNS Zone Transfer Best Practices
Zone transfers should normally be restricted to authorized secondary DNS servers by source IP, TSIG, or DNS provider access controls. If a public nameserver allows AXFR unexpectedly, disable public transfer access, rotate exposed secrets if necessary, and review the zone for internal hostnames or sensitive TXT records.
Related Tools
DNS Lookup
Look up common DNS records for any domain.
DNS Propagation Checker
A DNS Propagation Checker verifies how recent DNS changes have spread across multiple DNS servers worldwide.
DNS Leak Test
Check whether your DNS requests are using unexpected resolvers outside your VPN or secure DNS path.
NS Lookup
Lookup NS (name server) records for the domain name in the DNS system.
BIMI Lookup and Generator
Look up BIMI records and review logo authentication setup.
DNS Reputation Check
Check DNS reputation signals for a domain or host.
Suggest an improvement
Tell us if something is confusing, broken, incorrect, or missing. Feedback helps us improve the tools and workflows people use every day.