DNS Zone Transfer Attack: What It Reveals About Misconfigured DNS
During a penetration test, you execute the following command: dnsrecon -d example.com -t axfr. The output shows 'AXFR record received' followed by a list of all DNS records. What does this indicate about the target's DNS configuration?
Quick Answer
The correct answer is that the DNS server is vulnerable to zone transfer attacks, allowing unauthorized users to retrieve the entire zone file. This is because the `dnsrecon -d example.com -t axfr` command successfully performed a full AXFR query from an unauthorized client, which should only be permitted between trusted secondary DNS servers. A misconfigured DNS server that fails to restrict zone transfers by IP address or TSIG keys exposes every hostname, IP address, and service record in the zone, giving an attacker a complete network blueprint. On the Certified Ethical Hacker CEH exam, this scenario tests your understanding of DNS enumeration and common misconfigurations; a common trap is confusing a successful AXFR with a normal DNS query, but the key indicator is the phrase “AXFR record received.” Remember the mnemonic “AXFR = All eXposed From Records” to recall that an open zone transfer leaks the entire DNS database.
⚠ Common exam trap
Many exam-takers confuse DNSSEC with access control mechanisms, or assume that a successful zone transfer implies proper authorization, when in fact the CEH exam emphasizes that any successful AXFR from an unauthorized client is a critical misconfiguration and vulnerability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DNS server is vulnerable to zone transfer attacks, allowing unauthorized users to retrieve the entire zone file
The successful execution of `dnsrecon -d example.com -t axfr` and the receipt of an AXFR (full zone transfer) response indicates that the target DNS server is misconfigured to allow zone transfers from any host. A properly secured DNS server should restrict AXFR queries to only authorized secondary (slave) servers, typically by IP address or TSIG (Transaction Signature) keys. Since the command was run from an unauthorized client, this confirms a zone transfer vulnerability, allowing an attacker to retrieve the entire DNS zone file, which reveals all hostnames, IP addresses, and service records.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DNS server is using DNSSEC to secure zone transfers
Why it's wrong here
DNSSEC does not prevent AXFR; it provides data integrity and authentication but zone transfer restrictions are separate.
- ✓
The DNS server is vulnerable to zone transfer attacks, allowing unauthorized users to retrieve the entire zone file
Why this is correct
A successful AXFR to an unauthenticated client indicates a misconfiguration that exposes internal network details.
- ✗
The DNS server is properly configured and only allows zone transfers to authorized secondary servers
Why it's wrong here
If only authorized, the AXFR request would have been denied.
- ✗
The target uses a split-DNS configuration with internal and external views
Why it's wrong here
Split-DNS might restrict zone transfers, but a successful AXFR from an external perspective indicates a flaw.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are common countermeasures to prevent DNS zone transfers from being abused? (Choose THREE.)
hard- A.Enable DNS recursion on the name server
- ✓ B.Restrict zone transfers to only specific authorized secondary name servers
- ✓ C.Implement split DNS (internal vs external views)
- ✓ D.Use Transaction Signatures (TSIG) to authenticate zone transfer requests
- E.Configure the name server to allow zone transfers from any host
Why B: Restricting zone transfers to only specific authorized secondary name servers (Option B) is a fundamental access control measure that prevents unauthorized hosts from requesting a full copy of the DNS zone data, thereby mitigating information leakage during reconnaissance. Implementing split DNS (Option C) limits the information an external attacker can gain from a successful zone transfer by presenting different views of DNS data to internal and and external clients. Using Transaction Signatures (TSIG) (Option D) provides cryptographic authentication for zone transfer requests, ensuring that only trusted secondary servers with the shared secret key can perform transfers.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.