DNS Zone Transfer Attack: What It Reveals About Misconfigured DNS
During a penetration test, you execute the following command: dnsrecon -d example.com -t axfr. The output shows 'AXFR record received' followed by a list of all DNS records. What does this indicate about the target's DNS configuration?
Quick Answer
The correct answer is that the DNS server is vulnerable to zone transfer attacks, allowing unauthorized users to retrieve the entire zone file. This is because the `dnsrecon -d example.com -t axfr` command successfully performed a full AXFR query from an unauthorized client, which should only be permitted between trusted secondary DNS servers. A misconfigured DNS server that fails to restrict zone transfers by IP address or TSIG keys exposes every hostname, IP address, and service record in the zone, giving an attacker a complete network blueprint. On the Certified Ethical Hacker CEH exam, this scenario tests your understanding of DNS enumeration and common misconfigurations; a common trap is confusing a successful AXFR with a normal DNS query, but the key indicator is the phrase “AXFR record received.” Remember the mnemonic “AXFR = All eXposed From Records” to recall that an open zone transfer leaks the entire DNS database.
⚠ Common exam trap
Many exam-takers confuse DNSSEC with access control mechanisms, or assume that a successful zone transfer implies proper authorization, when in fact the CEH exam emphasizes that any successful AXFR from an unauthorized client is a critical misconfiguration and vulnerability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DNS server is vulnerable to zone transfer attacks, allowing unauthorized users to retrieve the entire zone file
The successful execution of `dnsrecon -d example.com -t axfr` and the receipt of an AXFR (full zone transfer) response indicates that the target DNS server is misconfigured to allow zone transfers from any host. A properly secured DNS server should restrict AXFR queries to only authorized secondary (slave) servers, typically by IP address or TSIG (Transaction Signature) keys. Since the command was run from an unauthorized client, this confirms a zone transfer vulnerability, allowing an attacker to retrieve the entire DNS zone file, which reveals all hostnames, IP addresses, and service records.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DNS server is using DNSSEC to secure zone transfers
Why it's wrong here
DNSSEC signs records for authenticity and integrity; it does not govern who may request a zone transfer. AXFR succeeded because the server allowed the transfer, not because of DNSSEC. DNSSEC would be relevant when validating signed responses, not when explaining an unrestricted zone transfer.
- ✓
The DNS server is vulnerable to zone transfer attacks, allowing unauthorized users to retrieve the entire zone file
Why this is correct
A successful AXFR response means the DNS server permitted an unauthenticated zone transfer, exposing every record in the zone. This misconfiguration lets anyone enumerate hosts, subdomains and mail servers, confirming the server is vulnerable to zone transfer attacks.
- ✗
The DNS server is properly configured and only allows zone transfers to authorized secondary servers
Why it's wrong here
The AXFR transfer succeeded, meaning the server permitted the zone transfer to your host — an open, misconfigured server. A properly configured server restricts transfers to authorised secondaries via ACLs or TSIG, refusing anonymous requests. This option describes that hardened state, which the successful transfer output directly contradicts.
- ✗
The target uses a split-DNS configuration with internal and external views
Why it's wrong here
A successful AXFR transfer means the nameserver permits unauthenticated zone transfers to any requester; it reveals nothing about split-DNS views. Split-DNS is inferred from differing internal and external answers, which requires querying both resolvers separately.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are common countermeasures to prevent DNS zone transfers from being abused? (Choose THREE.)
hard- A.Enable DNS recursion on the name server
- ✓ B.Restrict zone transfers to only specific authorized secondary name servers
- ✓ C.Implement split DNS (internal vs external views)
- ✓ D.Use Transaction Signatures (TSIG) to authenticate zone transfer requests
- E.Configure the name server to allow zone transfers from any host
Why B: Option B is correct because restricting zone transfers to specific authorized secondary name servers (for example, via BIND's allow-transfer ACL) ensures that only trusted servers can request a copy of the zone, blocking unauthorized AXFR/IXFR attempts. Option C is correct because split DNS separates internal and external views, so external clients querying the public name server never see internal-only records, limiting what a leaked zone transfer could expose. Option D is correct because TSIG uses a shared secret and HMAC to cryptographically authenticate zone transfer requests, so a server will only honor an AXFR/IXFR from a peer that presents a valid signature. Option A is not a countermeasure—enabling recursion actually increases exposure to cache poisoning and amplification abuse and is unrelated to zone transfer protection. Option E is the opposite of a countermeasure, since allowing zone transfers from any host permits anyone to pull the entire zone with a single AXFR query.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.