DNS Zone Transfer Attack: Exploiting AXFR Misconfiguration
An incident responder analyzes logs and finds repeated failed zone transfer attempts from an external IP. The zone transfer requests are targeting the domain example.com. Which DNS record type, if misconfigured, would allow this attack to succeed?
Quick Answer
The correct answer is AXFR, because this DNS record type, when misconfigured to allow unrestricted zone transfers from any IP, enables an attacker to request and receive the entire DNS zone file for a domain like example.com. AXFR stands for Asynchronous Full Transfer, and it is the standard protocol used to replicate DNS zone data between primary and secondary servers; if the server is set to respond to AXFR queries from any host without restriction, an external attacker can dump all DNS records, revealing internal network topology and potential attack surfaces. On the Certified Ethical Hacker CEH exam, this scenario tests your understanding of DNS enumeration techniques and common misconfigurations—a frequent trap is confusing AXFR with incremental zone transfers (IXFR) or assuming that failed attempts mean the service is secure, when in fact the attacker is simply probing for an open port. A solid memory tip: think of AXFR as “All XFer” because it transfers the entire zone, so if it’s open to anyone, the whole domain is exposed.
⚠ Common exam trap
Candidates often confuse the DNS record type (e.g., NS, SOA) with the protocol or query type (AXFR) used to perform the zone transfer, leading them to select a record type instead of recognizing AXFR as the specific misconfiguration that enables the attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AXFR
B is correct because AXFR (Asynchronous Full Transfer) is the DNS zone transfer protocol that, if misconfigured (i.e., allowing unrestricted AXFR queries from any IP), permits an external attacker to request and receive the entire DNS zone file for example.com. The repeated failed attempts indicate the attacker is probing for an open AXFR service, which would succeed if the DNS server is configured to allow zone transfers to any host without restriction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NS records
Why it's wrong here
NS records specify authoritative name servers; they do not control zone transfer permissions.
- ✓
AXFR
Why this is correct
AXFR is the DNS query type for zone transfers. Allowing AXFR from unauthorized hosts is a misconfiguration.
- ✗
MX records
Why it's wrong here
MX records specify mail servers; they are not related to zone transfers.
- ✗
SOA records
Why it's wrong here
SOA records contain administrative information but do not control zone transfer permissions.
Visual reference
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a security assessment, you execute: dnsenum --enum example.com. The tool returns results including the nameservers (NS), mail servers (MX), and performs a zone transfer attempt. The zone transfer fails. What is the MOST likely reason for the failure?
hard- A.The DNS server is not running
- B.The zone transfer requires TCP port 443
- ✓ C.The DNS server is configured to deny zone transfers from unauthorized hosts
- D.The domain does not exist
Why C: DNS zone transfers (AXFR) are typically restricted by default on authoritative DNS servers to prevent unauthorized disclosure of the entire zone file. The `dnsenum` tool attempts an AXFR query over TCP port 53, and the failure indicates the server explicitly denied the request, which is a standard security configuration per RFC 5936.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.