The Zone Transfer Test checks whether a domain's authoritative name servers expose a full AXFR zone transfer to the public — a serious misconfiguration that leaks the entire zone contents, including internal hostnames.
Enter a domain name (example.org) and run the tool. The probe requests an AXFR zone transfer from each authoritative name server and reports whether it was permitted.
Input: Domain — e.g. example.org.
Each line shows a name server and whether the transfer was ALLOWED or DENIED. ALLOWED is a security problem — it means anyone can download the entire zone, exposing subdomains and internal records that are not otherwise discoverable. A healthy configuration denies AXFR to all untrusted sources.
→ Audit authoritative name servers for accidental AXFR exposure.
→ Verify transfer restrictions after a DNS provider migration.
→ Demonstrate a misconfiguration to a client or vendor.
→ Confirm secondaries still replicate while public transfer is denied.
It lets anyone download the entire zone — every subdomain, internal hostname and record — in one request. This reveals your internal topology and hosts that were meant to be unguessable, expanding your attack surface for targeted attacks.
Only between your own primary and secondary name servers, restricted by source IP / TSIG. It should never be permitted to the public internet or arbitrary source addresses.
On your name server, restrict allow-transfer (BIND) or the equivalent to your secondaries’ IPs or a TSIG key, and remove any wildcard allow rules. Re-run this tool to confirm every NS now denies public AXFR.