Zone Transfer Check

What It Does

Resolves all authoritative nameservers, then sends real AXFR queries (RFC 5936) to each. Reports per-server result (vulnerable, refused, timeout), total records exposed, sample owner-names, and a record-type breakdown — TXT, CAA, SRV, and TLSA are flagged as `high_sensitivity_types_present` since these typically expose SPF includes, verification tokens, certificate-issuance policy, and service topology that are far more sensitive than CNAME glue. When AXFR is refused, cross-references the dns-nsec-walkability check: zones using legacy NSEC (rather than NSEC3) can still be enumerated by walking the NSEC chain, so `alternative_enumeration_risks.nsec_walkable` surfaces this. Detects the authoritative DNS provider and returns provider-keyed `remediation_snippets` — paste-ready `allow-transfer` config for BIND, PowerDNS, NSD, Knot, plus notes for Cloudflare DNS and Route 53 (which don't support AXFR by default).

Why It's Useful

A 2022 survey found ~12% of organizations had at least one nameserver allowing unauthorized zone transfers. Most AXFR tools stop at "vulnerable yes/no", but the severity of an exposed zone depends entirely on what's in it — a leaked zone full of SPF includes and verification tokens is much worse than one with mostly CNAME glue. The record-type breakdown turns "you're vulnerable" into "your TXT records are leaking; here's exactly what's exposed". The NSEC cross-reference catches a frequently-missed case where AXFR is correctly refused but enumeration is still possible. The provider-keyed remediation makes the fix concrete instead of generic.

Use Cases

Parameters

Response Fields

Code Examples

curl "https://api.edgedns.dev/v1/dns/zone-transfer" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "domain=example.com"

const response = await fetch(
  'https://api.edgedns.dev/v1/dns/zone-transfer?domain=example.com',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.edgedns.dev/v1/dns/zone-transfer',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    params={
    'domain': 'example.com'
    }
)

data = response.json()
print(data)

Related Endpoints

External References

Learn more about the standards and protocols behind this endpoint.