# MA-469.042015: MyCERT Alert - DNS Zone Transfer AXFR Requests May Leak Domain Information

**Date:** 20 Apr 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-469.042015  
**Advisory ID:** MA-469.042015

---

#### **1.0 Introduction** AXFR is a protocol for “zone transfers” for replication of DNS data across multiple DNS servers [1]. Unlike normal DNS queries that require the user to know some DNS information ahead of time, AXFR queries reveal subdomain names [2]. Because a zone transfer is a single query, it could be used by an adversary to efficiently obtain DNS data.
A well-known problem with DNS is that zone transfer requests can disclose domain information; for example, see CVE-1999-0532 [3] and a 2002 CERT/CC white paper [4].
However, the issue has regained attention due to recent Internet scans still showing a large number of misconfigured DNS servers. Open-source, tested scripts are now available to scan for the possible exposure, increasing the likelihood of exploitation.
**2.0 Impact**
A remote unauthenticated user may observe internal network structure, learning information useful for other directed attacks.
**3.0 Systems Affected**
Misconfigured Domain Name System (DNS) servers that respond to global Asynchronous Transfer Full Range (AXFR) requests.
**4.0 Recommendation**
Configure your DNS server to respond only to zone transfer (AXFR) requests from known IP addresses. Many open-source resources give instructions on reconfiguring your DNS server. For example, see this AXFR article [5] for information on testing and fixing the configuration of a BIND DNS server.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#fc9f859e998ec5c5c5bc9f859e998e8f999f898e958885d29185) or [[email protected]](/cdn-cgi/l/email-protection#e68b9f85839492a68b9f85839492c8899481c88b9f) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
1. [US-CERT: DNS Zone Transfer AXFR Requests May Leak Domain Information](https://www.us-cert.gov/ncas/alerts/TA15-103A)
2. [How the AXFR Protocol Works](http://cr.yp.to/djbdns/axfr-notes.html)
3. [Vulnerability Summary for CVE-1999-0532](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-1999-0532)
4. [Securing an Internet Name Server](https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=52493)
5. [Scanning Alexa's Top 1M for AXFR](https://en.internetwache.org/scanning-alexas-top-1m-for-axfr-29-03-2015/)