Simple definition
AXFR is the DNS mechanism used to transfer an entire authoritative zone from one DNS server to another.
Technical definition
An AXFR transfer carries the full set of zone records and normally uses TCP. It is mainly used to synchronize a secondary server with a primary server when a complete copy of the zone is required.
How it works / role
The secondary requests the zone from the authorized server. The primary verifies that the source is allowed and then sends the records framed by the SOA. After the transfer, the secondary has a complete copy that it can serve authoritatively.
What is it used for?
Fully synchronize a DNS zone to a secondary server or another explicitly authorized tool.
Practical example
A newly deployed secondary DNS server performs an AXFR from the primary to obtain all records in the zone.
Common issues
- Zone transfer is exposed publicly
- ACL does not permit the secondary server
- TSIG authentication is missing when required
- TCP port 53 is filtered between the servers
Key takeaway: AXFR should be restricted to explicitly authorized servers or tools because a public zone transfer can reveal much of the DNS structure.