Zone Transfers Explained: AXFR, IXFR, and Primary/Secondary DNS

A zone transfer is how a secondary DNS server copies zone data from the primary, keeping multiple nameservers in sync. The mechanism — AXFR, IXFR, NOTIFY and the serial number — is the foundation of redundant DNS, and leaving it unrestricted is a real security mistake.

Primary and secondary

In classic DNS redundancy, one server is the primary (where you edit the zone) and one or more secondaries hold copies. Secondaries do not answer with their own data; they pull the zone from the primary and serve an identical copy, so queries can be answered even if the primary is unavailable. See setting up secondary DNS.

AXFR vs IXFR

• AXFR (full transfer) — the secondary pulls the entire zone. Simple and reliable, but heavier for large zones.
• IXFR (incremental transfer) — the secondary pulls only the changes since its current version, which is far more efficient for big zones that change often.

How a transfer is triggered

It revolves around the SOA serial number:

1. You edit the zone and the serial increases.
2. The primary sends a NOTIFY to secondaries, prompting them to check.
3. A secondary compares serials; if the primary's is higher, it requests a transfer.
4. Otherwise, secondaries also check periodically based on the SOA refresh interval.

NOTIFY makes updates near-immediate rather than waiting for the refresh timer.

Securing transfers

Zone data can reveal your entire infrastructure, so never allow transfers to just anyone:

• Restrict AXFR to your known secondary servers' IPs only.
• Use TSIG — a shared secret that cryptographically authenticates transfers between primary and secondary.

An open AXFR lets outsiders download your whole zone — a common finding in DNS audits. Test with dig AXFR that strangers are refused.

Frequently asked questions

What's the difference between AXFR and IXFR?

AXFR transfers the whole zone every time; IXFR transfers only the changes since the secondary's last version. IXFR is more efficient for large, frequently-updated zones, while AXFR is simpler and a reliable fallback.

How do secondaries know when to update?

Primarily via NOTIFY messages the primary sends after a change, prompting an immediate serial check. Secondaries also poll periodically using the SOA refresh interval as a backstop if a NOTIFY is missed.

Why should I restrict zone transfers?

Because a full zone transfer exposes every record — effectively a map of your infrastructure. Limit AXFR to your secondaries' IPs and authenticate with TSIG so outsiders cannot download your zone.