Skip to main content

8. Security Considerations

This document is a clarification of a mechanism outlined in RFCs 1034 and 1035 and as such does not add any new security considerations. RFC 3833 [RFC3833] is devoted entirely to security considerations for the DNS; its Section 4.3 delineates zone transfer security aspects from the security threats addressed by DNSSEC.

Concerns regarding authorization, traffic flooding, and message integrity are mentioned in "Authorization" (Section 5), "TCP" (Section 4.1), and "Zone Integrity" (Section 6).

Primary Security Concerns​

  1. Unauthorized zone disclosure: Zone files can contain sensitive information about a network's infrastructure, including the names and IP addresses of internal hosts. Unauthorized zone transfers can aid attackers in reconnaissance activities. AXFR servers MUST implement authorization mechanisms (Section 5) to restrict zone transfers to trusted clients.

  2. Man-in-the-middle attacks: Without integrity protection, an attacker positioned between the AXFR client and server could intercept and modify zone data in transit. Implementations SHOULD use TSIG [RFC2845] or SIG(0) [RFC2931] to protect against such attacks (Section 6).

  3. Denial of Service (DoS): Zone transfers can consume significant network bandwidth and server resources. An attacker could attempt to exhaust server resources by initiating many concurrent zone transfer requests. AXFR servers SHOULD implement rate limiting and connection limits to mitigate DoS attacks.

  4. Data integrity: Transferred zone data must be protected against unauthorized modification. AXFR clients SHOULD validate the integrity of received data using TSIG, SIG(0), or DNSSEC validation (Section 6).

  5. Replay attacks: An attacker could capture a legitimate zone transfer and replay it later, potentially causing the client to revert to outdated zone data. TSIG and SIG(0) provide protection against replay attacks through the use of timestamps and nonces.

Recommendations​

  1. Use authentication: Zone transfers SHOULD be authenticated using TSIG or SIG(0). Unauthenticated zone transfers are vulnerable to spoofing and man-in-the-middle attacks.

  2. Implement access controls: AXFR servers MUST implement access control policies to restrict which clients are permitted to request zone transfers. IP-based ACLs, TSIG, and SIG(0) are all viable authorization mechanisms.

  3. Protect confidential zones: For zones containing sensitive information, operators SHOULD consider using network-level encryption (e.g., VPNs, IPsec) in addition to application-level authentication.

  4. Monitor transfers: Operators SHOULD monitor zone transfer activity for anomalies, such as unexpected transfer requests or failed authentication attempts.

  5. Limit resource usage: AXFR servers SHOULD implement mechanisms to limit resource consumption, such as:

    • Restricting the number of concurrent zone transfers.
    • Implementing per-client rate limiting.
    • Setting timeouts on idle connections.

  6. Keep software updated: Operators SHOULD ensure that DNS software is kept up to date to benefit from security fixes and improvements.

DNSSEC Considerations​

For DNSSEC-signed zones, the AXFR protocol transfers all DNSSEC-related records (DNSKEY, RRSIG, NSEC, NSEC3, DS). AXFR clients receiving DNSSEC-signed zones SHOULD validate the DNSSEC signatures on the transferred data to ensure integrity.

However, DNSSEC does not provide confidentiality or protect the AXFR protocol itself. TSIG or SIG(0) SHOULD still be used to authenticate zone transfer requests and protect against unauthorized transfers.

Threat Analysis​

For a comprehensive analysis of DNS security threats, including those related to zone transfers, operators and implementers should consult RFC 3833 [RFC3833], "Threat Analysis of the Domain Name System (DNS)".

Last updated on