Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What information will the axfr and ixfr commands in DIG provide to an attacker?

share|improve this question
Interesting question. Perhaps, there should be a tag for "interview-questions" in this QnA. – Karma Sep 1 '12 at 7:13
btw... nice handle, reminds me of me :D – Karma Sep 1 '12 at 7:19
I have tried to fix the question. It wasn't a good security question previously, and I nearly closed as off topic. – Rory Alsop Sep 1 '12 at 12:14
@RoryAlsop this user is simply copy-pasting questions from certification exams. This one is question 2 from this exam – tylerl Sep 2 '12 at 6:56
@tylerl - yes they have been warned and given a temporary suspension. Thanks. – Rory Alsop Sep 2 '12 at 9:48

AXFR is the traditional way of zone transferring - you just completely copy the dns records from one zone to the other - an attacker will have a complete list of resources in the organizations and if you save some more information on those servers on your nameserver it will be included

IXFR on the other hand helps sysadmins in replicating an already given zone that was doing a complete AXFR in the past and need to be updated to the latest record revision on the nameserver, without the hassle and band-choking of a complete copy of records. in IXFR you can select the revision that you have and the server will provide you with the updated data since your revision, to an attacker is the same as before - just less information.

share|improve this answer

She wants to download the zone and discover the list of the machines with ip numbers she can access. This way, I just download the zone, and all the server names and it's ip numbers are revealed, so I look upon systems to which I can have access and I can try my login / password.

Easy way to accomplish this:

host -a -l

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.