# bind An authoritative nameserver running BIND with `allow-transfer { none; }`: whoever asks for a zone transfer is enumerating zones, and one refused AXFR/IXFR is a verdict — a day's ban on every port, a week on a return. ## What it reads BIND's security log — a channel of its own with `print-time yes` (the `named/security.log` a `logging { channel security_log { file "/var/log/named/security.log"; print-time yes; severity info; }; category security { security_log; }; }` writes), or the same messages through syslog. Category `dns`: ```yaml logs: - {path: /var/log/named/security.log, log: dns, ports: [53]} ``` The parser keys on the client and the verdict (`client @0x… IP#port (zone): zone transfer '…' denied`), so either file reads the same. The zone asked for is captured (a facet), never reported. ## Rules and policy - `dns-zone-transfer` — one refused transfer in ten minutes; policy `dns-probe`: 24h, 7d, 25d, every port, thirty days of memory. Refused recursive queries (`query (cache) … denied`, the open-resolver scans) are not counted: they are the background noise of any authoritative server and ban nothing under CrowdSec either. Translated from the operator's `lrob/dns-zone-transfer-probe` scenario (CrowdSec, © its author, MIT), figures measured on a nameserver over four weeks.