Shieldlist

bind Free

An authoritative BIND nameserver: refused zone transfers.

Download the pack tar.gz of the files listed below

Rules (1)

About this pack

An authoritative nameserver running BIND with allow-transfer { none; }: whoever asks for a zone transfer is enumerating zones, and one refused AXFR/IXFR is a verdict — a day's ban on every port, a week on a return.

What it reads

BIND's security log — a channel of its own with print-time yes (the named/security.log a logging { channel security_log { file "/var/log/named/security.log"; print-time yes; severity info; }; category security { security_log; }; } writes), or the same messages through syslog. Category dns:

logs:
  - {path: /var/log/named/security.log, log: dns, ports: [53]}

The parser keys on the client and the verdict (client @0x… IP#port (zone): zone transfer '…' denied), so either file reads the same. The zone asked for is captured (a facet), never reported.

Rules and policy

Refused recursive queries (query (cache) … denied, the open-resolver scans) are not counted: they are the background noise of any authoritative server and ban nothing under CrowdSec either.

Translated from the operator's lrob/dns-zone-transfer-probe scenario (CrowdSec, © its author, MIT), figures measured on a nameserver over four weeks.

Parsers (1)

The building blocks: each parser names a log, a cheap prefilter and the regex that extracts the address.

bind-transfer-denied dns 
# A refused zone transfer, as BIND logs it — in its own security log
# (channel with `print-time yes`, no syslog prefix):
#   2026-08-14T14:05:29.166 security: error: client @0x7f9ae42a3c98 203.0.113.9#62834 (example.org): zone transfer 'example.org/AXFR/IN' denied
# or through syslog (`named[pid]: client @0x… 203.0.113.9#62834 (example.org): zone transfer 'example.org/AXFR/IN' denied`).
# The pattern keys on the client and the verdict, whatever came before
# them, so it reads either file. Category `dns`; the zone is captured
# (a facet: which zones the enumerators go for), the line's own time is
# not read.
parser: bind-transfer-denied
log: dns
prefilter: "zone transfer"
regex: "client @0x[0-9a-f]+ (?P<ip>[0-9a-fA-F.:]+)#\\d+ \\((?P<zone>[^)]*)\\): zone transfer '(?P<transfer>[^']*)' denied"

Ban policies

dns-probe 24h → 7d → 25d 
# For probes of the nameservers: a day on the first, a week, then the
# ceiling; every port (a nameserver exposes DNS and SSH, and the probe
# has no business with either). Thirty days of memory: the enumerators
# come back for weeks.
policy: dns-probe
durations: [24h, 7d, 25d]
ports: all
memory: 30d

Reports

dns-zone-transfer Attempted an unauthorised DNS zone transfer (AXFR/IXFR) — zone enumeration 
# The category the CrowdSec notifier used for the same scenario (1, DNS
# compromise — the provider's closest name for zone enumeration).
# `include` is empty: the zone asked for is a customer's domain.
report: dns-zone-transfer
categories: [dns-compromise]
says: "Attempted an unauthorised DNS zone transfer (AXFR/IXFR) — zone enumeration"
include: []

Files