dns-zone-transfer Free

A zone transfer (AXFR/IXFR) refused by BIND — the whole zone asked for by a host that is not one of our secondaries; reconnaissance, one and out

Category

dns

Threshold

1/10m

Ban policy

bot

Report

dns-zone-transfer

Parsers

bind-transfer-denied

Why it is written this way

The rule file View raw

# One refused zone transfer is a verdict. The nameservers run
# `allow-transfer { none; }`: no legitimate AXFR/IXFR client exists,
# secondaries refresh from their masters over an outbound connection
# this never touches — so whoever asks is enumerating zones. Measured
# under CrowdSec on one nameserver over four weeks: 1 099 attempts from
# 482 addresses, methodical enumerators (one AXFR per zone, back for
# weeks) and a tail of single shots, all from rented infrastructure.
# Banned on every port for a day and climbing: an address banned on a
# nameserver cannot make ordinary queries either — accepted, a
# legitimate secondary would have been in allow-transfer.
rule: dns-zone-transfer
description: "A zone transfer (AXFR/IXFR) refused by BIND — the whole zone asked for by a host that is not one of our secondaries; reconnaissance, one and out"
about:
  purpose: >-
    Stop the methodical enumeration of every zone a nameserver holds.
  blocks: >-
    One refused zone transfer, AXFR or IXFR. Measured on one nameserver over four weeks: 1 099 attempts from 482 addresses, and not one legitimate.
  applies_to: >-
    An authoritative nameserver that refuses transfers to the world.
  requires:
    - >-
      named's log, declared as `log: dns`.
    - >-
      `allow-transfer { none; }`, or an explicit list of your secondaries. A server that transfers to anyone has no refusals to read, and one that transfers to a secondary NOT in the list would ban it.
  beware:
    - >-
      The ban is on every port, deliberately: an address banned on a nameserver cannot make ordinary queries either. A legitimate secondary belongs in allow-transfer, where it is never refused.
category: dns
parsers: bind-transfer-denied
threshold: 1/10m
ban: bot
report: dns-zone-transfer