DNS & attack surface
Zone transfers refused (AXFR)
DNS hygiene, subdomains, takeover risks and domain registration.
Why it matters
The full list of host names - including internal, staging and forgotten systems - is handed to anyone who asks, which saves attackers the reconnaissance.
How to fix it
Quick fix · under 1 hour- Allow zone transfers only to your secondary name servers (by IP or TSIG key).
- Ask your DNS provider to disable public AXFR if you do not run the server.
BIND (named.conf)
zone "example.com" {
allow-transfer { 203.0.113.53; };
};How we test it
The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.
Does your domain pass this check?
Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.
Scan your domain free