Learning DNS - Deep Zone Transfers (AXFR & IXFR)

#Introduction

Zone transfers are the path data travels from primary to secondary. Episode 9 got them working; episode 10 makes them fast, secure, and scalable. We'll dissect the two transfer mechanisms — AXFR and IXFR — then secure them with TSIG, and close with the advanced ixfrdist feature and autosecondary mode.

Think of this episode as a technical deep dive: instead of just "flowing data", you now control how, how often, and with what authentication the data flows.

#AXFR vs IXFR

#Full and Incremental Transfers

AXFR (Authoritative Transfer) sends the entire zone contents. Simple and robust, but wasteful: for large zones or small changes, nearly all data is resent. IXFR (Incremental Transfer) sends only the differences since the last serial. For large, frequently-changing zones, IXFR is far more efficient.

Imagine the difference as editing a document: AXFR resends the whole document every time one sentence changes, whereas IXFR only sends the changed sentence. For large, frequently-edited documents, IXFR clearly saves bandwidth and CPU.

#How IXFR Works

IXFR leverages the zone's change history. Every time a zone changes, PowerDNS records the difference from the previous serial. When a secondary requests IXFR carrying the last serial it holds, the primary simply fetches the stored delta and sends it.

dig @192.0.2.10 example.com AXFR

The dig @192.0.2.10 example.com AXFR command above pulls the entire zone directly from the primary — a quick way to check the full zone contents while also testing whether the server allows transfers.

#When to Use Which

• AXFR: first transfer, small zones, or when IXFR logs aren't available.
• IXFR: large zones that change frequently; the secondary uses this after its first full copy.

In PowerDNS, IXFR is supported by backends that store change history (like databases). File-based bind backends generally only provide AXFR, unless ixfrdist (covered at the end of this episode) provides IXFR externally.

#Transfer Security

#Restricting AXFR Sources

The first rule of transfer security: only legitimate servers may pull zones. The IP list in allow-axfr-ips is a minimum barrier, but IPs can be spoofed. A stronger solution is cryptographic authentication.

#Authentication with TSIG

TSIG (RFC 2845) signs every transfer message with a shared secret key, so the receiver can prove the sender is genuine and the message wasn't altered. Create a key on the primary:

pdnsutil generate-tsig-key transfer-key hmac-sha256
pdnsutil add-tsig-key transfer-key hmac-sha256 <key-hash>
pdnsutil set-tsig-key example.com transfer-key primary

pdnsutil generate-tsig-key transfer-key hmac-sha256 generates a key. add-tsig-key registers it, and set-tsig-key binds it to the example.com zone with the primary role. On the secondary side, set-tsig-key with the secondary role uses the same key.

dig @192.0.2.10 example.com AXFR -y hmac-sha256:transfer-key:<key-hash>

The -y flag signs the transfer query with the TSIG key. If the primary doesn't recognize the key or the hash is wrong, the transfer is rejected with status NOTAUTH — proof that authentication works.

#Advanced Features

#ixfrdist: Standalone IXFR Distribution

For zones with many secondaries and high transfer traffic, ixfrdist provides standalone IXFR distribution, separate from the Authoritative. It acts as a transfer "hub": the primary only deals with one client (ixfrdist), and all secondaries pull from there.

listen=0.0.0.0:53
primary=192.0.2.10
zones=example.com

#Autosecondary Mode

PowerDNS can discover and register secondary zones automatically from incoming NOTIFY, as long as the sender's IP is listed in allow-axfr-ips or in the autosecondary setting:

secondary=yes
autosecondary=192.0.2.10

With autosecondary mode, the secondary automatically creates new zones from trusted primaries — very useful when zones keep growing without needing one-by-one manual registration.

#Applying Transfers Correctly

#Verifying Synchronization

Once transfers run, verify by comparing serials and tracking whether transfers use AXFR or IXFR:

dig +nssearch example.com
journalctl -u pdns -n 50 --no-pager | grep -i transfer

dig +nssearch example.com shows every server's serial at once. The logs list which transfer type occurred, helping you confirm IXFR is really used for small changes.

#Conclusion

Episode 10 makes your zone transfers secure and efficient: you know when to use full AXFR versus incremental IXFR, secure both with TSIG, and leverage ixfrdist and autosecondary for larger scale.

Key takeaways:

• AXFR sends the entire zone; IXFR sends only the differences since the last serial.
• AXFR for first transfers and small zones; IXFR for large zones that change often.
• allow-axfr-ips is only an IP barrier; TSIG provides cryptographic authentication that can't be spoofed.
• pdnsutil generate-tsig-key creates a key, set-tsig-key binds it to a zone.
• ixfrdist centralizes IXFR distribution; autosecondary registers secondaries automatically.

In episode 11, we'll cover backends and zone data management — the domains and records table structure in gsqlite3 and gmysql, data import-export, backup and restore, other backends like lmdb, geoip, and remote, plus the full lifecycle of a zone from creation to deletion.