What is the purpose of a DNS zone transfer?

What is the purpose of a DNS zone transfer?

• A. To obscure internal host names
• B. To copy a zone's data from one server to another
• C. To recover from a DoS attack
• D. To poison a DNS cache

Answer: (B)

DNS zone transfers exist to copy a zone’s data from a primary DNS server to other authoritative servers so they all have the same set of records. This keeps information like A/AAAA, MX, NS, and TXT records consistent across servers, providing redundancy, reliability, and load distribution. Transfers can be full, bringing the entire zone, or incremental, updating only the changes since the last transfer. While this mechanism is essential for proper DNS operation, if zone transfers are left open or misconfigured, an attacker could retrieve a complete map of a domain’s hosts. The goal of a zone transfer is not to obscure names, recover from DoS, or poison caches; those are separate concerns.

DNS zone transfers exist to copy a zone’s data from a primary DNS server to other authoritative servers so they all have the same set of records. This keeps information like A/AAAA, MX, NS, and TXT records consistent across servers, providing redundancy, reliability, and load distribution. Transfers can be full, bringing the entire zone, or incremental, updating only the changes since the last transfer. While this mechanism is essential for proper DNS operation, if zone transfers are left open or misconfigured, an attacker could retrieve a complete map of a domain’s hosts. The goal of a zone transfer is not to obscure names, recover from DoS, or poison caches; those are separate concerns.