Fix "Nameserver allows unauthorized DNS zone transfer" (open AXFR)

[isscbta]

The problem

Security scanners and corporate pentests (Qualys, Nessus, Detectify, etc.) often report a finding like: "Nameserver allows unauthorized DNS zone transfer".

It means anyone on the internet can download your complete DNS zone - every subdomain, MX, SRV and TXT record - with a single command. Zone transfers (AXFR) exist only so a secondary nameserver can replicate the zone from the primary; they were never meant to be public.

Check if you are affected (run this from any machine outside your server):

Code: Select all

dig -t AXFR example.com @ns1.example.com

If you get a full list of records back - you are affected. If you get ; Transfer failed. - you are fine and can stop reading.

Why the fix belongs in named.conf.options on myVesta

myVesta uses BIND9. The panel writes zone declarations into /etc/bind/named.conf like this:

Code: Select all

zone "example.com" {type master; file "/home/admin/conf/dns/example.com.db";};

Notice there is no per-zone allow-transfer directive, so the global setting from /etc/bind/named.conf.options applies to every zone. That makes it the perfect place for the fix:

• one line covers all existing domains and every future domain you add through the panel
• myVesta rewrites named.conf whenever domains are added or removed, but it never touches named.conf.options - the change survives panel operations and updates

The fix

1. Back up the current config, just in case:

Code: Select all

cp -a /etc/bind /root/bind-backup-$(date +%F)

2. Edit /etc/bind/named.conf.options and add inside the options { } block:

Code: Select all

options {
    ...
    allow-transfer { none; };
    version "hidden";   // optional: hides the BIND version from scanners
};

If you do have a real secondary DNS (a classic BIND slave that pulls the zone via AXFR), whitelist only its IP instead:

Code: Select all

acl "xfer" { 203.0.113.10; };

options {
    ...
    allow-transfer { "xfer"; };
};

myVesta DNS cluster note: if you use v-add-remote-dns-host, synchronization goes through the Vesta API, not AXFR - so allow-transfer { none; }; does not break the cluster.

3. Validate the config and reload BIND:

Code: Select all

named-checkconf
systemctl reload bind9    # on newer Debian the unit is "named"; "rndc reload" also works

Verify

From an external machine (not the server itself):

Code: Select all

dig -t AXFR example.com @ns1.example.com
dig -t AXFR example.com @ns2.example.com

Expected result on both:

Code: Select all

; Transfer failed.

(the server now answers REFUSED). Then confirm normal resolution still works:

Code: Select all

dig NS example.com @YOUR.SERVER.IP +short
dig A  example.com @YOUR.SERVER.IP +short

Denied attempts are logged, so you can monitor them later:

Code: Select all

journalctl -u bind9 | grep -i "axfr request denied"