When having two public DNS servers that provide NS, A, MX, and CNAME records for your domain (website), is it necessary to encrypt the zone transfer data or is it fine to have the master-to-slave sent in clear over the network?

I'm using bind9 on Debian 8.


All conversations on the internet should be private. DNS should always be private, it runs the internet, without clean DNS records we could not rely on networking.

If a MITM attack occurred between master and slave and they modified records on the slave, they only need to DOS primary server and slave will start serving incorrect records

Read this nice article

  • Interesting. It surprises me all these how-to articles don't illustrate how to secure zone transfers. I thought secure zone-transfers were only for internal networks but after reading some guides, it seems all transfers should be secure. I did put my domain name in this tool and said it failed on both servers but I guess there's always IP spoofing. hackertarget.com/zone-transfer – debuser14 Sep 2 '15 at 13:50
  • Doing a MITM behind a DNS master nameserver and its slaves is certainly not the easiest way to do things. The nameservers constellation can be provisioned by other means than exchanging DNS messages. Also, as for the content of the zone you now have DNSSEC that provides integrity. – Patrick Mevzek Apr 14 '18 at 22:09

There is no practical danger in sending zones in plaintext, unless:

  • A zone contains records that shouldn’t be exposed to bystanders’ eyes (ex.: in your “example.net” zone there is a “hiddenstuff.example.net” record to be used only by few people).
  • There are some special security concerns about networks involved (ex.: transfer goes over an Ethernet network with delinquent users).

You are probably not chasing the correct problem but you do not provide enough context to really help you put things in perspective.

You can secure zone file transmission between different hosts, in various ways. First the master can restrict AXFR/IXFR queries to come only from its slaves and the slaves can restrict NOTIFY queries (the slaves pull the data from the master, so it is the initiator). For stronger authentication you have TSIG. See this for Bind9: ftp://ftp.isc.org/isc/bind9/cur/9.9/doc/arm/Bv9ARM.ch04.html#tsig

Also nowadays many nameservers constellation are configured from a single source and/or provisioned out-of-band. For example, content can be in a database, generated in some place then distributed using rsync or equivalent to all nameservers. There are no DNS messages between the nameservers to update them one from another.

In a separate way you often have an "hidden" master: a nameserver where all zonefile changes appear to feed all public nameservers. There is no MITM possible there since you do not even know there is an hidden master and even less where it is and its IP (except if you were already able to get control of one the nameservers, in which case this is a completely different problem).

And like I said in another comment, you now have DNSSEC. If your zone is correctly configured with DNSSEC, even if someone manages to change its content either on the nameserver or in transit, then any validating recursive nameserver will detect the change as the new answer will either not be signed at all or incorrectly signed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.