Zone transfer (AXFR/IXFR)
Zone transfer TSIG key setup: allow DNSMigrator to read authoritative zones by AXFR (and optionally IXFR) over TCP 53 without granting update access.
On this page
Zone transfer TSIG key permissions
- Credential type
- Transfer allow-list and optional TSIG key
- Preview access
- Authoritative SOA query followed by AXFR for every listed zone; TSIG is optional
- Apply access
- Not supported: this provider is read-only and never writes to the primary.
- API endpoint
- You provide a public API endpoint.
Additional access
DNSControl id
This provider does not have a DNSControl id.
Create credentials
Allow DNSMigrator to read authoritative zones by AXFR (and optionally IXFR) over TCP 53 without granting update access.
Access you'll grant
Authoritative SOA query followed by AXFR for every listed zone; TSIG is optional
Not supported: this provider is read-only and never writes to the primary.
Before you start
- Authoritative primary servers for every zone and permission to change their transfer ACLs.
- A public TCP 53 path from our egress IP; up to five servers and 200 zones can be entered.
Setup steps
0 of 8 done
Inventory the primary servers and zones
List authoritative primaries in failover order and list each zone you need to migrate, monitor, or back up. DNSMigrator requires the SOA response to have the authoritative AA bit before it transfers a zone.
Serversns1.example.com ns2.example.comZonesexample.com example.netChoose IP or TSIG authentication
IP-only transfers rely on
our egress IPin the server ACL. TSIG also proves the request identity and is preferred; enter TSIG key name and TSIG secret together. Do not grant RFC 2136 update rights to this read-only connection.Generate a BIND keytsig-keygen -a hmac-sha256 dnsmigratorConfigure BIND if it serves the zones
Add one allow-transfer form to each primary zone. Use the IP form or the TSIG form; retaining
our egress IPat the firewall is still required when TSIG is used.IP-onlyallow-transfer { our egress IP; };TSIGallow-transfer { key "dnsmigrator."; };Configure Knot DNS if it serves the zones
Define a key and an ACL with action: transfer, then reference the ACL from every zone. When address and key appear in the same ACL, both must match.
Knot configurationkey: - id: dnsmigrator. algorithm: hmac-sha256 secret: <base64-secret> acl: - id: dnsmigrator-transfer address: our egress IP key: dnsmigrator. action: transfer zone: - domain: example.com acl: dnsmigrator-transferConfigure PowerDNS if it serves the zones
For an unsigned transfer, allow
our egress IPglobally and keep AXFR enabled. For TSIG, generate or import the key and add it to each zone'sTSIG-ALLOW-AXFRmetadata; a TSIG-authorized transfer bypassesallow-axfr-ips, so retain the network firewall rule.pdns.conf IP ACLallow-axfr-ips=our egress IP disable-axfr=noAdd zone TSIG metadatapdnsutil metadata add example.com TSIG-ALLOW-AXFR dnsmigratorConfigure Windows DNS if it serves the zones
Open Windows Administrative Tools → DNS, right-click the zone, select Properties → Zone Transfers, enable Allow zone transfers, choose Only to the following servers, and add
our egress IP. Repeat for every zone, or use PowerShell.Windows PowerShellSet-DnsServerPrimaryZone -Name "example.com" -SecureSecondaries "TransferToSecureServers" -SecondaryServers "our egress IP" -PassThruAllow public TCP 53
Allow
our egress IPto every listed primary on TCP port 53; AXFR and IXFR do not use UDP here. DNSMigrator connects from its servers over the public Internet. Its guard rejects private, loopback, link-local, CGNAT, metadata, documentation/reserved, and other non-public addresses, validates every DNS answer, and pins one validated IP. Hosted connections use port 53 unless the operator has explicitly allow-listed another TCP port.Required flowour egress IP → primary:53/tcpEnter the transfer settings
Paste the servers and zones, leave Port empty for 53, and add all three TSIG values only when the server requires them. Enable Prefer IXFR for change checks to request deltas; unsupported IXFR automatically falls back to AXFR. Check access against the first zone before saving.
Troubleshooting
SOA is returned but is not authoritative
Point the connection at an authoritative primary or secondary for the zone, not a recursive resolver or load balancer that clears the AA bit.
AXFR returns REFUSED
Check the zone-specific transfer ACL, exact TSIG identity and algorithm, and the source address seen by the server. Allow our egress IP, not your browser's IP.
TCP 53 times out
Permit TCP as well as any existing UDP DNS rule, verify NAT reaches the authoritative server, and ensure every DNS answer for the hostname is public.
The transfer exceeds 10 MB or never completes
Reduce unusually large generated data, transfer from a closer authoritative server, or use another source connector. DNSMigrator intentionally caps transfer size at 10 MB.
Official documentation
- BIND 9: allow-transfer
- Knot DNS: access-control lists
- PowerDNS: TSIG
- Windows Server: configure zone transfers
Guide checked against the official documentation on .
Credential fields
| Field | Requirement | Where to find it |
|---|---|---|
| Primary serversservers | Required | One public primary hostname or IP per line, in failover order (maximum five). Each must answer authoritative SOA and allow transfers. |
| Portport | Optional | TCP transfer port; leave empty for 53. DNSMigrator's hosted guard permits TCP 53 unless an operator explicitly adds another port. |
| Zoneszones | Required | One authoritative zone per line (maximum 200). The first zone is used by the access check. |
| TSIG key namekeyName | Optional | Optional exact TSIG identity, including a trailing dot when configured. Enter it together with the secret. |
| TSIG algorithmkeyAlgorithm | Optional | Optional TSIG algorithm matching the server. Defaults to hmac-sha256 when a key is used; avoid SHA-1 and MD5 for new keys. |
| TSIG secretkeySecret | Optional | Optional Base64 TSIG secret without quotes. Enter it together with the key name. |
| Prefer IXFR for change checkspreferIxfr | Optional | Request IXFR while polling for changes and fall back to AXFR when unavailable. The initial read still needs a complete transfer. |
Capabilities
- Create zones
- No
- List zones
- Yes
- DNSSEC
- Not available through this connection
- Minimum TTL
- 0 seconds
- Apex CNAME
- No
- Read only
- Yes
Record types
- A
- AAAA
- CNAME
- MX
- TXT
- NS
- SRV
- CAA
- PTR
- DS
- TLSA
- SSHFP
- NAPTR
- SPF
- URI
- DNAME
- OPENPGPKEY
- SMIMEA
- DHCID
- RP
- HTTPS
- SVCB
Caveats
- Read-only source: zone transfer connections can be migrated from, monitored and backed up, but never written to.
- We reach primaries only over TCP port 53 at public addresses; private, loopback, link-local and metadata addresses are refused.
- A transfer shows what the server publishes: proxied (CDN) addresses, flattened apex CNAMEs and provider-managed records can't be recovered from it.
- DNSSEC signatures and keys (RRSIG, NSEC/NSEC3, DNSKEY, CDS/CDNSKEY) are dropped; the destination signs the zone itself.
- We can't receive NOTIFY messages, so changes are picked up by polling the SOA serial, then IXFR when the server supports it.
Troubleshooting
- SOA is returned but is not authoritative
- Point the connection at an authoritative primary or secondary for the zone, not a recursive resolver or load balancer that clears the AA bit.
- AXFR returns REFUSED
- Check the zone-specific transfer ACL, exact TSIG identity and algorithm, and the source address seen by the server. Allow {egressIp}, not your browser's IP.
- TCP 53 times out
- Permit TCP as well as any existing UDP DNS rule, verify NAT reaches the authoritative server, and ensure every DNS answer for the hostname is public.
- The transfer exceeds 10 MB or never completes
- Reduce unusually large generated data, transfer from a closer authoritative server, or use another source connector. DNSMigrator intentionally caps transfer size at 10 MB.