DNS Zone Transfer Controls Should Be Verified With ACL Tests, Not Config Review

A DNS zone transfer can expose every record in a zone, which is acceptable for a trusted secondary server but not for arbitrary internet clients. In BIND, the allow-transfer setting controls this access, but its effective policy depends on whether it is set at the zone, view, or global level and on which listener receives the request. Recent BIND release notes indicate an explicit ACL is needed to enable outgoing transfers, so the behavior should be checked against the manual for the installed version. The article recommends testing access directly with an AXFR request from both authorized and unauthorized networks, across each relevant view, and then confirming secondaries still synchronize after any change. Finally, it advises recording the configuration, version, test source, commands, and responses as evidence for ACL reviews.