Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a Zone Transfer (AXFR)?
Short answer
Zone transfer is the bulk copying of all the records of a zone from one DNS server to another; AXFR is the DNS query type for this full transfer (RFC 5936). Slave servers receive the zone from the master server this way. TR7 GTM uses AXFR in two directions. To pull the records on an external DNS server into GTM, the Zone Transfer window on the Records screen (one-time) or an Express Profiles profile assigned to the domain's data center group (continuous synchronization) is used. To give the zone in GTM to other servers, the addresses of those servers are added to the domain's Slave Server IPs list; these addresses can receive the zone with AXFR and receive a NOTIFY at every change.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| GTM → GTM Services → service name → Records → Zone Transfer | Datacenter, Master Addresses (at most 10, default port 53), IDENTIFIER PATTERN, Collision Decision, Record Types to Retrieve | Pulling the records from an external server once; the button is visible while there is at least one Local data center group in the domain |
| GTM → Express Profiles (DNS Integration) | Master Addresses, IDENTIFIER PATTERN | Continuous synchronization with the master server through NOTIFY or Sync via Express |
| GTM → GTM Services → service name → Domains → Add / Edit | Slave Server IPs (default Disabled) | Permitting the zone on TR7 to be given to these addresses with AXFR |
| GTM → GTM Services → service name → Records | Express Logs button (while there is an Express group in the domain) | The log of the Express transfers and the record changes |
Collision Decision in the Zone Transfer Window
| Option | If there is a local record with the same name and type |
|---|---|
| Keep Current Records (default) | The local record is preserved; only the names and types that are not present locally are added |
| Overwrite | The content is replaced with the one in the source; the local records that have no equivalent in the source (including the records of the types not selected in the Record Types to Retrieve list) are removed |
| Combine Records | The local content is preserved, the addresses in the source that are missing locally are added |
- The transfer waits for a response containing SOA from the source server within 10 seconds; otherwise that address is considered AXFR failed and the next address in the list is tried.
- The source server must allow the zone transfer request coming from the Frontend IP address of the TR7 DNS service in the same network (or, if there is none, from its cluster VIP).
- The records created with the transfer take the mode of the domain, the All Records algorithm and the TTL in the source; the SOA record is never deleted in the transfer.
Common Misconceptions
- "Zone transfer is open to everyone." The transfer should be made only to permitted addresses; in TR7, the zone transfer permission is given to the addresses in the Slave Server IPs list.
- "AXFR transfers only the changed records." AXFR is a full transfer; all the records of the zone are sent. The method that transfers only the difference is IXFR (RFC 1995).
- "The Zone transfer window synchronizes the records continuously." The window performs a one-time transfer; for continuous synchronization, an Express profile is assigned to the domain's data center group.
How it is done in the documentation
