#axfr — Public Fediverse posts

@meuon 👏 👏. So called cloud providers has taken away the joy in doing things old school. This annoyance is what made me come with a secondary dns service. Run your zone even at home on a raspberry pi if you have ipv6 or ipv4 if you are lucky. Just send us axfr and we replicate your zone. https://anyzone.org #dns #axfr #secondarydns #ipv6 #raspberrypi

Findes der mon nogen DSN services der gratis (Eller billigt) leverer sekundær DNS (hidden) med AXFR osv ligesom gode gamle gratisdns gjorde det? Jeg har en hel del domæner liggende hos one.com dns fra da de overtog gratisdns, men deres support er mildest sagt håbløs og de spammer konstant for at få en til at have webhosting, forhandleraftale, mm hos dem.
#dns #axfr #secondarydns #needhelp

@unlambda @whitequark

The root and a few of its direct and indirect subdomains have publicly available data.

% tcp-socket-connect lax.xfr.dns.icann.org 53 axfr-get uri.arpa uri uri.tmp

There is a list of these.

https://news.ycombinator.com/item?id=44318136

#DNS #AXFR #Estonia

When building a library, it's not just about providing features but getting the ergonomics right so that developers can take maximum advantage of the functionality provided. After several approaches, we're finally happy with #DNS Zone Transfers for our #OpenSource `domain` crate for #rustlang. #CodingInTheOpen #IXFR #AXFR #TSIG
https://github.com/NLnetLabs/domain/pull/375

I’ve received on my postmaster@ address a message from some security researchers warning me of the “insecure” #DNSSEC configuration of my domain, so for the record:

My domain (incenp.org) is configured to use #NSEC, and not #NSEC3, on purpose. This is not a misconfiguration. I weighed the pros and cons of NSEC3, and decided it was just not worth it.

Yes, people could use NSEC records to enumerate all the DNS records of my zone. So what?

Usually I am not a fan (and that’s an euphemism) of the “if you have nothing to hide, you have nothing to fear” argument, but in this case, there is really nothing to hide in my DNS zone. I would happily give a list of all the records (or even the original master zone file) to anyone who asks for it.

Actually last time I checked, one of the slave DNS servers I use was even configured to allow #AXFR requests from anywhere, and I never bothered to contact the admin of that server to ask him to do anything about it. So if you want the entirety of my zone’s records, don’t waste your time mounting a NSEC enumeration attack, just ask the right server.

@tolstoevsky Не обязательно #BIND9 aka #BIND, его много критикуют. Есть ещё #KnotDNS, #YADIFA и другие; а если не нужен #AXFR (все вторичные сервера свои, синхронизируются #rsync'ом), то #gdnsd (#NSD, по-моему, только для больших нагрузок, а на малых не уменьшает потребление памяти). Есть ещё маленький и экономичный #MaraDNS, но там надо изучать другой синтаксис файла зоны.

#DNS #NS

In case you ever need to test an #AXFR implementation or just want to play around with zone transfers:

I created a thing for such use cases: https://icanhazaxfr.com