COREDNS-TRANSFER(7)

💅 COREDNS-TRANSFER ✨

okay so bestie, welcome to the transfer plugin's whole vibe — it's the manual page for COREDNS-TRANSFER(7), and yes we're getting into it 🫶

🎀 NAME 🎀

transfer — it does the (outgoing) zone transfers for other plugins. that's the whole job. iconic of it honestly 💅

✨ DESCRIPTION ✨

so this plugin is the one answering zone transfers on behalf of authoritative plugins that implement transfer.Transferer — like, it's the front desk and they're the department, yk? 🧚

transfer answers full zone transfer (AXFR) requests, and it answers incremental zone transfer (IXFR) requests with AXFR fallback if the zone has changed. yes, it's got backup plans. main character energy 🔥

when a plugin wants to notify its secondaries, it calls back into the transfer plugin. team work, no cap 🤝

the plugins that implement zone transfers using this plugin are: file, auto, secondary, and kubernetes. and if you're a plugin author who wants to use this plugin, go read transfer.go for the implementation details — the lore is right there 📖

🌸 SYNTAX 🌸

transfer [ZONE...] {
  to ADDRESS...
  source ADDRESS
}

• ZONE — the zones transfer will answer zone transfer requests for. if you leave it blank, the zones are inherited from the enclosing server block. and lowkey important: to answer zone transfers for a given zone, there has to be another plugin in the same server block that serves the same zone and implements transfer.Transferer. no plugin, no transfers, that's the rule 🌈
• to ADDRESS... — the hosts transfer will transfer to. use * to permit transfers to all addresses. zone change notifications get sent to all ADDRESS that are an IP address or an IP address and port, e.g. 1.2.3.4, 12:34::56, 1.2.3.4:5300, [12:34::56]:5300. and to can be specified multiple times — stack 'em up 💅
• source ADDRESS — this is the local IP address to use when sending zone change notifications to the configured to addresses. to be super clear: it does not change which clients are allowed to request AXFR or IXFR transfers. it's just the sender address, not the bouncer 🙈

you can also use the acl plugin to further restrict hosts permitted to receive a zone transfer. see the example below, it's giving teamwork 🦋

👑 EXAMPLES 👑

use it in conjunction with the acl plugin to restrict access to subnet 10.1.0.0/16. like, this is the whole "only my friends get in" moment:

...
  acl {
    allow type AXFR net 10.1.0.0/16
    allow type IXFR net 10.1.0.0/16
    block type AXFR net *
    block type IXFR net *
  }
  transfer {
    to *
  }
...

send NOTIFY messages from a specific local address — very "this is where i'm calling from" energy ✨

...
  transfer {
    to 2001:db8::1
    source 2001:db8::53
  }
...

and each plugin that can use transfer includes an example of use in their respective documentation — go check them out, they all slay in their own way 💖

---

ngl the to * in that first example only works out because the acl plugin is doing the actual gatekeeping — read them together, bestie, not separately 😭

okay that's the whole page!! you understood it, i'm obsessed 💜

this was COREDNS-TRANSFER(7) from CoreDNS, dated October 2026 — mwah, go transfer some zones responsibly 🎀✨