axfr-get(8)

📦 version 1.05, in debian bookworm, debian trixie, nixos 26.05, nixpkgs unstable, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 axfr-get — the zone-transfer client bestie 💖

okay so this is axfr-get(8) from the System Manager's Manual (section 8, the admin-girlies section 💅), and she is literally a DNS zone-transfer client. no cap.

✨ NAME ✨

axfr-get — a DNS zone-transfer client.

the way she works: she sends a zone-transfer request in DNS-over-TCP format to descriptor 7, then reads the results back from descriptor 6, and saves those results in a file. iconic behaviour fr fr 🎀

🌸 SYNOPSIS 🌸

normally you don't even run her by herself — she lives under tcpclient(1), which is the one who sets up descriptors 6 and 7 as a TCP connection to a remote host. she's a passenger princess, basically 🦋

axfr-get z fn fn.tmp

💫 DESCRIPTION 💫

axfr-get performs a zone transfer for domain z. she writes the results to fn.tmp in a format that can be used as input to tinydns-data(8). and if the zone transfer completes successfully, she atomically renames fn.tmp as fn. glow-up complete, no half-written files, we love a clean swap ✨

⚠️ heads up bestie: fn.tmp and fn must be on the same filesystem. don't be messy about this.

axfr-get writes the zone serial number as a comment at the top of fn.tmp.

she skips the zone transfer entirely, leaving fn alone, if all three of these are true:

  1. fn already exists,
  2. fn has a serial number matching the zone serial number,
  3. and both serial numbers are nonzero.

like she checked, she's up to date, she's not doing unpaid labour today 💅

zone transfers often include duplicate records — that's just how it is — so you should feed the axfr-get results through sort -u. let her do the transfer, let sort -u do the de-dupe, teamwork makes the dream work 🫶

axfr-get discards all records outside the domain z. she does accept records in child zones, but she marks all child zones as non-authoritative, so tinydns(8) will not report those records except as glue. okay so if you plan to merge the axfr-get results for a domain and a child of the same domain — creating a file authoritative for both zones — make sure to eliminate records in the first output that are within the child zone. otherwise it's giving chaos, and not the fun kind 😭

axfr-get will accept arbitrarily large zone transfers. so if you want to limit the maximum file size to 1 megabyte, run axfr-get under:

softlimit -f 1048576

🧚 Compatibility notes 🧚

axfr-get handles BIND's RFC-1034-violating multiple-answers zone-transfer format. yes she does. she's built different 🔥

axfr-get does not precisely simulate BIND's handling of *.dom. under BIND, records for *.dom do not apply to y.dom or anything.y.dom if there is a normal record for x.y.dom. with axfr-get and tinydns(8), the records do apply to y.dom and anything.y.dom except x.y.dom. subtle diff, but it's a diff, so know about it 👑

axfr-get does not precisely simulate BIND's handling of multiple IP addresses for a single name either. when there are more than 8 addresses, tinydns(8) selects a random set of 8 for each query. vibe check: randomized. every single time. 🌈

👑 SEE ALSO 👑

and that's the whole page bestie, go read the docs, ily 💜

sign-off time 🎀 — this one is page axfr-get(8) out of the System Manager's Manual (that's the source and the manual section, and there's no date stamp on this one, so consider this your timestamp: now, when you needed her most*).* ✨🦋💖

📦 where this page comes from