axfrdns(8)

💖 axfrdns — a DNS zone-transfer server 💖

okay bestie, sit down, we're talking about axfrdns(8) from the System Manager's Manual. it's giving very specific, very powerful, and honestly? iconic.

✨ NAME ✨

axfrdns — a DNS zone-transfer server. that's it, that's the girl. 💅

🌸 DESCRIPTION 🌸

so here's the vibe: axfrdns reads a zone-transfer request in DNS-over-TCP format straight from its standard input, and then it responds with locally configured information. it's not out here guessing, it's reading the room (stdin) and answering with what it actually knows. 🎀

🦋 Configuration 🦋

ngl, normally you don't hand-wire this thing yourself — axfrdns is set up by the axfrdns-conf(8) program. let that program do its thing.

axfrdns runs chrooted in the directory specified by the $ROOT environment variable, and it runs under the uid and gid specified by the $UID and $GID environment variables. yes, all caps, yes, they're environment variables, don't fight it. 💜

normally axfrdns runs under tcpserver(1) to handle TCP connections on port 53 of a local IP address. and listen — tcpserver(1) is the one responsible for rejecting connections from hosts that aren't authorized to perform zone transfers. that's not axfrdns's job, okay? she's got her own tasks.

axfrdns can also run under secure connection tools offering an UCSPI-compliant interface. she's flexible like that. 🫶

axfrdns looks up zone-transfer results in data.cdb — that's a binary file created by tinydns-data(8). she also responds to normal client queries, like SOA queries, which usually come right before zone-transfer requests. so she's multitasking, and she's slaying at it. ⭐

here's the access-control tea: axfrdns allows zone transfers for any zone listed in the $AXFR environment variable. 🎀

$AXFR is a slash-separated list of domain names. and if $AXFR isn't set at all? then axfrdns allows zone transfers for all zones available in data.cdb. so like, set it or don't, but know what you're doing bestie.

💀 now the part where she just... gives up. axfrdns aborts if it: - runs out of memory - has trouble reading data.cdb - receives a request larger than 512 bytes - receives a truncated request - receives a zone-transfer request disallowed by $AXFR - receives a request not answered by data.cdb - or waits 60 seconds with nothing happening

she's not dramatic, she just has standards. 😭

🌈 Further notes on zone transfers 🌈

axfrdns provides every record it can find inside the target domain. and yes, that may include records in child zones. some of these records (like glue inside a child zone) are essential; others are not. it is up to the client to decide which out-of-zone records to keep. not her problem, respectfully. 💅

axfrdns does not provide glue records outside the target domain. periodt.

the zone-transfer protocol does not support timestamps. so here's the situation: if a record is scheduled to be created in the future, axfrdns does not send it; after the starting time, the zone-transfer client will continue claiming that the record doesn't exist, until it contacts axfrdns again. similarly, if a record is scheduled to die in the future, axfrdns sends it (with a 2-second TTL); after the ending time, the zone-transfer client will continue providing the old record, until it contacts axfrdns again. it's giving "we'll fix it next time we talk." 🙈

zone-transfer clients rely on zone serial numbers changing for every zone modification. that's the whole trust system, okay?

tinydns-data(8) uses the modification time of the data file as its serial number for all zones. so:

🚨 Do not make more than one modification per second. 🚨

fr fr. one per second. that's the rule.

BIND's zone-transfer client, named-xfer, converts zone-transfer data to zone-file format. beware that zone-file format has no generic mechanism to express records of arbitrary types; 🔥

and named-xfer chokes if it does not recognize a record type used in data.cdb. literally chokes. poor thing. 😭

👑 SEE ALSO 👑

• axfrdns-conf(8)
• tinydns-data(8)
• tcpserver(1)
• http://cr.yp.to/djbdns.html

and that's the whole page, bestie — this was axfrdns(8) from the System Manager's Manual, and yes, we read every single line of her. no skimming, no cap. go forth and transfer those zones responsibly 💖✨🎀🦋🌸💅🫶