Legacy AXFR Flags Survive Windows DNS Upgrades

The Trap

The AXFR zone transfer flag on an Active Directory-integrated DNS zone, specifically the SecureSecondaries property, remaining set to TransferAnyServer after a domain controller migration or in-place operating system upgrade.

The Default State

Fresh Windows Server DNS installations default new AD-integrated primary zones to TransferToSecureServers, restricting transfers to name servers listed in the zone’s NS records. That default is only applied at zone creation. When a domain is migrated via demote-and-repromote, or when an old Windows Server 2008 or 2012 DNS role is upgraded in place rather than rebuilt, the zone object inherits whatever SecureSecondaries value existed on the source server. Many legacy builds shipped or were manually configured with TransferAnyServer to support third-party secondary resolvers that no longer exist. Nobody revisits the Zone Transfer tab after the migration, because the zone still resolves correctly and no error is logged.

The Blast Radius

Any device with line-of-sight to UDP/TCP 53 on a domain controller can run dig axfr corp.internal @10.0.0.10 or an equivalent nslookup ls -d session and receive the entire zone in one response: every host record, every _ldap._tcp, _kerberos._tcp and _gc._tcp SRV record identifying which domain controllers hold the PDC emulator, Global Catalog and RID master roles, plus CNAME and A records for internal application tiers, backup servers and jump boxes. No credential is required and no authentication event is generated, because AXFR is served by the DNS process independently of Kerberos or NTLM. An attacker who has landed on a single unprivileged workstation now has a prioritised target list for DCSync attempts, Kerberoasting against service accounts, and lateral movement, without triggering a single alert tied to logon activity.

The Lead Mechanic Fix

Audit every zone with Get-DnsServerZoneTransferPolicy or by reviewing dnscmd /zoneinfo <zone> /allowedxfr output line by line across all domain controllers, since the setting is stored per zone, not per server. Correct any zone showing TransferAnyServer with:
Set-DnsServerPrimaryZone -Name "corp.internal" -SecureSecondaries "TransferToSecureServers"
and explicitly enumerate legitimate secondaries where required using -SecondaryServers. Confirm remediation by re-running the AXFR query externally and verifying REFUSED, then bake a scheduled compliance check into your build pipeline so re-promoted or upgraded domain controllers cannot silently reintroduce the flag.