Test if your nameservers allow DNS zone transfers. A server that responds to AXFR queries exposes your full DNS structure including internal hostnames.
Enter a domain and nameserver to attempt a zone transfer
AXFR (Authoritative Zone Transfer) is a DNS operation that replicates an entire zone from a primary to a secondary nameserver. If a nameserver accepts AXFR queries from arbitrary sources, anyone can download your complete DNS zone, revealing internal hostnames, IP addresses, mail servers, and network topology.
A secure nameserver responds with REFUSED (RCODE 5) or NOTAUTH (RCODE 9) to unauthorized AXFR requests. Zone transfers should be restricted to known secondary nameserver IPs via ACLs in BIND (allow-transfer), PowerDNS, or your DNS provider's dashboard.
Sent to our server: Domain. We look it up in DNS. We connect to its name servers. Part of this work runs on our own server. To answer a repeated check fast, we have to keep answers for 1 hour; then they are deleted. Also added to the page link, so you can share the result: Domain.