Why is restricting Zone transfers important in DNS security?

• A. To prevent unauthorized access to DNS records and configurations.
• B. To improve DNS query performance.
• C. To enable dynamic updates.
• D. To reduce DNS traffic.

Answer: (C)

Restricting zone transfers focuses on protecting the confidentiality of DNS data. A zone transfer is the process by which a primary DNS server shares its zone information with secondary servers to keep them in sync. If zone transfers are allowed from any host or without proper authentication, an attacker or unauthorised party could request a full copy of the zone and learn every domain, host name, and resource record inside that zone. That exposure can reveal internal network structure, subdomains, and other sensitive details that an attacker could abuse for targeted attacks.

By limiting transfers to trusted secondary servers and using authentication (for example, TSIG) or other access controls, you ensure that only authorized systems receive the zone data. This reduces the risk of data leakage and tampering, reinforcing the security of the DNS infrastructure.

This control doesn’t directly improve query performance, nor does it enable dynamic updates, and it doesn’t aim to reduce overall DNS traffic. Dynamic updates and performance considerations are separate aspects of DNS operation.