Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently failed a PCI compliance scan because of the following:

This DNS server allows unrestricted zone transfers. Attackers may be able to use this information to gain knowledge on the structure of your networks to aid in device discovery prior to an actual attack.

And the suggested solution is as follows:

Reconfigure this DNS server to restrict zone transfers to specific authorized servers only.

I am running a dedicated Linux Centos server.

My understanding is that I have to edit the /etc/named.conf file, which I have done and the the relevant part is as follows:

options {
    acl "trusted" {; 
  ; //this is one of the server's ip's
  ; //this is another server's ip

    allow-recursion { 
    allow-notify { 
    allow-transfer { 

I then restarted the named service /etc/rc.d/init.d/named restart and requested a re-scan, which failed again for the same reason.

Am I missing something obvious here?

share|improve this question
OK, I think I may have found the problem: the acl{} tab should not be under options, but its own tab. Resubmitting for scan...lets hope – JonoB Nov 26 '11 at 23:59
You can try to initiate a zone transfer from different hosts using dig -tAXFR @your_nameserver or nslookup and the ls command. You will see yourself when they are allowed. – nrolans Nov 27 '11 at 0:36

Check the rest of your config file (which you did not post here) to make sure that allow-transfer is not being overridden by the zone configuration in question.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.