DNS trace and zone transfer
The DNS trace resolves a name from the root servers down like dig +trace; the zone transfer test shows whether your zone is exposed via AXFR.
Two tools for troubleshooting at the source: the DNS-Trace shows where things go wrong on the way from the root to the name. The Zonentransfer-Test (zone transfer test) checks whether outsiders can download your entire zone. Both need a license and direct connections to the name servers. That’s why they’re missing in the browser; the zone transfer test is also desktop only.
DNS trace
The trace resolves a name step by step on its own, without any resolver cache, just like dig +trace.
- Type the name into Name oder IP (name or IP).
- Pick the Typ (type).
- Click Verfolgen (trace).
The app starts at a random one of the 13 root servers, follows every referral to the next zone and asks its name servers until an answer comes back. If a referral lists a name server without glue, it resolves that server’s address via the selected resolver. On a CNAME it starts again at the root for the target. If you enter an IP address, it traces the PTR record.
The Trace table shows every step with the zone, the server asked, the answer (usually Verweis auf …, referral to …, with the next zone’s name servers) and the response time. So you can see which server hands out which delegation. That helps when a name server change at the registrar hasn’t reached the TLD yet.
Findings
| Finding | Meaning and what to do |
|---|---|
| Aufgelöst in n Schritten (resolved in n steps) | The name is reachable; the explanation names the answering server. |
| Letzte Antwort ohne AA-Flag (last answer without AA flag, warning) | The last server doesn’t answer authoritatively. Usually a wrongly listed name server. |
| … existiert nicht (NXDOMAIN) (doesn’t exist, warning) | The responsible zone doesn’t know the name. |
| Keine A-Records (no A records, warning) | The name exists but has no entry of this type. |
| CNAME … → … (note) | The trace follows the alias. |
| Nameserver ohne Glue, über den Resolver aufgelöst (name servers without glue, resolved via resolver, note) | Normal when the name servers live in another zone. |
| Keiner der Nameserver von … antwortet (none of the name servers answer, error) | The delegation points to servers that aren’t reachable. Check the NS entries at the registrar. |
| … antwortet SERVFAIL or another error code (error) | The server has a problem with the zone. |
| Fehlerhafter Verweis (faulty referral, error) | A server refers to a zone that doesn’t get any closer to the name. Misconfiguration on that server. |
| Zu viele CNAME-Stufen (too many CNAME hops, error) | More than 8 aliases in a row, probably a loop. |
| Auflösung nicht abgeschlossen (resolution not completed, error) | No answer after 30 steps. |
Zone transfer test
A zone transfer (AXFR) copies the entire zone from one name server to another. It belongs between primary and secondary servers, not on the open internet. If it’s allowed for everyone, anyone can download every host name in the zone, including internal ones like vpn, test or admin.
Type the zone into Domain, so example.com, not www.example.com, and click Prüfen (check). The app fetches the NS records, resolves each name server and attempts a transfer over TCP at each address.
The Nameserver table shows the result per server and address, such as abgelehnt (REFUSED, 41 ms) (refused), Zeitüberschreitung (timeout) or ERLAUBT: 154 Records (allowed).
Findings
| Finding | Meaning and what to do |
|---|---|
| Kein Nameserver erlaubt einen Zonentransfer (no name server allows a zone transfer) | That’s how it should be. |
| Zonentransfer erlaubt bei … (zone transfer allowed at …, warning) | Anyone can read the zone. Restrict AXFR to your secondary name servers: allow-transfer in BIND, the equivalent setting in other server software, or the zone transfer settings at your DNS host. |
| Keine NS-Records (no NS records, error) | You probably entered a host name instead of the zone. |
| Nur die ersten 2000 von n Records angezeigt (only the first 2000 of n records shown, note) | The table is truncated; the complete zone is under Rohdaten (raw data). |
If a transfer succeeds, the Übertragene Zone (transferred zone) table shows the records received, and Rohdaten holds the whole zone in zone file format, ready to copy. Only test zones you manage or are allowed to test.