Infrastructure · XB Field Notes

Zone transfer copies authoritative data under explicit authorization and serial rules

Sun, 05 Dec 2027 00:00:00 +0000

AXFR transfers a complete DNS zone so another server or authorized client can obtain its data. A secondary can then answer authoritatively from its local copy. The protocol does not magically identify callers as legitimate authoritative servers: access control decides who may transfer. A zone is also a defined authority boundary, not every record in every delegated child zone or the organization’s entire DNS namespace.

Compare serial and actual data, not serial alone. The source’s 10-to-11 repair is a concrete case; general comparison uses 32-bit serial arithmetic. Complete-transfer framing, TSIG authorization and SOA expiry are separate checks. The zone-transfer exercise was not rerun and no shared secret was generated.

When it breaks

Editing primary data without updating the SOA serial can leave a secondary serving different content with the same version number. Reloading the primary does not force every secondary to replace an apparently unchanged zone. DNS serial comparison uses 32-bit serial arithmetic, including wraparound rules; a date-looking number is only an operator convention, not an independent guarantee that every numeric change is newer.

An unrestricted transfer can reveal the zone’s full published contents to an arbitrary requesting client. Source restrictions and TSIG can control access, but their configuration semantics matter. In particular, listing an address and a key in an ordinary BIND allow-list is not automatically an AND requirement. Review the actual ACL behavior and test an unauthorized request from a relevant source, rather than assuming two listed conditions both apply.

A secondary’s ability to answer during primary failure is bounded by SOA expiry. Record TTL controls caching by downstream consumers; it is not the same as the secondary’s expiry timer for its authoritative copy. After unsuccessful refresh for the allowed period, the secondary must stop treating that copy as current authoritative data. Existing successful answers do not establish unlimited independence from the primary.

Check it quickly

Save this as check-zone-transfer.py and run python3 check-zone-transfer.py with Docker. Two BIND 9.18.49 processes run inside an isolated container. A randomly generated disposable TSIG secret authorizes transfers, and is not printed. The fixture uses deliberately short refresh and expiry values to expose state changes promptly; these values are test settings, not a suggested production policy:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries

@contextmanager
def named_process(root,config):
 root.mkdir(exist_ok=True);conf=root/'named.conf';log=root/'named.log';conf.write_text(config)
 run('named-checkconf',str(conf))
 with log.open('w') as output:
 process=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 try:
 def ready():
 assert process.poll() is None,log.read_text()
 return re.search(r'\brunning\s*$',log.read_text(),re.M) is not None
 wait(ready);yield process,log
 finally:stop(process)
import base64,secrets
import dns.tsig,dns.tsigkeyring
with TemporaryDirectory(prefix='xbcatm-xfr-') as directory:
 root=Path(directory);primary=root/'primary';secondary=root/'secondary';primary.mkdir();secondary.mkdir()
 secret=base64.b64encode(secrets.token_bytes(32)).decode();keyring=dns.tsigkeyring.from_text({'xfr.lab.test.':secret})
 key_config=f'key "xfr.lab.test." {{ algorithm hmac-sha256; secret "{secret}"; }};'
 zone=primary/'zone'
 def save(serial,address):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 2\n@ IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 1 1 6 1)\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\nservice IN A {address}\n')
 run('named-checkzone','lab.test',str(zone))
 def options(path,port):return f'''options {{ directory "{path}"; listen-on port {port} {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; max-cache-size 8m; session-keyfile none; pid-file "{path}/named.pid"; lock-file "{path}/named.lock";
min-refresh-time 1; max-refresh-time 2; min-retry-time 1; max-retry-time 2; }}; controls {{}};'''
 save(10,'127.0.0.2')
 primary_config=key_config+options(primary,1053)+f'''zone "lab.test" {{ type primary; file "{zone}";
allow-transfer {{key "xfr.lab.test.";}}; notify explicit; also-notify {{127.0.0.1 port 1054 key "xfr.lab.test.";}}; }};'''
 secondary_config=key_config+options(secondary,1054)+f'''zone "lab.test" {{ type secondary; file "{secondary}/copy";
primaries {{127.0.0.1 port 1053 key "xfr.lab.test.";}}; allow-transfer {{none;}}; }};'''
 with named_process(primary,primary_config) as (master,master_log),named_process(secondary,secondary_config):
 wait(lambda: values(query('service.lab.test.',port=1054))==['127.0.0.2'])
 def transfer(**kwargs):return [rr for message in dns.query.xfr('127.0.0.1','lab.test.',port=1053,timeout=2,lifetime=4,relativize=False,**kwargs) for rr in message.answer]
 copied=transfer(keyring=keyring,keyname='xfr.lab.test.')
 assert copied[0].rdtype==copied[-1].rdtype==dns.rdatatype.SOA
 assert copied[0][0].serial==copied[-1][0].serial==10
 assert any(str(rr.name)=='service.lab.test.' and any(str(item)=='127.0.0.2' for item in rr) for rr in copied)
 rejected={}
 for label,kwargs in [('unsigned',{}),('wrong_secret',{'keyring':dns.tsigkeyring.from_text({'xfr.lab.test.':base64.b64encode(secrets.token_bytes(32)).decode()}),'keyname':'xfr.lab.test.'})]:
 try:transfer(**kwargs);raise AssertionError('unauthorized zone transfer succeeded')
 except (dns.query.TransferError,dns.tsig.PeerBadSignature) as error:rejected[label]=type(error).__name__
 assert values(query('service.lab.test.'))==['127.0.0.2']
 save(10,'127.0.0.3');master.send_signal(signal.SIGHUP);wait(lambda: values(query('service.lab.test.'))==['127.0.0.3'])
 time.sleep(2.2);unchanged=query('service.lab.test.',port=1054);assert values(unchanged)==['127.0.0.2']
 save(11,'127.0.0.3');master.send_signal(signal.SIGHUP)
 wait(lambda: query('lab.test.','SOA').answer[0][0].serial==11)
 wait(lambda: values(query('service.lab.test.',port=1054))==['127.0.0.3'])
 secondary_soa=query('lab.test.','SOA',1054);assert secondary_soa.answer[0][0].serial==11
 requested_ixfr=transfer(keyring=keyring,keyname='xfr.lab.test.',rdtype='IXFR',serial=10)
 assert requested_ixfr[0][0].serial==11 and requested_ixfr[1].rdtype!=dns.rdatatype.SOA
 assert requested_ixfr[-1].rdtype==dns.rdatatype.SOA and requested_ixfr[-1][0].serial==11
 stop(master)
 while_valid=query('service.lab.test.',port=1054);assert values(while_valid)==['127.0.0.3']
 expired=[]
 def no_longer_served():
 answer=query('service.lab.test.',port=1054);expired.append(answer);return answer.rcode()==dns.rcode.SERVFAIL
 wait(no_longer_served,timeout=12)
 print(json.dumps({'AXFR_SOA_serials':[copied[0][0].serial,copied[-1][0].serial],'AXFR_record_sets':len(copied),
 'unauthorized_transfer_errors':rejected,'same_serial_secondary_address':values(unchanged),'updated_secondary_serial':11,
 'IXFR_without_history_returned_AXFR':True,'primary_stopped_secondary_initially_answers':values(while_valid),
 'secondary_after_SOA_expire':dns.rcode.to_text(expired[-1].rcode())},sort_keys=True))
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The primary starts at serial 10 with service.lab.test pointing to 127.0.0.2. A real secondary transfers the zone and answers that address. An ordinary Python client using the authorized TSIG key also completes AXFR. Its five RRset entries include opening and closing SOA records with serial 10 and the expected service data, demonstrating both transfer completion and access by an authorized non-server client.

An unsigned request and a request signed with a different secret fail, even though the requests originate inside the same loopback environment. Ordinary permitted address queries still succeed. The tested rule requires the configured key for transfer; it does not make every DNS query require TSIG. Authentication of the transfer operation is separate from publishing ordinary authoritative answers.

The primary then reloads a changed service address, 127.0.0.3, while retaining serial 10. After the short refresh window, the secondary still answers 127.0.0.2. Raising the serial to 11 and reloading lets the secondary acquire the changed address. The example therefore verifies the divergence and its repair, rather than merely checking that both configuration files mention the same primary.

An IXFR request for changes since serial 10 receives a full AXFR-style response because this primary retains no incremental history for the update. The script identifies the response’s SOA framing. Finally, it stops the primary. The secondary initially continues answering 127.0.0.3, then returns SERVFAIL after its short SOA expiry interval. No host clock or shared network setting is changed to produce that transition.

Validate replication, authorization, and confidentiality separately

NOTIFY can prompt an earlier check, while periodic refresh provides another opportunity to detect a newer serial. Neither makes replication instantaneous. Monitor each authoritative server’s serial and actual answer data, and investigate transfer failures before expiry removes service. When repairing a serial mistake, ensure the secondary receives the intended complete state rather than assuming that any subsequent incremental update will repair arbitrary divergence.

IXFR can save work when a suitable change history exists, but the request type does not guarantee an incremental response. AXFR can span multiple DNS messages over TCP, so complete-transfer verification must respect its protocol boundaries. A partial stream or a single matching record is insufficient evidence that the entire zone arrived and can be served correctly.

TSIG authenticates messages using shared key material and protects integrity; it does not encrypt the zone contents. Protect the key and apply transport confidentiality where the deployment requires it. Keep transfer authorization, successful replication, ordinary query availability, and replica expiry as distinct checks. Together they establish the practical boundary far more clearly than an assumption that transfers only happen between trusted servers.

Sources

RFC 5936 AXFR, full-zone transfer framing and completion, checked 2026-09-12.
RFC 1995 IXFR, incremental requests and full-transfer fallback, checked 2026-09-12.
RFC 1982 serial number arithmetic, 32-bit DNS serial comparisons and wraparound, checked 2026-09-12.
RFC 8945 TSIG, shared-key message authentication and integrity, checked 2026-09-12.
BIND 9.18.49 reference, transfer ACLs, notification, and secondary refresh controls, checked 2026-09-12.

Infrastructure as code is a changelog, not magic

Fri, 13 Nov 2026 00:00:00 +0000

Declarative infrastructure describes a desired result and lets a tool calculate changes. An imperative script can also inspect existing resources and behave idempotently; duplication is not inherent to scripting. Terraform’s advantage is a shared model of configuration, resource identities, dependencies, and proposed actions that reviewers can inspect together.

Review configuration and proposed operations together: changing an address can alter identity, while unchanged files can still produce a plan after external changes.

Plan is a proposal, not a transaction

A normal plan reads managed objects through providers and compares the refreshed view with configuration. It proposes creation, updates, replacement, or deletion. Unknown values, provider behavior, permissions, and changes between planning and applying mean it cannot guarantee success or describe every eventual API call.

Saving a plan lets you apply the reviewed proposal instead of automatically calculating another. It does not freeze the remote system. A stale state can invalidate the saved plan, and an apply can fail partway through. Protect saved plans and state as sensitive artifacts rather than posting their complete contents in public logs.

After a successful apply, an unchanged, stable configuration should normally produce no further changes. Persistent differences deserve investigation: external controllers, computed attributes, provider bugs, and changing inputs can defeat that expectation. A clean plan is evidence about managed observations, not a complete inventory of the account.

State preserves identity

State binds configuration addresses to remote objects and retains other information Terraform needs. Losing that mapping does not immediately delete the objects. A later plan may propose new resources; whether applying creates duplicates or encounters name conflicts depends on the provider and service.

First investigate backend versions and recoverable snapshots. When restoration is inappropriate or unavailable, import can associate supported existing objects with configuration addresses. Both the CLI workflow and configuration-driven import exist; this is not necessarily a sequence of manual commands. Reconcile the resource configuration and review the resulting plan before making changes.

Shared state needs access control, recoverable history, and a backend with appropriate locking support. Not every backend locks. A lock acquisition failure stops the operation; waiting depends on command options such as the lock timeout. Avoid disabling locking to work around another legitimate run, and never interpret state version history alone as a complete infrastructure audit trail.

Drift and refactoring are different decisions

For an already tracked resource changed outside Terraform, decide whether to keep the new value or restore the configured one. Keeping it generally means updating configuration; ordinary attribute drift does not require import. A refresh-only apply updates Terraform’s records without reconciling remote objects to configuration. It does not edit configuration, so a later normal plan can still propose reversal.

Ignored attributes and provider schemas affect which differences produce actions. The console change may have its own audit logs; the operational failure is often that nobody linked the emergency action to the next deployment.

Renaming an address without recording the relationship can produce a destroy/create proposal. A moved block documents that relationship, including supported moves into modules, so a compatible refactor need not recreate the object. Other configuration changes can still require replacement. Removing a resource block generally proposes destruction unless you explicitly use an appropriate removal workflow.

When it breaks

During an incident, somebody enlarges an instance and forgets to update configuration. An unrelated apply later proposes to shrink it. Require review of the relevant actions and record the intended lasting value. Exit code 2 means a nonempty plan, not specifically drift, danger, or failure.

For an unexpected destroy, compare old and new addresses before approving anything. For apparently missing resources, verify the selected backend and workspace before assuming state was lost. Stop concurrent writers during recovery; a plausible-looking empty state is not permission to recreate the estate.

Terraform address identity: mechanism and evidence boundaries.

Check it quickly

With Terraform 1.4 or newer, use a fresh lab and reviewed CLI settings; inherited TF_CLI_ARGS, workspace and configuration can alter behavior. Run each command separately and stop on error: this shell block has no fail-fast guard. Its built-in terraform_data changes local state, not cloud infrastructure.

lab=$(mktemp -d)
cd "$lab" || exit 1
cat > main.tf <<'HCL'
resource "terraform_data" "old" { input = "kept" }
HCL
terraform init -input=false
terraform validate
terraform apply -input=false -auto-approve
terraform state show terraform_data.old
cat > main.tf <<'HCL'
resource "terraform_data" "new" { input = "kept" }
HCL
terraform plan
cat >> main.tf <<'HCL'
moved {
 from = terraform_data.old
 to = terraform_data.new
}
HCL
terraform validate
terraform plan -out=moved.tfplan
terraform apply -input=false moved.tfplan
terraform state show terraform_data.new
terraform plan -detailed-exitcode

The retained Terraform 1.13.3 review reports the unrecorded rename as one creation and one deletion; do not apply that intermediate plan. With moved, it reports zero resource actions, the same ID, and final exit 0. This review did not rerun it. A move-only detailed plan can return 2 for an address change.

This fixture exercises local Terraform planning and address migration. It does not test cloud-provider import, remote drift, or backend locking. In general, detailed exit codes mean 0 for no changes, 1 for error, and 2 for changes present; inspect the actions rather than treating 2 as failure.

When finished, use cd - to leave the lab, then remove only the generated directory named by $lab; it contains disposable configuration, plans, and state.

Sources

Terraform: state, address bindings and state requirements, checked 2026-10-15.
Terraform: plan command, planning modes, saved plans, lock options, and exit codes, checked 2026-10-15.
Terraform: remote state, shared storage and backend capabilities, checked 2026-10-15.
Terraform: state locking, backend support and lock failures, checked 2026-10-15.
Terraform: refactor modules, explicit moved mappings and compatible refactors, checked 2026-10-15.
Terraform: import overview, configuration-driven adoption of existing resources, checked 2026-10-15.
Terraform: CLI import, the alternative CLI import workflow, checked 2026-10-15.
Terraform: manage resource drift, refreshed observations and configuration reconciliation, checked 2026-10-15.
Terraform: lifecycle, ignored attributes and removal consequences, checked 2026-10-15.
Terraform: terraform_data, the built-in local lifecycle resource used by the exercise, checked 2026-10-15.
Terraform: apply command, applying saved plans and partial failures, checked 2026-10-15.
Terraform CLI environment variables, inherited CLI arguments, workspace and configuration, checked 2026-10-18.