What is AXFR?

AXFR (authoritative zone transfer) is how a secondary DNS server copies an entire zone from its primary, over TCP, so both serve identical records.

The secondary connects to the primary on TCP port 53 and sends a query of type AXFR for the zone. The primary streams back every record in the zone, starting and ending with the zone's SOA record, which tells the secondary the transfer is complete. AXFR is defined in RFC 5936. IXFR (incremental zone transfer, RFC 1995) is the lighter alternative: the secondary sends the serial it already holds, and the primary replies with only the records added and removed since then, or falls back to a full transfer if it doesn't have the history. Either way, a secondary only asks for a transfer when the primary's SOA serial is higher than its own. It checks on its SOA refresh timer, or immediately when the primary sends a NOTIFY.

A zone transfer hands over the whole zone, every hostname and address in it, so primaries should allow it only to their own secondaries. PowerDNS refuses AXFR by default: until the secondary's address is listed in allow-axfr-ips, the primary logs "client IP has no permission" and the secondary reports "Not Authorized". On top of an address list, TSIG keys can authenticate transfers. Other common problems are a firewall that permits UDP 53 but blocks TCP 53, which breaks transfers while ordinary queries keep working, and forgetting to raise the serial, so the secondaries never fetch the change. In the PowerDNS on Debian lesson, a secondary's first transfer is refused and then fixed.