DNS Incremental Zone Transfer Request

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects a DNS incremental zone transfer request. This type of request is used to synchronize DNS zone data between DNS servers. While legitimate in some network configurations, it can also be abused by attackers during reconnaissance to gather information about a network's internal structure.