Following the recent acquisition of a new business, your manager asks you to investigate their DNS service and report back on its status. He is concerned as they only have one DNS server in the organi

Reviewing firewall logs and blocking port 53 inbound would break DNS resolution for external clients; DNS must remain accessible on port 53 for the service to function.

Zone transfer (AXFR) allows a full copy of a DNS zone to be downloaded, and leaving it unrestricted on a public-facing server lets any attacker enumerate all hostnames, IP addresses, and services in the organization. Disabling zone transfers to untrusted hosts closes this reconnaissance vector immediately, and proposing a split-horizon DNS design with a hidden primary and public secondary addresses the single-point-of-failure and exposure concerns raised by having only one Internet-visible DNS server.

Using nslookup to manually transfer zone records is itself the attack vector being protected against; initiating a zone transfer does not secure the server.

Removing the only DNS server without a replacement plan would cause an immediate service outage and does not address the underlying security architecture problem.