{"record":{"id":"e38c402779481ab8","repo":"TechnitiumSoftware/DnsServer","slug":"invalid-ixfr-axfr-response-was-received","errorCode":null,"errorMessage":"Invalid IXFR/AXFR response was received.","messagePattern":"Invalid IXFR/AXFR response was received\\.","errorType":"exception","errorClass":"DnsServerException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs","lineNumber":2688,"sourceCode":"\n                if (zone.Name.Equals(zoneName, StringComparison.OrdinalIgnoreCase))\n                    zone.SyncRecords(latestEntries.Value);\n                else if ((zone is SubDomainZone subDomainZone) && subDomainZone.AuthoritativeZone.Name.Equals(zoneName, StringComparison.OrdinalIgnoreCase))\n                    zone.SyncRecords(latestEntries.Value);\n            }\n\n            if (!_root.TryGet(zoneName, out ApexZone apexZone))\n                throw new InvalidOperationException();\n\n            apexZone.UpdateDnssecStatus();\n\n            SaveZoneFile(apexZone.Name);\n        }\n\n        public IReadOnlyList<DnsResourceRecord> SyncIncrementalZoneTransferRecords(string zoneName, IReadOnlyList<DnsResourceRecord> xfrRecords)\n        {\n            if ((xfrRecords.Count < 2) || (xfrRecords[0].Type != DnsResourceRecordType.SOA) || !xfrRecords[0].Name.Equals(zoneName, StringComparison.OrdinalIgnoreCase) || !xfrRecords[xfrRecords.Count - 1].Equals(xfrRecords[0]))\n                throw new DnsServerException(\"Invalid IXFR/AXFR response was received.\");\n\n            if ((xfrRecords.Count < 4) || (xfrRecords[1].Type != DnsResourceRecordType.SOA))\n            {\n                //received AXFR response\n                SyncZoneTransferRecords(zoneName, xfrRecords);\n                return Array.Empty<DnsResourceRecord>();\n            }\n\n            if (!_root.TryGet(zoneName, out ApexZone apexZone))\n                throw new InvalidOperationException(\"No such zone was found: \" + zoneName);\n\n            IReadOnlyList<DnsResourceRecord> soaRecords = apexZone.GetRecords(DnsResourceRecordType.SOA);\n            if (soaRecords.Count != 1)\n                throw new InvalidOperationException(\"No authoritative zone was found: \" + zoneName);\n\n            //process IXFR response\n            DnsResourceRecord currentSoaRecord = soaRecords[0];\n            DnsSOARecordData currentSoa = currentSoaRecord.RDATA as DnsSOARecordData;","sourceCodeStart":2670,"sourceCodeEnd":2706,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs#L2670-L2706","documentation":"Thrown by SyncIncrementalZoneTransferRecords when the received IXFR/AXFR response fails the same structural validation as SyncZoneTransferRecords: fewer than 2 records, first record not SOA, name mismatch, or start/end SOA not equal. This is the entry point for processing incoming incremental transfer data; it validates the envelope before deciding whether the payload is IXFR or AXFR format.","triggerScenarios":"Calling SyncIncrementalZoneTransferRecords(zoneName, xfrRecords) with a malformed response. If the response has fewer than 4 records or the second record is not SOA, it falls through to SyncZoneTransferRecords (AXFR path). The validation at line 2687 catches the most basic structural problems before that branching logic.","commonSituations":"Remote primary returns a truncated or empty response; TCP connection dropped mid-transfer producing an incomplete record list; primary server sends unexpected record types; zone name mismatch between the transfer request and the received data; incompatible DNS server implementation.","solutions":["Validate xfrRecords.Count >= 2, first is SOA, first.Name matches zoneName, first.Equals(last) before calling SyncIncrementalZoneTransferRecords.","If validation fails, fall back to requesting a full AXFR from the primary.","Check the remote primary server's health and DNS software version compatibility.","Verify network reliability for the TCP connection carrying the transfer."],"exampleFix":"// before\nvar deleted = authZoneManager.SyncIncrementalZoneTransferRecords(zoneName, xfrRecords);\n\n// after\nbool IsValidEnvelope(IReadOnlyList<DnsResourceRecord> records, string zone)\n    => records.Count >= 2\n       && records[0].Type == DnsResourceRecordType.SOA\n       && records[0].Name.Equals(zone, StringComparison.OrdinalIgnoreCase)\n       && records[^1].Equals(records[0]);\n\nif (!IsValidEnvelope(xfrRecords, zoneName))\n{\n    _logger.LogWarning(\"Malformed IXFR/AXFR for '{Zone}'; falling back to full AXFR.\", zoneName);\n    xfrRecords = await dnsClient.QueryZoneTransferAsync(zoneName);\n    authZoneManager.SyncZoneTransferRecords(zoneName, xfrRecords);\n    return Array.Empty<DnsResourceRecord>();\n}\nvar deleted = authZoneManager.SyncIncrementalZoneTransferRecords(zoneName, xfrRecords);","handlingStrategy":"validation","validationCode":"static bool IsValidXfrResponse(string zoneName, IReadOnlyList<DnsResourceRecord> xfrRecords)\n{\n    return xfrRecords.Count >= 2\n        && xfrRecords[0].Type == DnsResourceRecordType.SOA\n        && xfrRecords[0].Name.Equals(zoneName, StringComparison.OrdinalIgnoreCase)\n        && xfrRecords[^1].Equals(xfrRecords[0]);\n}\n\nif (!IsValidXfrResponse(zoneName, xfrRecords))\n    throw new InvalidOperationException(\"Invalid IXFR/AXFR response structure.\");","typeGuard":"static bool IsValidXfrEnvelope(IReadOnlyList<DnsResourceRecord> records, string zoneName)\n    => records.Count >= 2\n       && records[0].Type == DnsResourceRecordType.SOA\n       && records[0].Name.Equals(zoneName, StringComparison.OrdinalIgnoreCase)\n       && records[^1].Equals(records[0]);","tryCatchPattern":"try\n{\n    var deleted = authZoneManager.SyncIncrementalZoneTransferRecords(zoneName, xfrRecords);\n}\ncatch (DnsServerException ex) when (ex.Message.Contains(\"Invalid IXFR/AXFR response\"))\n{\n    logger.LogWarning(\"IXFR/AXFR sync failed for '{Zone}'; falling back to full AXFR.\", zoneName);\n    xfrRecords = await dnsClient.QueryZoneTransferAsync(zoneName);\n    authZoneManager.SyncZoneTransferRecords(zoneName, xfrRecords);\n}","preventionTips":["Validate the transfer envelope before calling SyncIncrementalZoneTransferRecords.","Fall back to full AXFR (SyncZoneTransferRecords) when the IXFR response is malformed.","Check remote primary server health and DNS implementation compatibility.","Ensure TCP connection reliability for zone transfer streams."],"tags":["zone-transfer","ixfr","axfr","zone-management","validation","network"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}