Zone transfers are not open to the world

AXFR is the zone transfer protocol: it asks a nameserver for the entire contents of a zone in one response. It exists so secondaries can replicate from a primary, and it is meant to be restricted to those secondaries.

A server that will transfer to anybody hands over the complete list of names in the zone. That is a reconnaissance gift — every hostname you have, including the ones you assumed were private because nobody links to them: vpn, staging, jenkins, backup-old, the admin interface on an obscure name. DNS offers no way to enumerate names, and open AXFR removes that protection in a single query.

Nothing in the zone is *secret* in a cryptographic sense — each name is discoverable individually if guessed. The exposure is that guessing is no longer necessary.

Restrict transfers to the addresses of your secondaries. allow-transfer in BIND, and the equivalent in every other implementation; the default in most modern software is already to refuse, so an open one usually means it was opened deliberately at some point.

Better, authenticate them with TSIG rather than by address alone, so a transfer requires a shared key and not merely the right source address.

Check every authoritative server, not just the primary. Secondaries are frequently configured from a different template and are where an open transfer tends to survive.