MS DNS server - Is zone transfer really enabled on Cache and how to disable?

Question

I was reviewing the configuration of my Microsoft DNS server by executing dnscmd localhost /exportsettings and then going through the C:\Windows\system32\dns\DnsSettings.txt file. As I understood the SecureSecondaries displays the the zonetransfer settings. If it is set to 0 (meaning "Disable secondary security. Send zone transfers to all secondary servers that request them."), it is a security risk as discussed here (it can reveal sensitive information about the network topology).

However in the DnsSettings.txt file SecureSecondaries is set to 0 for the Cache zone:

[Zones]

Cache=Cache,AD-integrated
*removed*


[Cache]

Type=Cache
Store=AD-integrated
AllowUpdate=0
ZoneDN=DC=RootDNSServers,cn=MicrosoftDNS,DC=*removed*
DirectoryPartition=*removed*
SecureSecondaries=0
Secondaries=NULL
NotifyList=NULL

However I can not find where it can be disabled in the DNS Manager application, and the command given by Microsoft: dnscmd localhost /ZoneResetSecondaries Cache /NoXfr returns Command failed: DNS_ERROR_ZONE_DOES_NOT_EXIST 9601 0x2581.

Is DNS zone transfer really enabled for the Cache zone, or as Cache is not a master zone it can not be enabled at all? If it is enabled, how can I disable it?

Answer 1

The Cache is not a zone. It's merely a placeholder for the current list of DNS root servers. Hence the error you see... dnscmd can't find a zone called "cache". It's real name is "." but is still not a real zone just a special boot-strapping construct. So secondary settings don't matter.