AXFR Only Outputs in JSON Mode

[knavesec]

dnsx version: 1.2.2

Current Behavior:

Doing AXFR checks against a known-vulnerable example does not result in valid results.

echo "zonetransfer.me" | dnsx -axfr 
echo "zonetransfer.me" | dnsx -axfr --json

The former does not output the results of the zone transfer check, the latter does and must be parsed out of the JSON values.

Expected Behavior:

For non-JSON output, I would expect an output similar to an equivalent dig command below

dig axfr zonetransfer.me @nsztm1.digi.ninja +short

An equivalent would effectively be the command below, but obviously requires more steps

echo "zonetransfer.me" | dnsx -axfr --json | jq -r '.axfr.chain[0].all[]'

Alternatively, just a raw list of records would be nice as well rather than the records and responses similar to hakaxfr.

Steps To Reproduce:

Its unclear if this is intended behavior since there is a very deliberate check to see if JSON is set as the output method before printing results https://github.com/projectdiscovery/dnsx/blob/dev/internal/runner/runner.go#L684

Since the check is fairly explicit not to output if not JSON, it's likely more of a choice than bug, but wanted to raise it nonetheless.

[dogancanbakir]

mentioning @Mzack9999 for review

[bad-antics]

You're right — this is a known limitation. The AXFR output in non-JSON mode doesn't display the transferred records, it only shows the domain name as "vulnerable" without the actual zone data.

Current workaround (as you found):

echo "zonetransfer.me" | dnsx -axfr --json | jq -r '.axfr.chain[0].all[]'

Cleaner one-liner:

echo "zonetransfer.me" | dnsx -axfr -json -silent | jq -r '.axfr.chain[].all[]' 2>/dev/null

For batch processing multiple domains:

cat domains.txt | dnsx -axfr -json -silent | jq -r 'select(.axfr.chain != null) | .host as $h | .axfr.chain[].all[] | $h + " " + .'

Why it works this way: The AXFR response contains dozens/hundreds of records per domain. The plain text output mode was designed for simple single-value responses (A, AAAA, CNAME), not multi-record dumps. JSON is the intended output format for complex responses like AXFR.

This would be a good feature request — having -axfr in plain text mode output at minimum a one-record-per-line format similar to dig +short.