Last Modified: Jul 03, 2026
Affected Product(s):
BIG-IP DNS
Known Affected Versions:
16.1.6.1, 17.1.3.2, 17.5.1.6
Opened: May 19, 2026 Severity: 3-Major
- DNS Express logs indicate that it will attempt an AXFR after receiving a NOTIMPL response to an IXFR request, but it does not actually initiate the AXFR. - DNS Express repeatedly retries IXFR requests instead of falling back to AXFR. - The affected DNS zone remains stale and is not updated from the primary server. - Administrators may be misled by log messages stating AXFR will be attempted.
- DNS Express fails to update its zone data, serving stale DNS records to clients. - Manual intervention is required to update the zone data.
- BIG-IP DNS Express is configured as a secondary server for a DNS zone. - The upstream (primary) DNS server supports only AXFR and returns NOTIMPL (RCODE 4) in response to IXFR requests (e.g., NSD 4.3.8). - A zone update occurs on the primary server, causing the secondary to initiate an IXFR.
Manually disable and re-enable the affected DNS zone on BIG-IP DNS Express to force a full AXFR and update the zone data: tmsh modify ltm dns zone <zone-name> enabled false tmsh modify ltm dns zone <zone-name> enabled true
None