If you don't specifically configure a DNS server to only accept zone transfer requests from designated sources, anyone on the Internet with the proper tools can transfer a complete copy of your DNS zone database to his or her system.
Malicious users typically accomplish this using the NSLOOKUP utility and the ls -d command. In addition, a hacker could possibly configure a DNS server to act as a secondary name server for the zone and transfer the database in that fashion.
To lock down your network, it's a best practice to configure your DNS server to accept zone transfer requests only from selected IP addresses.
Follow these steps:
The DNS server will now reject zone transfer requests from any sources other than those listed. You can add IP addresses to this list even if they're not for Microsoft DNS servers without causing errors.