debian.org DNSs allow unrestricted zone transfers

["Abel Martín" <abel.martin.ruiz@gmail.com>]

Hi,

I thought zone transfers should only be possible between DNSs which
have records for the same domain, so why are debian.org DNSs (raff,
rietz, klecker) allowing zone transfers? Maybe I'm paranoid, but I
think there are security issues related to this, including the
possibility of suffering DoS attacks (it serves 254 records). Is there
an explanation for this?

You can check this with:
dig -t axfr debian.org @raff.debian.org

Regards,
Abel