diff --git a/dashcaddy-api/__tests__/dns/dns-provider-parity.test.js b/dashcaddy-api/__tests__/dns/dns-provider-parity.test.js
index acb51c2..6970f31 100644
--- a/dashcaddy-api/__tests__/dns/dns-provider-parity.test.js
+++ b/dashcaddy-api/__tests__/dns/dns-provider-parity.test.js
@@ -183,8 +183,9 @@ describe('RFC2136 listRecords via AXFR (BIND 9 parity, DC-171)', () => {
     const [, args] = execFile.mock.calls[0];
     expect(args[0]).toBe('@192.0.2.10');
     expect(args.slice(1, 3)).toEqual(['-p', '53']);
-    expect(args[3]).toBe('AXFR');
-    expect(args[4]).toBe('other.example.com.');
+    // dig's documented positional contract: [name] [type] — zone before AXFR
+    expect(args[3]).toBe('other.example.com.');
+    expect(args[4]).toBe('AXFR');
     expect(args.slice(5)).toContain('+onesoa');
     const kIdx = args.indexOf('-k');
     expect(kIdx).toBeGreaterThan(-1);
diff --git a/dashcaddy-api/src/dns/dns-providers/rfc2136.js b/dashcaddy-api/src/dns/dns-providers/rfc2136.js
index 3f1ccc2..39bf823 100644
--- a/dashcaddy-api/src/dns/dns-providers/rfc2136.js
+++ b/dashcaddy-api/src/dns/dns-providers/rfc2136.js
@@ -337,10 +337,13 @@ class RFC2136Provider extends BaseDNSProvider {
     if (!effectiveZone) throw new Error('Missing required config: zone');
     const fqdnZone = this._ensureFqdn(effectiveZone);
 
+    // dig positional contract is `dig [@server] [name] [type]` — zone name
+    // FIRST, then the AXFR request type (BIND 9.18 happens to accept either
+    // order, but 9.11-9.16 on older distros follow the documented order).
     const args = [
       `@${this.server}`,
       '-p', String(this.port),
-      'AXFR', fqdnZone,
+      fqdnZone, 'AXFR',
       '+nocomments', '+onesoa', '+nostats',
       '+time=10', '+tries=1',
     ];