How can I identify open DNS resolvers in my network?

Question

This article highlights how open DNS resolvers are being used to create DDOS attacks across the internet. How can I identify whether any of our DNS servers are open? If I find that we are running open DNS servers, how would I close them to prevent them being abused for DDOS attacks?

Answer 1

There are a few sites out there that scan the internet for open DNS resolvers and publish lists of them to help ISP's detect and shut down the resolvers. Here is one, you can use it to search for ip's whithin your network that are open resolvers:

• http://dns.measurement-factory.com/surveys/openresolvers.html

As for secureing them it's fairly simple - just restrict the dns resolvers to only allow queries from inside your network. Either configure the dns to only reply queries from addresses that are inside your network, or use firewall/packet filter rules to restrict access to port 53.

Team Cymru has a guide here: http://www.team-cymru.org/Services/Resolvers/instructions.html

Just make sure you don't filter out your authoritative nameservers, the internet needs to reach those for your domains to work!

Answer 2

An Open DNS server is one that answers DNS requests from anyone for anything. As a general rule, the DNS servers you run should only respond to the requests you want them to.

In a typical organisation, for example, you want machines inside your network, such as your laptop to be able to resolve anything, and machine outside your network to only be able to resolve your public facing services, such as your web server and inbound mail. Of course, your organisation might not be typical.

To identify if your DNS servers are responding to requests you don't want them to, make such requests and see what happens! Using a machine outside your network, point a copy of dig at your resolvers, and try querying things.

To secure your DNS servers, consult the documentation for your particular brand of DNS server, and configure them to do what you want.