This article highlights how open DNS resolvers are being used to create DDOS attacks across the internet. How can I identify whether any of our DNS servers are open? If I find that we are running open DNS servers, how would I close them to prevent them being abused for DDOS attacks?
x.x.x.x = DNS server IP
nmap -sU -p 53 -sV -P0 --script "dns-recursion" x.x.x.x
Possible output would be:
PORT STATE SERVICE VERSION
If you prefer make use of online services, openresolver project is very good, it checks also subnets of /22 width, so check it out ---> http://www.openresolverproject.org
After an Open DNS server discovery with online tools is a good idea to do a double check getting a proof about recursion ---> http://www.kloth.net/services/dig.php
Example output, watch the "ra" flag means recursion available:
Disable Recursion in Windows Server 2003 and 2008
Disable Recursion in Linux
An Open DNS server is one that answers DNS requests from anyone for anything. As a general rule, the DNS servers you run should only respond to the requests you want them to.
In a typical organisation, for example, you want machines inside your network, such as your laptop to be able to resolve anything, and machine outside your network to only be able to resolve your public facing services, such as your web server and inbound mail. Of course, your organisation might not be typical.
To identify if your DNS servers are responding to requests you don't want them to, make such requests and see what happens! Using a machine outside your network, point a copy of dig at your resolvers, and try querying things.
To secure your DNS servers, consult the documentation for your particular brand of DNS server, and configure them to do what you want.
There are a few sites out there that scan the internet for open DNS resolvers and publish lists of them to help ISP's detect and shut down the resolvers. Here is one, you can use it to search for ip's whithin your network that are open resolvers:
As for secureing them it's fairly simple - just restrict the dns resolvers to only allow queries from inside your network. Either configure the dns to only reply queries from addresses that are inside your network, or use firewall/packet filter rules to restrict access to port 53.
Team Cymru has a guide here: http://www.team-cymru.org/Services/Resolvers/instructions.html
Just make sure you don't filter out your authoritative nameservers, the internet needs to reach those for your domains to work!