This article highlights how open DNS resolvers are being used to create DDOS attacks across the internet. How can I identify whether any of our DNS servers are open? If I find that we are running open DNS servers, how would I close them to prevent them being abused for DDOS attacks?

  • The "how do I close an open DNS server" question is probably better suited to ServerFault than to this site -- and you should specify the version of the DNS software that you are working with (but first read the manual). – D.W. Nov 13 '12 at 6:21
  • Identify an Open DNS server by your own querying via NMAP:

x.x.x.x = DNS server IP

nmap -sU -p 53 -sV -P0 --script "dns-recursion" x.x.x.x

Possible output would be:

53/udp open domain ISC BIND "version"
*|_dns-recursion: Recursion appears to be enabled*

  • Online services:

If you prefer make use of online services, openresolver project is very good, it checks also subnets of /22 width, so check it out ---> http://www.openresolverproject.org

After an Open DNS server discovery with online tools is a good idea to do a double check getting a proof about recursion ---> http://www.kloth.net/services/dig.php

Example output, watch the "ra" flag means recursion available:
; <<>> DiG 9.7.3 <<>> @x.x.x.x domain.cn A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: xxx
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 5, ADDITIONAL: 0

(source knowledgelayer softlayer com)

Disable Recursion in Windows Server 2003 and 2008

Access the DNS Manager from the Start menu:
    Click the Start button.
    Select Administrative Tools.
    Select DNS.
Right click on the desired DNS Server in the Console Tree.
Select the Proprerties tab.
Click the Advanced button in the Server Options section.
Select the Disable Recursion checkbox.
Click the OK button.

Disable Recursion in Linux

Locate the BIND configuration file within the operating system. The BIND configuration file is usually located in one of the following paths:
Open the named.conf file in your preferred editor.
Add the following details to the Options section:
allow-transfer {"none";};
allow-recursion {"none";};
recursion no;
Restart the device.
| improve this answer | |

An Open DNS server is one that answers DNS requests from anyone for anything. As a general rule, the DNS servers you run should only respond to the requests you want them to.

In a typical organisation, for example, you want machines inside your network, such as your laptop to be able to resolve anything, and machine outside your network to only be able to resolve your public facing services, such as your web server and inbound mail. Of course, your organisation might not be typical.

To identify if your DNS servers are responding to requests you don't want them to, make such requests and see what happens! Using a machine outside your network, point a copy of dig at your resolvers, and try querying things.

To secure your DNS servers, consult the documentation for your particular brand of DNS server, and configure them to do what you want.

| improve this answer | |

There are a few sites out there that scan the internet for open DNS resolvers and publish lists of them to help ISP's detect and shut down the resolvers. Here is one, you can use it to search for ip's whithin your network that are open resolvers:

As for secureing them it's fairly simple - just restrict the dns resolvers to only allow queries from inside your network. Either configure the dns to only reply queries from addresses that are inside your network, or use firewall/packet filter rules to restrict access to port 53.

Team Cymru has a guide here: http://www.team-cymru.org/Services/Resolvers/instructions.html

Just make sure you don't filter out your authoritative nameservers, the internet needs to reach those for your domains to work!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.