"Open DNS Server" questions

[Stephen Hedberg]

Hello all,

www.dnsreport.com reports my internet facing DNS server is an "Open DNS Server".
"ERROR: One or more of your nameservers reports that it is an open DNS server. This usually means that anyone in the world can query it for domains it is not authoritative for (it is possible that the DNS server advertises that it does recursive lookups when it does not, but that shouldn't happen). This can cause an excessive load on your DNS server. Also, it is strongly discouraged to have a DNS server be both authoritative for your domain and be recursive (even if it is not open), due to the potential for cache poisoning (with no recursion, there is no cache, and it is impossible to poison it). Also, the bad guys could use your DNS server as part of an attack, by forging their IP address. Problem record(s) are:
Server 65.121.44.78 reports that it will do recursive lookups. [test] "

It indicates that this is a possible security risk.
I am running Bind 9.2.0 on HPUX 11.11
I added the "recursion no;" option to the /etc/named.conf however after I did that, many dns queries began to fail .. ie www.candy.com resolved before, and came back as unknown after I made the change.

Any ideas/suggestions?

thanks!

Steve

[Steven E. Protter]

Shalom Steve,

Same first name, we went down the same road.

recursion no prevents foreign lookups from being done on your DNS servers. What the concern is is that a DNS server supporting a website can be taken down with a denial of service attack that simply looks up lots and lots of names on the DNS server.

So, if your DNS server is not supporting external web servers, take the comment out of named.conf, restart named and leave it alone. The chances of a DOS attack causing any issues is low.

If you DNS server is supporting an external web server then I recommend splitting its functionality into two boxes. The important box that supports website services has recursion set to no.

The box that supports your web browsing, mail inbound and such can't have the option set and work properly.

I had the exact same thing happen to me a few months back except it was a combined DNS inbound mail server that lost its ability to look up foreign sites and accept mail the moment we made the change.

SEP

[Kevin Wright]

resolvers on pc's and workstations are 'stub' resolvers, which cannot follow referrals. When recursion is set to no, the dns server refers the client to the root dns servers, which they cannot follow, therefore fail.