Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Windows 2003 server hosting box. It runs DNS for the domains we host and needs to do lookups to find remote domain IPs. This means the server can be used as a DNS by anyone who wants to access it.

How can I lock it down so only the local machine can do the wildcard lookup, and remote users only access the DNS of the domains we're hosting without stopping the server side apps being able to access what ever it needs to?


share|improve this question
up vote 5 down vote accepted

The DNS server is also a DNS client (but not neccessarily it's own DNS client).

To disable the DNS server component from performimng recursion for other DNS clients you need to disable recursion on the Advanced tab of the server's properties in the DNS management console.

To allow the DNS client component to resolve queries for itself, you can configure external DNS servers on the TCP\IP properties of the network card.

The DNS server and DNS client components are separate and unrelated components. The DNS client would exist even if the server were not a DNS server and the DNS client works the same as it would on any other Windows computer. This can be a tricky concept to grasp but just remember that one does not rely on the other and that the DNS server (if it's only a DNS server and not an AD server) does not need to use itself for DNS resolution.

share|improve this answer
I didn't actually bother to READ the poster's question, eh? I, incorrectly, saw him as wanting to provide both recursive resolution to clients and to host authoritative domains. Had I bothered to read... >smile< +1 for your answer, BTW. – Evan Anderson Jul 31 '10 at 21:57
@Evan: Reading is so over-rated. ;) Thanks for the +1. – joeqwerty Jul 31 '10 at 21:59
Thanks, I disabled recursive DNS on the server and set the LAN port and all client apps to use the DNS reserver of our datacentre. – Guppy Aug 1 '10 at 6:59

If you use Simple DNS Plus as your DNS server, you can restrict recursion by sender IP address. This way you don't need two different DNS servers.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.