Our DNS servers are running on Windows Server 2008 R2, in conjunction with Active Directory. My understanding is that I need recursion on these servers, so that when my clients look up a name my DNS servers will ultimately be able to provide a response. However, the corollary is that my DNS server should not be reachable from the outside, thus preventing them from taking part in an attack like the one recently seen... except perhaps from any internal clients that are acting as zombies. My logs show no increase over the usual trickle of DNS over the time period in question.
However, part of this doesn't seem quite right to me... I'd like to prevent any possibility of compromised computers on my network (we're a small college: there is always a student machine or three that I have limited authority over that is infected with something or other) taking advantage of the situation. I would much rather turn Recursion off if my understanding of of the process is wrong, and merely having a forwarder configured is good enough.