Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In light of recent events (even if it's likely overblown), I thought this was a good opportunity to double-check my DNS Recursion settings.

Our DNS servers are running on Windows Server 2008 R2, in conjunction with Active Directory. My understanding is that I need recursion on these servers, so that when my clients look up a name my DNS servers will ultimately be able to provide a response. However, the corollary is that my DNS server should not be reachable from the outside, thus preventing them from taking part in an attack like the one recently seen... except perhaps from any internal clients that are acting as zombies. My logs show no increase over the usual trickle of DNS over the time period in question.

However, part of this doesn't seem quite right to me... I'd like to prevent any possibility of compromised computers on my network (we're a small college: there is always a student machine or three that I have limited authority over that is infected with something or other) taking advantage of the situation. I would much rather turn Recursion off if my understanding of of the process is wrong, and merely having a forwarder configured is good enough.

share|improve this question
If your DNS server isn't accessible from the outside, my understanding is that you're OK. – ceejayoz Mar 29 '13 at 14:54
Disabling recursion also disables forwarders. If you disable recursion then your internal clients won't have DNS resolution for external DNS. – joeqwerty Mar 29 '13 at 15:06
@joeqwerty that is my current understanding... mainly wanting to just confirm that I'm already doing it right. – Joel Coel Mar 29 '13 at 15:42
Forwarding IS recursion. Recursion done by the DNS server acting as a client. If you disable forwarding, clients do repeated (recursive) requests to your DNS. If you disable recursion, your DNS should REFER to another DNS, and your clients then do DNS requests to that other DNS server. That doesn't solve the public-good problem either: if your clients can use the internet, they can make DNS requests. – user165568 Mar 30 '13 at 9:05
ERROR CORRECTION --if you disable forwarding, your DNS does repeated (recursive) requests -- (If you enable forwarding, your DNS requests upstream recursion) -- – user165568 Mar 30 '13 at 11:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.