Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
[~]# /usr/bin/dig +recurs @MYIP

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.5 <<>> +recurs @MYIP
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 31758
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;              IN      A

;; Query time: 24 msec
;; WHEN: Tue Apr  2 22:39:24 2013
;; MSG SIZE  rcvd: 34


options {
    /* make named use port 53 for the source of all queries, to allow
         * firewalls to block all ports except 53:

    // query-source    port 53;

    /* We no longer enable this by default as the dns posion exploit
        has forced many providers to open up their firewalls a bit */

    // Put files that named is allowed to write in the data/ directory:
    directory                "/var/named"; // the default
    pid-file                 "/var/run/named/";
    dump-file                "data/cache_dump.db";
    statistics-file          "data/named_stats.txt";
   /* memstatistics-file     "data/named_mem_stats.txt"; */
    allow-transfer {"none";};
    recursion no;

Does this mean I am protected from DNS based attacks? And attacks like reflector?

share|improve this question… – Sirex Apr 3 '13 at 2:44

You put your question wrong. Proper put wording would be like "Is my DNS server configured correctly to not amplify DNS-reflector attack?". — That's because it's important to realize that attackers don't attack DNS-servers, they abuse them to attack chosen victim, when we deal with DNS-reflector/amplifier kind of abuse, of course (and yes, victim still can be a host running DNS, but that's kinda irrelevant).

So, if your question was merely this, you can run tcpdump and compare DNS request and response sizes, but yes, since you've disabled recursion, it means that your server won't send any data not related to its own zones. But, in case zones it hosts have some very lengthy records, as you probably understand, it still work as amplifier (by definition) responding to spoofed short answers. Although, it would be a bit more difficult for attackers to use it in this way, comparing to open-recursive servers, it's still possible.

The only proper way to mitigate those kind of attacks is imposing of anti-spoof protection at all possible levels, starting from distribution one. For lone DNS server it's too late, in general — usually it doesn't have any way to find out whether it's responding to spoofed IP source or not.

UPD.: Actually, you can look into an IETF-memo on this subject:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.