Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a windows 2008 server, which run a dns server for webs sites run on this server. I have report that our server used for an DNS Amplification Attack. in logs I see many queries bout How can setup my windows dns server to only response to query about local sites? I remove all root hints, and forwards, but still it received and response to query about

share|improve this question

migrated from Jul 23 '13 at 19:10

This question came from our site for pro webmasters.

you need to disable recursion – ALex_hha Jul 23 '13 at 19:14
You can safely restore your forwarders and root hints (and in fact you should probably do so). For the future: Flailing around in a panic hoping to make a problem go away is NOT the way to administer a system. Take a deep breath, slow down, research the problem until you understand it, and then proceed logically. – voretaq7 Jul 23 '13 at 19:27
up vote 1 down vote accepted

OK - first things first: Either firewall your server so people outside your organization can't access it, or disable recursion:

  1. Open DNS Manager.
  2. In the console tree, right-click the applicable DNS server, then click Properties.
  3. Click the Advanced tab.
  4. In Server options, select the Disable recursion check box, and then click OK.

(Chris posted a handy picture of the page and the option you want to enable)
Do this now.

Now that you are no longer actively breaking the internet you can read about DNS amplification attacks, how they happen, why they're bad, and some of the things you can do to prevent being a pawn in them.
You may also want to read this Technet article about DNSSEC and DNS Amplification attacks which includes some informative references.

You can then determine how best to prevent your server from being used in such attacks.
Typically you will do this by only answering recursive queries for a known group of hosts (your internal machines), but other options exist as well.

share|improve this answer
I do this setting but still I received many queries for ISC.ORG. – Ashian Jul 23 '13 at 21:00
@Ashian Unless you actively block external access to your DNS server you will continue to receive queries, but your server should refuse them rather than passing them along. Again, please read the resources I linked you to so you understand what a DNS amplification attack is, how it works, and what each mitigation option does. – voretaq7 Jul 23 '13 at 21:16
  • Open the DNS Manager console.
  • Right click the server, select Properties.
  • Advanced tab.
  • Disable Recursion.

enter image description here

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.