Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a non domain joined authoritative dns server for a zone, I've disabled dns recursion in server settings. When i do a query with dig @ns1.mydomain.tld . it returns the root hints.

I've read that its possible to create a new primary zone named "." that will act as root zone. However this still returns the host name of my box and some incomplete soa information.

From my understanding returning root hints could be used for dns amplification attacks. Whats the best practice to handle this ?

share|improve this question
up vote 0 down vote accepted

Sadly, you can't disable the root hints with the Windows DNS server. This does leave your machine vulnerable to be abused for DNS reflection attacks, however most attackers look for actual recursive DNS servers.

Long term, you'd probably want to move to different DNS server software to fix this.

share|improve this answer
Found a semi good solution myself. You can pause the . zone. Sadly this does not survive a reboot. I would like to leave this thread open because there must be someone out there using windows server to serve his zones and maybe has another fix, or doesn't care :) – mt7 Mar 25 '14 at 9:04

You can try to remove all the root hint servers on the Root Hints tab, then it will return Server failed for recursive requests.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.