Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a non domain joined authoritative dns server for a zone, I've disabled dns recursion in server settings. When i do a query with dig @ns1.mydomain.tld . it returns the root hints.

I've read that its possible to create a new primary zone named "." that will act as root zone. However this still returns the host name of my box and some incomplete soa information.

From my understanding returning root hints could be used for dns amplification attacks. Whats the best practice to handle this ?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Sadly, you can't disable the root hints with the Windows DNS server. This does leave your machine vulnerable to be abused for DNS reflection attacks, however most attackers look for actual recursive DNS servers.

Long term, you'd probably want to move to different DNS server software to fix this.

share|improve this answer
    
Found a semi good solution myself. You can pause the . zone. Sadly this does not survive a reboot. I would like to leave this thread open because there must be someone out there using windows server to serve his zones and maybe has another fix, or doesn't care :) –  mt7 Mar 25 at 9:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.