We have a network with a router and an internal DNS on a Windows Server 2019. The DNS is visible to the outside via a NAT on the router (UDP 53 -> Server IP, this is required because we're a hidden-primary/authority DNS for our domain).

For some time we're receiving malicious DNS requests as part of an amplificiation attack.

We're using Response Rate Limiting as per this article using the Set-DNSServerresponseratelimiting command ... so far so good.

Now, the same article and also another article describe a method how recursion can be limited to the internal clients only.

Essentially both articles say you turn off recursion and then add a rule that allows it for clients that match a certain criteria.

The first step is to turn recursion off:

Set-DnsServerRecursionScope -Name . -EnableRecursion $false  /* or $true */

I'm testing this with a Mac with an IP of and using a dig command like dig -4 @server some.obscuredomain.com and checking if the dig command prints a warning that recursion is disabled. This works depending on the general setting. If I turn this on or off with the above command, the dig command shows (or not shows) the warning about the recursion accordingly. So far so good also.

The full command sequence for disabling it and adding an exception is this:

Add-DnsServerClientSubnet -Name "Internal-24" -IPv4Subnet "" -PassThru
Set-DnsServerRecursionScope -Name . -EnableRecursion $False
Add-DnsServerRecursionScope -Name "InternalClients" -EnableRecursion $True
Add-DnsServerQueryResolutionPolicy -Name "AllowInternal" -Action ALLOW -ApplyOnRecursion -RecursionScope "InternalClients" -ClientSubnet "EQ,Internal-24"

However, I use this sequence of commands, no matter what I do, I can not get it to be allowed to be recursive for the Mac.

I thought I may have the subnet wrong, but then for a test I just used "NE,Internal-24", thinking that either of the two clauses should match the request (either it EQ or NE should match those requests, you're on a subnet or your're not). I also tried -Computername or -Fqdn. Apparently nothing makes a difference.

Any ideas?

  • This is really where going with a Linux/Bind zone with the minimal subset of records is the way to go. That's makes it more difficult to expose juicy internal AD zones to the Internet.
    – Greg Askew
    Feb 12 at 11:47
  • @GregAskew Using a Windows Server wasn't the smartest idea, but it was made many years prior so we're kind of stuck with it because a shit-ton of stuff has now grown on it. And besides, if that method from the articles would work as advertised, I'd find it kind of okay (even though want to puke every time I come across the word 'policy' in a windows server context). Feb 12 at 16:15

2 Answers 2


I think your commands are actually working.

I tried this here first with a Windows client and used clear-dnsservercache on the server after each test with those commands.

It seems that a Windows client does or does not get an answer as expected (e.g. can or can't resolve a ping to a name), depending on the Add-DnsServerQueryResolutionPolicy command and parameters.

A macOS client did the same (got his the actual answers for IP addresses in a dig or could resolve for a ping command). However, the recursion-warning in the dig seems to be incorrect, which I guess is only a cosmetic problem.

  • Cool finding ... and thanks for the effort of actually trying this. Feb 15 at 11:34

I would see if I can put something like a cloudflare dns firewall in front of your dns server. Cloudflare DNS Firewall proxies all DNS queries to your nameservers through Cloudflare’s global network. This action protects upstream nameservers from DDoS attacks and reduces load by caching DNS responses.


I found a example on the docs.microsoft.com to allow recursion for internal clients

PS C:\> Add-DnsServerRecursionScope -Name "InternalClients" -EnableRecursion $True
PS C:\> Set-DnsServerRecursionScope -Name . -EnableRecursion $False 
PS C:\> Add-DnsServerQueryResolutionPolicy -Name "SplitBrainPolicy" -Action ALLOW -ApplyOnRecursion -RecursionScope "InternalClients" -ServerInterfaceIP  "EQ," -PassThru

The first command creates a recursion scope called InternalClients. Recursion is enabled for this scope.

The second command modifies the default recursion scope by using the Set-DnsServerRecursionScope cmdlet. The default scope, identified by a dot (.), has recursion disabled.

The final command creates a policy that uses the InternalClients scope. For that scope, on the specified server interface address, the policy allows recursion.


When you want to use -ClientSubnet, you first need to add the subnet using Add-DnsServerClientSubnet -Name "InternetNaLSubnet" -IPv4Subnet -PassThru

And then you can use

-ClientSubnet "EQ,InternetNaLSubnet"
  • Thanks for the suggestion with cloud flare. Regarding the MSFT example, you see that I have those four commands you suggested in my example and I'm saying that apparently they don't work. Feb 13 at 8:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .