I have a windows 2008 server, which run a dns server for webs sites run on this server. I have report that our server used for an DNS Amplification Attack. in logs I see many queries bout isc.org. How can setup my windows dns server to only response to query about local sites? I remove all root hints, and forwards, but still it received and response to query about isc.org

migrated from webmasters.stackexchange.com Jul 23 '13 at 19:10

This question came from our site for pro webmasters.

  • 3
    you need to disable recursion – ALex_hha Jul 23 '13 at 19:14
  • 4
    You can safely restore your forwarders and root hints (and in fact you should probably do so). For the future: Flailing around in a panic hoping to make a problem go away is NOT the way to administer a system. Take a deep breath, slow down, research the problem until you understand it, and then proceed logically. – voretaq7 Jul 23 '13 at 19:27

OK - first things first: Either firewall your server so people outside your organization can't access it, or disable recursion:

  1. Open DNS Manager.
  2. In the console tree, right-click the applicable DNS server, then click Properties.
  3. Click the Advanced tab.
  4. In Server options, select the Disable recursion check box, and then click OK.

(Chris posted a handy picture of the page and the option you want to enable)
Do this now.

Now that you are no longer actively breaking the internet you can read about DNS amplification attacks, how they happen, why they're bad, and some of the things you can do to prevent being a pawn in them.
You may also want to read this Technet article about DNSSEC and DNS Amplification attacks which includes some informative references.

You can then determine how best to prevent your server from being used in such attacks.
Typically you will do this by only answering recursive queries for a known group of hosts (your internal machines), but other options exist as well.

  • I do this setting but still I received many queries for ISC.ORG. – Ashian Jul 23 '13 at 21:00
  • 1
    @Ashian Unless you actively block external access to your DNS server you will continue to receive queries, but your server should refuse them rather than passing them along. Again, please read the resources I linked you to so you understand what a DNS amplification attack is, how it works, and what each mitigation option does. – voretaq7 Jul 23 '13 at 21:16
  • Open the DNS Manager console.
  • Right click the server, select Properties.
  • Advanced tab.
  • Disable Recursion.

enter image description here


Disabling recursion may not stop attacks on public servers.

The problem is that the query is around 94 bytes and the response (stating it is an NXDOMAIN) is a minimum of 119 bytes so the attack is slightly amplified and almost always coming from a spoofed ip.

You must also have the dot zone (.) with no records in it in order to get the repsponse down to 119 bytes.

The most common of these attacks will ask for freeinfosys.com

None of the above stops the attack itself, but will reduce it's affect.

When the dns server is a public authoritative server, it needs to allow queries from anyone and any where for the zones it carries so you can not limit by p and other steps you can use for private or internal dns servers.

The next version of dns from Microsoft that ships with 2016 will have RRL which will help greatly, too bad they didn't release this much needed functionality that Bind has had for years.

  • What you're referring to initially is a kind of workaround for how MSDNS responds with authority information for the root (.) for queries to unknown zones when recursion is off, while almost all current nameserver software instead responds with a completely empty response with status REFUSED to such queries. Ideally one would have a way of refusing queries, that not only yields a slightly smaller response but is also actually a completely correct response, while NXDOMAIN is not actually true (you don't know if the name exists or not, yet you claim to have authority to say it doesn't). – Håkan Lindqvist Mar 30 '16 at 9:24
  • Clearing out all the root hints appears to actually result in somewhat better behavior. It then responds with empty SERVFAIL responses when querying unknown zones, which is not quite as clear as REFUSED but at least not untrue, also slightly smaller responses vs NXDOMAIN + a SOA record. – Håkan Lindqvist Mar 30 '16 at 9:35

When you run an authoritative dns server and jerkwad script kiddies or those wanting to cause your dns server additional traffic can and WILL send queries to your dns server (from spoofed ips) for domains that your server is NOT authoritative for.

If the dot (.) zone does not exist, even with recursion turned off the server will try and answer that query.

Only until you create the dot zone can you reduce the response to what I stated 119 bytes. And if I recall, any time you start filling the dot zone with any records other than the SOA, the response packets grow larger.

Now if you have a live example and have proof that doing something else will stop this kind of attack 100%, I am all ears and would truly love to see another answer.

I have studied this for quite a while, and have tried many things, and based upon my research, what I detailed above seems to be the best way to reduce the outgoing response as much as possible.

If you have not done so, read up on the domain I listed about along with dns attacks as it is the single most requested domain name in this kind of attack.

Granted, it is often associated with an attack on a recursive server, but these kinds of attacks DO take place on authoritative servers with recursion disabled.

I have servers running that have the root hints cleared, with recursion off, and have spent a great deal of time studying the packets with wireshark during these kinds of attacks and not once have I even seen response like you detailed. (I admit I know just enough about wireshark to make me slightly dangerous)

Do you have or know of a live demo or lab where I could see this in action? Do you happen to know what the size of that response would be since any reduction in packet size would be an improvement?

What other dns server software responds with does NOT answer Microsoft DNS Server questions as the original question was about Server 2008.

  • I take it this is a response to my earlier comments to your initial answer rather than an answer to the question per se? Can you maybe edit parts that are relevant as an answer into that original answer and briefly make other points in the comments? – Håkan Lindqvist Mar 30 '16 at 10:34
  • My response has to do with mitigating dns amplification attacks on Microsoft DNS Server. Yes part of the comment also dealt with and addressed your comments, but it is all related to the original question, and I am interested in any statements or comments that do in fact work to stop or reduce the response packet to the original problem and question of how to mitigate the attacks on 2008. – Universal4 Mar 30 '16 at 19:31
  • Alright, it was probably just the way some of it was phrased that threw me off. I would however still suggest at least considering to edit your three separate answers into one more cohesive answer instead of having them each stand on their own. – Håkan Lindqvist Mar 30 '16 at 20:00
  • Honestly I think most people that would read this thread could understand what I wrote, and after reading your suggestion will see I did in fact try that. I think they can see from my test results how to get the response to reduce the amplification to about as low as possible. Like I had previously stated, I would be happy to try anything that anyone has actually PROVEN to reduce the response even smaller. – Universal4 Mar 30 '16 at 22:08
  • I posted a link with the results I were referring to in the comments to your initial answer in an additional comment there, I was hoping that would clarify that point. The other point I made here is purely about the Serverfault format of questions and answers, which is rather different from a discussion forum. Each answer stands on its own and is supposedly an answer to the question (also, answers are ordered by votes rather than chronologically), but your three answers rather come across as a discussion continuing over three posts which is the only reason why I suggested consolidating them. – Håkan Lindqvist Mar 30 '16 at 22:31

By the way, there is also the query block list, but that also does NOT refuse query's for domain in the list.

Interestingly enough since I was currently experiencing this kind of attack I tried AGAIN what one of the suggestions was.

I removed the . root zone and got a warning about needing to add root hints but ignored it.

I stopped and restarted the dns services and made sure the root hints were still clear.

The response packets went from 119 bytes to over 700 bytes so now I was apmplifying the attack by a factor of 10.

So if someone throws a meg at me I am sending out 10X the bandwith for queries I am not authoritative for to an ip that did not send the request.

I do wish that the suggestion would have worked and I was sure I had tried that before but did so once again since I just happened to have a live attack situation to try it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.