Open DNS Resolver Check
Check whether a DNS server answers recursive queries for anyone, and see the amplification factor an attacker could achieve using it for reflection DDoS, probed from our EU servers.
About Open DNS Resolver Check
The Open DNS Resolver Check sends a recursive query for a name the target cannot possibly be authoritative for, then reports whether it answered. A server that resolves arbitrary names for arbitrary clients is an open resolver. For a public resolver service that is the entire point, but on an authoritative nameserver, a customer-facing router, or an internal resolver exposed by a firewall change, it means anyone on the internet can spend your bandwidth attacking someone else. When the server does answer, the check also measures how much amplification is available through it.
Reflection works because DNS over UDP has no handshake to verify the source address of a query. An attacker forges the victim's address, sends small queries to thousands of open resolvers, and every reply lands on the victim instead of the attacker. RFC 5358, also published as BCP 140, describes this and asks operators to limit recursion to their own clients, while RFC 2827 (BCP 38) asks networks not to forward spoofed source addresses in the first place. The amplification comes from asymmetry: a query of a few dozen bytes can pull back a DNSSEC response many times its size.
The probe is a single A query for a name the target cannot be authoritative for, so an answer means it recursed on our behalf. When it does, a second query for the .org DNSKEY set measures the realistic amplification vector, and the result reports query bytes, response bytes and the factor between them. That large response is fetched from the target itself, so no traffic is aimed at a third party. Private and reserved address ranges are refused outright, which means the check cannot be used to sweep an internal network from outside.
How to use it
- 1Enter the IP address of the DNS server to test, for example 9.9.9.9.
- 2Select Test resolver.
- 3Read the verdict banner: is an open resolver, or did not answer a recursive query.
- 4Check the response time and response code, and where the server is open, the amplification factor and the query-to-response byte figures.
- 5On your own infrastructure, restrict recursion to the networks you serve, then re-test to confirm the server no longer answers us.
Common use cases
- -Confirming an authoritative nameserver has recursion switched off after a rebuild or configuration change.
- -Auditing a customer or branch-office router that may be exposing a resolver to the internet.
- -Verifying that a firewall rule meant to limit UDP port 53 to internal clients actually does so.
- -Quantifying the amplification a misconfigured server offers, to justify the work of fixing it.
- -Checking the response time of a public resolver from Europe before adopting it.
Frequently asked questions
- What is an open DNS resolver?
- An open resolver is a DNS server that performs recursive lookups for any client on the internet, not only its own users. Public services such as Quad9 or DNS4EU are open by design and defend themselves with rate limiting. An authoritative nameserver, a home router or an internal resolver answering recursively is a misconfiguration, because it can be abused as a DDoS amplifier.
- What is DNS amplification and how large can it get?
- The attacker sends a small query with the victim's address forged as the source, so the resolver's much larger reply travels to the victim. A query of roughly 30 to 50 bytes can return a DNSSEC key set or a large TXT answer of several thousand bytes, so factors in the tens are ordinary and higher is possible. The attacker's own bandwidth is multiplied by that factor.
- How do I stop my DNS server being an open resolver?
- Limit recursion to the networks you actually serve. In BIND, set allow-recursion to your client prefixes and turn recursion off entirely on authoritative-only servers; in Unbound, use access-control to permit only your own ranges. Add response rate limiting for whatever still reaches the server, and apply BCP 38 filtering on your own network so spoofed sources cannot leave it.
- Can I use an open resolver check to scan my internal network?
- No. Private and reserved address ranges are refused before any query is sent, so the check cannot be pointed at RFC 1918 space or link-local addresses. It probes public IP addresses only. To test an internal resolver, run the equivalent query from inside your network with dig against that server and see whether it recurses for an external name.