Open DNS resolver test: is this server answering the whole internet?

A DNS resolver turns names like example.com into IP addresses. Most DNS servers only answer their own clients: the users on the same network or in the same company. An open resolver answers recursive queries from anyone on the internet, no matter who is asking.

That is the raw material for DNS amplification. An attacker sends a tiny forged query to thousands of open resolvers with the source address set to the victim. Each resolver fires a much bigger answer straight at the victim. The ratio can reach 70 bytes out for every byte in, which is why open resolvers are a favourite tool for volumetric DDoS attacks.

Public resolvers like 8.8.8.8 (Google) and 1.1.1.1 (Cloudflare) are open on purpose, but they rate-limit and watch for abuse, so they are not a practical amplifier. A home router with DNS exposed on the WAN side, a small VPS or a company server with recursion left on is a different story.

1. Recursion test: we ask the target for test.openresolver.com TXT. If it fetches that record from the authoritative nameserver on our behalf, it is open. A properly configured server answers REFUSED or SERVFAIL and never contacts the authoritative server.
2. External resolution test: we ask the target to resolve google.com A. A hardened server refuses. An open resolver returns real IP addresses.
3. Version disclosure test: we query version.bind TXT CHAOS. Showing the software version (say BIND 9.16.1) is a small information leak that helps attackers pick a known exploit for that exact version.

Results are cached for 30 minutes. After you change the server configuration, wait a few minutes and run the test again to confirm the fix.

The exact fix depends on the DNS software, but the principle is always the same: allow recursion for trusted IP ranges such as your own network, and refuse or drop queries from everything else.

BIND (named)

Edit named.conf.options and restrict recursion to a trusted access control list:

acl "trusted" {
 192.168.1.0/24; // your local network
 127.0.0.1;
};

options {
 recursion yes;
 allow-recursion { trusted; };
 allow-query { trusted; };
};

Unbound

In unbound.conf, deny everyone by default and allow your own ranges explicitly:

server:
 access-control: 0.0.0.0/0 refuse
 access-control: 127.0.0.1/8 allow
 access-control: 192.168.0.0/16 allow

Windows DNS Server

Open DNS Manager, right-click the server, go to Properties and then the Advanced tab. Tick "Disable recursion", or use DNS policies to limit which clients may recurse.

Router or home gateway

Many consumer routers expose their DNS proxy on the WAN interface by accident. Log in to the router's admin page and look for "DNS relay" or "WAN DNS access", then switch it off for the WAN side. If there is no such option, update the firmware or ask the manufacturer.