How do I check for Open Resolvers?

This article applies to your 123 Reg Server This article will show you what Open Resolvers are and how you can fix them?

What are Open Resolvers?

An open DNS resolver is essentially a DNS server that responds to requests and these request can allows you to forward your DNS traffic at a specified target.

Why are Open Resolvers not allowed on our network?

Open Resolvers are commonly used in DNS Amplification attacks, or DDOS (Distributed Denial of Service) attacks. These kinds of attacks have been used to take down major corporations and as such, we do not allow them on our network. 123 Reg Servers will not have DNS Recursion by default, so if we see that it is enabled on your server, you will be notified by ticket, advising you of the situation. If necessary, further action will be taken to ensure that DNS Recursion is disabled.

How do I find an Open Resolver?

Open Resolvers are fairly easy to spot. The easiest is to use the following links. They will allow you to enter your IP or Net Range, and you will be provided with a a list of open resolvers. However, these lists are not always up to date, so it is still a good idea to check by running commands: This will give an output that looks like this: The above output does not look to be showing up as allowing recursion and does not have the required flags, which are “rd” and “ra”, which mean recursive denied and recursive allowed. A server can be recursive desired and not an Open Resolver, however, it if shows “ra” then this would indicate that it is an Open Resolver. See below for an example: This time we do not get the root service, but rather, the correct A records and looking at the flags again, there is a difference: The ra would identify that this server is indeed an Open Resolver.

How to fix and Open Resolver

The method for resolving an Open Resolver is based upon the type of server you use.

Plesk Control Panel

From the Server Tab or Tools and Settings select DNS Template Settings under General Settings. Go to the DNS Recursion tab and select Deny/Allow Locally.

Plesk Command Line (Windows)

Windows DNS

From Remote Desktop, click on the Start button and select Administrative Tools. Then select DNS, right click on the Server, select Properties, and then Select Advanced. Here, ensure that Disable recursion (also disables forwards) is ticked, then click apply.

Windows CMD

Linux

Edit the file /ect/named.conf and changed the below variables in the options{ section to secure your DNS service: Once these modifications are complete, you must restart the DNS Service.

How to check if the issue is fixed

The command you should use to check for DNS recursion: The fixed output should look like this: The tags above show only as rd if the flags contain ra – this indicated that recursion is allowed.