The Danger of Open Recursive DNS Resolvers (and How to Fix Yours)

Open recursive DNS resolvers are one of the internet’s longest-running and most exploited infrastructure problems. Despite years of awareness campaigns, millions remain exposed — and in 2026, they’re routinely weaponised in DDoS amplification attacks that take down websites, networks, and services. This guide explains what open resolvers are, why they’re dangerous, how to check if you’re running one, and what to do about it.

What Is an Open Recursive DNS Resolver?

Every time you visit a website, DNS (the Domain Name System) translates the domain name into an IP address. A recursive resolver does this lookup work on behalf of a client. An open recursive resolver does this for any client on the internet — not just those on its own network. That openness is the problem: it makes the resolver available as a tool for anyone to abuse, including attackers.

The DNS Amplification Attack: Why Open Resolvers Are Dangerous

Here’s the attack pattern that makes open resolvers so harmful. An attacker sends a small DNS query (typically 40–60 bytes) to an open resolver, with the source IP address spoofed to be the victim’s IP. The resolver responds with a much larger DNS response — sometimes 70x the size — directed at the victim. By using thousands of open resolvers simultaneously, attackers generate massive, amplified traffic floods directed at a target without using proportionate bandwidth themselves. It’s essentially borrowing and multiplying attack power from misconfigured servers they don’t own.

A single open resolver is a minor contributor. Millions of them — which is the real state of the internet — form a globally distributed amplification infrastructure that has been used to generate DDoS attacks exceeding 300 Gbps. Your misconfigured server becomes someone else’s weapon.

How to Check If You’re Running an Open Resolver

If you run a server, VPS, or any networked infrastructure with DNS running, check it:

1. Online checker: Tools like DNSChecker.org and similar services let you query your server’s IP to see if it responds to external recursive queries.
2. Command-line test: From an external network (not your own), run:
   dig @YOUR.SERVER.IP.HERE google.com
   If you get a resolved answer rather than a REFUSED or SERVFAIL, your resolver is open.
3. The Open Resolver Project has historically maintained lists of known open resolvers — check if your IP appears.

How to Fix an Open Resolver

The fix is restricting recursive queries to authorised clients only. How you do this depends on your DNS software:

• BIND: In named.conf, set allow-recursion { 127.0.0.1; your-network-range; }; — restricting to localhost and your own IP ranges.
• Unbound: Configure access-control directives to allow only your network.
• Windows DNS Server: Configure forwarder settings and disable open recursion in the server properties.
• Firewall level: Block inbound UDP port 53 from the public internet on any resolver that should only serve internal clients. This is the belt-and-suspenders approach alongside software configuration.

For hosting providers and ISPs: if you provide shared hosting, audit every DNS instance. A compromised shared host exposing an open resolver affects your entire infrastructure’s reputation. For broader infrastructure security context, our guide on layered cybersecurity covers building defences at every level.

The Bigger Picture

Open resolvers are a collective action problem: each individual operator may see their contribution as negligible, but the aggregate is what enables massive attacks. Closing your open resolver protects not just your server’s reputation and bandwidth, but contributes to reducing the globally available amplification pool. This is one of those cases where doing the right thing technically is also genuinely the right thing for everyone else on the internet.

FAQ

What is an open recursive DNS resolver? A DNS resolver that answers recursive queries from any IP on the internet, not just its own network. This makes it exploitable as an amplifier in DDoS attacks.

How do open resolvers enable DDoS attacks? Attackers spoof the victim’s IP in small DNS queries sent to open resolvers. The resolvers send large responses to the victim — amplifying small attack traffic into a massive flood without the attacker needing proportionate bandwidth.

How do I check if my server is an open resolver? Run dig @YOUR.IP google.com from an external network. If you get a resolved answer, it’s open. Online tools like DNSChecker can also test this.

How do I fix an open resolver? Restrict recursive queries to authorised IP ranges in your DNS software configuration (BIND: allow-recursion; Unbound: access-control) and block inbound UDP port 53 from the public internet at the firewall.

Why should I care about fixing my open resolver? Your server becomes part of the infrastructure used to attack others. It also consumes your bandwidth, can harm your IP reputation, and exposes your infrastructure to abuse.