A nameserver answers queries for domains that are not yours

MediumConfirmeddns.health.recursion-open

What this check looks for

One of your nameservers will look up any domain on the internet for anybody who asks. That makes it a free amplifier for attacks on other people, and eventually gets its address blocked.

Why it matters

An open recursive server is used to bounce traffic at victims: a small forged query produces a large answer sent to the target's address. Your server absorbs the load and takes the blame, and once its address is on abuse lists, resolvers start ignoring it — which breaks your own domain.

When the check passes, your report says: “Nameservers answer only for the domains they serve”.

What it costs your score

When this check fails it removes 8 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.

It shares the dns.health.exposure family ceiling of 25 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.

Severity: medium
Default confidence: confirmed
Status when triggered: warn
Deduction: 8 points
Family cap: dns.health.exposure · 25
Category: DNS
Module: Dns health
Fix owned by: dns host
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Turn recursion off on your authoritative nameservers.

An open resolver is used to attack third parties and ends up blocked, which breaks your own domain.

Set recursion no; in BIND, or leave PowerDNS Authoritative in its default non-recursive mode.
If the same machine must also serve recursion to your own network, bind the recursive service to an internal address only, or restrict it with an ACL.
Apply the change on every authoritative nameserver.

How to confirm it worked

dig +norecurse @‹nameserver› A www.iana.org — expect no answer and no ra flag

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

Linux host

BIND:     options { recursion no; allow-query { any; }; };
PowerDNS: (Authoritative is non-recursive by default — do not run Recursor on the same address)
Knot/NSD: authoritative only; no recursion is implemented

Technical detail

These nameservers answered a recursive query for ‹probed name›, a name in a zone they cannot be authoritative for: ‹server list›. RFC 5358 §3 recommends that an authoritative server offer no recursion at all, and that a recursive server serve only its own clients. The two roles should not share a listener; almost every server package separates them with a single directive.

Standards and references

RFC 5358 §3 — Recommendations § 3

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the dns health checker Build the fix