Open DNS Resolver Test
An open resolver is a DNS server that recursively answers lookups for anyone on the internet — which makes it a free spoofed-source DDoS reflector and a cache-poisoning target. Enter a nameserver host or IP and this test probes UDP/53 to answer one question: can this server be abused? It checks for open recursion, ANY-query amplification, public AXFR zone transfers, and version.bind disclosure, and returns the exact fix for each. It is read-only — it sends a handful of safe queries, never floods.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- Open recursion — whether the server recursively resolves a domain it is NOT authoritative for, making it usable as a reflector (SVC_DNS_OPEN_RESOLVER)
- ANY-query amplification — how many times larger the response is than the request, the lever used in UDP reflection/amplification DDoS (SVC_DNS_AMPLIFICATION, with the measured ratio)
- Public zone transfers — whether the server allows a full AXFR to anyone, leaking every hostname and IP in the zone (SVC_DNS_AXFR_OPEN)
- Version disclosure — whether it answers a version.bind CHAOS query and reveals its software version (SVC_DNS_VERSION_DISCLOSED)
- The detected DNS product/version where the server discloses it
- The equivalent command — dig +short +recurse @<host> example.com A — so you can reproduce the recursion test
How to read the result
- Fail — open resolver: the server recursively answers for outside names, so anyone can use it as a spoofed-source DDoS reflector and for cache poisoning. Disable public recursion (restrict it to your own clients).
- If amplification is also present, the summary appends the measured factor (e.g. 'ANY responses amplify ~4.0x the request') — a higher ratio means a more attractive reflector.
- Fail/Warn — AXFR open: recursion may be refused, but full zone transfers are allowed to anyone; restrict AXFR to your secondary nameservers only.
- Warn — amplification without open recursion: ANY queries still amplify the request, so the port is usable as a UDP reflector; enable response-rate-limiting (RRL) and minimal-ANY.
- Warn — version disclosed: recursion is refused (good) but version.bind leaks the software version, which helps an attacker target known CVEs; hide the version string.
- OK: the server refuses recursion for outside names, so it cannot be abused as an open-resolver reflector; 'no DNS service answered on udp/53' means there is no resolver here at all.
Frequently asked questions
What is an open DNS resolver and why is it dangerous?
An open resolver answers recursive DNS queries for any client on the internet, not just its own network. Attackers abuse this two ways: they send tiny queries with a forged (spoofed) source IP so the large answers flood a victim — a reflection/amplification DDoS — and they can attempt to poison its cache. A recursive resolver should only answer for its own users.
How do I close an open resolver?
Restrict recursion to your own clients. In BIND set 'recursion no;' on authoritative servers, or use 'allow-recursion { trusted-networks; };'; in Unbound set access-control to refuse outside ranges; on a Windows DNS server disable recursion if it is authoritative-only. After that, the server should answer only for zones it hosts.
What does the amplification factor mean?
It is the size of the DNS response divided by the size of the request. A small ANY query that returns a much larger answer (a high ratio) is what makes DNS attractive for reflection DDoS: an attacker spends little bandwidth but directs a lot at the spoofed victim. Lowering it means refusing recursion, enabling response-rate-limiting, and minimising ANY responses.
Why does it test for AXFR zone transfers?
AXFR is the DNS zone-transfer mechanism. If a nameserver allows AXFR to anyone, an attacker can download the entire zone — every subdomain, host and IP — which maps your internal attack surface. Zone transfers should be limited to your secondary (slave) nameservers with 'allow-transfer'.
What is version.bind and why hide it?
version.bind is a special CHAOS-class query many DNS servers answer with their software version. Revealing the exact version lets an attacker look up known vulnerabilities for that build. Set the version string to a blank or generic value so the server can't be fingerprinted.
Is the test safe to run against my nameserver?
Yes. It is read-only and sends only a few safe queries on UDP/53 — a recursion probe, an ANY query, an AXFR attempt and a version.bind lookup — then reports what it found. It does not flood the server or send attack traffic. It reuses the same DNS probe the Service Inspector runs, scoped to the reflection question.