Open DNS Resolver Being Abused

1. Check if your resolver is open to the internet

# Test from an external host (not your own network)
# If this returns a full answer, your resolver is open
dig @YOUR_SERVER_IP google.com A

# Test the classic amplification vector: ANY query
dig @YOUR_SERVER_IP isc.org ANY +bufsize=4096

# Verify from your own server which IPs are allowed
named-checkconf -p | grep allow-recursion   # BIND
grep -i "allow-recursion\|allow-query" /etc/named.conf
grep -i "recursive\|acl" /etc/unbound/unbound.conf

2. Measure current DNS traffic volume

# Count DNS queries per second (press Ctrl+C after a few seconds)
sudo tcpdump -i eth0 -nn port 53 -l 2>/dev/null | pv -l -i 1 > /dev/null

# Show source IPs sending the most DNS queries
sudo tcpdump -i eth0 -nn port 53 -c 10000 2>/dev/null \
  | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn | head -20

# Check current DNS traffic bandwidth
sudo iftop -i eth0 -f "port 53" -n

3. Inspect query types being processed

# For BIND: enable query logging temporarily
rndc querylog on
tail -f /var/named/data/named_querylog | head -500

# For unbound: increase verbosity temporarily
unbound-control verbosity 2
tail -f /var/log/unbound.log | head -500

# For systemd-resolved
journalctl -u systemd-resolved -f | head -100

4. Check if you are listed as an open resolver

# openresolverproject.org maintains a list of known open resolvers
# Check via their website or DNS-based lookup
dig +short TXT openresolver.com @YOUR_SERVER_IP
# If it returns data, you ARE an open resolver

Step 1: Immediately restrict recursion in your DNS server config

BIND (/etc/named.conf):

options {
    // Only allow recursion for your own networks
    allow-recursion { 127.0.0.1; 10.0.0.0/8; 192.168.0.0/16; };
    allow-query { any; };              // OK for authoritative
    allow-query-cache { 127.0.0.1; 10.0.0.0/8; 192.168.0.0/16; };
    recursion yes;                     // Only reachable to allowed-recursion IPs
};

sudo named-checkconf    # Validate
sudo systemctl restart named

Unbound (/etc/unbound/unbound.conf):

server:
    access-control: 0.0.0.0/0 refuse
    access-control: 127.0.0.0/8 allow
    access-control: 10.0.0.0/8 allow
    access-control: 192.168.0.0/16 allow

sudo unbound-checkconf
sudo systemctl restart unbound

Step 2: Block UDP port 53 inbound at the firewall

# Drop DNS queries from outside your network
sudo iptables -A INPUT -p udp --dport 53 ! -s 10.0.0.0/8 -j DROP
sudo iptables -A INPUT -p tcp --dport 53 ! -s 10.0.0.0/8 -j DROP

# Save rules
sudo iptables-save | sudo tee /etc/iptables/rules.v4

Step 3: Rate-limit DNS responses to mitigate in-progress abuse

BIND RRL (Response Rate Limiting):

rate-limit {
    responses-per-second 5;
    window 5;
};

Step 4: Verify the fix

# Test from an external host — should now be refused
dig @YOUR_SERVER_IP google.com A
# Expected: ;; connection timed out; no servers could be reached

• Restrict recursion at install time: Any DNS server deployed internet-facing should have allow-recursion { trusted_nets; }; set before the first packet is accepted — this should be part of your server provisioning checklist.
• Firewall DNS at the network edge: Even if the DNS daemon is misconfigured, a firewall rule dropping inbound UDP/TCP 53 from untrusted networks is a safety net.
• Enable DNS Response Rate Limiting (RRL): Even for authoritative-only servers, RRL in BIND and NSD limits how many identical responses are sent per second to a single IP, defeating amplification even if queries slip through.
• Audit regularly: Run dig @YOUR_IP google.com from a VPS in another network monthly to confirm your resolver remains closed.
• Monitor DNS query rates: Alert when outbound DNS traffic exceeds a baseline — a sudden 10x spike is a strong abuse indicator.