DNS Amplification & Open Resolver Checker

Detect misconfigured DNS servers acting as open resolvers. Prevent your infrastructure from being weaponized in high-volume volumetric Distributed Denial of Service (DDoS) reflection attacks by validating recursion and rate-limiting policies against RFC 5358 and BCP 140.

No signup

Instant results

100% free

What Is DNS Amplification?

DNS Amplification is an asymmetric reflection attack that leverages UDP's stateless nature and small spoofed queries to solicit disproportionately large responses (like ANY or DNSSEC-signed TXT records). A single misconfigured open resolver can amplify attack traffic by a factor of up to 50x to 100x, debilitating target networks, saturating upstream bandwidth, and potentially leading to infrastruc

Why It Matters

Common DNS Resolver Misconfigurations

Allowing unrestricted recursive queries from the public internet instead of limiting to internal subnets or trusted clients.

SPOOFED_UDP_QUERY

OPEN_RESOLVER

ANY_RECORD_REQUEST

REFUSED_RCODE

AMPLIFICATION_ENGINE

AMPLIFIED_RESPONSE

How It Works

Open Resolver Test

Sends a non-recursive DNS query to the target IP to verify basic DNS availability, then tests recursive query handling.

Amplification Measurement

Issues a recursive ANY-record query and measures the byte-size ratio of query-to-response to calculate amplification factor.

Response Rate Limit Check

Simulates burst query traffic to determine if the resolver implements Response Rate Limiting (RRL) as per RFC 8020.

Remediation Report

Generates a comprehensive report highlighting open recursion vulnerabilities, amplification factor scores, and configuration fixes.

Open Recursion Detection

Accurately identifies if your DNS server processes recursive queries for arbitrary external domains, violating RFC 5358 best practices.

Amplification Factor Analysis

Measures the byte-size ratio of query-to-response using ANY or TXT queries to quantify the exact amplification multiplier your server provides.

EDNS0 & DNSSEC Payload Testing

Evaluates how your server handles EDNS0 pseudo-records and DNSSEC (DO flag) queries, which are frequently exploited for maximum payload size.

Port 53 UDP/TCP Validation

Checks both UDP (the primary vector for spoofing) and TCP handling to ensure complete coverage of your DNS transport layer security.

Response Rate Limiting (RRL) Check

Simulates burst query traffic to determine if your resolver employs RRL mechanisms to truncate or drop abusive query volumes.

Remediation Guidance

Provides actionable, platform-specific configuration snippets (e.g., BIND ACLs, CoreDNS policies) to securely lock down recursive functionality.

Frequently Asked Questions

What is an open DNS resolver?

An open DNS resolver is a DNS server that provides recursive name resolution for clients outside of its administrative domain. Because it answers queries from any IP address on the internet, it can be abused by attackers using spoofed source IPs to reflect amplified traffic onto a victim network.

How does a DNS amplification attack work?

Attackers send small DNS queries (e.g., 60 bytes) with a spoofed source IP matching their target to an open resolver. They often request large records like ANY or DNSSEC-signed zones. The resolver then sends the massive response (e.g., 3000 bytes) to the victim, resulting in a 50x amplification of the attacker's original bandwidth.

Which RFCs address the issue of open resolvers?

RFC 5358 (Preventing Use of Recursive Nameservers in Reflector Attacks) specifically outlines best current practices for restricting recursion. Additionally, BCP 38 (RFC 2827) addresses network ingress filtering to prevent the IP spoofing necessary for these reflection attacks.

How do I fix an open resolver in BIND?

In BIND, you should define an ACL containing your trusted networks and apply it using the 'allow-recursion' and 'allow-query-cache' directives in the options block. Ensure that 'recursion yes;' is only accessible to that specific ACL, not to 'any'.

What is Response Rate Limiting (RRL)?

Response Rate Limiting (RRL) is a mitigation technique implemented in modern DNS software to detect and throttle high volumes of identical queries originating from a single subnet. If a threshold is exceeded, the server will either drop the query or send an empty response with the TC (Truncated) flag, forcing the client to fall back to TCP.

Why is UDP used instead of TCP for amplification attacks?

UDP is a connectionless protocol, meaning it does not perform a three-way handshake to verify the sender's IP address. This makes it trivial for an attacker to spoof the source IP address in the packet header. TCP, requiring a handshake, prevents IP spoofing in this context.

Can authoritative-only DNS servers be used for amplification?

Yes, although typically less effective than recursive resolvers, authoritative servers can still be exploited if they serve large zone files (like TXT or DNSSEC data) and do not implement RRL. While they don't perform recursion, the ratio of query size to response size can still yield a significant amplification factor.