0

I have configured dns server, and if i enable recursion, I can ping and got the result.

[root@seobd ec2-user]# nslookup google.com
Server:         52.10.197.195
Address:        52.10.197.195#53

Non-authoritative answer:
Name:   google.com
Address: 216.58.193.78

But If I disable recursion, I can't ping my result. configuration:

options {
        listen-on port 53 { 127.0.0.1; 52.10.197.195; 0.0.0.0/0;};
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { localhost; 0.0.0.0/0; };
        notify yes;
        recursion no;
        dnssec-enable no;
        dnssec-validation yes;
};

zone "iftibd.com" IN {
        type master;
        file "seobd.fz";
        allow-update {none;};
};

zone "197.10.52.in-addr.arpa" IN {
        type master;
        file "seobd.rz";
        allow-update {none;};
};

[root@seobd ec2-user]# ping google.com
ping: unknown host google.com
2

That is expected behaviour; if you do not allow recursion, BIND won't iterate through the possibilities/servers for eventually getting your answer, and thus won't be able to answer.

The important part is creating ACLs limiting the networks which can do recursive requests, and avoiding having an open DNS server that can be and will be abused remotely.

I would also advise to add to the top of your options section:

allow-recursion { 127.0.0.0/8; x.x.x.x/24; y.y.y.y/24; };

where x.x.x.x and y.y.y.y are your netblocks.

Have a look at: What’s the difference between recursion and forwarding in bind

For the security implications, please have a look at Open Resolver Project

Open Resolvers pose a significant threat to the global network infrastructure by answering recursive queries for hosts outside of its domain. They are utilized in DNS Amplification attacks and pose a similar threat as those from Smurf attacks commonly seen in the late 1990s.

4
  • 1
    +1. e.g. allow-recursion { 127.0.0.0/8 ; x.x.x.x/24 ; y.y.y.y/24}; – cas Apr 26 '16 at 12:15
  • yes. Although I personally use views, and do not allow recursion in the external view. – Rui F Ribeiro Apr 26 '16 at 12:16
  • As I am using amazon aws, so I just do this below configuration: recursion yes; allow-recursion {127.0.0.1;52.10.197.195; 123.0.17.252;}; where 123.0.17.252= real ip of my office network. – Ifti Apr 27 '16 at 4:05
  • the following error has occured if i allow recursion before options,[root@seobd ec2-user]# service named restart Redirecting to /bin/systemctl restart named.service Job for named.service failed because the control process exited with error code. See "systemctl status named.service" and "journalctl -xe" for details. – Ifti Apr 27 '16 at 4:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.