Turning Off DNS Recursion For Bind

[flesso]

DNS recursion / open DNS server is when your DNS server is readily available to do DNS lookups for the general public. If you are an open DNS server it is most likely that your server will get abused by spammers and others alike, and is very resource consuming. If you need to turn DNS recursion off for your Bind installation, follow these steps

Note: You need to have root access to the server to be able to do this.
Note: It's not PHP code, it's just the first button I could find.

1) To check if your name servers are open DNS servers, run a DNS report for your domain. This can be done by going to http://www.dnsreport.com.

2) If DNS report tells you that your name servers are open DNS servers, login to your name servers as root via SSH.

3) Open the named config file for editing by running the following command:

vi /etc/named.conf

To start editing press 'shift' and 'i'.

4) Scroll down to the following section of the config file:

PHP Code:

options {
        directory "/var/named";
        dump-file "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        /*
         * If there is a firewall between you and nameservers you want
         * to talk to, you might need to uncomment the query-source
         * directive below.  Previous versions of BIND always asked
         * questions using port 53, but BIND 8.1 uses an unprivileged
         * port by default.
         */
         // query-source address * port 53; 


5) Move your cursor down to the end of the following line:

PHP Code:

        statistics-file "/var/named/data/named_stats.txt"; 


6) Press 'return' for a new line and enter the following:

PHP Code:

recursion no; 


After editing, it should look like the following

PHP Code:

options {
        directory "/var/named";
        dump-file "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        recursion no;
        /*
         * If there is a firewall between you and nameservers you want
         * to talk to, you might need to uncomment the query-source
         * directive below.  Previous versions of BIND always asked
         * questions using port 53, but BIND 8.1 uses an unprivileged
         * port by default.
         */
         // query-source address * port 53; 


Save and exit by doing the following:

Press 'esc' > Type ':wq' > Press 'return'

9) That's the config file saved, now to restart named by issuing the following command:

/etc/init.d/named restart