When I run a dns check against any domains on my MS 2003 web server I get the following message from various online dns query tools:
Recursive Queries:
I could use the nameservers listed below to performe recursive queries. It may be that I am wrong but the chances of that are low. You should not have nameservers that allow recursive queries as this will allow almost anyone to use your nameservers and can cause problems. Problem record(s) are:
52.xx.xxx.xxx (my servers IP)
I've also ran wireshark on it and I'm getting dns queries from about 100+ public ip's for domains that aren't on my server.
How can I fix this?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Hmm, I guess I don' t understand.
If my webserver has DNS running on it, and it is the nameserver for my domains, if I only allow internal IP addresses or block port 53, how would www visitors resolve my domains to visit them?
Wouldn't some DNS server have to query my DNS server to resolve my domain names?
I'm just trying to prevent other users or other DNS servers from querying domains that my server is not authoritive for. (E.g. google.com)
The best way is for you to configure forwarders with iteration:
A brief explaination of each:
---Recursive lookup: A recursive lookup is handled by the server. It will go out to a distant server and try to resolve DNS queries that it can't do on for the client. In other words, if the DNS server can't find an internal address, it will go out to other servers and ask them to look for it. If a resolution is provided. The resolution will be passed down to the client from the server. It is recommended to turn off recursive lookups for security reasons and performance reasons.
--Iteration: Iteration is done when the server can't resolve the query and tells the client, "I can't do it, ask another DNS server." The resolution comes from the remote server, not the local server. So, this is basically passing the buck.
---forwarders: forwarders are manually configured DNS servers that your server will forward queries to if your server can't make the resolution. (most folks configure the ISP's DNS server as the forwarders)
---Root Hints: Root Hints are a list of public DNS servers that your server forwards DNS queries to if your server can't resolve the DNS query
Business Accounts
Answer for Membership
by: LegendZMPosted on 2008-06-03 at 13:30:51ID: 21704251
In DNS right click the server node go to properties, tell it to only listen to requests on the internal IP address. or click security tab and only allow authenticated users
You could also set firewall to block access to DNS on port 53