How to test a DNS server for open recursion with dig

A DNS server that resolves unrelated Internet names for arbitrary clients can be used in reflection attacks and can spend resolver capacity on untrusted traffic. Testing from outside the approved client networks shows whether the public-facing policy actually limits recursive service.

The dig utility requests recursion by default, so the query and response contain the rd flag. A server that offers recursion to that client also returns ra; a BIND server that denies the request commonly returns REFUSED without ra and may include a Prohibited Extended DNS Error.

An external DNS client reaches the same server address over one network path for both the unrelated-name request and the authoritative SOA request. A refusal for the unrelated name paired with an authoritative answer for the hosted zone shows that the resolver ACL denied recursion while the authoritative service remained reachable.

Related: How to query a specific DNS server with dig

Steps to test a DNS server for open recursion with dig:

  1. Confirm that you administer the DNS server or have explicit permission to assess its recursion policy.

    Unauthorized DNS assessment can violate policy, and repeated high-rate questions can burden production infrastructure.

  2. Record the server's public address, one hosted zone, and an unrelated test name with a fresh numeric label.
  3. Request recursion from a client network that should not use the resolver. 
    $ dig @203.0.113.53 recursion-check-82314.example.net A

; <<>> DiG 9.20.18-1ubuntu2.1-Ubuntu <<>> @203.0.113.53 recursion-check-82314.example.net A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 19602
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 9d27c39ad7c3ec83010000006a5411055351c57d2cc5e5c5 (good)
; EDE: 18 (Prohibited)
; EDE: 20 (Not Authoritative): (recursion disabled)
;; QUESTION SECTION:
;recursion-check-82314.example.net. IN A

;; Query time: 1 msec
;; SERVER: 203.0.113.53#53(203.0.113.53) (UDP)
;; WHEN: Sun Jul 12 22:11:17 UTC 2026
;; MSG SIZE  rcvd: 120

    203.0.113.53 represents the selected public server address. REFUSED, rd without ra, and zero answers show that this client requested recursion but the server did not provide it. A resolved answer or NXDOMAIN response with both rd and ra shows that the server completed recursion for this client.

  4. Query a zone hosted by the same server with recursion disabled. 
    $ dig @203.0.113.53 authoritative.example SOA +norecurse

; <<>> DiG 9.20.18-1ubuntu2.1-Ubuntu <<>> @203.0.113.53 authoritative.example SOA +norecurse
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34280
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

##### snipped #####

;; ANSWER SECTION:
authoritative.example. 300 IN SOA ns1.authoritative.example. hostmaster.authoritative.example. 2026071302 3600 900 604800 300

;; Query time: 0 msec
;; SERVER: 203.0.113.53#53(203.0.113.53) (UDP)
;; WHEN: Sun Jul 12 22:11:17 UTC 2026
;; MSG SIZE  rcvd: 159

    authoritative.example represents the selected hosted zone. NOERROR and aa prove that the same endpoint is reachable and authoritative even though it denied recursion for the unrelated name.