Open DNS resolver
An open DNS resolver answers recursive queries from any client on the internet rather than only its intended users, letting an attacker spoof a victim's address and trigger a flood of replies far larger than the request -- a DNS amplification attack. AdminKit's resolver test names the resolver actually answering a device's queries.
By AdminKit team, Netbase JSC · Updated
An open DNS resolver accepts and answers recursive queries from any client on the internet, not just the network or users it was meant to serve. Because a small DNS query can produce a much larger response, an attacker can send a query to an open resolver with a victim’s IP address spoofed as the source, so the oversized reply floods the victim instead of the attacker — a reflection and amplification attack. RFC 5358, also published as BCP 140, recommends operators restrict recursive DNS service to intended clients only, through access control lists or authentication, rather than leaving it open to the whole internet. The attack also depends on source-address spoofing working at all, which is the separate problem BCP 38 addresses by filtering forged source addresses at the network edge; closing either gap — open recursion or spoofable source addresses — helps prevent this class of attack.