{"id":23087,"date":"2024-03-04T11:42:35","date_gmt":"2024-03-04T11:42:35","guid":{"rendered":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/?lw_help_doc=security\/disabling-recursive-dns-in-bind"},"modified":"2026-07-02T13:28:11","modified_gmt":"2026-07-02T17:28:11","slug":"disabling-recursive-dns-in-bind","status":"publish","type":"lw_help_doc","link":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/hosting\/security\/disabling-recursive-dns-in-bind\/","title":{"rendered":"Disabling Recursive DNS in BIND"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Recursive DNS acts as a middle-man between the viewer of a site, and the authoritative DNS servers hosting the domains and the IP addresses associated with a domain name. Recursive DNS performs two major tasks:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>When a user types a URL into their web browser, the URL is sent to the recursive DNS server first. The first thing the recursive DNS server will do is check the cache memory to see if the IP address for the URL is already stored. If the IP address information is already stored, the recursive DNS server will immediately provide the IP address back to the browser, and the viewer will be taken to the website.<\/li>\n\n\n\n<li>If the recursive DNS server doesn&#8217;t have the IP address in cache, it will go through the process of fetching the IP address, called walking the DNS tree, and return it to the user. The recursive DNS server then stores the IP address in memory for a certain amount of time. The amount of time that the IP address is stored is defined by the owner of the domain using a setting called TTL, Time to Live.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading has-large-font-size\" id=\"h-what-is-bind\">What is BIND?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">BIND is the most widely used domain name system software on the internet. It was originally designed at the University of California, Berkeley, and the name originates from the acronym of Berkeley Internet Name Domain. The software consists of the DNS server component called&nbsp;<i>named<\/i>, the contracted form of&nbsp;<i>name<b>&nbsp;<\/b><\/i>and&nbsp;<i>daemon<\/i>. The software suite contains various administration tools, and a DNS resolver interface library.<\/p>\n\n\n\n<h2 class=\"wp-block-heading has-large-font-size\" id=\"h-why-are-recursive-dns-requests-not-recommended\">Why are recursive DNS requests not recommended?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Servers that support this type of request are vulnerable to fake requests from a spoofed IP address (the victim of the attack), the spoofed IP address can get overwhelmed by the number of DNS results it receives and be unable to serve regular Internet traffic. This is called an Amplifier attack because this method takes advantage of DNS servers to reflect the attack onto a target while also amplifying the volume of packets sent to the victim.<\/p>\n\n\n\n<h2 class=\"wp-block-heading has-large-font-size\" id=\"h-how-do-i-disable-recursive-dns-requests-on-my-server-that-is-using-bind\">How do I disable recursive DNS requests on my server that is using BIND?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The process to disable recursive DNS requests is straightforward and only involves editing your named.conf file followed by restarting named. The following directions assume you are logged into your <a href=\"https:\/\/round-lake.dustinice.workers.dev:443\/https\/www.liquidweb.com\/dedicated-server-hosting\/\">Linux server<\/a> via SSH. For more information on SSH, see <a href=\"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/hosting\/server-administration\/linux\/logging-into-your-server-via-secure-shell-ssh\/\" target=\"_blank\" rel=\"noreferrer noopener\">Logging into Your Server via Secure Shell (SSH)<\/a>.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">acl \"trusted\" { 127.0.0.1; x.x.x.1; x.x.x.2; };<\/pre>\n\n\n\n<ol class=\"wp-block-list\">\n<li>The first step is to back up your named.conf file in your \/etc folder like this:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-preformatted\">cp named.conf named.conf.backup<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The above command uses the linux cp command and makes a backup copy of <i>named.conf<\/i> to a new file with the name <i>named.conf.backup<\/i>.<\/p>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li>The next step is to edit <i>named.conf<\/i> and add a section to \u2018trust\u2019 your server\u2019s own IP addresses, and then to block recursion from all external sources. Now that <i>named.conf<\/i> is backed up, use an editor, such as vim, and open the file.<\/li>\n\n\n\n<li>With <i>named.conf<\/i> open in a text editor, we\u2019ll add the ACL section to \u2018trust\u2019 our server\u2019s IP address with the following sections at the top of the file:<br><pre class=\"ckeditor_codeblock\">acl \"trusted\"{<br>127.0.0.1;<br>x.x.x.1;<br>x.x.x.2;<br>];<\/pre><br><p>Replace the x.x.x lines with your server\u2019s IP addresses. &nbsp;If your server only has one, you only need to update one x.x.x line and can remove the second.<\/p><br><\/li>\n\n\n\n<li>Right below you should see a section called \u2018options\u2019. &nbsp;Add the following line in this section to notify named what the \u2018trusted\u2019 IP addresses are that we just added:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-preformatted\">allow-recursion { trusted; };<\/pre>\n\n\n\n<ol start=\"5\" class=\"wp-block-list\">\n<li>Lastly, skim through the remaining sections and you will probably see some sections named <b>\u2018localhost_resolver\u2019<\/b> and\/or <b>\u2018internal\u2019<\/b>. &nbsp;The one we are interested in is \u2018external\u2019. &nbsp; In this section, you should see a line like this:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-preformatted\">recursion no;<\/pre>\n\n\n\n<ol start=\"6\" class=\"wp-block-list\">\n<li>If you do not see it, go ahead and add it. &nbsp;When done, it should look like this:<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-content\/uploads\/2026\/06\/help.liquidweb.com_TJUmnV.png\" alt=\"showing recursion as no in command line\"\/><\/figure>\n\n\n\n<ol start=\"7\" class=\"wp-block-list\">\n<li>You should be all set. &nbsp;Go ahead and save <i>named.conf<\/i> and then you can restart the named service with:<br><pre class=\"ckeditor_codeblock\">service named restart<\/pre><br><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>Disabling recursive DNS requests is crucial to prevent amplification attacks.<\/p>\n","protected":false},"author":76,"featured_media":0,"parent":22933,"menu_order":0,"template":"","meta":{"footnotes":"","_nx_search_keywords":"","_nx_search_boost":0},"vertical":[256],"lw_resource_category":[2822],"lw_resource_topic":[],"lw_resource_section":[3561],"class_list":["post-23087","lw_help_doc","type-lw_help_doc","status-publish","hentry","vertical-hosting","lw_resource_category-domain-name-system-dns","lw_resource_section-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.9 (Yoast SEO v27.9) - https:\/\/round-lake.dustinice.workers.dev:443\/https\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Disabling Recursive DNS in BIND - Nexcess Documentation<\/title>\n<meta name=\"robots\" content=\"noindex, follow\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Disabling Recursive DNS in BIND\" \/>\n<meta property=\"og:description\" content=\"Disabling recursive DNS requests is crucial to prevent amplification attacks.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/hosting\/security\/disabling-recursive-dns-in-bind\/\" \/>\n<meta property=\"og:site_name\" content=\"Nexcess Documentation\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-02T17:28:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-content\/uploads\/2026\/06\/help.liquidweb.com_TJUmnV.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/docs.nexcess.com\\\/hosting\\\/security\\\/disabling-recursive-dns-in-bind\\\/\",\"url\":\"https:\\\/\\\/docs.nexcess.com\\\/hosting\\\/security\\\/disabling-recursive-dns-in-bind\\\/\",\"name\":\"Disabling Recursive DNS in BIND - Nexcess Documentation\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/docs.nexcess.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/docs.nexcess.com\\\/hosting\\\/security\\\/disabling-recursive-dns-in-bind\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/docs.nexcess.com\\\/hosting\\\/security\\\/disabling-recursive-dns-in-bind\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/docs.nexcess.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/help.liquidweb.com_TJUmnV.png\",\"datePublished\":\"2024-03-04T11:42:35+00:00\",\"dateModified\":\"2026-07-02T17:28:11+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/docs.nexcess.com\\\/hosting\\\/security\\\/disabling-recursive-dns-in-bind\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/docs.nexcess.com\\\/hosting\\\/security\\\/disabling-recursive-dns-in-bind\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/docs.nexcess.com\\\/hosting\\\/security\\\/disabling-recursive-dns-in-bind\\\/#primaryimage\",\"url\":\"https:\\\/\\\/docs.nexcess.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/help.liquidweb.com_TJUmnV.png\",\"contentUrl\":\"https:\\\/\\\/docs.nexcess.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/help.liquidweb.com_TJUmnV.png\",\"width\":768,\"height\":89},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/docs.nexcess.com\\\/hosting\\\/security\\\/disabling-recursive-dns-in-bind\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/docs.nexcess.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security Overview\",\"item\":\"https:\\\/\\\/docs.nexcess.com\\\/hosting\\\/security\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Disabling Recursive DNS in BIND\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/docs.nexcess.com\\\/#website\",\"url\":\"https:\\\/\\\/docs.nexcess.com\\\/\",\"name\":\"Nexcess Documentation\",\"description\":\"Search the docs, or browse by product, category, and topic across Hosting and WordPress.\",\"publisher\":{\"@id\":\"https:\\\/\\\/docs.nexcess.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/docs.nexcess.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/docs.nexcess.com\\\/#organization\",\"name\":\"Nexcess Documentation\",\"url\":\"https:\\\/\\\/docs.nexcess.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/docs.nexcess.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/docs.nexcess.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/favicon-1.webp\",\"contentUrl\":\"https:\\\/\\\/docs.nexcess.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/favicon-1.webp\",\"width\":512,\"height\":512,\"caption\":\"Nexcess Documentation\"},\"image\":{\"@id\":\"https:\\\/\\\/docs.nexcess.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Disabling Recursive DNS in BIND - Nexcess Documentation","robots":{"index":"noindex","follow":"follow"},"og_locale":"en_US","og_type":"article","og_title":"Disabling Recursive DNS in BIND","og_description":"Disabling recursive DNS requests is crucial to prevent amplification attacks.","og_url":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/hosting\/security\/disabling-recursive-dns-in-bind\/","og_site_name":"Nexcess Documentation","article_modified_time":"2026-07-02T17:28:11+00:00","og_image":[{"url":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-content\/uploads\/2026\/06\/help.liquidweb.com_TJUmnV.png","type":"","width":"","height":""}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/hosting\/security\/disabling-recursive-dns-in-bind\/","url":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/hosting\/security\/disabling-recursive-dns-in-bind\/","name":"Disabling Recursive DNS in BIND - Nexcess Documentation","isPartOf":{"@id":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/hosting\/security\/disabling-recursive-dns-in-bind\/#primaryimage"},"image":{"@id":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/hosting\/security\/disabling-recursive-dns-in-bind\/#primaryimage"},"thumbnailUrl":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-content\/uploads\/2026\/06\/help.liquidweb.com_TJUmnV.png","datePublished":"2024-03-04T11:42:35+00:00","dateModified":"2026-07-02T17:28:11+00:00","breadcrumb":{"@id":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/hosting\/security\/disabling-recursive-dns-in-bind\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/hosting\/security\/disabling-recursive-dns-in-bind\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/hosting\/security\/disabling-recursive-dns-in-bind\/#primaryimage","url":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-content\/uploads\/2026\/06\/help.liquidweb.com_TJUmnV.png","contentUrl":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-content\/uploads\/2026\/06\/help.liquidweb.com_TJUmnV.png","width":768,"height":89},{"@type":"BreadcrumbList","@id":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/hosting\/security\/disabling-recursive-dns-in-bind\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/"},{"@type":"ListItem","position":2,"name":"Security Overview","item":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/hosting\/security\/"},{"@type":"ListItem","position":3,"name":"Disabling Recursive DNS in BIND"}]},{"@type":"WebSite","@id":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/#website","url":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/","name":"Nexcess Documentation","description":"Search the docs, or browse by product, category, and topic across Hosting and WordPress.","publisher":{"@id":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/#organization","name":"Nexcess Documentation","url":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/#\/schema\/logo\/image\/","url":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-content\/uploads\/2026\/07\/favicon-1.webp","contentUrl":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-content\/uploads\/2026\/07\/favicon-1.webp","width":512,"height":512,"caption":"Nexcess Documentation"},"image":{"@id":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-json\/wp\/v2\/lw_help_doc\/23087","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-json\/wp\/v2\/lw_help_doc"}],"about":[{"href":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-json\/wp\/v2\/types\/lw_help_doc"}],"author":[{"embeddable":true,"href":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-json\/wp\/v2\/users\/76"}],"version-history":[{"count":6,"href":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-json\/wp\/v2\/lw_help_doc\/23087\/revisions"}],"predecessor-version":[{"id":55891,"href":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-json\/wp\/v2\/lw_help_doc\/23087\/revisions\/55891"}],"up":[{"embeddable":true,"href":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-json\/wp\/v2\/lw_help_doc\/22933"}],"wp:attachment":[{"href":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-json\/wp\/v2\/media?parent=23087"}],"wp:term":[{"taxonomy":"vertical","embeddable":true,"href":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-json\/wp\/v2\/vertical?post=23087"},{"taxonomy":"lw_resource_category","embeddable":true,"href":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-json\/wp\/v2\/lw_resource_category?post=23087"},{"taxonomy":"lw_resource_topic","embeddable":true,"href":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-json\/wp\/v2\/lw_resource_topic?post=23087"},{"taxonomy":"lw_resource_section","embeddable":true,"href":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/docs.nexcess.com\/wp-json\/wp\/v2\/lw_resource_section?post=23087"}],"curies":[{"name":"wp","href":"https:\/\/round-lake.dustinice.workers.dev:443\/https\/api.w.org\/{rel}","templated":true}]}}