Recursion check

None.

Integrity.

All nameserver IP addresses.

Every 5 minutes.

None.

None.

Purpose

The Recursion check attempts recursive queries on all authoritative DNS servers for the domain.

A public authoritative DNS server should, for security reasons, never provide recursion! Since recursive resolvers and authoritative DNS servers face different security threats, it is very wise not to offer both services on the same server or platform. If your name server software provides both recursive and authoritative functions make sure to disable the recursive function on your public DNS servers.

Later DNS server developments in the open source market tend to use separate software for authoritative and recursive servers which usually makes them more proficient in their respective areas of operation.

Event severities and messages

Recursion was not allowed.
Recursion Available flag was set to 0

Recursion request was allowed.
The check was able to perform a recursive query and receive a query response. The authoritative server is most likely also operating as an open resolver.
This is strongly discouraged! This makes the authoritative server also vulnerable to a wide range of resolver attacks including DOS- and cache poisoning attacks.
You are advised to reconfigure your DNS server to refuse responding to recursive queries. If you really need an open resolver it is advisable to set up a separate recursive resolver on a different server.

Corrupt or malformed response from nameserver.
The check received a malformed response from the name server or the response data was corrupted or otherwise unreadable.

Recursion query timed out. Test result is inconclusive.
The query to the server timed out for unknown reasons. This could indicate one out of four things

• The DNS service is unreachable over UDP on port 53.
• The network is down.
  A firewall or IPS is blocking the recursion request, or
  The DNS is configured to drop incoming recursion requests.
• Unexpected response from server with a return code.
  The check failed with an unexpected return code. This is a very unusual message and should be looked at separately. Please report this through the normal support channel.

Check failed due to invalid input data.
When this message appears, usually one of the queries leading up to the final query has received an empty or garbled query response. Please report this through the normal support channel.

Solutions, tips & tricks