Back to scan results
What this check probes
The scanner resolves the submitted domain to its public IPv4 and IPv6 addresses and tests a bounded sample of those target addresses on both UDP and TCP port 53. It does not test unrelated third-party authoritative name servers merely because they appear in the domain's NS records.
For each responding DNS service, the scanner first requests an A record for an unrelated public hostname with the recursion-desired flag set. A response is only considered a candidate when it matches the transaction and question, contains a successful answer, and advertises recursion availability.
A candidate is then tested with a second, uniquely randomized hostname below example.com. The check fails only when the same server and transport also returns a valid recursive response to that confirmation query. A refusal, recursion-disabled response, closed port, or ordinary timeout does not fail. A candidate that cannot be confirmed is shown as a warning for manual review.
The test performs ordinary DNS lookups only. It does not request a zone transfer, change DNS data, attempt cache poisoning, spoof a source address, or generate amplification traffic.
Why this matters for PCI DSS
An unrestricted recursive resolver exposes a network service that most public web hosts do not need. Attackers can abuse open resolvers in reflected denial-of-service attacks, consume server and network capacity, and use them to conceal or relay DNS activity.
For PCI readiness, every externally reachable service should have a documented business purpose, secure configuration, current patching, and access limited to the systems that require it. Authoritative DNS can remain public while recursive resolution is restricted to trusted clients or disabled entirely.
How to fix it
If this host is not intended to provide DNS, close UDP and TCP port 53 at the host firewall and upstream firewall or security group. Remove or stop the DNS service after confirming that no application depends on it.
If it is authoritative-only BIND DNS, disable recursion and public cache access:
options {
recursion no;
allow-recursion { none; };
allow-query-cache { none; };
};
If BIND must also resolve names for an internal network, define a trusted-client ACL and permit recursion and cache queries only from that ACL. Firewall port 53 so the recursive listener is not reachable from the public internet where practical.
On Windows DNS Server, disable recursion in the server's Advanced properties when the server is authoritative-only, or run:
Set-DnsServerRecursion -Enable $false
When internal clients require recursion, keep it on an internal interface and restrict UDP/TCP 53 with Windows Firewall and the network firewall to explicit trusted address ranges. Do not expose the recursive listener through a public NAT rule.
For Unbound, deny internet clients and allow only the required internal networks:
server:
access-control: 0.0.0.0/0 refuse
access-control: ::0/0 refuse
access-control: 10.0.0.0/8 allow
After changing the configuration, restart or reload the DNS service, verify that authoritative answers still work where required, and re-run this scan from outside the trusted network.