DNS Recursion Disabled
DNS recursion allows a DNS server to query other nameservers on behalf of clients to resolve names outside its own zones. When recursion is disabled on a resolver that clients depend on, they receive REFUSED responses for any domain not directly hosted on that server. Conversely, leaving recursion open on authoritative-only nameservers creates security risks including DNS amplification attacks.
Symptoms
- DNS queries for external domains return REFUSED
- Internal clients cannot resolve internet domains
- nslookup works for local domains but fails for external ones
- Applications report DNS resolution failures
Common Causes
- Recursion intentionally disabled on a resolver that clients use
- Security hardening disabled recursion on all nameservers including internal resolvers
- Mixed authoritative/recursive server with incorrect recursion ACL
- DNS server migration without preserving recursion settings
Step-by-Step Troubleshooting
- 1
Identify your DNS resolver
Determine which DNS server your clients are configured to use.
Use DNS Lookup → - 2
Test recursion support
Query the resolver for an external domain to check if recursion is available.
Use DNS Lookup → - 3
Check nameserver configuration
Verify the recursion and allow-recursion directives in BIND or equivalent settings.
- 4
Separate roles
Use dedicated servers for authoritative DNS (recursion off) and recursive resolving (recursion on for authorized clients).
Recommended Diagnostic Tools
Monitor DNS Resolution
Track DNS server availability and recursion status continuously.