Network & Infrastructure / DNS, DNSSEC & Service Discovery
Restrict recursion separately from authoritative answering
A public authoritative server also performs recursion for arbitrary Internet clients. The exposure expands resource use and abuse potential even though the public zone answers correctly.
Environment and inputs: Authoritative and recursive DNS infrastructure; BIND examples are conceptual and require release-matched configuration. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Check recursion availability from authorized and unauthorized networks, access-control matching and per-role resource use. Distinguish authoritative answers for hosted zones from recursive answers for unrelated names.
Explain the result
Authoritative service and recursive resolution have different audiences. A server can legitimately answer its public zones while refusing recursion to the same external requester.
Plan the fix
Separate roles or apply the documented recursion and cache-query ACLs with explicit trusted clients. Review configuration inheritance so a broad listener does not silently broaden recursive access.
Check the result and rollback
Verify public authoritative resolution still works and external recursion is refused. Restore prior listener changes if legitimate resolvers lose service, then correct the ACL without reopening recursion globally.