IPTOOL TR My IP

DNS

Open DNS resolver (recursion) test

Test whether a DNS server is an open resolver.

Daily queries 0 / 40

40 queries left

Sign up → 200/day · Pro → 5000/day Sign up / see Pro

Queries leave from this Linux server, not your ISP DNS. Free. Cached answers can differ for a short time.

Guests and free members can look up one IP. /24 scans need a Pro membership.

What is an open resolver test?

A recursive resolver answers names it is not authoritative for. Open recursion (RA=1) to the world is abused for amplification and grows cache-poisoning surface. Authoritative name servers should keep recursion off; 8.8.8.8 is open because that is its job.

Use this only on IPs you own or are allowed to test. It is a single example.com A query, not a port scan.

Examples

Expected (auth NS)
RA=0 or refusedYour authoritative NS should look like this.
Public resolver
8.8.8.8 → RA=1By design; do not mirror this on your own NS.
Filtered
timeoutUDP/53 may be closed; that is not “recursion on”.

Frequently asked questions

Why is 8.8.8.8 open?

It is designed as a public resolver. Your own authoritative server should not be.

UDP 53 is closed — what then?

Timeout or a network error. A filter is not the same as “recursion on”.

Should I test my own resolver?

An internal resolver should not be open to the internet. Only probe IPs you operate.

What does RA=0 mean?

The server is not answering recursively — expected for an authoritative-only server.

Is this an attack?

No. It is one example.com A query. Still do not scan hosts without permission.