Open recursion and lame nameservers
An authoritative nameserver should answer only for the zones it is responsible for. Two common faults are open recursion and lame servers.
Open recursion
An open resolver answers recursive queries for names it is not authoritative for, from anyone on the internet. That is a problem: open resolvers are abused to amplify denial-of-service attacks. Your authoritative nameservers should refuse recursion (they should not answer a query for, say, google.com with a real address).
Lame servers
A lame nameserver is one that is listed in your delegation but does not actually answer authoritatively for the zone (it returns no answer, or answers without the "authoritative" bit). Resolvers waste time querying it and some lookups fail.
How to fix it
- Recursion: disable recursion on authoritative servers (BIND
recursion no;), or, if you use a managed DNS provider, this is handled for you - a flagged result usually means a nameserver is misconfigured or does not belong in your list. - Lame: remove nameservers from your delegation that no longer serve the zone, and make sure every listed nameserver has the zone loaded.
How to verify
# Recursion should NOT return an answer with ra=1:
dig @<your-nameserver> google.com A
# Each listed nameserver should answer authoritatively (aa flag) for your zone:
dig @<your-nameserver> example.com SOA +norecurse
For open recursion, the first query should be refused or return no answer (no ra flag doing work for a foreign name). For lameness, every listed nameserver should set the aa (authoritative answer) flag for your own zone.