A provider's abuse desk sends a notice that your IP took part in a DNS amplification attack. Or a security scan lists "open recursive DNS" against your office firewall. Either way the question is the same: does this address answer recursive DNS queries from strangers on the internet?
The DNS Open Resolver Checker answers it with a single, harmless DNS query from the NetTools.tech server to the address. It tells you whether the address resolved the query for an outsider (open), refused it (not open), stayed silent (no response) or replied ambiguously (inconclusive), and shows the response flags behind the verdict.
What is an open DNS resolver?
In simple terms
A recursive resolver is a DNS server that looks up any name for its clients by asking other servers. Your router does this for your home network, your company DNS servers do it for the office. It becomes an open resolver when it also does this for anyone on the internet who asks. A handful of large public services (Google, Cloudflare, Quad9, OpenDNS) are open deliberately and built to handle abuse. Almost every other open resolver is an accident.
Technical background
Every DNS message has a header with flags (RFC 1035, section 4.1.1). Three of them matter here:
- RD (Recursion Desired) is set by the client to ask the server to resolve the name fully.
- RA (Recursion Available) is set by the server when it offers recursion to this client.
- AA (Authoritative Answer) is set when the server answers from a zone it hosts itself rather than from recursion.
A server that returns RA set, AA clear and a normal response code to an outside client has performed recursion for that client: it is open.
The abuse that makes this matter is DNS amplification. DNS runs mainly over UDP, which has no handshake, so the source address of a query can be forged. An attacker sends many small queries with the victim's address as the source; the resolver sends its larger replies to the victim. Guidance on operating DNS servers safely, including restricting recursion, is in RFC 5358 (BCP 140).
Why use the open resolver check?
- Respond to an abuse report. Confirm whether the reported address really is an open resolver, and confirm the fix afterwards.
- Audit your edge. Routers, CPE modems and firewalls sometimes forward port 53 from the WAN to their internal DNS proxy.
- Check new DNS servers. Before exposing an authoritative server to the internet, make sure recursion is not offered to everyone.
- Avoid blocklists and suspension. Providers and blocklists act on addresses used in amplification attacks.
Who should use it?
- Home users and small offices who received a notice from their provider.
- Network and firewall administrators auditing public addresses.
- DNS administrators running BIND, Unbound, Windows DNS, dnsmasq or Pi-hole.
- Hosting and VPS customers who installed a DNS server on a public machine.
- Security teams verifying a finding from a vulnerability scan.
How the open resolver check works
The check is deliberately minimal. When you start it, your browser sends either the IP address you entered or a "check my IP" request to the NetTools.tech server in Latvia. The server then:
- Validates the target. Only single public IPv4 or IPv6 addresses are accepted; private, loopback, link-local and reserved addresses are rejected. "Check my IP" uses the public address your request arrived from, and is refused with an explanation if that is not a public address.
- Applies a per-target cap. Each address can be checked at most 10 times per hour, whoever asks, in addition to the normal per-visitor rate limits.
- Sends one query. A standard DNS query over UDP port 53: type A, class IN, with only the RD flag set, for a random name
nt-<16 hex characters>.example.com. The random label guarantees no resolver has the answer cached, so an answer can only come from real recursion. The packet is built and parsed by the server itself, not by a shell tool. - Waits up to 3 seconds and accepts only a reply that comes from the target address, carries the same query ID and is at most 4,096 bytes.
- Classifies the reply header:
- REFUSED → not open.
- RA not set → not open (no recursion offered).
- AA set → not open (an authoritative answer, not recursion).
- RA set and truncated → inconclusive.
- RA set and SERVFAIL → inconclusive.
- RA set, AA clear, NOERROR or NXDOMAIN → open.
- Anything else, or a malformed reply → inconclusive.
- No reply within 3 seconds → no response.
Because example.com does not contain the random name, an open resolver will normally return NXDOMAIN. That is still "open": the resolver went out to the internet and fetched the answer on behalf of an outsider.
The response is never amplified and never forwarded anywhere: the query is about 50 bytes, and only the header of the reply is evaluated.
How to use the NetTools.tech open resolver check
- Open the DNS Open Resolver Checker.
- To test your own connection, press Check my IP address. This tests the public address your router or firewall uses; you can confirm which address that is with What Is My IP.
- To test another address, enter it in IP address, for example a DNS server or your firewall's public IP, and press Check. Ranges and hostnames are not accepted.
- Read the verdict card. If the address is open and is not a known public resolver, a How to close an open resolver section appears with fixes for common systems.
- After changing the configuration, run the check again.
Other NetTools.tech tools can link here with ?ip= to prefill the address; the probe is still only sent when you press Check.
Understanding the results
| Result | Meaning | What to look for |
|---|---|---|
| Open resolver | The address performed recursion for an outside client | Fix it unless it is an intentional public resolver |
| Not an open resolver | REFUSED, no recursion offered, or an authoritative-only answer | The desired outcome for anything that is not a public resolver |
| No DNS response | Nothing answered on UDP 53 within 3 seconds | No DNS service exposed, or a firewall drops it: also fine |
| Inconclusive | A reply that does not clearly show recursion | Truncation, SERVFAIL or odd codes; review the DNS configuration |
| Finding | One-sentence reason for the verdict | Tells you which rule decided it |
| Response code | NOERROR, NXDOMAIN, SERVFAIL, REFUSED, FORMERR, NOTIMP or a number | NXDOMAIN with RA=Yes is the typical "open" reply |
| Recursion available (RA) | Whether the server offers recursion to the NetTools.tech server | "Yes" combined with an answer means open |
| Authoritative answer (AA) | Whether the answer came from a zone the server hosts | "Yes" means authoritative, not recursive |
| Truncated (TC) | Shown only when the reply was cut | Leads to Inconclusive when recursion is offered |
| Answers | Number of answer records in the reply | Usually 0 for the random probe name |
| Response time | Round trip from the NetTools.tech server in ms | Informational only |
| Intentional public resolver notice | The IP is in the site's list of public resolvers | No action needed |
Example: an office firewall flagged in an abuse report
An abuse report names 203.0.113.10, the office's public address.
Note
203.0.113.10 is a documentation address standing in for a real public IP. The tool itself rejects documentation ranges such as 192.0.2.0/24 and 203.0.113.0/24, so use your real address when you try this.
- From the office, press Check my IP address. The card reads:
203.0.113.10 (your connection), Open resolver, Finding "The server performed recursion for an outside client (RA set, non-authoritative answer).", Response code NXDOMAIN, Recursion available Yes, Authoritative answer No, Answers 0. - The remediation section appears. The firewall's DNS proxy was enabled on the WAN interface; the admin disables it there and keeps it on the LAN interface.
- Running the check again shows No DNS response: "No DNS reply within 3 seconds — no DNS service is reachable on UDP port 53, or it is filtered." The address is no longer usable for amplification over UDP.
For comparison, checking 9.9.9.9 returns Open resolver with a note that it is Quad9, an intentional public resolver, and no remediation section.
Common use cases
- Verifying and closing an address named in a provider's abuse notice.
- Checking a home router or ISP modem after a firmware update.
- Auditing the public IPs of firewalls and VPN gateways.
- Confirming that an authoritative-only DNS server does not offer recursion.
- Checking a VPS where dnsmasq, Pi-hole or Unbound was installed with default listen settings.
Troubleshooting
Open, but I never installed a DNS server
The device answering is usually the router, modem or firewall at that address, running a DNS relay or proxy that listens on the WAN side. Look for settings like "DNS relay", "DNS proxy", "remote management" or port forwards for port 53, and disable them for the WAN.
Still open after the configuration change
Restart the DNS service so the new configuration is loaded, and make sure there is no second DNS service or port forward on the same address. Also confirm which device actually holds the public IP: with carrier-grade NAT or a provider modem in front of your router, it may be the provider's device.
Not open, but my provider says it is
The report may refer to another address, a past state, or DNS over TCP. This check tests UDP port 53 on one address at the time you run it. Check the exact IP and timestamp in the report and test that address.
Inconclusive with SERVFAIL
The server offers recursion but failed to resolve the probe, for example because it cannot reach the internet or its forwarders are broken. It may still be open; restrict recursion anyway.
"This address was checked too often recently"
The per-target cap of 10 checks per hour was reached, possibly by other visitors checking the same address. Wait and try again.
"Your connection appears as … which is not a public address"
Your request reached the server from a non-public address, so there is nothing to test from the internet. Check a specific public IP instead.
Common mistakes
- Treating Open for 1.1.1.1, 8.8.8.8 or 9.9.9.9 as a problem. Those services are meant to be open.
- Testing from inside the network with a local tool and concluding the server is open. Inside clients are supposed to get recursion; only outside access matters.
- Fixing the DNS server but leaving a firewall port forward for UDP 53 to another internal device.
- Assuming "not open" means the DNS server is otherwise secure. This check covers only open recursion.
- Restricting UDP but leaving recursion open over TCP or on another address of the same server.
Limitations
- UDP port 53 only. A resolver that only answers over TCP, DNS over TLS (853) or DNS over HTTPS is reported as "no response".
- One query, one moment, one source. The result is the state at the time of the check, as seen from the NetTools.tech server in Latvia. A server that allows recursion only from certain regions or networks may look different from elsewhere.
- Rate-limited targets. Some resolvers rate-limit or drop unknown clients; a single dropped packet produces "no response".
- IPv6. IPv6 addresses are accepted, but the NetTools.tech probe server's other network tools report that it currently has no IPv6 connectivity. If an IPv6 check returns "No DNS response", do not take it as proof; test that address from an IPv6-capable host.
- Header-based verdict. The check reads the reply's flags and response code; it does not evaluate DNSSEC, cache poisoning resistance or response rate limiting.
- Single addresses. No ranges, no hostnames, no other ports.
Security & privacy
The IP address you enter, or your own public address for "Check my IP", is sent to the NetTools.tech server, which sends one DNS query to that address from its own IP. The target sees a query for a random name under example.com from the NetTools.tech server; no information about you is included. Because the probe name is under example.com, an open resolver will contact the example.com name servers to resolve it. Verdicts are not published or shared. The design (one small query, single public addresses, 10 checks per address per hour) is meant to prevent the tool from being used to find or abuse open resolvers. No credentials are needed.
Related tools
- What Is My IP – the public address that "Check my IP" will test; guide: What is my IP.
- Port Check – test whether a single TCP port, such as 53, accepts connections; guide: Port check.
- Port Scanner – check which ports are exposed on hosts you are authorized to test; guide: Port scanner and firewall test.
- Nslookup – ordinary DNS lookups through public resolvers; guide: DNS lookup.
- Category overview: DNS & domain tools.
Summary
An open resolver performs recursion for anyone on the internet and can be abused for DNS amplification. The NetTools.tech checker sends one recursive A query for a random, uncacheable name to a single public IP over UDP port 53 and decides from the RA and AA flags and the response code whether the address is open, not open, silent or inconclusive. If it is open and not an intentional public resolver, restrict recursion to your own networks or block inbound port 53, then check again.
Frequently asked questions
What is an open DNS resolver?
It is a DNS server that performs recursive lookups for any IP address on the internet instead of only for its own users. Public resolvers such as 1.1.1.1, 8.8.8.8 and 9.9.9.9 are open on purpose; most other open resolvers are misconfigured routers, modems, firewalls or servers.
Why is an accidental open resolver dangerous?
Attackers send small queries with the victim's address forged as the source, and the resolver sends larger replies to the victim, which is DNS amplification. Your bandwidth is used in the attack, your IP can be blocklisted, and your provider may restrict the connection.
What exactly does the check send?
One standard DNS query over UDP port 53: type A, class IN, recursion desired, for a random name like nt-<16 hex characters>.example.com that no resolver can have cached. The reply's header flags and response code decide the verdict; nothing else is sent.
Does "No DNS response" mean I am safe?
For this test, yes: nothing answered a recursive query on UDP port 53 within 3 seconds, so the address is not acting as an open resolver over UDP. It does not test DNS over TCP, other ports or other addresses you own.
Why is an open result shown for 8.8.8.8 or 1.1.1.1?
Because they are open resolvers by design. When the checked address is in the NetTools.tech list of public resolvers, the page says so and does not suggest any fix.
My router is an open resolver. What should I do?
Turn off DNS relay, DNS proxy or remote management on the WAN side and update the firmware. If the router has no such setting, ask your provider or replace the device; your own devices keep using the router's DNS from the inside.
Can I check a whole subnet?
No. Only single public IP addresses are accepted, and each address can be checked at most 10 times per hour no matter who asks. This keeps the tool from being used to scan for open resolvers.
Why does the result say Inconclusive?
The address answered and offers recursion, but the reply was truncated, returned SERVFAIL or used an unexpected response code, so it is not clear that it actually resolved the name. Check the DNS service's configuration and run the check again later.