DNS Open Resolver Checker
AvailableCheck whether your IP address or DNS server is an open resolver — one that answers recursive DNS queries from anyone on the internet and can be abused for DDoS amplification.
What is an open DNS resolver?
An open DNS resolver is a DNS server that accepts recursive queries from any IP address on the internet, instead of only from its own local or authorized clients. It looks up any domain for anyone who asks.
Public utility
Intentional public resolvers — Google (8.8.8.8), Cloudflare (1.1.1.1), Quad9, OpenDNS — are open on purpose. They are run at scale, filtered and rate-limited against abuse.
Misconfiguration
Most other open resolvers are accidents: home routers, modems, enterprise firewalls or DNS servers that answer the whole internet instead of only their own network.
Why it matters: attackers send small queries with a forged source address, and the open resolver sends much larger answers to the victim — DNS amplification, a common DDoS technique. The resolver’s owner pays in bandwidth, can end up on blocklists, and risks having the connection suspended. This tool tells you whether your connection or server is one.
Run the check
Tests the public address your connection uses — where your router or firewall is exposed to the internet.
Run a check to see whether the address answers DNS queries from the internet.
How to close an open resolver
Allow recursion only for your own networks, and block inbound port 53 on devices that should not serve DNS to the internet.
After changing the configuration, run the check again.
How it works
The NetTools server sends one recursive DNS query (recursion desired) over UDP port 53 to the address, asking for a random name that no resolver can have cached. If the address resolves it for us — recursion available and a non-authoritative answer — it is an open resolver. A REFUSED reply or no recursion means it is closed; no reply means no DNS service is reachable there.
Safeguards & responsible use
- One small DNS query per check — never a scan, never an amplified response.
- Single public IP addresses only; private, loopback and reserved addresses and ranges are rejected.
- Each address can be checked at most 10 times per hour, whoever asks, plus per-visitor rate limits.
- “Check my IP” tests your own connection, the address your router or firewall is exposed on.
Frequently asked questions
What is an open DNS resolver?
A DNS server that accepts recursive queries from any IP address on the internet instead of only from its own users. Public resolvers like Google (8.8.8.8), Cloudflare (1.1.1.1) and OpenDNS are open on purpose and are built to handle abuse; most other open resolvers are accidents — misconfigured home routers, modems, firewalls or servers.
Why is an accidental open resolver a problem?
Attackers send small DNS queries with a forged source address, and the resolver sends much larger replies to the victim: DNS amplification, a common DDoS technique. Your bandwidth gets used, your IP can end up on blocklists, and your ISP may suspend the connection. Open resolvers can also be used for cache-poisoning attempts.
My router is an open resolver — what should I do?
Disable DNS relay or remote access on the WAN (internet) side in the router settings and update its firmware. If there is no such option, ask your ISP or replace the device. Your own devices keep working: they use the router’s DNS from the inside.
Does “no response” mean I am safe?
For this check, yes: nothing answered DNS on UDP port 53 from the internet. It can also mean a firewall drops the probe, which is the desired outcome.
Can I check any IP address?
Single public addresses, yes — the check is one ordinary DNS query. To prevent misuse, each address can only be checked a limited number of times per hour, and ranges are not supported.