The first step in securing a recursive DNS resolver service is determining how your server is being accessed or will be accessed:

  • Is my resolver service public or private?
    • Public: can be reached over the open internet (public IP address, not restricted)
    • Private: cannot be reached over the open internet (private IP address, or ACL restrictions, or a combination)
  • Is my resolver service open or closed?
    • Open: reachable by, and responds to, queries from any client
    • Closed: requires authentication of some sort to be used (for example, IP address, TSIG, or TLS certificate [DoT])

Depending on your company policy or business practice, you may be operating one or more types of resolvers. KINDNS best practices and implementation guidelines for Resolver Operators cover three major categories, reflecting the types of resolver services found on the internet in practice:

Private Resolvers

Private resolvers are not publicly accessible and cannot be reached over the open internet. They are typically found in corporate networks or other restricted-access networks. Private resolvers in some cases are part of a trusted computing domain (e.g., Active Directory).

More

Shared Private Resolvers

Shared private resolver operators are typically ISPs or similar hosting service providers. They offer DNS resolution services to their customers (mobile, cable/DSL/fiber residential and commercial users, as well as hosted servers and applications). The client or host is using the ISP to access the rest of the Internet.

More

Public Resolvers

This category includes both open and closed public resolvers. Closed public resolvers are typically commercial DNS filtering/scrubbing services. These service providers are typically not Internet Service Providers, and the clients sending queries to them are located on remote networks. Note that some operators of closed public resolvers may also offer a free tier service, which also makes them open public resolvers.
More

I am a

Private Resolver
Operator

Shared Private
Resolver Operator

Public Resolver
Operator