Mitigating DNS Recursion Loop Denial of Service (100% CPU) on Windows Server DNS?

Question

Mitigating DNS Recursion Loop Denial of Service (100% CPU) on Windows Server DNS?

George Wilson 60

Morning all,

We’ve recently been hit by a right pain of an issue: one of our core Windows Server DNS nodes locked up at 100% CPU. Investigation showed it got stuck in an infinite query recursion loop between our internal forwarders and external upstream roots.

I’m trying to figure out the cleanest way to enforce query depth limits and recursion throttling natively within Windows DNS to prevent this sort of amplification loop from taking down the service.

Does anyone have experience hardening the Windows DNS engine against recursion loops via PowerShell or DNS Policies? Would be dead useful to see how others in the community handle this in enterprise environments. Thanks!

0 comments

Answer accepted by question author

Domic Vo 32,305 Independent Advisor

Hello George Wilson,

The problem of infinite loops in DNS recursion occurs when internal forwarders and external root servers query each other without a termination condition. Windows DNS itself doesn't offer an explicit "Recursion Depth Limit" setting like BIND, but you can harden the engine using two mechanisms. First, you can restrict recursion completely or selectively via DNS policies (Add-DnsServerQueryResolutionPolicy), so that specific zones or clients don't forward recursive queries. Second, you can set the MaxRecursionDepth and MaxRecursionTimeout values in the registry under HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters. These values are not exposed by default but are documented by Microsoft to prevent infinite loops.

In practical terms, this means: set MaxRecursionDepth to a conservative value like 3–5 so that the server discards the request after a few hop attempts, and don't unnecessarily increase the timeout, as this will increase CPU load. With PowerShell, you can also use Set-DnsServerRecursion to globally disable recursion or allow it only for specific clients. Before rolling out the recursion, you should monitor the cluster logs to ensure that the loops are actually being terminated and that legitimate internal queries are still being resolved. This way, you achieve a clean limitation without the risk of an amplification loop crippling the service again.

If my answer is helpful to you, please click "Accept the answer" to support me.

Thank you,

Domic.

0 comments

1 additional answer

Your answer

Answer 1

Windows DNS does not expose a native query-depth limit control for recursion loops in the provided material. The supported hardening options shown are to restrict or disable recursion, scope recursion to trusted clients, and enable response rate limiting where applicable.

A practical native approach is:

Disable recursion in the default recursion scope.

Set-DnsServerRecursionScope -Name . -EnableRecursion $False

This prevents the server from acting as an open resolver broadly.

Create a separate recursion scope for internal clients that are allowed to recurse.

Add-DnsServerRecursionScope -Name "InternalClients" -EnableRecursion $True

Bind that recursion-enabled scope to trusted internal traffic by DNS policy. Example for a specific server interface:

Add-DnsServerQueryResolutionPolicy -Name "SplitBrainRecursionPolicy" -Action ALLOW -ApplyOnRecursion -RecursionScope "InternalClients" -ServerInterfaceIP "EQ,10.0.0.39"

This limits recursion to queries arriving on the internal interface instead of allowing it generally.

If the server is edge-facing and running Windows Server 2016 or later, enable Response Rate Limiting (RRL). RRL is supported for authoritative DNS servers and reduces amplification impact. If legitimate queries are throttled, increase only the Response/Sec and Errors/Sec values incrementally until valid traffic succeeds.

Operationally, the key design point is deciding whether the DNS server should recurse at all. If the server is intended only to answer from local zones, recursion can be disabled. If it must resolve external names for clients, recursion cannot be disabled globally without affecting those lookups.

Also note these constraints from the material:

By default, Microsoft DNS servers allow recursion.
Legacy recursion settings cannot disable recursion per-client or per-interface, but DNS Policy can implement selective recursion control.
Disabling recursion globally is impactful because the server will no longer resolve names outside locally hosted zones.
New DNS policies are applied dynamically without restarting the DNS server.

If the issue specifically involves problematic AAAA recursion behavior with a third-party DNS implementation, this mitigation is documented:

Add-DnsServerQueryResolutionPolicy -Name "BlockRecursionOfAAAA" -ApplyOnRecursion -Action Deny -QType "EQ,AAAA"

For a clean enterprise hardening baseline, use selective recursion control first, then add RRL on edge-facing authoritative servers. Avoid broad recursion exposure on servers that do not need to resolve for all clients.

References: