Why do we restrict who can perform recursion?

• A. To prevent amplification attacks
• B. To improve DNS caching
• C. To reduce memory usage
• D. To simplify configuration

Answer: (A)

Restricting who can perform recursion focuses on preventing abuse of DNS resolvers. A recursive resolver may answer by querying multiple other DNS servers and returning a larger response to the requester. If arbitrary users on the Internet can use the resolver, an attacker can spoof a victim’s IP and trigger a flood of large responses toward that victim, creating a DNS amplification attack. Limiting recursion to trusted clients or a controlled network reduces the potential for such abuse because only authorized users can generate recursive queries and the operator can monitor, rate-limit, and defend the resolver. While caching efficiency or memory use can be influenced in other ways, the central reason is to stop amplification attacks.