Can someone explain in short what recursive DNS query means and how it can be considered bad?
What is a recursive DNS query?
dns
TL;DR: Recursive queries are part of the way the internet and DNS work,but not all DNS servers should be receiving recursive queries, and whenthe ones that shouldn't respond do respond you can get problems.Longer version:Recursion, n: See under Recursion.A recursive DNS query happens when the DNS server you asked for the address of, say, unix.stackexchange.com doesn't know the answer itself, so it has to check with another server.Normally this is actually how DNS works -- the DNS server of your ISP does not have the entire internet's domain records permanently memorized for obvious reasons, so the following exchange happens under the hood:You: Hey, browser, show me http://unix.stackexchange.comBrowser: Sure thing! ... Hm. I don't actually know what IP addressthat is.Hey, OS, can you tell me where to find unix.stackexchange.com?OS: Sure thing...Hmm. It's not in my own hosts file. Lemme just check my resolverconfiguration...Hey, ISP's DNS server, can you tell me where tofind unix.stackexchange.com?ISP's DNS server: Sure thing!... Hmmm. That one isn't in my list of authoritative domains, and rightnow I don't have that answer cached.Hey, internet root servers, can you tell me who is authoritativefor stackexchange.com?Internet Root Servers: Sure thing! According to our records, you wantns1.serverfault.com, ns2.serverfault.com, or ns3.serverfault.com.ISP's DNS server: Thanks, Internet Root Servers!Hi there, ns2.serverfault.com, can you tell me where to find unix.stackexchange.com? ns2.serverfault.com: Sure thing! That's address 64.34.119.12ISP's DNS server: Great, thanks!OS, the number you're looking for is 64.34.119.12.OS: Great, thanks!Browser, you need address 64.34.119.12Browser: Great, thanks!Okay, calling up the page now.You: Yay, thanks Browser!Now bear in mind that there are actually two types of name serversqueried here -- authoritative DNS servers (the so called rootservers that told your ISP's DNS server where to find SE.com's DNSserver, and SE.com's authoritative DNS server) and recursing orforwarding DNS servers (your ISP's DNS server). Normally, the former type is not supposed to respond to recursivequeries, especially not from outside their own domain.  Smaller ISPssometimes save on costs by having their primary authoritative nameserver be the same server as their primary forwarding nameserver,but that's somewhat unsafe policy - especially if you don't configureyour server to refuse recursive queries from outside your own IPrange.Further reading here on Wikipedia.