MEDIUM: DNS Open Resolvers Report

DESCRIPTION LAST UPDATED: 2025-10-30

DEFAULT SEVERITY LEVEL: MEDIUM

This report identifies DNS servers that have the potential to be used in DNS amplification attacks by malicious actors that wish to perform denial of service attacks.

The DNS servers are checked with a command equivalent to:

dig +short @[ip] dnsscan.shadowserver.org

Items that are tagged with “openresolver” indicate that the host responded to the request with the proper name and the proper IP address associated with that DNS name. Items that are tagged with “openresolver;bogusresolver” indicate that the host responded to the request with the proper name, but with an IP address that is NOT associated with that DNS name.

You can view our scan results on our Dashboard.

You can learn more on the report in our DNS Open Resolvers Report tutorial.

CVE-2025-40778 tagging

On 2025-10-30, we added CVE-2025-40778 tagging to our reports. Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. Please make sure to patch. Please note this is a version based scan. If you believe a result is a false positive (for example, due to backporting a patch without updating the version) please let us know. CVE-2025-40778 entries have severity level set to CRITICAL. See also: https://kb.isc.org/docs/cve-2025-40778 (Cache poisoning attacks with unsolicited RRs).

You can learn more on our reports in general in our Overview of Free Public Benefit Shadowserver Reports presentation, which also explains example Use Cases.

Severity levels are described here.

For more information on our scanning efforts, check out our Internet scanning summary page.
This report comes in 2 versions: IPv4 and IPv6.

Filename(s): scan_dns, scan6_dns

 

Fields

  • timestamp
    Time that the IP was probed in UTC+0
  • severity
    Severity level
  • ip
    The IP address of the device in question
  • protocol
    Protocol that the DNS response came on (usually UDP)
  • port
    Port that the DNS response came from
  • hostname
    Reverse DNS name of the device in question
  • tag
    Set to openresolver or openresolver;bogusresolver
  • dns_version
    DNS version string that is reported back when device is probed
  • asn
    ASN of where the device in question resides
  • geo
    Country where the device in question resides
  • region
    State / Province / Administrative region where the device in question resides
  • city
    City in which the device in question resides
  • min_amplification
    The approximate minimum amount of traffic amplification that you could get by querying the DNS server for an A record — this number is obtained by dividing the size of the response by the size of the query
  • naics
    North American Industry Classification System Code
  • hostname_source
    Hostname source
  • sector
    Sector the identified device belongs to

Sample

"timestamp","severity","ip","protocol","port","hostname","tag","dns_version","asn","geo","region","city","min_amplification","naics","hostname_source","sector"
"2010-02-10 00:00:00",medium,192.168.0.1,udp,53,node01.example.com,openresolver,,64512,ZZ,Region,City,1.38,0,,
"2010-02-10 00:00:01",medium,192.168.0.2,udp,53,node02.example.com,openresolver,,64512,ZZ,Region,City,1.38,0,,
"2010-02-10 00:00:02",medium,192.168.0.3,udp,53,node03.example.com,openresolver,,64512,ZZ,Region,City,1.38,0,,

Our 139 Report Types

« Back to Network Reporting