How to disable recursive DNS service on the firewall by CLI?

Zyxel_Jeff

Scenario :

Some Internet Service Providers may offer recursive DNS service. Once the firewall/router is assigned a public IP, external Internet users can execute a DNS query via the public IP (e.g., using 'nslookup www.google.com [public IP address]'). However, this behavior may impose additional load on the firewall/router. This article will guide you on how to disable it by the CLI. Regarding this FAQ article: How to disable recursive DNS service on the firewall? We already guide you on how to disable recursive DNS service on the device Web-GUI. You also can use CLI to disable this function.

Answer :

Disable CLIs:

Router# configure terminal
Router(config)# ip dns security-options default
Router(config-ip-dns-security-options)# no recursion activate
Router(config-ip-dns-security-options)# no additional-from-cache activate
Router(config-ip-dns-security-options)# exit

Once you complete the disable CLIs and navigate to System > DNS > Advance > Security Option Control will find those two options are set to deny.

If you want to enable it again, please refer to below Enable CLIs :

Router# configure terminal
Router(config)# ip dns security-options default
Router(config-ip-dns-security-options)# recursion activate
Router(config-ip-dns-security-options)# additional-from-cache activate
Router(config-ip-dns-security-options)# exit