topic Re: Requests from internal company DNS to Root-servers.net in General Topics

Requests from internal company DNS to Root-servers.net

R.Colella615280 — Wed, 11 Feb 2026 20:21:24 GMT

Hi, i'm observing in the fw logs massive requests from company dns servers to root servers (53 udp).
These servers are generally named *.root-servers.net.
I know that our Dns are configured to interrogate our provider DNS.

Do i need to allow communication to root servers?
How to securely address the policy rule as i cannot allow all dns query (to avoid dns spoofing)?

Re: Requests from internal company DNS to Root-servers.net

JayGolf — Thu, 12 Feb 2026 04:18:37 GMT

Hi @R.Colella615280 ,

Is your internal DNS set to forward all queries to the provider DNS? If so, then Id imagine you shouldn't see so many requests contacting root servers directly from your internal... I would verify how DNS is setup internally in your environment (review forwarders/conditional forwarding/recursion). If your DNS servers are performing recursive lookups themselves, then querying root servers is typical.

What to do with the traffic you see directly to root servers depends entirely on your orgs intended DNS design. If the intent was the environment should only use provider DNS, then root queries should not occur at all.

As far as how to handle DNS, from a high-level:

- only specify your internal DNS servers as a source

- destination is set to only approved upstream DNS servers or Root servers

- Block all other outbound DNS from internal networks

- specify the dns app and service being app-default

- Attach an anti-spyware profile w/ DNS Security enabled to inspect and protect DNS traffic.

Hope this helps!

Re: Requests from internal company DNS to Root-servers.net

OtakarKlier — Thu, 19 Feb 2026 18:53:48 GMT

Hello,

While I'm sure there is a reason you are using root servers for external DNS. You might want to watch this 12 min video.

https://www.youtube.com/watch?v=ROIAYSEbTuo

Regards,