We have a DNS that sends me a message at the sqish
page that says Security: Server hobbit.gfinter.com (200.33.202.43) is recursive, I would like what does this message means.
Nameservers can be configured in recursive allowed (ra) mode or not.
dnscheck says the message about the server being recursive when it receives a response from a server that has the ra flag set.
Recursion is used by "dumb" clients, such as the unix stub resolver (in libc/libresolv) which does not have the capability to descend the DNS tree and find the answer for itself.
For security reasons it is traditional to have nameservers not configured to recurse if they are hosting zones. Recursion is considered bad because part of the process is to cache responses, and therefore this has the potential to poison your authoritative records if the server has a bug, and therefore an attacker might use this to redirect users somewhere else.
