The person who asked that question does demonstrate some lack of understanding of what it is he is getting himself into. But I don't think that in itself is enough to justify closing the question as off-topic.

I would much rather see it closed as a duplicate of a good canonical question with a useful answer.

With an answer which simply says: "don't do it", we run the risk that some of the people reading that answer are simply going to ignore it, and run insecure resolvers which is bad for the internet.

In short people are more likely to pay attention to what you say if you give them an answer explaining how to solve the problem they want to solve than they are if you tell them they are unprofessional and they should not even try.

The problem can be solved

I believe it will be more effective to actually explain what it takes to operate a secure recursive resolver. Some will be able to use those answers to operate a secure service. Some will be scared by the answers and decide not to operate an open resolver.

The main threat from open resolvers is amplification. But if every open resolver would implement DNS cookies and force fallback to TCP for all clients without DNS cookies support, that problem would be more or less solved.

Rather than trying to get rid of all open resolves, I think it would be more realistic to get all of them to enforce DNS cookies, and I think that would be better for the internet.

Another threat

Apart from reflection there is another threat, which is flooding authoritative DNS servers with queries for non-existing records. However that threat is not inherent to open resolvers.

Almost every machine participating in such an attack has legitimate access to multiple resolvers which they could use in the attack. An absence of open resolvers would not prevent such an attack.

There is a draft standard intended to address that threat. And it applies to all resolvers whether they are open or not.

Advocating these two solutions (and possibly others which I didn't think of), would in my opinion be a much better strategy than trying to stop everybody from running open resolvers.

The person who asked that question does demonstrate some lack of understanding of what it is he is getting himself into. But I don't think that in itself is enough to justify closing the question as off-topic.

I would much rather see it closed as a duplicate of a good canonical question with a useful answer.

With an answer which simply says: "don't do it", we run the risk that some of the people reading that answer are simply going to ignore it, and run insecure resolvers which is bad for the internet.

In short people are more likely to pay attention to what you say if you give them an answer explaining how to solve the problem they want to solve than they are if you tell them they are unprofessional and they should not even try.

The problem can be solved

I believe it will be more effective to actually explain what it takes to operate a secure recursive resolver. Some will be able to use those answers to operate a secure service. Some will be scared by the answers and decide not to operate an open resolver.

The main threat from open resolvers is amplification. But if every open resolver would implement DNS cookies and force fallback to TCP for all clients without DNS cookies support, that problem would be more or less solved.

Rather than trying to get rid of all open resolves, I think it would be more realistic to get all of them to enforce DNS cookies, and I think that would be better for the internet.

Another threat

Apart from reflection there is another threat, which is flooding authoritative DNS servers with queries for non-existing records. However that threat is not inherent to open resolvers.

Almost every machine participating in such an attack has legitimate access to multiple resolvers which they could use in the attack. An absence of open resolvers would not prevent such an attack.

There is a draft standard intended to address that threat. And it applies to all resolvers whether they are open or not.

Advocating these two solutions (and possibly others which I didn't think of), would in my opinion be a much better strategy than trying to stop everybody from running open resolvers.

The person who asked that question does demonstrate some lack of understanding of what it is he is getting himself into. But I don't think that in itself is enough to justify closing the question as off-topic.

I would much rather see it closed as a duplicate of a good canonical question with a useful answer.

With an answer which simply says: "don't do it", we run the risk that some of the people reading that answer are simply going to ignore it, and run insecure resolvers which is bad for the internet.

In short people are more likely to pay attention to what you say if you give them an answer explaining how to solve the problem they want to solve than they are if you tell them they are unprofessional and they should not even try.

The problem can be solved

I believe it will be more effective to actually explain what it takes to operate a secure recursive resolver. Some will be able to use those answers to operate a secure service. Some will be scared by the answers and decide not to operate an open resolver.

The main threat from open resolvers is amplification. But if every open resolver would implement DNS cookies and force fallback to TCP for all clients without DNS cookies support, that problem would be more or less solved.

Rather than trying to get rid of all open resolves, I think it would be more realistic to get all of them to enforce DNS cookies, and I think that would be better for the internet.

Another threat

Apart from reflection there is another threat, which is flooding authoritative DNS servers with queries for non-existing records. However that threat is not inherent to open resolvers.

Almost every machine participating in such an attack has legitimate access to multiple resolvers which they could use in the attack. An absence of open resolvers would not prevent such an attack.

There is a draft standard intended to address that threat. And it applies to all resolvers whether they are open or not.

Advocating these two solutions (and possibly others which I didn't think of), would in my opinion be a much better strategy than trying to stop everybody from running open resolvers.

The person who asked that question does demonstrate some lack of understanding of what it is he is getting himself into. But I don't think that in itself is enough to justify closing the question as off-topic.

I would much rather see it closed as a duplicate of a good canonical question with a useful answer.

With an answer which simply says: "don't do it", we run the risk that some of the people reading that answer are simply going to ignore it, and run insecure resolvers which is bad for the internet.

In short people are more likely to pay attention to what you say if you give them an answer explaining how to solve the problem they want to solve than they are if you tell them they are unprofessional and they should not even try.

The problem can be solved

I believe it will be more effective to actually explain what it takes to operate a secure recursive resolver. Some will be able to use those answers to operate a secure service. Some will be scared by the answers and decide not to operate an open resolver.

The main threat from open resolvers is amplification. But if every open resolver would implement DNS cookies and force fallback to TCP for all clients without DNS cookies support, that problem would be more or less solved.

Rather than trying to get rid of all open resolves, I think it would be more realistic to get all of them to enforce DNS cookies, and I think that would be better for the internet.

Another threat

Apart from reflection there is another threat, which is flooding authoritative DNS servers with queries for non-existing records. However that threat is not inherent to open resolvers.

Almost every machine participating in such an attack has legitimate access to multiple resolvers which they could use in the attack. An absence of open resolvers would not prevent such an attack.

There is a draft standard intended to address that threat. And it applies to all resolvers whether they are open or not.

Advocating these two solutions (and possibly others which I didn't think of), would in my opinion be a much better strategy than trying to stop everybody from running open resolvers.