How to secure a dns server?

Question

System administration

Hello, there is a dns server which forward port is open to the outside, what settings and recommendations can you advise to protect the dns server using pfsense
Thanks in advance

Answer 1

I would generally close it from the outside. For no reason. What goes on inside your grid should stay there.
If there is a site outside, then the hoster and keep dns.
This is of course IMHO, but such a scenario removes a lot of headaches from you and puts a clear boundary between the internal grid and the wild Internet. Ideally, only vpn should be open to the outside.

Answer 2

Open dns is available to everyone
Or limit it to ip addresses

Answer 3

Looking for what purposes the DNS was created.
If its purpose is to serve DNS requests from the outside, then it makes no sense to close it, otherwise it will not work. It is recommended to translate requests to DoH into e, i.e. DNS over Https is a more reliable query protocol.