Nameservers are not open resolvers

An authoritative nameserver answers for the zones it holds. A recursive resolver answers for anything, by going and finding out. A server doing both for the general public is an open resolver, and it is a problem for other people rather than for you.

The main risk is reflection. A small forged query can produce a much larger answer, so an open resolver lets an attacker aim that amplification at a victim by spoofing their address as the source — your server does the sending, and its capacity becomes part of somebody else's denial-of-service attack. Open resolvers also widen the surface for cache-poisoning attempts against whoever ends up using them.

This is one of the few probes that deliberately sets the recursion-desired bit, because the question being asked is precisely whether the server will recurse for a stranger.

Separate the roles. Authoritative servers should answer only for their own zones and refuse recursion entirely; resolvers for your users should be reachable only from your networks. Running one process for both is where this nearly always comes from.

In BIND that is recursion no; on the authoritative instance; in others it is the equivalent setting, and every implementation has one.

If the same host must do both, restrict recursion by client address and enable response rate limiting, which blunts the amplification even when a query does get through.