diff --git a/pkg/cmd/server/origin/master.go b/pkg/cmd/server/origin/master.go
index <HASH>..<HASH> 100644
--- a/pkg/cmd/server/origin/master.go
+++ b/pkg/cmd/server/origin/master.go
@@ -785,6 +785,7 @@ func (c *MasterConfig) RunDNSServer() {
 		glog.Fatalf("Could not start DNS: %v", err)
 	}
 	config.DnsAddr = c.Options.DNSConfig.BindAddress
+	config.NoRec = true // do not want to deploy an open resolver
 
 	_, port, err := net.SplitHostPort(c.Options.DNSConfig.BindAddress)
 	if err != nil {
SkyDNS: don't recurse requests