DNS Forwarders with no recursion

Question

As I understand it, Windows DNS has a problem with its recursion (being attacked recently). But if you turn it off, and turn off internet access (forwarders). Is there a way to turn off recursion, and still allow the DNS server to use the root hint servers? 
Other DNS servers?
If, as I suspect, the answer is no.  Is there a way to disable recursion, but still allow certain domains (say domains that I control) to resolve.  As an example;
DomainA.edu is prod
DomainB.edu is test
I don't really care if DomainB can see google, but I do want DomainB too be able to resolve DomainA.  There is no Active Directory or other connection between the domains.
Can I do an import of DomainA or something to that effect (A manual zone transfer say)

Answer 1

Do you have a link that you can share with more information on that attack issue you are referring to? - Thanks.
Or perhaps you are talking about DNS Cache Poisoning?
There are two separate Recurision settings - one under the Advanced tab, and one under Forwarders.
Advanced tab: If you disable the one under Advanced, then your DNS server effectively becomes a Root server and won't recurse at all, meaning it will not use root hints (because it thinks it's one of them), and won't Forward (since that's
a recursion request. This effectively also makes it a content only server where whatever zones it hosts, is all it will resolve for requests.
Forwarders tab: If you disable it under Forwarders, it won't look further if the forwarder(s) fail(s).
You could theoretically set a conditional forwarder to a specific DNS, such as 2.2.2.2 for example, for DomainA.edu, and set the checkbox for no Recursion just for that domain, so it will only send the request to 2.2.2.2, then on 2.2.2.2 is set
to not allow recursion under the Advanced tab.
You could also setup one or two separate DNS servers in your DMZ that are not part of your domain and that have the MaxCacheTTL set to 0 so it won't cache, and have them just use the Roots and host no zones. Then internally, you can forward to
them, which they in turn will resolve external data. This is a secure setup that meets PCI DSS requirements (Payment Card Industy Data Security Standards). I myself work at a university hospital with 27k mailboxes. Without getting into specifics, this is part
of our setup, which meets HIPAA requirements.
Here's a secure setup (not neccessarily what we have in our establishment):
Here's a detailed discussion about Forwarders, recursion, etc:
TechNet thread: "DNS Recursion:"
https://social.technet.microsoft.com/Forums/en-US/24ea1094-0ae4-47b5-9b74-2f77884cce15/dns-recursion
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.