What’s the difference between recursion and forwarding in bind

I’m trying to understand how bind works but have been unable to find definite information about the difference between recursive queries and “forwarding”.

I’ve read that globally allowing recursive queries is bad because it allows ddos attacks. But isn’t the same true for forwarding? Or is forwarding a prerequisite for recursive queries?

In a nutshell:

Forwarding: just passes the DNS query to another DNS server (e.g. your ISP's). Home routers use forwarding to pass DNS queries from your home network's clients to your ISP's DNS servers. For example, for foo.example.com, a forwarding DNS server would first check its cache (did it already ask this question before), and if the answer is not in its cache, it would ask its forwarder (your ISP's DNS server) for the answer, which would respond with either a cached response, or would perform recursion until it figured out the answer.

Recursion: the DNS server receiving the query takes it upon itself to figure out the answer to that query by recursively querying authoritative DNS servers for that domain. For example, for foo.example.com, a recursor would first query the root servers for what DNS servers are responsible for the .com TLD, then it would ask those servers for example.com, then it would query the servers for example.com for foo.example.com, finally getting the answer to the original query.

In terms of security, you should separate recursors/forwarders (typically DNS servers used to service a bunch of clients) and authoritative DNS servers (typically these are responsible ONLY for answering queries re: domains that they are authoritative for - these servers will NOT perform recursive queries for anyone).

I hope this clears things up a bit...