STIGQter: STIG Summary: Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

For zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts.

DISA Rule

SV-215585r561297_rule

Vulnerability Number

V-215585

Group Title

SRG-APP-000516-DNS-000091

Rule Version

WDNS-CM-000016

Severity

CAT II

CCI(s)

CCI-000366 - The organization implements the security configuration settings.

Weight

Fix Recommendation

Remove any RRs from the internal zones for which the resolution is for an external IP address.

Remove any RRs from the external zones for which the resolution is for an internal IP address.

Check Contents

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press Windows Key + R, execute dnsmgmt.msc.

On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server, and then expand Forward Lookup Zones.

From the expanded list, click to select the zone.

For each zone, review the records.

If any RRs (Resource Records) on an internal DNS server resolve to IP addresses located outside the internal DNS server's network, this is a finding.

If any RRs (Resource Records) on an external DNS server resolve to IP addresses located inside the network, this is a finding.

For zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments