STIGQter STIGQter: STIG Summary: Infoblox 8.x DNS Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

Recursion must be disabled on Infoblox DNS service members that are configured as External Authoritative DNS service members.

DISA Rule

SV-233860r1156949_rule

Vulnerability Number

V-233860

Group Title

SRG-APP-000383-DNS-000047

Rule Version

IDNS-8X-400002

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

In a split DNS configuration with separate External and Internal DNS servers, verify on the External DNS member:

1. Navigate to Data Management >> DNS >> Members tab.
2. Select each grid member configured in an authoritative role and click "Edit".
3. Review the "Queries" tab.
4. Verify that "Allow Recursion" is not enabled.
5. When complete, click "Cancel" to exit the "Properties" screen.

Check Contents

In a split DNS configuration with separate External and Internal DNS servers, verify on the External DNS member:

1. Navigate to Data Management >> DNS >> Members tab.
2. Select each grid member configured in an authoritative role and click "Edit".
3. Review the "Queries" tab.
4. Verify that "Allow Recursion" is not enabled.
5. When complete, click "Cancel" to exit the "Properties" screen.

If recursion is not disabled on an External authoritative DNS service member, this is a finding.

If split DNS configuration is used and recursion is enabled for External Authoritative DNS, this is a finding.

Vulnerability Number

V-233860

Documentable

False

Rule Version

IDNS-8X-400002

Severity Override Guidance

In a split DNS configuration with separate External and Internal DNS servers, verify on the External DNS member:

1. Navigate to Data Management >> DNS >> Members tab.
2. Select each grid member configured in an authoritative role and click "Edit".
3. Review the "Queries" tab.
4. Verify that "Allow Recursion" is not enabled.
5. When complete, click "Cancel" to exit the "Properties" screen.

If recursion is not disabled on an External authoritative DNS service member, this is a finding.

If split DNS configuration is used and recursion is enabled for External Authoritative DNS, this is a finding.

Check Content Reference

M

Target Key

5251