STIGQter: STIG Summary: Infoblox 8.x DNS Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The Infoblox Grid Master must be configured as a stealth (hidden) domain DNS service member in order to protect the Zone Signing Key (ZSK) residing on it.

DISA Rule

SV-233904r1083000_rule

Vulnerability Number

V-233904

Group Title

SRG-APP-000176-DNS-000096

Rule Version

IDNS-8X-500007

Severity

CAT I

CCI(s)

• CCI-000186 - For public key-based authentication, enforce authorized access to the corresponding private key.

Weight

10

Fix Recommendation

1. Navigate to Data Management >> DNS >> Zones.
2. Select the zone, click "Edit", and select the "DNS service members" tab.
3. Mark the Grid Master as "Stealth".
4. If no other DNS service members are listed, one must be added before the configuration can be valid.
5. When complete, click "Save & Close" to save the changes and exit the "Properties" screen.
6. Perform a service restart if necessary.

Check Contents

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable.

By default, ZSK private keys are stored encrypted within the Infoblox database on the Grid Master. The Grid Master will by default enable the DNS service when DNSSEC is enabled for internal processing. Clients must not be permitted to use the Grid Master DNS service. Refer to the Infoblox STIG Overview document for additional information on HSM usage.

1. Navigate to Data Management >> DNS >> Zones.
2. Review each zone by selecting the zone, clicking "Edit", and selecting the "DNS service members" tab.
3. When complete, click "Cancel" to exit the "Properties" screen.

If the Grid Master is a listed DNS service member and not marked "Stealth", this is a finding.

Vulnerability Number

V-233904

Documentable

False

Rule Version

IDNS-8X-500007

Severity Override Guidance

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable.

By default, ZSK private keys are stored encrypted within the Infoblox database on the Grid Master. The Grid Master will by default enable the DNS service when DNSSEC is enabled for internal processing. Clients must not be permitted to use the Grid Master DNS service. Refer to the Infoblox STIG Overview document for additional information on HSM usage.

1. Navigate to Data Management >> DNS >> Zones.
2. Review each zone by selecting the zone, clicking "Edit", and selecting the "DNS service members" tab.
3. When complete, click "Cancel" to exit the "Properties" screen.

If the Grid Master is a listed DNS service member and not marked "Stealth", this is a finding.

Check Content Reference

M

Target Key

5251