STIGQter: STIG Summary: Infoblox 8.x DNS Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The Infoblox DNS service member implementation must provide the means to indicate the security status of child zones.

DISA Rule

SV-233909r1082708_rule

Vulnerability Number

V-233909

Group Title

SRG-APP-000214-DNS-000025

Rule Version

IDNS-8X-700004

Severity

CAT II

CCI(s)

• CCI-001179 - Provides the means to indicate the security status of child zones, when operating as part of a distributed, hierarchical namespace.

Weight

10

Fix Recommendation

1. Navigate to Data Management >> DNS >> Zones tab.
2. Select the External parent zone and use the DNSSEC drop-down menu to select "Import Keyset".
3. Add the child zone DS resource records (RRs) and select "Import".
4. Click "Save" and "Close".

Check Contents

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable.

Infoblox systems within a Grid configuration automatically publish DS records to the parent zone when the child zone is signed.

If all External-facing DNS service members for parent and child zones are within an Infoblox Grid, this is not a finding.

1. Review the parent External zones hosted on the External-facing Infoblox server for which the child zone is on the same Infoblox Grid.
2. Verify that each zone includes the DS records for the child zone.

If DS records are not published in the parent zone for DNSSEC signed zones, this is a finding.

Vulnerability Number

V-233909

Documentable

False

Rule Version

IDNS-8X-700004

Severity Override Guidance

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable.

Infoblox systems within a Grid configuration automatically publish DS records to the parent zone when the child zone is signed.

If all External-facing DNS service members for parent and child zones are within an Infoblox Grid, this is not a finding.

1. Review the parent External zones hosted on the External-facing Infoblox server for which the child zone is on the same Infoblox Grid.
2. Verify that each zone includes the DS records for the child zone.

If DS records are not published in the parent zone for DNSSEC signed zones, this is a finding.

Check Content Reference

M

Target Key

5251