STIGQter STIGQter: STIG Summary: Infoblox 8.x DNS Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The Infoblox DNS service member implementation must maintain the integrity of information during reception.

DISA Rule

SV-233926r1082744_rule

Vulnerability Number

V-233926

Group Title

SRG-APP-000442-DNS-000067

Rule Version

IDNS-8X-700021

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Note: Ensure DNSSEC is configured on all External-facing zones to meet all other STIG requirements prior to signing a zone to avoid signing with an unapproved configuration.

1. Navigate to Data Management >> DNS >> Grid DNS Properties.
2. Toggle Advanced Mode and select the "DNSSEC" tab.
3. Enable DNSSEC validation by selecting the check box.
4. Configure the Trust Anchors.
5. When complete, click "Save & Close" to save the changes and exit the "Properties" screen.
6. Perform a service restart if necessary.

Check Contents

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable.

1. Navigate to Data Management >> DNS >> Zones.
2. Review all external-facing authoritative zones.
Note: To add "Signed" column, select an existing column >> down arrow >> Columns >> Edit Columns. Set the "Signed" check box to "Visible" and select "Apply". DNSSEC signing status will be displayed in the Zones tab. Verify that external authoritative zones are DNSSEC signed.

If DNSSEC is not used for authoritative DNS this is a finding.

Vulnerability Number

V-233926

Documentable

False

Rule Version

IDNS-8X-700021

Severity Override Guidance

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable.

1. Navigate to Data Management >> DNS >> Zones.
2. Review all external-facing authoritative zones.
Note: To add "Signed" column, select an existing column >> down arrow >> Columns >> Edit Columns. Set the "Signed" check box to "Visible" and select "Apply". DNSSEC signing status will be displayed in the Zones tab. Verify that external authoritative zones are DNSSEC signed.

If DNSSEC is not used for authoritative DNS this is a finding.

Check Content Reference

M

Target Key

5251