STIGQter: STIG Summary: Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Windows DNS name servers for a zone must be geographically dispersed.

DISA Rule

SV-259340r1156964_rule

Vulnerability Number

V-259340

Group Title

SRG-APP-000218-DNS-000027

Rule Version

WDNS-22-000008

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

For non-AD integrated Windows DNS Servers, distribute secondary authoritative servers to be in different buildings from the primary authoritative server.

Check Contents

Windows DNS Servers that are Active Directory (AD) integrated must be located where required to meet the AD services.

If all the Windows DNS Servers are AD integrated, this check is not applicable.

If any or all the Windows DNS Servers are standalone and non-AD integrated, verify their geographic location with the system administrator.

If any or all of the authoritative name servers are located in the same building as the primary authoritative name server and the primary authoritative name server is not "hidden", this is a finding.

Vulnerability Number

V-259340

Documentable

False

Rule Version

WDNS-22-000008

Severity Override Guidance

Windows DNS Servers that are Active Directory (AD) integrated must be located where required to meet the AD services.

If all the Windows DNS Servers are AD integrated, this check is not applicable.

If any or all the Windows DNS Servers are standalone and non-AD integrated, verify their geographic location with the system administrator.

If any or all of the authoritative name servers are located in the same building as the primary authoritative name server and the primary authoritative name server is not "hidden", this is a finding.

Check Content Reference

M

Target Key

5576