STIGQter STIGQter: STIG Summary: Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

Forwarders on an authoritative Windows DNS Server, if enabled for external resolution, must forward only to an internal, non-Active Directory (AD)-integrated DNS server or to the DOD Enterprise Recursive Services (ERS).

DISA Rule

SV-259342r1156949_rule

Vulnerability Number

V-259342

Group Title

SRG-APP-000383-DNS-000047

Rule Version

WDNS-22-000010

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "dnsmgmt.msc".

On the opened DNS Manager snap-in from the left pane, right-click on the server name for the DNS server and select "Properties".

Click the "Forwarders" tab.

Replace the forwarders being used with another DOD-managed DNS server or the DOD ERS.

Deselect "Use root hints if no forwarders are available".

Check Contents

Note: If the Windows DNS Server is in the classified network, this check is not applicable. If forwarders are not being used, this is not applicable.

Note: In Windows DNS Server, if forwarders are configured, the recursion setting must also be enabled because disabling recursion will disable forwarders.

If forwarders are not used, recursion must be disabled. In both cases, the use of root hints must be disabled.

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "dnsmgmt.msc".

On the opened DNS Manager snap-in from the left pane, right-click on the server name for the DNS server and select "Properties".

Click the "Forwarders" tab.

Review the IP address(es) for the forwarder(s) use.

If the DNS server does not forward to another DOD-managed DNS server or to the DOD ERS, this is a finding.

If "Use root hints if no forwarders are available" is selected, this is a finding.

Vulnerability Number

V-259342

Documentable

False

Rule Version

WDNS-22-000010

Severity Override Guidance

Note: If the Windows DNS Server is in the classified network, this check is not applicable. If forwarders are not being used, this is not applicable.

Note: In Windows DNS Server, if forwarders are configured, the recursion setting must also be enabled because disabling recursion will disable forwarders.

If forwarders are not used, recursion must be disabled. In both cases, the use of root hints must be disabled.

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "dnsmgmt.msc".

On the opened DNS Manager snap-in from the left pane, right-click on the server name for the DNS server and select "Properties".

Click the "Forwarders" tab.

Review the IP address(es) for the forwarder(s) use.

If the DNS server does not forward to another DOD-managed DNS server or to the DOD ERS, this is a finding.

If "Use root hints if no forwarders are available" is selected, this is a finding.

Check Content Reference

M

Target Key

5576