STIGQter STIGQter: STIG Summary: Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

All authoritative name servers for a zone must be located on different network segments.

DISA Rule

SV-259348r1156953_rule

Vulnerability Number

V-259348

Group Title

SRG-APP-000516-DNS-000087

Rule Version

WDNS-22-000017

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

For non-AD-integrated Windows DNS Servers, distribute secondary authoritative servers on separate network segments from the primary authoritative server.

Check Contents

Windows DNS Servers that are Active Directory (AD) integrated must be located where required to meet the Active Directory services.

If all of the Windows DNS Servers are AD integrated, this check is not applicable.

If any or all the Windows DNS Servers are standalone and non-AD integrated, verify their geographic location with the system administrator.

If all of the authoritative name servers are located on the same network segment and the primary authoritative name server is not "hidden", this is a finding.

Vulnerability Number

V-259348

Documentable

False

Rule Version

WDNS-22-000017

Severity Override Guidance

Windows DNS Servers that are Active Directory (AD) integrated must be located where required to meet the Active Directory services.

If all of the Windows DNS Servers are AD integrated, this check is not applicable.

If any or all the Windows DNS Servers are standalone and non-AD integrated, verify their geographic location with the system administrator.

If all of the authoritative name servers are located on the same network segment and the primary authoritative name server is not "hidden", this is a finding.

Check Content Reference

M

Target Key

5576