STIGQter: STIG Summary: Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

For zones split between the external and internal sides of a network, the resource records (RRs) for the external hosts must be separate from the RRs for the internal hosts.

DISA Rule

SV-259352r961863_rule

Vulnerability Number

V-259352

Group Title

SRG-APP-000516-DNS-000091

Rule Version

WDNS-22-000021

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Remove any RRs from the internal zones for which the resolution is for an external IP address.

Remove any RRs from the external zones for which the resolution is for an internal IP address.

Check Contents

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "dnsmgmt.msc".

On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server and then expand "Forward Lookup Zones".

From the expanded list, click to select the zone.

For each zone, review the records.

If any RRs on an internal DNS server resolve to IP addresses located outside the internal DNS server's network, this is a finding.

If any RRs on an external DNS server resolve to IP addresses located inside the network, this is a finding.

Vulnerability Number

V-259352

Documentable

False

Rule Version

WDNS-22-000021

Severity Override Guidance

Check Content Reference

Target Key

5576