STIGQter STIGQter: STIG Summary: Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Windows DNS Server must protect secret/private cryptographic keys while at rest.

DISA Rule

SV-259393r1028387_rule

Vulnerability Number

V-259393

Group Title

SRG-APP-000231-DNS-000033

Rule Version

WDNS-22-000065

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

To ensure the cryptographic keys are protected after being backed up to tape or other medium, develop a backup policy that includes the protection of backup date at or above the level as the DNS server.

Check Contents

This check is not applicable for Windows DNS Servers that only host Active Directory-integrated zones or for Windows DNS servers on a classified network.

To verify the cryptographic keys are protected after being backed up to another medium (tape, disk, SAN, etc.), consult with the system administrator to determine the backup policy in place for the DNS server.

If a backup policy does not exist or the backup policy does not specify the protection required for the backup medium to be at or above the level as the server, this is a finding.

Vulnerability Number

V-259393

Documentable

False

Rule Version

WDNS-22-000065

Severity Override Guidance

This check is not applicable for Windows DNS Servers that only host Active Directory-integrated zones or for Windows DNS servers on a classified network.

To verify the cryptographic keys are protected after being backed up to another medium (tape, disk, SAN, etc.), consult with the system administrator to determine the backup policy in place for the DNS server.

If a backup policy does not exist or the backup policy does not specify the protection required for the backup medium to be at or above the level as the server, this is a finding.

Check Content Reference

M

Target Key

5576