STIGQter: STIG Summary: Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Windows DNS Server must follow procedures to re-role a secondary name server as the primary name server if the primary name server permanently loses functionality.

DISA Rule

SV-259402r1156951_rule

Vulnerability Number

V-259402

Group Title

SRG-APP-000451-DNS-000069

Rule Version

WDNS-22-000074

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.
CCI-002775 - Implement organization-defined fail-safe procedures when organization-defined failure conditions occur.

Weight

Fix Recommendation

AD-integrated DNS servers will handle the promotion of a secondary DNS server when a primary DNS server loses functionality.

Develop, test, and implement documented procedures to re-role a non-AD-integrated secondary name server to a master name server role if a master name server loses functionality.

Check Contents

Active Directory (AD)-integrated DNS servers will handle the promotion of a secondary DNS server when a primary DNS server loses functionality.

If all of the DNS servers are AD integrated, this is not a finding.

Consult with the system administrator to determine if there are documented procedures to re-role a non-AD-integrated secondary name server to a master name server role if a master name server loses functionality.

If there are no documented procedures to re-role a non-AD-integrated secondary name server to primary if a master name server loses functionality, this is a finding.

Vulnerability Number

V-259402

Documentable

False

Rule Version

WDNS-22-000074

Severity Override Guidance

Check Content Reference

Target Key

5576