STIGQter: STIG Summary: Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 30 Jan 2025:

The Exchange Edge server must point to a trusted list of DNS servers for external and internal resolution.

DISA Rule

SV-259636r961587_rule

Vulnerability Number

V-259636

Group Title

SRG-APP-000424

Rule Version

EX19-ED-000224

Severity

CAT II

CCI(s)

• CCI-002466 - Request data integrity verification on the name/address resolution responses the system receives from authoritative sources.

Weight

10

Fix Recommendation

Verify in the EDSP or consult with the appropriate personnel who manage which DNS servers to use for Internal and External DNS resolution.

If a GUID for the External and Internal network adapters are applicable, then gather the values to populate the appropriate properties with the following commands:

netsh lan show interfaces

This will provide the adapters and the GUIDs for each. Identify the external and internal adapters for the Edge server.

Once gathered, run the following:

Set-TransportService -Identity <name of server> -ExternalDNSAdapterEnabled $true -ExternalDNSAdapterGuid <externalAdapterGUID> -InternalDNSAdapterEnabled $true -InternalDNSAdapterGuid <InternalAdapterGuid>

If the "ExternalDNSAdapterEnabled" or InternalDNSAdapterEnabled are set to false, use the following to set the DNS configuration:

Set-TransportService -Identity <name of server> -InternalDNSServers @{add="Trusted DNS IP1","Trusted DNS IP2"}
Set-TransportService -Identity <name of server> -ExternalDNSServers @{add="Trusted DNS IP1","Trusted DNS IP2"}

Check Contents

Verify in the EDSP or consult with the appropriate personnel who manage DNS which servers to use for Internal and External DNS resolution.

If the server is not multi-homed, this does not apply.

In Exchange Management Shell, run the following command:

Get-TransportService |Format-List *dns*

If "ExternalDNSAdapterEnabled : True", and no GUID exists, this is a finding.

If "ExternalDNSAdapterEnabled : False", and the property "ExternalDNSServers" is not populated with the documented trusted DNS servers for External DNS queries, this is a finding.

If "InternalDNSAdapterEnabled : True" and no GUID exists, this is a finding.

If "InternalDNSAdapterEnabled : False" and the property "InternalDNSServers" is not populated the documented trusted DNS servers for Internal DNS queries, this is a finding.

Vulnerability Number

V-259636

Documentable

False

Rule Version

EX19-ED-000224

Severity Override Guidance

Verify in the EDSP or consult with the appropriate personnel who manage DNS which servers to use for Internal and External DNS resolution.

If the server is not multi-homed, this does not apply.

In Exchange Management Shell, run the following command:

Get-TransportService |Format-List *dns*

If "ExternalDNSAdapterEnabled : True", and no GUID exists, this is a finding.

If "ExternalDNSAdapterEnabled : False", and the property "ExternalDNSServers" is not populated with the documented trusted DNS servers for External DNS queries, this is a finding.

If "InternalDNSAdapterEnabled : True" and no GUID exists, this is a finding.

If "InternalDNSAdapterEnabled : False" and the property "InternalDNSServers" is not populated the documented trusted DNS servers for Internal DNS queries, this is a finding.

Check Content Reference

M

Target Key

5579