STIGQter STIGQter: STIG Summary: Domain Name System (DNS) Security Requirements Guide Version: 2 Release: 4 Benchmark Date: 23 Oct 2015:

The salt value for zones signed using NSEC3 RRs must be changed every time the zone is completely re-signed.

DISA Rule

SV-69163r1_rule

Vulnerability Number

V-54917

Group Title

SRG-APP-000516-DNS-000077

Rule Version

SRG-APP-000516-DNS-000077

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Include instructions in the DNS operational procedures to change the salt value every time RRs signed by NSEC3 have been re-signed.

Check Contents

Check the DNS configuration files and operational documentation. If the zone's RRs have been signed with NSEC3, the operational procedures should stipulate to change the salt value every time the zone is completely re-signed.

If the operational procedures do not specify to change the salt value for RRs signed with NSEC3 every time the zone is completely re-signed, this is a finding.

Vulnerability Number

V-54917

Documentable

False

Rule Version

SRG-APP-000516-DNS-000077

Severity Override Guidance

Check the DNS configuration files and operational documentation. If the zone's RRs have been signed with NSEC3, the operational procedures should stipulate to change the salt value every time the zone is completely re-signed.

If the operational procedures do not specify to change the salt value for RRs signed with NSEC3 every time the zone is completely re-signed, this is a finding.

Check Content Reference

M

Target Key

2355

Comments