STIGQter STIGQter: STIG Summary: Domain Name System (DNS) Security Requirements Guide Version: 2 Release: 4 Benchmark Date: 23 Oct 2015:

A zone file must not include resource records that resolve to a fully qualified domain name residing in another zone.

DISA Rule

SV-69209r1_rule

Vulnerability Number

V-54963

Group Title

SRG-APP-000516-DNS-000113

Rule Version

SRG-APP-000516-DNS-000113

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Remove any resource records in a zone file if the resource record resolves to a fully qualified domain name residing in another zone.

Check Contents

Review the zone files and confirm with the DNS administrator that the hosts defined in the zone files do not resolve to hosts in another zone with its fully qualified domain name.

The exceptions are glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third party Content Delivery Networks (CDN) or cloud computing platforms. In the case of third-party CDNs or cloud offerings, an approved mission need must be demonstrated.

If resource records are maintained that resolve to a fully qualified domain name in another zone, and the usage is not for resource records resolving to hosts that are glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms with a documented and approved mission need, this is a finding.

Vulnerability Number

V-54963

Documentable

False

Rule Version

SRG-APP-000516-DNS-000113

Severity Override Guidance

Review the zone files and confirm with the DNS administrator that the hosts defined in the zone files do not resolve to hosts in another zone with its fully qualified domain name.

The exceptions are glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third party Content Delivery Networks (CDN) or cloud computing platforms. In the case of third-party CDNs or cloud offerings, an approved mission need must be demonstrated.

If resource records are maintained that resolve to a fully qualified domain name in another zone, and the usage is not for resource records resolving to hosts that are glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms with a documented and approved mission need, this is a finding.

Check Content Reference

M

Target Key

2355

Comments