STIGQter: STIG Summary: Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

Forwarders on an authoritative Windows 2012 DNS Server, if enabled for external resolution, must only forward to either an internal, non-AD-integrated DNS server or to the DoD Enterprise Recursive Services (ERS).

DISA Rule

SV-215574r561297_rule

Vulnerability Number

V-215574

Group Title

SRG-APP-000383-DNS-000047

Rule Version

WDNS-CM-000004

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press Windows Key + R, execute dnsmgmt.msc.

On the opened DNS Manager snap-in from the left pane, right-click on the server name for the DNS server and select “Properties”.

Click on the “Forwarders” tab.

Replace the forwarders being used with another DoD-managed DNS server or the DoD Enterprise Recursive Services (ERS).

Deselect the "Use root hints if no forwarders are available".

Check Contents

Note: If the Windows DNS server is in the classified network, this check is Not Applicable.

Note: In Windows DNS Server, if forwarders are configured, the recursion setting must also be enabled since disabling recursion will disable forwarders.

If forwarders are not used, recursion must be disabled. In both cases, the use of root hints must be disabled.

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press Windows Key + R, execute dnsmgmt.msc.

On the opened DNS Manager snap-in from the left pane, right-click on the server name for the DNS server and select “Properties”.

Click on the “Forwarders” tab.

If forwarders are not being used, this is not applicable.

Review the IP address(es) for the forwarder(s) use.

If the DNS Server does not forward to another DoD-managed DNS server or to the DoD Enterprise Recursive Services (ERS), this is a finding.

If the "Use root hints if no forwarders are available" is selected, this is a finding.

Vulnerability Number

V-215574

Documentable

False

Rule Version

WDNS-CM-000004

Severity Override Guidance

Note: If the Windows DNS server is in the classified network, this check is Not Applicable.

Note: In Windows DNS Server, if forwarders are configured, the recursion setting must also be enabled since disabling recursion will disable forwarders.

If forwarders are not used, recursion must be disabled. In both cases, the use of root hints must be disabled.

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press Windows Key + R, execute dnsmgmt.msc.

On the opened DNS Manager snap-in from the left pane, right-click on the server name for the DNS server and select “Properties”.

Click on the “Forwarders” tab.

If forwarders are not being used, this is not applicable.

Review the IP address(es) for the forwarder(s) use.

If the DNS Server does not forward to another DoD-managed DNS server or to the DoD Enterprise Recursive Services (ERS), this is a finding.

If the "Use root hints if no forwarders are available" is selected, this is a finding.

Check Content Reference

M

Target Key

4016

Comments