DISA_STIG_Windows_2012_Server_DNS_v2r5.audit from DISA Microsoft Windows 2012 Server Domain Name System v2r5 STIG

WDNS-AC-000001 - The Windows 2012 DNS Server must restrict incoming dynamic update requests to known clients.

CAT|II

CCI|CCI-000054

Rule-ID|SV-215647r561297_rule

STIG-ID|WDNS-AC-000001

STIG-Legacy|SV-72667

STIG-Legacy|V-58237

Vuln-ID|V-215647

WDNS-AU-000001 - The Windows 2012 DNS Server must be configured to record, and make available to authorized personnel, who added/modified/deleted DNS zone information.

CCI|CCI-000366

CCI|CCI-001902

Rule-ID|SV-215648r561297_rule

STIG-ID|WDNS-AU-000001

STIG-Legacy|SV-72973

STIG-Legacy|V-58543

Vuln-ID|V-215648

WDNS-AU-000003 - The Windows 2012 DNS Server must, in the event of an error validating another DNS servers identity, send notification to the DNS administrator.

CCI|CCI-001906

Rule-ID|SV-215649r561297_rule

STIG-ID|WDNS-AU-000003

STIG-Legacy|SV-72977

STIG-Legacy|V-58547

Vuln-ID|V-215649

WDNS-AU-000005 - The Windows 2012 DNS Server log must be enabled.

CCI|CCI-000169

Rule-ID|SV-215650r561297_rule

STIG-ID|WDNS-AU-000005

STIG-Legacy|SV-72979

STIG-Legacy|V-58549

Vuln-ID|V-215650

WDNS-AU-000006 - The Windows 2012 DNS Server logging must be enabled to record events from all DNS server functions.

Rule-ID|SV-215651r819716_rule

STIG-ID|WDNS-AU-000006

STIG-Legacy|SV-72981

STIG-Legacy|V-58551

Vuln-ID|V-215651

WDNS-AU-000007 - The Windows 2012 DNS Server logging criteria must only be configured by the ISSM or individuals appointed by the ISSM - manage

CCI|CCI-000171

Rule-ID|SV-215652r561297_rule

STIG-ID|WDNS-AU-000007

STIG-Legacy|SV-72983

STIG-Legacy|V-58553

Vuln-ID|V-215652

WDNS-AU-000007 - The Windows 2012 DNS Server logging criteria must only be configured by the ISSM or individuals appointed by the ISSM - permissions

WDNS-AU-000016 - The Windows 2012 DNS Servers audit records must be backed up at least every seven days onto a different system or system component than the system or component being audited.

CCI|CCI-001348

Rule-ID|SV-215660r561297_rule

STIG-ID|WDNS-AU-000016

STIG-Legacy|SV-73003

STIG-Legacy|V-58573

Vuln-ID|V-215660

WDNS-CM-000001 - The validity period for the RRSIGs covering the DS RR for a zones delegated children must be no less than two days and no more than one week.

Rule-ID|SV-215661r561297_rule

STIG-ID|WDNS-CM-000001

STIG-Legacy|SV-73005

STIG-Legacy|V-58575

Vuln-ID|V-215661

WDNS-CM-000002 - The Windows DNS name servers for a zone must be geographically dispersed.

Rule-ID|SV-228571r561297_rule

STIG-ID|WDNS-CM-000002

STIG-Legacy|SV-73007

STIG-Legacy|V-58577

Vuln-ID|V-228571

WDNS-CM-000003 - The Windows 2012 DNS Server must prohibit recursion on authoritative name servers for which forwarders have not been configured for external queries - recursion

Rule-ID|SV-215573r561297_rule

STIG-ID|WDNS-CM-000003

STIG-Legacy|SV-73009

STIG-Legacy|V-58579

Vuln-ID|V-215573

WDNS-CM-000003 - The Windows 2012 DNS Server must prohibit recursion on authoritative name servers for which forwarders have not been configured for external queries - root hints

WDNS-CM-000004 - Forwarders on an authoritative Windows 2012 DNS Server, if enabled for external resolution, must only forward to either an internal, non-AD-integrated DNS server or to the DoD Enterprise Recursive Services (ERS) - forwarders

Rule-ID|SV-215574r561297_rule

STIG-ID|WDNS-CM-000004

STIG-Legacy|SV-73011

STIG-Legacy|V-58581

Vuln-ID|V-215574

WDNS-CM-000004 - Forwarders on an authoritative Windows 2012 DNS Server, if enabled for external resolution, must only forward to either an internal, non-AD-integrated DNS server or to the DoD Enterprise Recursive Services (ERS) - root hints

WDNS-CM-000005 - The Windows 2012 DNS Server with a caching name server role must restrict recursive query responses to only the IP addresses and IP address ranges of known supported clients.

Rule-ID|SV-215575r561297_rule

STIG-ID|WDNS-CM-000005

STIG-Legacy|SV-73013

STIG-Legacy|V-58583

Vuln-ID|V-215575

WDNS-CM-000006 - The Windows 2012 DNS Server with a caching name server role must be secured against pollution by ensuring the authenticity and integrity of queried records.

Rule-ID|SV-215576r561297_rule

STIG-ID|WDNS-CM-000006

STIG-Legacy|SV-73015

STIG-Legacy|V-58585

Vuln-ID|V-215576

WDNS-CM-000007 - The Windows 2012 DNS Server must implement cryptographic mechanisms to detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS).

Rule-ID|SV-215577r561297_rule

STIG-ID|WDNS-CM-000007

STIG-Legacy|SV-73017

STIG-Legacy|V-58587

Vuln-ID|V-215577

WDNS-CM-000008 - The validity period for the RRSIGs covering a zones DNSKEY RRSet must be no less than two days and no more than one week.

Rule-ID|SV-215578r561297_rule

STIG-ID|WDNS-CM-000008

STIG-Legacy|SV-73019

STIG-Legacy|V-58589

Vuln-ID|V-215578

WDNS-CM-000009 - NSEC3 must be used for all internal DNS zones.

Rule-ID|SV-215579r561297_rule

STIG-ID|WDNS-CM-000009

STIG-Legacy|SV-73021

STIG-Legacy|V-58591

Vuln-ID|V-215579

WDNS-CM-000010 - The Windows 2012 DNS Servers zone files must have NS records that point to active name servers authoritative for the domain specified in that record.

CAT|I

Rule-ID|SV-215580r561297_rule

STIG-ID|WDNS-CM-000010

STIG-Legacy|SV-73023

STIG-Legacy|V-58593

Vuln-ID|V-215580

WDNS-CM-000012 - All authoritative name servers for a zone must be located on different network segments.

Rule-ID|SV-215581r561297_rule

STIG-ID|WDNS-CM-000012

STIG-Legacy|SV-73025

STIG-Legacy|V-58595

Vuln-ID|V-215581

WDNS-CM-000013 - All authoritative name servers for a zone must have the same version of zone information.

Rule-ID|SV-215582r744230_rule

STIG-ID|WDNS-CM-000013

STIG-Legacy|SV-73027

STIG-Legacy|V-58597

Vuln-ID|V-215582

WDNS-CM-000014 - The Windows 2012 DNS Server must be configured to enable DNSSEC Resource Records.

Rule-ID|SV-215583r561297_rule

STIG-ID|WDNS-CM-000014

STIG-Legacy|SV-73029

STIG-Legacy|V-58599

Vuln-ID|V-215583

WDNS-CM-000015 - Digital signature algorithm used for DNSSEC-enabled zones must be FIPS-compatible.

Rule-ID|SV-215584r561297_rule

STIG-ID|WDNS-CM-000015

STIG-Legacy|SV-73031

STIG-Legacy|V-58601

Vuln-ID|V-215584

WDNS-CM-000016 - For zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts.

Rule-ID|SV-215585r561297_rule

STIG-ID|WDNS-CM-000016

STIG-Legacy|SV-73033

STIG-Legacy|V-58603

Vuln-ID|V-215585

WDNS-CM-000017 - In a split DNS configuration, where separate name servers are used between the external and internal networks, the external name server must be configured to not be reachable from inside resolvers.

Rule-ID|SV-215586r804964_rule

STIG-ID|WDNS-CM-000017

STIG-Legacy|SV-73035

STIG-Legacy|V-58605

Vuln-ID|V-215586

WDNS-CM-000018 - In a split DNS configuration, where separate name servers are used between the external and internal networks, the internal name server must be configured to not be reachable from outside resolvers.

Rule-ID|SV-215587r804966_rule

STIG-ID|WDNS-CM-000018

STIG-Legacy|SV-73037

STIG-Legacy|V-58607

Vuln-ID|V-215587

WDNS-CM-000019 - Primary authoritative name servers must be configured to only receive zone transfer requests from specified secondary name servers.

Rule-ID|SV-215588r561297_rule

STIG-ID|WDNS-CM-000019

STIG-Legacy|SV-73039

STIG-Legacy|V-58609

Vuln-ID|V-215588

WDNS-CM-000020 - The Windows 2012 DNS Servers zone database files must not be accessible for edit/write by users and/or processes other than the Windows 2012 DNS Server service account and/or the DNS database administrator.

Rule-ID|SV-215589r561297_rule

STIG-ID|WDNS-CM-000020

STIG-Legacy|SV-73041

STIG-Legacy|V-58611

Vuln-ID|V-215589

WDNS-CM-000021 - The Windows 2012 DNS Server must implement internal/external role separation.

Rule-ID|SV-215590r561297_rule

STIG-ID|WDNS-CM-000021

STIG-Legacy|SV-73043

STIG-Legacy|V-58613

Vuln-ID|V-215590

WDNS-CM-000022 - The Windows 2012 DNS Server authoritative for local zones must only point root hints to the DNS servers that host the internal root domain.

Rule-ID|SV-215591r561297_rule

STIG-ID|WDNS-CM-000022

STIG-Legacy|SV-73045

STIG-Legacy|V-58615

Vuln-ID|V-215591

WDNS-CM-000023 - The DNS name server software must be at the latest version.

Rule-ID|SV-215592r561297_rule

STIG-ID|WDNS-CM-000023

STIG-Legacy|SV-73047

STIG-Legacy|V-58617

Vuln-ID|V-215592

WDNS-CM-000024 - The Windows 2012 DNS Servers zone files must not include resource records that resolve to a fully qualified domain name residing in another zone.

Rule-ID|SV-215593r561297_rule

STIG-ID|WDNS-CM-000024

STIG-Legacy|SV-73049

STIG-Legacy|V-58619

Vuln-ID|V-215593

WDNS-CM-000025 - The Windows 2012 DNS Servers zone files must not include CNAME records pointing to a zone with lesser security for more than six months.

Rule-ID|SV-215594r561297_rule

STIG-ID|WDNS-CM-000025

STIG-Legacy|SV-73051

STIG-Legacy|V-58621

Vuln-ID|V-215594

WDNS-CM-000026 - Non-routable IPv6 link-local scope addresses must not be configured in any zone.

Rule-ID|SV-215595r744231_rule

Detections

Analytics

DISA Microsoft Windows 2012 Server DNS STIG v2r5

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

Revision 1.0

Miscellaneous


Revision 1.3 May 28, 2024 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.2 Apr 12, 2023 Miscellaneous Metadata updated. Platform check updated. Variables updated.
Revision 1.1 Mar 7, 2023 Miscellaneous Metadata updated. References updated.
Revision 1.0 Jun 22, 2022 Miscellaneous Metadata updated.