DISA_STIG_Microsoft_Windows_2012_Server_DNS_v2r7.audit from DISA Microsoft Windows 2012 Server Domain Name System v2r7 STIG

WDNS-AC-000001 - The Windows 2012 DNS Server must restrict incoming dynamic update requests to known clients.

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-215647r960735_rule

STIG-ID|WDNS-AC-000001

STIG-Legacy|SV-72667

STIG-Legacy|V-58237

Vuln-ID|V-215647

WDNS-AU-000001 - The Windows 2012 DNS Server must be configured to record, and make available to authorized personnel, who added/modified/deleted DNS zone information.

800-53|AU-10(1)(b)

800-53|CM-6b.

CCI|CCI-000366

CCI|CCI-001902

Rule-ID|SV-215648r987677_rule

STIG-ID|WDNS-AU-000001

STIG-Legacy|SV-72973

STIG-Legacy|V-58543

Vuln-ID|V-215648

WDNS-AU-000003 - The Windows 2012 DNS Server must, in the event of an error validating another DNS servers identity, send notification to the DNS administrator.

800-53|AU-10(2)(b)

CCI|CCI-001906

Rule-ID|SV-215649r987679_rule

STIG-ID|WDNS-AU-000003

STIG-Legacy|SV-72977

STIG-Legacy|V-58547

Vuln-ID|V-215649

WDNS-AU-000005 - The Windows 2012 DNS Server log must be enabled.

800-53|AU-12a.

CCI|CCI-000169

Rule-ID|SV-215650r960879_rule

STIG-ID|WDNS-AU-000005

STIG-Legacy|SV-72979

STIG-Legacy|V-58549

Vuln-ID|V-215650

WDNS-AU-000006 - The Windows 2012 DNS Server logging must be enabled to record events from all DNS server functions.

Rule-ID|SV-215651r960879_rule

STIG-ID|WDNS-AU-000006

STIG-Legacy|SV-72981

STIG-Legacy|V-58551

Vuln-ID|V-215651

WDNS-AU-000007 - The Windows 2012 DNS Server logging criteria must only be configured by the ISSM or individuals appointed by the ISSM.

800-53|AU-12b.

CCI|CCI-000171

Rule-ID|SV-215652r961863_rule

STIG-ID|WDNS-AU-000007

STIG-Legacy|SV-72983

STIG-Legacy|V-58553

Vuln-ID|V-215652

WDNS-AU-000016 - The Windows 2012 DNS Servers audit records must be backed up at least every seven days onto a different system or system component than the system or component being audited.

800-53|AU-9(2)

CCI|CCI-001348

Rule-ID|SV-215660r960948_rule

STIG-ID|WDNS-AU-000016

STIG-Legacy|SV-73003

STIG-Legacy|V-58573

Vuln-ID|V-215660

WDNS-CM-000001 - The validity period for the RRSIGs covering the DS RR for a zones delegated children must be no less than two days and no more than one week.

Rule-ID|SV-215661r961104_rule

STIG-ID|WDNS-CM-000001

STIG-Legacy|SV-73005

STIG-Legacy|V-58575

Vuln-ID|V-215661

WDNS-CM-000002 - The Windows DNS name servers for a zone must be geographically dispersed.

Rule-ID|SV-228571r961863_rule

STIG-ID|WDNS-CM-000002

STIG-Legacy|SV-73007

STIG-Legacy|V-58577

Vuln-ID|V-228571

WDNS-CM-000003 - The Windows 2012 DNS Server must prohibit recursion on authoritative name servers for which forwarders have not been configured for external queries.

Rule-ID|SV-215573r961470_rule

STIG-ID|WDNS-CM-000003

STIG-Legacy|SV-73009

STIG-Legacy|V-58579

Vuln-ID|V-215573

WDNS-CM-000004 - Forwarders on an authoritative Windows 2012 DNS Server, if enabled for external resolution, must only forward to either an internal, non-AD-integrated DNS server or to the DoD Enterprise Recursive Services (ERS).

Rule-ID|SV-215574r961470_rule

STIG-ID|WDNS-CM-000004

STIG-Legacy|SV-73011

STIG-Legacy|V-58581

Vuln-ID|V-215574

WDNS-CM-000005 - The Windows 2012 DNS Server with a caching name server role must restrict recursive query responses to only the IP addresses and IP address ranges of known supported clients.

Rule-ID|SV-215575r961470_rule

STIG-ID|WDNS-CM-000005

STIG-Legacy|SV-73013

STIG-Legacy|V-58583

Vuln-ID|V-215575

WDNS-CM-000006 - The Windows 2012 DNS Server with a caching name server role must be secured against pollution by ensuring the authenticity and integrity of queried records.

Rule-ID|SV-215576r961470_rule

STIG-ID|WDNS-CM-000006

STIG-Legacy|SV-73015

STIG-Legacy|V-58585

Vuln-ID|V-215576

WDNS-CM-000007 - The Windows 2012 DNS Server must implement cryptographic mechanisms to detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS).

Rule-ID|SV-215577r961635_rule

STIG-ID|WDNS-CM-000007

STIG-Legacy|SV-73017

STIG-Legacy|V-58587

Vuln-ID|V-215577

WDNS-CM-000008 - The validity period for the RRSIGs covering a zones DNSKEY RRSet must be no less than two days and no more than one week.

Rule-ID|SV-215578r961863_rule

STIG-ID|WDNS-CM-000008

STIG-Legacy|SV-73019

STIG-Legacy|V-58589

Vuln-ID|V-215578

WDNS-CM-000009 - NSEC3 must be used for all internal DNS zones.

Rule-ID|SV-215579r961863_rule

STIG-ID|WDNS-CM-000009

STIG-Legacy|SV-73021

STIG-Legacy|V-58591

Vuln-ID|V-215579

WDNS-CM-000010 - The Windows 2012 DNS Servers zone files must have NS records that point to active name servers authoritative for the domain specified in that record.

CAT|I

Rule-ID|SV-215580r961863_rule

STIG-ID|WDNS-CM-000010

STIG-Legacy|SV-73023

STIG-Legacy|V-58593

Vuln-ID|V-215580

WDNS-CM-000012 - All authoritative name servers for a zone must be located on different network segments.

Rule-ID|SV-215581r961863_rule

STIG-ID|WDNS-CM-000012

STIG-Legacy|SV-73025

STIG-Legacy|V-58595

Vuln-ID|V-215581

WDNS-CM-000013 - All authoritative name servers for a zone must have the same version of zone information.

Rule-ID|SV-215582r961863_rule

STIG-ID|WDNS-CM-000013

STIG-Legacy|SV-73027

STIG-Legacy|V-58597

Vuln-ID|V-215582

WDNS-CM-000014 - The Windows 2012 DNS Server must be configured to enable DNSSEC Resource Records.

Rule-ID|SV-215583r961863_rule

STIG-ID|WDNS-CM-000014

STIG-Legacy|SV-73029

STIG-Legacy|V-58599

Vuln-ID|V-215583

WDNS-CM-000015 - Digital signature algorithm used for DNSSEC-enabled zones must be FIPS-compatible.

Rule-ID|SV-215584r961863_rule

STIG-ID|WDNS-CM-000015

STIG-Legacy|SV-73031

STIG-Legacy|V-58601

Vuln-ID|V-215584

WDNS-CM-000016 - For zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts.

Rule-ID|SV-215585r961863_rule

STIG-ID|WDNS-CM-000016

STIG-Legacy|SV-73033

STIG-Legacy|V-58603

Vuln-ID|V-215585

WDNS-CM-000017 - In a split DNS configuration, where separate name servers are used between the external and internal networks, the external name server must be configured to not be reachable from inside resolvers.

Rule-ID|SV-215586r961863_rule

STIG-ID|WDNS-CM-000017

STIG-Legacy|SV-73035

STIG-Legacy|V-58605

Vuln-ID|V-215586

WDNS-CM-000018 - In a split DNS configuration, where separate name servers are used between the external and internal networks, the internal name server must be configured to not be reachable from outside resolvers.

Rule-ID|SV-215587r961863_rule

STIG-ID|WDNS-CM-000018

STIG-Legacy|SV-73037

STIG-Legacy|V-58607

Vuln-ID|V-215587

WDNS-CM-000019 - Primary authoritative name servers must be configured to only receive zone transfer requests from specified secondary name servers.

Rule-ID|SV-215588r961863_rule

STIG-ID|WDNS-CM-000019

STIG-Legacy|SV-73039

STIG-Legacy|V-58609

Vuln-ID|V-215588

WDNS-CM-000020 - The Windows 2012 DNS Servers zone database files must not be accessible for edit/write by users and/or processes other than the Windows 2012 DNS Server service account and/or the DNS database administrator.

Rule-ID|SV-215589r961863_rule

STIG-ID|WDNS-CM-000020

STIG-Legacy|SV-73041

STIG-Legacy|V-58611

Vuln-ID|V-215589

WDNS-CM-000021 - The Windows 2012 DNS Server must implement internal/external role separation.

Rule-ID|SV-215590r961863_rule

STIG-ID|WDNS-CM-000021

STIG-Legacy|SV-73043

STIG-Legacy|V-58613

Vuln-ID|V-215590

WDNS-CM-000022 - The Windows 2012 DNS Server authoritative for local zones must only point root hints to the DNS servers that host the internal root domain.

Rule-ID|SV-215591r961863_rule

STIG-ID|WDNS-CM-000022

STIG-Legacy|SV-73045

STIG-Legacy|V-58615

Vuln-ID|V-215591

WDNS-CM-000023 - The DNS name server software must be at the latest version.

Rule-ID|SV-215592r961863_rule

STIG-ID|WDNS-CM-000023

STIG-Legacy|SV-73047

STIG-Legacy|V-58617

Vuln-ID|V-215592

WDNS-CM-000024 - The Windows 2012 DNS Servers zone files must not include resource records that resolve to a fully qualified domain name residing in another zone.

Rule-ID|SV-215593r961863_rule

STIG-ID|WDNS-CM-000024

STIG-Legacy|SV-73049

STIG-Legacy|V-58619

Vuln-ID|V-215593

WDNS-CM-000025 - The Windows 2012 DNS Servers zone files must not include CNAME records pointing to a zone with lesser security for more than six months.

Rule-ID|SV-215594r961863_rule

STIG-ID|WDNS-CM-000025

STIG-Legacy|SV-73051

Detections

Analytics

DISA Microsoft Windows 2012 Server DNS STIG v2r7

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous