WDNS-CM-000021 - The Windows 2012 DNS Server must implement internal/external role separation.

Information

DNS servers with an internal role only process name/address resolution requests from within the organization (i.e., internal clients). DNS servers with an external role only process name/address resolution information requests from clients external to the organization (i.e., on the external networks, including the Internet). The set of clients that can access an authoritative DNS server in a particular role is specified by the organization using address ranges, explicit access control lists, etc. In order to protect internal DNS resource information, it is important to isolate the requests to internal DNS servers. Separating internal and external roles in DNS prevents address space that is private (e.g., 10.0.0.0/24) or is otherwise concealed by some form of Network Address Translation from leaking into the public DNS system.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configure separate DNS servers for each of the external and internal networks.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_2012_Server_DNS_V2R7_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-215590r961863_rule, STIG-ID|WDNS-CM-000021, STIG-Legacy|SV-73043, STIG-Legacy|V-58613, Vuln-ID|V-215590

Plugin: Windows

Control ID: d452c794ed3d2b56ef5c7ccec0c09e9fedcb83c06400a2de3ebd8389196d35e0