WDNS-CM-000016 - For zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts.

Information

Authoritative name servers for an enterprise may be configured to receive requests from both external and internal clients.

External clients need to receive RRs that pertain only to public services (public Web server, mail server, etc.)

Internal clients need to receive RRs pertaining to public services as well as internal hosts.

The zone information that serves the RRs on both the inside and the outside of a firewall should be split into different physical files for these two types of clients (one file for external clients and one file for internal clients).

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Remove any RRs from the internal zones for which the resolution is for an external IP address.

Remove any RRs from the external zones for which the resolution is for an internal IP address.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_2012_Server_DNS_V2R4_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000366, Rule-ID|SV-215585r561297_rule, STIG-ID|WDNS-CM-000016, STIG-Legacy|SV-73033, STIG-Legacy|V-58603, Vuln-ID|V-215585

Plugin: Windows

Control ID: 5459384ec22552871ae7df7d361702ef856a30185e2cb5279d243c8c44f13dee