Information
Dynamic updates are used to automate the updating of zones. Dynamic updates are typically used with DHCP, however updates may include deleting or adding any resource records of a zone except the SOA and NS records. Allowing other systems to make permanent updates to your zones is of course not allowed by default, and needs to be carefully restricted.
Rationale:
The usage of the 'allow-update' option with IP addresses is discouraged as the source address of the UDP packet can be forged and could lead to a compromise of data. Due to this, 'allow-update' should not be used. If it is found to be necessary to use 'allow-update,' the use of TSIG authentication is encouraged as well as 'allow-update forwarding' to specify which slaves to accept updates from. Again, this configuration is strongly discouraged as it allows compromised slave servers to push updates to the master.
Instead of the 'allow-update' option, use 'update policy' to grant 'A' record updates to the dynamically updated sub-domain for the host specific TSIG key.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
1. Add a similar statement to a server's zone statement using the appropriate TSIG key for the target.
2. Include a server statement