Information
Forwarding queries to another name server allows the name service work to be aggregated and may improve performance if a name server is able to take advantage of the cache of an up-stream name server. This may also be a security weakness by relying on servers outside the organization's control and security policies.
Rationale:
One thing to consider when forwarding DNS requests is how secure the server is that is set up as the forwarder. A common recommendation is to use an ISP provided name service that is intended to help performance, and simplify network configuration. However, the down-stream name servers inherit the risk of the name server to which they forward queries. If the up-stream name server is compromised, or has its cache poisoned, then all the name servers that rely on it share the same fate. Forwarding is not necessarily a bad practice, but you need to evaluate the security and risk of the name servers to which you are forwarding queries. If these name servers are not under your organization's control, then evaluating their security can be difficult unless the provider specifically understands security as an integral and very necessary part of its service. In addition, you should be aware that if your forwarders are BIND version 4 or 8 servers, this may leave you vulnerable to the DNS cache poisoning attacks discussed in the next section on BIND versions.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Verify your DNS architecture forwards queries only to trustworthy DNS servers and verify the security of those servers against appropriate security standards.