The IP address for hidden master authoritative name servers must not appear in the name servers set in the zone database.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-54953	SRG-APP-000516-DNS-000108	SV-69199r1_rule		Medium

Description
A hidden master authoritative server is an authoritative DNS server whose IP address does not appear in the name server set for a zone. All of the name servers that do appear in the zone database as designated name servers get their zone data from the hidden master via a zone transfer request. In effect, all visible name servers are actually secondary slave servers. This prevents potential attackers from targeting the master name server because its IP address may not appear in the zone database.

Description

A hidden master authoritative server is an authoritative DNS server whose IP address does not appear in the name server set for a zone. All of the name servers that do appear in the zone database as designated name servers get their zone data from the hidden master via a zone transfer request. In effect, all visible name servers are actually secondary slave servers. This prevents potential attackers from targeting the master name server because its IP address may not appear in the zone database.

STIG	Date
Domain Name System (DNS) Security Requirements Guide	2015-01-05

Details

Check Text ( C-55579r1_chk )
Check the DNS documentation to determine if a hidden master authoritative name server is being used. If a hidden master authoritative name server is being used, check the NS records for all zones for which that hidden name server is authoritative and confirm there is not any NS record for that hidden name server. If any zone for which a hidden name server is authoritative has an NS record for that hidden name server, this is a finding. If the DNS implementation does not include any hidden name servers, this is not applicable.

Check Text ( C-55579r1_chk )

Check the DNS documentation to determine if a hidden master authoritative name server is being used. If a hidden master authoritative name server is being used, check the NS records for all zones for which that hidden name server is authoritative and confirm there is not any NS record for that hidden name server.

If any zone for which a hidden name server is authoritative has an NS record for that hidden name server, this is a finding.
If the DNS implementation does not include any hidden name servers, this is not applicable.

Fix Text (F-59815r1_fix)
Remove, from all zones' configuration files, any NS RRs for hidden name servers.