The Windows 2012 DNS Server must implement internal/external role separation.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-58613	WDNS-CM-000021	SV-73043r3_rule		Medium

Description
DNS servers with an internal role only process name/address resolution requests from within the organization (i.e., internal clients). DNS servers with an external role only process name/address resolution information requests from clients external to the organization (i.e., on the external networks, including the Internet). The set of clients that can access an authoritative DNS server in a particular role is specified by the organization using address ranges, explicit access control lists, etc. In order to protect internal DNS resource information, it is important to isolate the requests to internal DNS servers. Separating internal and external roles in DNS prevents address space that is private (e.g., 10.0.0.0/24) or is otherwise concealed by some form of Network Address Translation from leaking into the public DNS system.

Description

DNS servers with an internal role only process name/address resolution requests from within the organization (i.e., internal clients). DNS servers with an external role only process name/address resolution information requests from clients external to the organization (i.e., on the external networks, including the Internet). The set of clients that can access an authoritative DNS server in a particular role is specified by the organization using address ranges, explicit access control lists, etc. In order to protect internal DNS resource information, it is important to isolate the requests to internal DNS servers. Separating internal and external roles in DNS prevents address space that is private (e.g., 10.0.0.0/24) or is otherwise concealed by some form of Network Address Translation from leaking into the public DNS system.

STIG	Date
Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide	2019-12-23

Details

Check Text ( C-59485r2_chk )
Log on to the DNS server using the Domain Admin or Enterprise Admin account. Press Windows Key + R, execute dnsmgmt.msc. On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server, and then expand Forward Lookup Zones. From the expanded list, review each zone. Consult with the DNS Admin to determine if any of the zones also have hostnames needing to be resolved from the external network. If the zone is split between internal and external networks, verify separate DNS servers have been implemented for each network. If internal and external DNS servers have not been implemented for zones which require resolution from both the internal and external networks, this is a finding.

Check Text ( C-59485r2_chk )

Log on to the DNS server using the Domain Admin or Enterprise Admin account.

Press Windows Key + R, execute dnsmgmt.msc.

On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server, and then expand Forward Lookup Zones.

From the expanded list, review each zone.

Consult with the DNS Admin to determine if any of the zones also have hostnames needing to be resolved from the external network.

If the zone is split between internal and external networks, verify separate DNS servers have been implemented for each network.

If internal and external DNS servers have not been implemented for zones which require resolution from both the internal and external networks, this is a finding.

Fix Text (F-63997r2_fix)
Configure separate DNS servers for each of the external and internal networks.