UCF STIG Viewer Logo

The Windows DNS Server must implement internal/external role separation.


Finding ID Version Rule ID IA Controls Severity
V-259356 WDNS-22-000026 SV-259356r945262_rule Medium
DNS servers with an internal role only process name/address resolution requests from within the organization (i.e., internal clients). DNS servers with an external role only process name/address resolution information requests from clients external to the organization (i.e., on the external networks, including the internet). The set of clients that can access an authoritative DNS server in a particular role is specified by the organization using address ranges, explicit access control lists, etc. To protect internal DNS resource information, it is important to isolate the requests to internal DNS servers. Separating internal and external roles in DNS prevents address space that is private (e.g., or otherwise concealed by some form of Network Address Translation from leaking into the public DNS system.
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide 2024-01-09


Check Text ( C-63095r939771_chk )
Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "dnsmgmt.msc".

On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server and then expand "Forward Lookup Zones".

From the expanded list, review each zone.

Consult with the DNS Admin to determine if any of the zones also have hostnames that need to be resolved from the external network.

If the zone is split between internal and external networks, verify separate DNS servers have been implemented for each network.

If internal and external DNS servers have not been implemented for zones that require resolution from both the internal and external networks, this is a finding.
Fix Text (F-63003r939772_fix)
Configure separate DNS servers for each of the external and internal networks.