The Windows DNS Server must implement internal/external role separation.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259356	WDNS-22-000026	SV-259356r961863_rule		Medium

Description
DNS servers with an internal role only process name/address resolution requests from within the organization (i.e., internal clients). DNS servers with an external role only process name/address resolution information requests from clients external to the organization (i.e., on the external networks, including the internet). The set of clients that can access an authoritative DNS server in a particular role is specified by the organization using address ranges, explicit access control lists, etc. To protect internal DNS resource information, it is important to isolate the requests to internal DNS servers. Separating internal and external roles in DNS prevents address space that is private (e.g., 10.0.0.0/24) or otherwise concealed by some form of Network Address Translation from leaking into the public DNS system.

Description

DNS servers with an internal role only process name/address resolution requests from within the organization (i.e., internal clients). DNS servers with an external role only process name/address resolution information requests from clients external to the organization (i.e., on the external networks, including the internet). The set of clients that can access an authoritative DNS server in a particular role is specified by the organization using address ranges, explicit access control lists, etc. To protect internal DNS resource information, it is important to isolate the requests to internal DNS servers. Separating internal and external roles in DNS prevents address space that is private (e.g., 10.0.0.0/24) or otherwise concealed by some form of Network Address Translation from leaking into the public DNS system.

STIG	Date
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide	2024-06-14

Details

Check Text ( C-63095r939771_chk )
Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. Press the Windows key + R and execute "dnsmgmt.msc". On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server and then expand "Forward Lookup Zones". From the expanded list, review each zone. Consult with the DNS Admin to determine if any of the zones also have hostnames that need to be resolved from the external network. If the zone is split between internal and external networks, verify separate DNS servers have been implemented for each network. If internal and external DNS servers have not been implemented for zones that require resolution from both the internal and external networks, this is a finding.

Check Text ( C-63095r939771_chk )

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "dnsmgmt.msc".

On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server and then expand "Forward Lookup Zones".

From the expanded list, review each zone.

Consult with the DNS Admin to determine if any of the zones also have hostnames that need to be resolved from the external network.

If the zone is split between internal and external networks, verify separate DNS servers have been implemented for each network.

If internal and external DNS servers have not been implemented for zones that require resolution from both the internal and external networks, this is a finding.

Fix Text (F-63003r939772_fix)
Configure separate DNS servers for each of the external and internal networks.