Domain Name System (DNS) Security Requirements Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000516
Group -
For zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts.
Authoritative name servers for an enterprise may be configured to receive requests from both external and internal clients. External clients need to receive RRs that pertain only to public servic...Rule Medium Severity -
SRG-APP-000516
Group -
SRG-APP-000516
Group -
NSEC3 must be used for all internal DNS zones.
To ensure that RRs associated with a query are really missing in a zone file and have not been removed in transit, the DNSSEC mechanism provides a means for authenticating the nonexistence of an RR...Rule Medium Severity -
SRG-APP-000516
Group -
SRG-APP-000516
Group -
The two files generated by the dnssec-keygen program must be made accessible only to the server administrator account, or deleted, after they have been copied to the key file in the name server.
To enable zone transfer (requests and responses) through authenticated messages, it is necessary to generate a key for every pair of name servers. The key also can be used for securing other transa...Rule Medium Severity -
SRG-APP-000516
Group -
SRG-APP-000516
Group -
All authoritative name servers for a zone must have the same version of zone information.
The only protection approach for content control of DNS zone file is the use of a zone file integrity checker. The effectiveness of integrity checking using a zone file integrity checker depends up...Rule Medium Severity -
SRG-APP-000516
Group -
SRG-APP-000516
Group -
Digital signature algorithm used for DNSSEC-enabled zones must be FIPS-compatible.
The choice of digital signature algorithm will be based on recommended algorithms in well-known standards. NIST's Digital Signature Standard (DSS) [FIPS186] provides three algorithm choices: * Digi...Rule Medium Severity -
SRG-APP-000516
Group -
The DNS Name Server software must run with restricted privileges.
Failure to provide logical access restrictions associated with changes to application configuration may have significant effects on the overall security of the system. When dealing with access rest...Rule Medium Severity -
SRG-APP-000516
Group -
SRG-APP-000516
Group -
In a split DNS configuration, where separate name servers are used between the external and internal networks, the internal name server must be configured to not be reachable from outside resolvers.
Instead of having the same set of authoritative name servers serve different types of clients, an enterprise could have two different sets of authoritative name servers. One set, called external ...Rule Medium Severity -
SRG-APP-000516
Group -
Primary authoritative name servers must be configured to only receive zone transfer requests from specified secondary name servers.
Authoritative name servers (especially primary name servers) should be configured with an allow-transfer access control substatement designating the list of hosts from which zone transfer requests ...Rule Medium Severity -
SRG-APP-000516
Group -
The DNS implementation must be conformant to the IETF DNS specification.
Any DNS implementation must be designed to be able to conform to the Internet Engineering Task Force (IETF) specification. DoD utilizes many different DNS servers, and it is essential that core cap...Rule Medium Severity -
SRG-APP-000516
Group -
The IP address for hidden master authoritative name servers must not appear in the name servers set in the zone database.
A hidden master authoritative server is an authoritative DNS server whose IP address does not appear in the name server set for a zone. All of the name servers that do appear in the zone database ...Rule Medium Severity -
SRG-APP-000516
Group -
SRG-APP-000700
Group -
The DNS server implementation must disable accounts when the accounts have expired.
Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality, which reduce the attack surface of the system.Rule Medium Severity -
SRG-APP-000705
Group -
SRG-APP-000516
Group -
The DNS implementation must implement internal/external role separation.
DNS servers with an internal role only process name/address resolution requests from within the organization (i.e., internal clients). DNS servers with an external role only process name/address re...Rule Medium Severity -
SRG-APP-000516
Group -
The DNS must utilize valid root name servers in the local root zone file.
All caching name servers must be authoritative for the root zone because, without this starting point, they would have no knowledge of the DNS infrastructure and thus would be unable to respond to ...Rule Medium Severity -
SRG-APP-000516
Group -
The DNS name server software must be at the latest version.
Each newer version of the name server software, especially the BIND software, generally is devoid of vulnerabilities found in earlier versions because it has design changes incorporated to take car...Rule Medium Severity -
SRG-APP-000516
Group -
The DNS server implementation must disable accounts when the accounts are no longer associated to a user.
Disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality, which reduce the attack surface of the system.Rule Medium Severity -
SRG-APP-000745
Group -
SRG-APP-000516
Group -
SRG-APP-000516
Group -
The private key corresponding to the ZSK, stored on name servers accepting dynamic updates, must have appropriate directory/file-level access control list-based or cryptography-based protections.
The private keys in the KSK and ZSK key pairs must be protected from unauthorized access. If possible, the private keys should be stored off-line (with respect to the Internet-facing, DNSSEC-aware ...Rule Medium Severity -
SRG-APP-000516
Group -
SRG-APP-000516
Group -
The DNS server implementation must implement the capability to centrally review and analyze audit records from multiple components within the system.
Automated mechanisms for centralized reviews and analyses include Security Information and Event Management products.Rule Medium Severity -
SRG-APP-000795
Group -
SRG-APP-000915
Group -
SRG-APP-000516
Group -
CNAME records must not point to a zone with lesser security for more than six months.
The use of CNAME records for exercises, tests, or zone-spanning aliases should be temporary (e.g., to facilitate a migration). When a host name is an alias for a record in another zone, an adversar...Rule Medium Severity -
SRG-APP-000516
Group -
The DNS server implementation must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
Configuration settings are the set of parameters that can be changed that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting ...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.