Skip to content
ATO Pathways
Log In
Overview
Search
Catalogs
SCAP
OSCAL
Catalogs
Profiles
Resources
Documents
Publishers
References
Knowledge Base
Platform Documentation
Compliance Dictionary
Platform Changelog
About
Catalogs
XCCDF
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide
SRG-APP-000001-DNS-000115
The Windows DNS Server must restrict incoming dynamic update requests to known clients.
The Windows DNS Server must restrict incoming dynamic update requests to known clients.
An XCCDF Rule
Details
Profiles
Prose
The Windows DNS Server must restrict incoming dynamic update requests to known clients.
Medium Severity
<VulnDiscussion>Limiting the number of concurrent sessions reduces the risk of denial of service (DoS) on any system. A DNS server's function requires it to be able to handle multiple sessions at a time, so limiting concurrent sessions could impact availability. Primary name servers must be configured to limit the actual hosts from which they will accept dynamic updates and zone transfer requests, and all name servers should be configured to limit the hosts from/to which they receive/send zone transfers. Restricting sessions to known hosts will mitigate the DoS vulnerability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>