Detections
Analytics
WDNS-CM-000016 - For zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts.
Information
Authoritative name servers for an enterprise may be configured to receive requests from both external and internal clients.External clients need to receive RRs that pertain only to public services (public Web server, mail server, etc.)
Internal clients need to receive RRs pertaining to public services as well as internal hosts.
The zone information that serves the RRs on both the inside and the outside of a firewall should be split into different physical files for these two types of clients (one file for external clients and one file for internal clients).
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Remove any RRs from the internal zones for which the resolution is for an external IP address.Remove any RRs from the external zones for which the resolution is for an internal IP address.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_2012_Server_DNS_V1R14_STIG.zip
Item Details
References: CAT|II, CCI|CCI-000366, Rule-ID|SV-73033r3_rule, STIG-ID|WDNS-CM-000016, Vuln-ID|V-58603
Plugin: Windows
Control ID: 2d11773d5d80cdadd09bcbaabcb16a180a900d8375913d7b87b37fef8a22800e