The Windows DNS Server must only contain zone records that have been validated annually.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259394	WDNS-22-000066	SV-259394r945334_rule		Medium

Description
If zone information has not been validated in more than a year, there is no assurance that it is still valid. If invalid records are in a zone, an adversary could potentially use their existence for improper purposes. A standard operating procedure detailing this process can resolve this requirement.

STIG	Date
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide	2024-01-09

Details

Check Text ( C-63133r939885_chk )
This requirement is not applicable for a Windows DNS Server that is hosting only Active Directory (AD)-integrated zones. For a Windows DNS Server that hosts a mix of AD-integrated zones and manually maintained zones, ask the DNS database administrator if they maintain a separate database with record documentation for the non-AD-integrated zone information. Verify that the record's last verified date is less than one year prior to the date of the review. If a separate database with record documentation is not maintained for the non-AD-integrated zone information, this is a finding. If a separate database with record documentation is maintained for the non-AD-integrated zone information, log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. Press the Windows key + R and execute "dnsmgmt.msc". On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server and then expand "Forward Lookup Zones". From the expanded list, click to select the zone. Review the zone records of the non-AD-integrated zones and compare to the separate documentation maintained. Determine if any records have not been validated in more than a year. If zone records exist that have not been validated in more than a year, this is a finding.

Check Text ( C-63133r939885_chk )

This requirement is not applicable for a Windows DNS Server that is hosting only Active Directory (AD)-integrated zones.

For a Windows DNS Server that hosts a mix of AD-integrated zones and manually maintained zones, ask the DNS database administrator if they maintain a separate database with record documentation for the non-AD-integrated zone information. Verify that the record's last verified date is less than one year prior to the date of the review.

If a separate database with record documentation is not maintained for the non-AD-integrated zone information, this is a finding.

If a separate database with record documentation is maintained for the non-AD-integrated zone information, log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "dnsmgmt.msc".

On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server and then expand "Forward Lookup Zones".

From the expanded list, click to select the zone.

Review the zone records of the non-AD-integrated zones and compare to the separate documentation maintained.

Determine if any records have not been validated in more than a year.

If zone records exist that have not been validated in more than a year, this is a finding.

Fix Text (F-63041r939886_fix)
Create a separate database to maintain record documentation for non-AD-integrated zones. Develop a procedure to validate annually all zone information on the DNS server against the separately maintained database. Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. Press the Windows key + R and execute "dnsmgmt.msc". On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server and then expand "Forward Lookup Zones". From the expanded list, click to select the zone. Select the zone records that have not been validated in more than a year and revalidate.

Fix Text (F-63041r939886_fix)

Create a separate database to maintain record documentation for non-AD-integrated zones.

Develop a procedure to validate annually all zone information on the DNS server against the separately maintained database.

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press the Windows key + R and execute "dnsmgmt.msc".

On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server and then expand "Forward Lookup Zones".

From the expanded list, click to select the zone.

Select the zone records that have not been validated in more than a year and revalidate.