The DNS server implementation must validate the binding of the other DNS servers identity to the DNS information for a server-to-server transaction (e.g., zone transfer).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-205198	SRG-APP-000349-DNS-000043	SV-205198r987678_rule	CCI-001904	medium
Description
Validation of the binding of the information prevents the modification of information between production and review. The validation of bindings can be achieved, for example, by the use of cryptographic checksums. Validations must be performed automatically. DNSSEC and TSIG/SIG(0) technologies are not effective unless the digital signatures they generate are validated to ensure that the information has not been tampered with and that the producer's identity is legitimate.
STIG			Date
Domain Name System (DNS) Security Requirements Guide			2025-12-19

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-09.1Identity Binding

0.50

DISA STIG Benchmark (XCCDF)V4R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (9) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AU-10(1)Association of Identities

1.00

DISA STIG Benchmark (XCCDF)V4R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-10(2)Validate Binding of Information Producer Identity

1.00

DISA STIG Benchmark (XCCDF)V4R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-6Configuration Settings

1.00

DISA STIG Benchmark (XCCDF)V4R2intersects(normalised)
DISA STIG Benchmark (XCCDF)4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-20Secure Name/Address Resolution Service (Authoritative Source)

1.00

DISA STIG Benchmark (XCCDF)V4R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-20(2)Data Origin and Integrity

1.00

DISA STIG Benchmark (XCCDF)V4R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-21Secure Name/Address Resolution Service (Recursive or Caching Resolver)

1.00

DISA STIG Benchmark (XCCDF)V4R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-23Session Authenticity

1.00

DISA STIG Benchmark (XCCDF)V4R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-8(2)Pre- and Post-transmission Handling

1.00

DISA STIG Benchmark (XCCDF)V4R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SI-10Information Input Validation

1.00

DISA STIG Benchmark (XCCDF)V4R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V3R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V3R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CCI1 mapping

CCI-001904

1.00

DISA STIG Benchmark (XCCDF)V4R2intersects(normalised)

Details

Check Text (C-205198r987678_chk)

Review the DNS server implementation configuration to determine if the DNS server validates the binding of the other DNS server's identity to the DNS information for a server-to-server transaction (e.g., zone transfer). If the DNS server does not validate the binding of the other DNS server's identity to the DNS information, this is a finding.

Fix Text (F-5465r392508_fix)

Configure the DNS server to validate the binding of the other DNS server's identity to the DNS information for a server-to-server transaction (e.g., zone transfer).