Windows DNS STIG

18 items · Security · Hard difficulty · 4 hours

Harden Windows DNS servers with STIG-based, actionable steps.

• Apply latest Windows Server and DNS security patches

  Install OS and DNS role updates from WSUS or Windows Update to address known vulnerabilities.

• Backup DNS zones and server configuration

  Export zone files and registry settings or use server backup tools before changes.

• Disable recursion on authoritative DNS servers

  Turn off recursion for servers that are authoritative only to prevent abuse.

• Restrict zone transfers to authorized IP addresses

  Allow zone transfers only to specific secondary servers' IPs.

• Configure TSIG for authenticated zone transfers

  Use TSIG shared secrets for secure zone transfers between servers.

• Enable DNSSEC for all zones

  Plan and enable DNSSEC to ensure DNS data integrity and origin authentication.

• Generate and publish KSK and ZSK keys

  Create appropriately sized KSK/ZSK per policy and store keys securely.

• Publish DS records to the parent zone

  Submit DS records to the parent/registrar to enable chain of trust.

• Configure automatic key rollover (RFC5011)

  Enable automated rollover to manage key lifecycles and reduce outages.

• Enable DNSSEC validation on recursive resolvers

  Turn on validation to ensure clients receive authenticated DNS responses.

• Secure dynamic updates (allow only authenticated updates)

  Require secure updates or AD-integrated zones to prevent unauthorized changes.

• Set ACLs and NTFS permissions on DNS files and folders

  Limit write access to DNS files and DNS Admin group membership.

• Enable DNS server auditing and diagnostic logging

  Activate event and debug logging to capture changes and suspicious activity.

• Configure response rate limiting (RRL) to mitigate abuse

  Apply RRL settings to reduce amplification and reflected DDoS impact.

• Ensure time synchronization (NTP) across AD and DNS servers

  Keep clocks synchronized to support DNSSEC and Kerberos operations.

• Harden DNS service account and limit administrative access

  Apply least-privilege to service accounts and restrict DNS admin rights.

• Monitor DNS health and alerts (setup monitoring)

  Create alerts for zone changes, failures, validation errors, and high query rates.

• Document DNS configuration, keys, and change control procedures

  Record zone signing details, rollover schedule, and authorized transfer peers.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.