Windows Server DNS STIG Checklist (Ver 2, Rel 3)

18 items · Security · Hard difficulty · 2 hours

Harden Windows DNS servers to DISA STIG standards (Ver 2, Rel 3).

• Apply the Microsoft Windows DNS STIG baseline and latest cumulative updates

  Install official STIG settings and Windows updates to meet compliance baseline.

• Backup DNS server configuration and zone data

  Export zones and back up %systemroot%system32dns and AD-integrated records.

• Restrict zone transfers to authorized IP addresses

  Allow transfers only to listed secondary servers or management hosts.

• Configure TSIG authentication for zone transfers

  Use transaction signatures (TSIG) for authenticated transfers.

• Disable recursion on authoritative-only DNS servers

  Turn off recursion if server does not serve recursive resolver clients.

• Configure forwarders and conditional forwarders for resolution

  Point recursive queries to trusted forwarders and isolate internal resolution.

• Implement DNSSEC for zone authentication and integrity

  Enable DNSSEC support and policies for all applicable zones per STIG.

• Sign DNS zones with DNSSEC keys

  Use approved algorithms and key lengths for zone signing.

• Configure automated key rollover (RFC5011) for trust anchors

  Enable and schedule secure automated trust anchor updates.

• Enable DNSSEC validation on resolvers

  Turn on validation to reject signatures that fail verification.

• Restrict or require secure dynamic updates for AD-integrated zones

  Allow only secure, authenticated updates where needed.

• Enable and configure DNS logging and auditing

  Log queries, zone transfers, and administrative changes for audits.

• Limit DNS Server service account privileges and apply least privilege

  Run DNS service with minimal rights and remove unnecessary permissions.

• Harden network access: enforce firewall rules and block port 53 from untrusted networks

  Allow DNS traffic only from known networks and authorized clients.

• Enable response rate limiting or other flood protections

  Mitigate DNS amplification and reflection attacks with RRL or controls.

• Implement zone aging and scavenging to remove stale records

  Configure timestamps and scavenging to keep authoritative data current.

• Regularly review, test, and scan DNS configurations for STIG compliance

  Perform periodic assessments, automated scans, and corrective actions.

• Document DNS configuration, STIG version, change history, and support contacts

  Keep records of settings, changes, and the DISA contact/email for updates.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.