V-285281

Discussion

Instead of having the same set of authoritative name servers serve different types of clients, an enterprise could have two different sets of authoritative name servers. One set, called external name servers, can be located within a DMZ; these would be the only name servers that are accessible to external clients and would serve RRs pertaining to hosts with public services (web servers that serve external web pages or provide B2C services, mail servers, etc.). The other set, called internal name servers, is to be located within the firewall and should be configured so they are not reachable from outside and hence provide naming services exclusively to internal clients.

Check Content

Verify that Infoblox is configured to restrict queries and recursion options in split DNS environments.

If a split DNS configuration is not used, this is Not Applicable. 

Validation of this configuration item requires review of the network architecture and security configuration in addition to DNS service member configuration to verify that external DNS service members are not accessible from the internal network when a split DNS configuration is implemented. 

1. Navigate to Data Management >> DNS >> Members tab. 
2. Select each grid member that is running DNS and click "Edit". Review the "Queries" tab to verify that both queries and recursion options are enabled and allowed only from the respective client networks. 

If there is no access control configured or access control does not restrict queries and recursion to the respective client network, this is a finding.