V-285284

Discussion

DNS servers with an internal role only process name/address resolution requests from within the organization (i.e., internal clients). DNS servers with an external role only process name/address resolution information requests from clients external to the organization (i.e., on the external networks, including the internet). The set of clients that can access an authoritative DNS server in a particular role is specified by the organization using address ranges, explicit access control lists, etc. To protect internal DNS resource information, it is important to isolate the requests to internal DNS servers. Separating internal and external roles in DNS prevents address space that is private (e.g., 10.0.0.0/24) or is otherwise concealed by some form of Network Address Translation from leaking into the public DNS system.

Check Content

Verify that Infoblox is configured with the correct views in split DNS environments. 

If a split DNS configuration is not used, this is Not Applicable. 

1. If DNS Views are used, review each DNS View Client Match list using the "Edit" function. 
2. Navigate to Data Management >> DNS >> Members >> Edit Member >> Toggle Advanced Mode >> DNS Views. 
3. Review each zone and member assignment to ensure it is configured correctly with respect to its network assignment. 
4. When complete, click "Cancel" to exit the "Properties" screen. 

If separate appliances are used for internal/external roles:

1. Navigate to Data Management >> DNS >> Members tab. 
2. Select each grid member that is running DNS and click "Edit". Review the "Queries" tab to verify that both queries and recursion options are enabled and allowed only from the respective client networks. 

If an external DNS server contains internal data, or vice versa, this is a finding.

If there is no access control configured or access control does not restrict queries and recursion to the respective client network, this is a finding.