Instead of having the same set of authoritative name servers serve different types of clients, an enterprise could have two different sets of authoritative name servers.

In a split DNS configuration, where separate name servers are used between the external and internal networks, the external name server must be configured to not be reachable from inside resolvers. If communication sessions are not provided appropriate validity. The Windows 2012 DNS Server must protect the authenticity of dynamic updates via transaction signing.ĭNS is a fundamental network service that is prone to various attacks, such as cache poisoning and man-in-the middle attacks. Poorly constructed NS records pose a security risk because they create conditions under which an adversary might be able to provide the missing authoritative name services that are improperly. The Windows 2012 DNS Servers zone files must have NS records that point to active name servers authoritative for the domain specified in that record. In DNSSEC, trust in the public key (for signature verification) of the.

The specification for a digital signature mechanism in the context of the DNS infrastructure is in IETF's DNSSEC standard. The Windows 2012 DNS Server must be configured to enable DNSSEC Resource Records.

Findings (MAC III - Administrative Sensitive) Finding ID

12 server