All authoritative DNS service members for a zone must be geographically dispersed.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-233859	SRG-APP-000218-DNS-000027	IDNS-8X-400001	SV-233859r1082995_rule	2025-03-11	1

Description
In addition to network-based dispersion, authoritative name servers must be also be dispersed geographically. In other words, in addition to being located on different network segments, the authoritative name servers must not all be located within the same building. One approach that some organizations follow is to locate some authoritative name servers in their own premises and others in their ISP's data centers or in partnering organizations. A network administrator may choose to use a "hidden" master authoritative server and have only secondary servers visible on the network. A hidden master authoritative server is an authoritative DNS server in which the IP address does not appear in the name server set for a zone. If the master authoritative name server is "hidden", a secondary authoritative name server may reside in the same building as the hidden master.

Description

In addition to network-based dispersion, authoritative name servers must be also be dispersed geographically. In other words, in addition to being located on different network segments, the authoritative name servers must not all be located within the same building. One approach that some organizations follow is to locate some authoritative name servers in their own premises and others in their ISP's data centers or in partnering organizations. A network administrator may choose to use a "hidden" master authoritative server and have only secondary servers visible on the network. A hidden master authoritative server is an authoritative DNS server in which the IP address does not appear in the name server set for a zone. If the master authoritative name server is "hidden", a secondary authoritative name server may reside in the same building as the hidden master.

ℹ️ Check
1. Navigate to Data Management >> DNS >> Zones tab. 2. Review each zone by clicking "Edit" and inspecting the "DNS service members" tab. 3. Review the DNS service member records for each zone hosted and confirm that each authoritative DNS service member is located at a different physical location than the remaining DNS service members. 4. Infoblox supports designation as a "stealth" DNS service member, which will not have an NS record. If all DNS service members for which NS records are published within a zone are not physically at different locations, this is a finding.

ℹ️ Check

1. Navigate to Data Management >> DNS >> Zones tab. 2. Review each zone by clicking "Edit" and inspecting the "DNS service members" tab. 3. Review the DNS service member records for each zone hosted and confirm that each authoritative DNS service member is located at a different physical location than the remaining DNS service members. 4. Infoblox supports designation as a "stealth" DNS service member, which will not have an NS record. If all DNS service members for which NS records are published within a zone are not physically at different locations, this is a finding.

✔️ Fix
Configure the authoritative DNS service members to be geographically dispersed. Most optimal to least optimal (to provide context): - DNS service members are located on different continents. - DNS service members are located on the same continent, with greatest possible geographic dispersity. - DNS service members are located in different states/provinces. - DNS service members are located in different cities. - DNS service members are located in different buildings. - DNS service members are located in different data centers. - DNS service members are located at opposite ends of the same data center. - If moving DNS service members is not feasible, reconfigure one of the co-located service members to be a hidden primary.

✔️ Fix

Configure the authoritative DNS service members to be geographically dispersed. Most optimal to least optimal (to provide context): - DNS service members are located on different continents. - DNS service members are located on the same continent, with greatest possible geographic dispersity. - DNS service members are located in different states/provinces. - DNS service members are located in different cities. - DNS service members are located in different buildings. - DNS service members are located in different data centers. - DNS service members are located at opposite ends of the same data center. - If moving DNS service members is not feasible, reconfigure one of the co-located service members to be a hidden primary.