The IP address for hidden master authoritative DNS service members must not appear in the DNS service members set in the zone database.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-233876	SRG-APP-000516-DNS-000108	IDNS-8X-400018	SV-233876r1082648_rule	2025-03-11	1

Description
A hidden primary authoritative server is an authoritative DNS server in which the IP address does not appear in the name server set for a zone. All of the name servers that do appear in the zone database as designated name servers get their zone data from the hidden primary via a zone transfer request. In effect, all visible name servers are actually secondary servers. This prevents potential attackers from targeting the primary name server because its IP address may not appear in the zone database.

Description

A hidden primary authoritative server is an authoritative DNS server in which the IP address does not appear in the name server set for a zone. All of the name servers that do appear in the zone database as designated name servers get their zone data from the hidden primary via a zone transfer request. In effect, all visible name servers are actually secondary servers. This prevents potential attackers from targeting the primary name server because its IP address may not appear in the zone database.

ℹ️ Check
Verify that the Infoblox Grid Master is not configured to service DNS requests from clients. 1. Navigate to Data Management >> DNS >> Zones. 2. Review each zone by selecting the zone, clicking "Edit", and selecting the "DNS service members" tab. If the Grid Master is a listed DNS service member and not marked "Stealth", this is a finding.

✔️ Fix
For each zone that is not in compliance: 1. Navigate to Data Management >> DNS >> Zones. 2. Reconfigure the "Name Servers" tab and modify the Grid Master by selecting "Stealth". 3. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. 4. Perform a service restart if necessary.