The Infoblox Grid Master must be configured as a stealth (hidden) domain DNS service member in order to protect the Zone Signing Key (ZSK) residing on it.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
high	V-233904	SRG-APP-000176-DNS-000096	IDNS-8X-500007	SV-233904r1083000_rule	2025-03-11	1

Description
Security-relevant information is any information within information systems that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce system security policies or maintain the isolation of code and data. Security-relevant information includes, for example, file permissions, cryptographic key management information, configuration parameters for security services, and access control lists. Secure, nonoperable system states include the times in which information systems are not performing mission/business-related processing (e.g., the system is offline for maintenance, troubleshooting, bootup, and shutdown). On Infoblox, Domain Name System Security Extension (DNSSEC) ZSKs are stored on either a Hardware Security Module or the Infoblox Grid Master. By configuring the Grid Master as "stealth" to prevent client communications to the Infoblox Grid Master, and ensuring the Grid Master uses an encrypted management tunnel to update DNS members serving DNSSEC signed zones, the DNSSEC keys are protected.

Description

Security-relevant information is any information within information systems that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce system security policies or maintain the isolation of code and data. Security-relevant information includes, for example, file permissions, cryptographic key management information, configuration parameters for security services, and access control lists. Secure, nonoperable system states include the times in which information systems are not performing mission/business-related processing (e.g., the system is offline for maintenance, troubleshooting, bootup, and shutdown). On Infoblox, Domain Name System Security Extension (DNSSEC) ZSKs are stored on either a Hardware Security Module or the Infoblox Grid Master. By configuring the Grid Master as "stealth" to prevent client communications to the Infoblox Grid Master, and ensuring the Grid Master uses an encrypted management tunnel to update DNS members serving DNSSEC signed zones, the DNSSEC keys are protected.

ℹ️ Check
Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. By default, ZSK private keys are stored encrypted within the Infoblox database on the Grid Master. The Grid Master will by default enable the DNS service when DNSSEC is enabled for internal processing. Clients must not be permitted to use the Grid Master DNS service. Refer to the Infoblox STIG Overview document for additional information on HSM usage. 1. Navigate to Data Management >> DNS >> Zones. 2. Review each zone by selecting the zone, clicking "Edit", and selecting the "DNS service members" tab. 3. When complete, click "Cancel" to exit the "Properties" screen. If the Grid Master is a listed DNS service member and not marked "Stealth", this is a finding.

ℹ️ Check

Note: For Infoblox DNS systems on a classified network, this requirement is Not Applicable. By default, ZSK private keys are stored encrypted within the Infoblox database on the Grid Master. The Grid Master will by default enable the DNS service when DNSSEC is enabled for internal processing. Clients must not be permitted to use the Grid Master DNS service. Refer to the Infoblox STIG Overview document for additional information on HSM usage. 1. Navigate to Data Management >> DNS >> Zones. 2. Review each zone by selecting the zone, clicking "Edit", and selecting the "DNS service members" tab. 3. When complete, click "Cancel" to exit the "Properties" screen. If the Grid Master is a listed DNS service member and not marked "Stealth", this is a finding.

✔️ Fix
1. Navigate to Data Management >> DNS >> Zones. 2. Select the zone, click "Edit", and select the "DNS service members" tab. 3. Mark the Grid Master as "Stealth". 4. If no other DNS service members are listed, one must be added before the configuration can be valid. 5. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. 6. Perform a service restart if necessary.

✔️ Fix

1. Navigate to Data Management >> DNS >> Zones. 2. Select the zone, click "Edit", and select the "DNS service members" tab. 3. Mark the Grid Master as "Stealth". 4. If no other DNS service members are listed, one must be added before the configuration can be valid. 5. When complete, click "Save & Close" to save the changes and exit the "Properties" screen. 6. Perform a service restart if necessary.