← Back to Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide

V-259417

CAT II (Medium)

Windows DNS response rate limiting (RRL) must be enabled.

Rule ID

SV-259417r961155_rule

STIG

Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide

Version

V2R4

CCIs

CCI-001095

Discussion

This setting can prevent someone from sending a denial-of-service attack using the DNS servers. For instance, a bot net can send requests to the DNS server using the IP address of a third computer as the requestor. Without RRL, the DNS servers might respond to all the requests, flooding the third computer.

Check Content

As an administrator, run PowerShell and enter the following command: 
"Get-DnsServerResponseRateLimiting". 

If "Mode" is not set to "Enable", this is a finding.

Fix Text

As an administrator, run PowerShell and enter the command "Set-DnsServerResponseRateLimiting" to apply default values or "Set-DnsServerResponseRateLimiting -WindowInSec 7 -LeakRate 4 -TruncateRate 3 -ErrorsPerSec 8 -ResponsesPerSec 8". 

These settings are just an example. For more information, go to:
https://learn.microsoft.com/en-us/powershell/module/dnsserver/set-dnsserverresponseratelimiting?view=windowsserver2022-ps