← Back to Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide

V-259384

CAT II (Medium)

Automatic Update of Trust Anchors must be enabled on key rollover.

Rule ID

SV-259384r961107_rule

STIG

Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide

Version

V2R4

CCIs

CCI-001663

Discussion

A trust anchor is a preconfigured public key associated with a specific zone. A validating DNS server must be configured with one or more trust anchors to perform validation. If the DNS server is running on a domain controller, trust anchors are stored in the forest directory partition in Active Directory Domain Services (AD DS) and can be replicated to all domain controllers in the forest. On standalone DNS servers, trust anchors are stored in a file named "TrustAnchors.dns". A DNS server running Windows Server also displays configured trust anchors in the DNS Manager console tree in the "Trust Points" container. Trust anchors can also be viewed by executing Windows PowerShell commands or "Dnscmd.exe" at a Windows command prompt.

Check Content

Note: This check is not applicable for Windows DNS Servers that host only Active Directory-integrated zones or for Windows DNS Servers on a classified network.

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

If not automatically started, initialize the Server Manager window by clicking its icon from the bottom left corner of the screen.

Once the Server Manager window is initialized, from the left pane, click to select the DNS category.

From the right pane, under the "SERVERS" section, right-click the DNS server.

From the context menu that appears, click "DNS Manager".

On the opened DNS Manager snap-in from the left pane, expand the server name and then expand "Forward Lookup Zones".

From the expanded list, click to select and then right-click the zone name.

From the displayed context menu, click DNSSEC >> Properties.

Click the "KSK" tab.

For each KSK that is listed under Key signing keys (KSKs), click the KSK, click "Edit", and in the "Key Rollover" section, verify the "Enable automatic rollover" check box is selected.

If the "Enable automatic rollover" check box is not selected for every KSK listed, this is a finding.

Fix Text

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

If not automatically started, initialize the Server Manager window by clicking its icon from the bottom left corner of the screen.

Once the Server Manager window is initialized, from the left pane, click to select the DNS category.

From the right pane, under the "SERVERS" section, right-click the DNS server.

From the context menu that appears, click "DNS Manager".

On the opened DNS Manager snap-in from the left pane, expand the server name and then expand "Forward Lookup Zones".

From the expanded list, click to select and then right-click the zone name.

From the displayed context menu, click DNSSEC >> Properties.

Click the "KSK" tab.

For each KSK that is listed under key signing keys (KSKs), click the KSK, click "Edit", and in the "Key Rollover" section, select the "Enable automatic rollover" check box.