V2R6 changes
Microsoft Windows Server Domain Name System (DNS) STIG V2R6 (2026-09-30) replaced V2R5 (2026-07-01): 1 check removed, 5 updated. It has 80 checks, against 81 in V2R5.
V2R6 checklistV2R5 checklist Compare V2R5 and V2R6 in STIG Compare
- 0 added
- 1 removed
- 5 updated
Updated fields: Check text 4Fix text 3Title 2Discussion 1
Removed since V2R5 (1)
- V-259412CAT IIIn the event of a system failure, the Windows DNS Server must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.
Updated in V2R6 (5)
V-259342CAT IIForwarders on an authoritative Windows DNS Server, if enabled for external resolution, must forward only to an internal, non-Active Directory (AD)-integrated DNS server or to the DoW Enterprise Recursive Services (ERS).Title, Check text, Fix text
Title
Forwarders on an authoritative Windows DNS Server, if enabled for external resolution, must forward only to an internal, non-Active Directory (AD)-integrated DNS server or to the DODDoW Enterprise Recursive Services (ERS).
Check text
Note: If the Windows DNS Server is in the classified network, this check is not applicable. If forwarders are not being used, this is not applicable.
Note: In Windows DNS Server, if forwarders are configured, the recursion setting must also be enabled because disabling recursion will disable forwarders.
If forwarders are not used, recursion must be disabled. In both cases, the use of root hints must be disabled.
Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.
Press the Windows key + R and execute "dnsmgmt.msc".
On the opened DNS Manager snap-in from the left pane, right-click on the server name for the DNS server and select "Properties".
Click the "Forwarders" tab.
Review the IP address(es) for the forwarder(s) use.
If the DNS server does not forward to another DODDoW-managed DNS server or to the DODDoW ERS, this is a finding.
If "Use root hints if no forwarders are available" is selected, this is a finding.
Fix text
Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.
Press the Windows key + R and execute "dnsmgmt.msc".
On the opened DNS Manager snap-in from the left pane, right-click on the server name for the DNS server and select "Properties".
Click the "Forwarders" tab.
Replace the forwarders being used with another DODDoW-managed DNS server or the DODDoW ERS.
Deselect "Use root hints if no forwarders are available".
V-259353CAT IIIn a split DNS configuration between the external and internal networks, the external name server must be configured to not be reachable from inside resolvers.Check text
Check text
Consult with the system administrator to review the external Windows DNS Server's DODDoW approved firewall policy.
The inbound TCP and UDP ports 53 rule should be configured to only restrict IP addresses from the internal network.
If the DODDoW-approved firewall policy is not configured with the restriction, consult with the network firewall administrator to confirm the restriction on the network firewall.
If neither the DNS server's DODDoW approved firewall policy nor the network firewall is configured to block internal hosts from querying the external DNS server, this is a finding.
V-259374CAT IIThe Windows DNS Server's IP address must be statically defined and configured locally on the server.Check text, Fix text
Check text
Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.
Use "ipconfig /all" to identify all network adapters.
or
Locate the "Network Internet Access" icon, right-click on it, and select "Open Network & Sharing Center".
Click "Change adapter settings".
Right-click on the Ethernet and click "Properties".
Select "Internet Protocol Version 4 (TCP/IPv4)" and click "Properties".
Verify the "Use the following IP address" is selected, with an IPIPv4 address, subnet mask, and default gateway assigned.
Or
Select "Internet Protocol Version 4 (TCP/IPv6)" and click "Properties".
Verify the "Use the following IP address" is selected, with an IPv6 address, subnet prefix length, and default gateway assigned.
If the "Use the following IP address" is not selected with a configured IP address (either IPv4 or IPv6), subnet mask (or prefix length), and default gateway, this is a finding.
Fix text
Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.
Use "ipconfig /all" to identify all network adapters.
or
Locate the "Network Internet Access" icon, right-click on it, and select "Open Network & Sharing Center".
Click "Change adapter settings".
Right-click on the Ethernet and click "Properties".
Select "Internet Protocol Version 4 (TCP/IPv4)" and click "Properties".
Select "Use the following IP address" and populate with an IPIPv4 address, subnet mask, and default gateway.
Click "Ok".
Or
Select "Internet Protocol Version 6 (TCP/IPv6)" and click "Properties".
Select "Use the following IP address" and populate with an IPv6 address, subnet prefix length (typically 64), and default gateway.
Click "Ok".
V-259392CAT IIThe Windows DNS Server must use an approved DoW PKI certificate authority.Title, Discussion
Title
The Windows DNS Server must use an approved DODoW PKI certificate authority.
Discussion
Untrusted certificate authorities (CA) can issue certificates, but the certificates may be issued by organizations or individuals that seek to compromise DODDoW systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DODDoW-approved CA, trust of this CA has not been established.
The DODDoW will only accept PKI certificates obtained from a DODDoW-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of SSL/TLS certificates.
TSIG and SIG(0) are not configurable in Windows DNS Server. To meet the requirement for authentication between Windows DNS Servers, IPsec must be implemented between the Windows DNS Servers.
Note: If multiple certificates from the same CA are present on the DNS server, IPsec authentication might fail due to an incorrect certificate being chosen. For this purpose, an Active Directory Certificate Services (AD CS) role must be installed and configured as an Enterprise certificate authority (CA).
Refer to the Microsoft Windows Server DNS Overview.pdf for references on deploying certificates for this procedure.
V-259407CAT IIThe Windows DNS Server must verify the correct operation of security functions upon system startup and/or restart, upon command by a user with privileged access, and/or every 30 days.Check text, Fix text
Check text
This functionality should be performed by an approved and properly configured DODDoW system monitoring solution.
If all required DODDoW products are not installed and /or the installed productions are not enabled, this is a finding.
Fix text
Install an approved DODoW system monitoring solution.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R6 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.