BIND
Instruction: This check is only applicable to zone master servers. If there are no allow-transfer phrases within named.conf, then this is a finding. If there are allow-transfer phrases, then check that there is one corresponding to each of the zone partners. If this is not the case, then this is also a finding.
If there are allow-transfer phrases for servers other than those supplied, then there may be a finding associated with the incompleteness of the list.
If the key statement references a file, then no other key statement should reference the same file.
If the key statement includes a character representation of the key itself (an improper configuration), then no other key statement should include the same character string.
On the master name server, this is an example of a configured allow-transfer phrase:
zone "disa.mil" {
type master;
file "db.disa.mil";
allow-transfer {10.10.10.1; key ns1.kalamazoo.disa.mil_ns2.kalamazoo.disa.mil.; };
};
Windows 2000/2003 DNS
This check only applies for Windows DNS zones not integrated with active directory. From the DNS management console snap-in, expand the Forward Lookup zones branch, select the zone you want to configure and right click and select Properties. Select the Zone Transfer tab.
If "Allow zone transfers:" is checked, "Only to the following servers" must also be checked. The reviewer must validate the name servers listed. If this is not the case, then this is a finding