Secure Name/Address Resolution Service (Recursive or Caching Resolver) SC-21
System and Communications Protection · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds SC-21 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, System and Communications Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
SC-21 (Secure Name/Address Resolution Service — Recursive or Caching Resolver) is the other side of SC-20: it covers your server as a consumer of DNS (Domain Name System) answers, not as the authority. When your server looks up a name, it should request and check proof that the answer is genuine and unaltered — that is, it should validate DNSSEC (Domain Name System Security Extensions) signatures, either itself or through a trusted resolver over an authenticated channel. It is a Low-baseline control.
What good looks like
- Turn on DNSSEC validation so your server rejects DNS answers that fail their signature check.
- Point the server at trusted resolvers over a channel you trust, rather than whatever DNS the network hands out automatically.
- Treat a failed validation as a real signal — it can mean a tampered or spoofed answer.
- Do not silently fall back to unvalidated DNS when a DNSSEC check fails.
- Keep the resolver software patched, since it parses untrusted data straight off the network.
Framework mapping
- NIST CSF 2.0 — PR.IR-01 — Networks and environments are protected from unauthorized logical access and usage
- CIS Controls v8 — Control 4 — Secure Configuration of Enterprise Assets and Software
How to move it toward Implemented
- Enable validation on the local resolver: with
systemd-resolvedsetDNSSEC=yesin/etc/systemd/resolved.confand restart, or withunboundconfigure a trust anchor (auto-trust-anchor-file). - Set trusted upstream resolvers explicitly (
DNS=inresolved.conf, or aforward-zonein unbound) instead of trusting servers handed out automatically by the network. - Prove enforcement with a negative control:
delv <name>should report ‘fully validated’ for a good name, while a deliberately broken test domain (for examplednssec-failed.org) should return SERVFAIL, a validation failure. - Save that pair of results as a dated file.
- Attach that DNSSEC-validation check as hardening evidence on the asset, naming
SC-21in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.