mediumnetworkverified ✓

Configure at least two DNS name servers

dns-nameservers-configured · RHEL ≥ 8 · 1 impl

Description

For RHEL 8 systems using DNS resolution, at least two name servers must be configured in /etc/resolv.conf to provide redundancy. If DNS is managed by NetworkManager or systemd-resolved, the resolver configuration must include at least two nameserver entries.

Rationale

Relying on a single DNS server creates a single point of failure for name resolution. Configuring at least two name servers ensures continued DNS resolution if one server becomes unavailable.

Check → Remediate

Checkcommand

# First verify DNS is used for host resolution (nsswitch.conf)
if ! grep -qE '^\s*hosts:.*\bdns\b' /etc/nsswitch.conf 2>/dev/null; then
  echo "NOT APPLICABLE: DNS not configured in /etc/nsswitch.conf hosts line"
  exit 0
fi
# Then check at least two nameservers are configured
count=$(grep -c '^\s*nameserver\s' /etc/resolv.conf 2>/dev/null || echo 0)
if [ "$count" -lt 2 ]; then
  echo "FAIL: Only $count nameserver(s) in /etc/resolv.conf (need at least 2)"
  exit 1
fi
echo "OK: $count nameservers configured"

expected_exit:: 0

Remediatemanual

note:: Add at least two nameserver entries to /etc/resolv.conf or configure NetworkManager/systemd-resolved to use multiple DNS servers. Example: nameserver <primary-dns-ip> nameserver <secondary-dns-ip>

Framework references

STIG

V-281338 / RHEL-10-800060V-257948 / RHEL-09-252035V-230316

NIST 800-53

SC-20CM-6

Live verification

rhel8:check

#dns#nameserver#redundancy#resolv.conf#stig