Nursing PC forced through validating resolvers
Floor workstations use only hospital validating resolvers; attempts to set 8.8.8.8 via local config are blocked by GPO/MDM, reducing DNS spoof paths to the EHR.
Secure Name / Address Resolution Service (Recursive or Caching Resolver)
High Risk
Moderate
Medium Cost
SC-21 requires recursive or caching resolvers to perform data origin authentication and integrity verification when resolving names (typically DNSSEC validation) and to handle validation failures in a defined way. Clinical endpoints that trust open or non-validating resolvers can be steered to malicious EHR lookalikes, rogue update servers, or attacker-controlled APIs.
Control Objective
Ensure organizational recursive/caching resolvers used by ePHI systems authenticate and integrity-check resolution data and fail closed per policy when validation fails.
Implementation Guidance
- Standardize recursive resolvers for clinical VLANs, servers, and VDI (no ad-hoc public DNS on EHR subnets).
- Enable DNSSEC validation on resolvers; define failure behavior (serve SERVFAIL vs insecure fallback—document risk acceptance if fallback allowed).
- Disable recursion on authoritative-only nodes; keep roles distinct (SC-22).
- Block outbound client DNS to the Internet from clinical networks except via approved resolvers.
- Log resolution anomalies and validation failures to SIEM.
- Protect resolver admin planes; patch resolver software promptly.
- Cover container/cloud workloads that resolve names for ePHI microservices.
- Test phishing/malicious domain scenarios and validation failure handling.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Validation failure on forged EHR alias
A forged signed-looking response fails validation; SC-21 resolvers return failure instead of quietly resolving to an attacker IP hosting a credential harvester.
Imaging modality name lookup
PACS modalities use approved recursive services so study send destinations resolve consistently and securely during overnight batches.
Best Practices
- Force clinical traffic through enterprise validating resolvers.
- Document validation failure policy.
- Separate recursive vs authoritative roles.
- Monitor SERVFAIL spikes.
- Patch resolvers like any ePHI-supporting infra.
- Align with SC-20 signing on authoritative side.
Common Gaps & Violations
- Clinical devices using public DNS.
- Validation disabled "for compatibility."
- Authoritative servers also open recursive to the world.
- No logging of DNS anomalies.
- IoT/biomed on open resolvers with no control.
Required Documentation
- Recursive resolver security standard (SC-21)
- Resolver architecture diagram (clinical paths)
- DNSSEC validation and failure-handling policy
- Egress DNS firewall rules evidence
- Monitoring/alert definitions
How to Test & Validate
- From a clinical test host, confirm only approved resolvers are reachable.
- Query a known-bad/unsigned test case per policy; observe expected failure/fallback.
- Verify recursion is disabled on authoritative-only servers.
- Review SIEM for resolver validation events.
- Spot-check biomed VLAN DNS settings.
Audit Considerations
Ask where nursing stations resolve names. If the answer is \"whatever the ISP or public DNS returns,\" SC-21 is not operating for ePHI workstations.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.312(e) Transmission Security — correct endpoint resolution supports confidential transmission.
- 164.312(c) Integrity — resolver integrity protects against redirected sessions.
- 164.308(a)(1) Risk Management — DNS spoofing is a recognized residual risk.
- 164.312(a) Access Control — users must reach authorized systems, not impostors.
Compliance Tips
- Ban public DNS on ePHI VLANs in the network standard.
- Include resolver validation in annual technical control tests.
- Coordinate SC-21 with Zero Trust DNS/web gateway designs.
Frequently Asked Questions
How does SC-21 differ from SC-20?
SC-20 secures authoritative sources; SC-21 secures recursive/caching resolvers that clients use.
Can we use a secure cloud DNS resolver?
Yes if it provides required authentication/integrity properties, is covered by BA/contract as needed, and clinical egress is forced through it.
What if a legacy modality breaks on DNSSEC validation?
Document exception, compensating controls, and remediation timeline—do not disable validation enterprise-wide.
References & Resources
- NIST SP 800-53 Rev. 5 — SC-21
- Related controls: SC-20, SC-22, SC-7, SI-4
- NIST SP 800-81
Related Guidelines
Related controls that commonly accompany SC-21.
Need Help Implementing SC-21?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.