If you are configuring a dual-stack network for the host, you must set the minimum MTU value for the IPv4 address to 1280; if you do not, the IPv6 address will not be functional.
NIST SP 800 81r3 page with PDF.
The Infoblox STIG documents published by the US Defense Information Systems Agency. There is a DISA STIG for NIOS 8.x - https://www.stigviewer.com/stigs/infoblox_8x_dns
When you use RPZ to download Threat Feeds from a provider (e.g. Infoblox, etc), make sure that at the first RPZ feed in the list is a local feed that lists your critical internal domains and RFC1918 (and other networks that you use), set the action to allow without logging. This will prevent your internal systems from being impacted by erroneous data in the providers feed.
Under Grid Properties > General > Basic > Audit Logging you can set “Brief”, “Detailed”, “WAPI Detailed”. Setting to Brief instead of Detailed can (and has) hampered Infoblox support in establishing exact root cause of issues.
Under Grid Properties > Monitoring > Basic make sure you tick Copy Audit Log Message to Syslog. Because it is syslog that can be copied of to SIEM server, this is how you ensure a longer copy of audit logs.
The option “Return Minimal Responses” should generally be disabled for external facing DNS servers.
It has been see that enabling “Return Minimal Responses” can cause issues when Microsoft clients query NIOS which has a forwarder to a Microsoft Active Directory domain controller.
This means it returns
;; ANSWER SECTION: _mssms_mp_swa._tcp.domain.internal.local. 14400 IN SRV 0 0 80 domaincontrollerhostname.domain.internal.local.
Instead of
;; ANSWER SECTION: _mssms_mp_swa._tcp.domain.internal.local. 14400 IN SRV 0 0 80 domaincontrollerhostname.domain.internal.local. ;; ADDITIONAL SECTION: domaincontrollerhostname.domain.internal.local. 1200 IN A 1.2.3.4 domaincontrollerhostname.domain.internal.local. 1200 IN AAAA 2002:2002:2002::2002:2002
That extra bit is needed by the Microsoft clients so “Return Minimal Responses” had to be disabled.
NOTE: The following notes do not reflect official Infoblox best practice. These are just notes that I've made along the way.
In the Security tab in the Grid DNS Properties, it is recommended to turn on the following two options:
In accordance with RFC 6303 consider adding the following PTR zones as standard.
(And from here)