STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
STIGs updated 2 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

BIND 9.x Security Technical Implementation Guide

Version

V3R2

Release Date

Feb 25, 2026

SCAP Benchmark ID

BIND_9-x_STIG

Total Checks

73

Tags

other
CAT I: 3CAT II: 70CAT III: 0

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (73)

V-272364MEDIUMA BIND 9.x primary name server must limit the number of concurrent zone transfers between authorized secondary name servers.V-272365MEDIUMThe BIND 9.x secondary name server must limit the number of zones requested from a single primary name server.V-272366MEDIUMThe BIND 9.x secondary name server must limit the total number of zones the name server can request at any one time.V-272367MEDIUMThe BIND 9.x server implementation must limit the number of concurrent session client connections.V-272368MEDIUMThe print-severity variable for the configuration of BIND 9.x server logs must be configured to produce audit records containing information to establish what type of events occurred.V-272369MEDIUMThe print-time variable for the configuration of BIND 9.x server logs must be configured to establish when (date and time) the events occurred.V-272370MEDIUMThe print-category variable for the configuration of BIND 9.x server logs must be configured to record information indicating which process generated the events.V-272371MEDIUMA BIND 9.x server implementation must be configured to allow DNS administrators to audit all DNS server components based on selectable event criteria and produce audit records within all DNS server components that contain information for failed security verification tests, information to establish the outcome and source of the events, any information necessary to determine cause of failure, and any information necessary to return to operations with least disruption to mission processes.V-272372MEDIUMThe BIND 9.x server private key corresponding to the zone-signing key (ZSK) pair must be the only DNSSEC key kept on a name server that supports dynamic updates.V-272373MEDIUMThe BIND 9.x server signature generation using the key signing key (KSK) must be done offline, using the KSK-private key stored offline.V-272375MEDIUMThe read and write access to a TSIG key file used by a BIND 9.x server must be restricted to only the account that runs the name server software.V-272376MEDIUMA unique TSIG key used by a BIND 9.x server must be generated for each pair of communicating hosts.V-272377MEDIUMThe TSIG keys used with the BIND 9.x implementation must be owned by a privileged account.V-272378MEDIUMThe TSIG keys used with the BIND 9.x implementation must be group owned by a privileged account.V-272379MEDIUMOn a BIND 9.x server, for zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts.V-272380MEDIUMOn a BIND 9.x server in a split DNS configuration, where separate name servers are used between the external and internal networks, the internal name server must be configured to not be reachable from outside resolvers.V-272381MEDIUMOn a BIND 9.x server in a split DNS configuration, where separate name servers are used between the external and internal networks, the external name server must be configured to not be reachable from inside resolvers.V-272382MEDIUMA BIND 9.x implementation operating in a split DNS configuration must be approved by the organization's authorizing official (AO).V-272383MEDIUMOn the BIND 9.x server the IP address for hidden primary authoritative name servers must not appear in the name servers set in the zone database.V-272384MEDIUMA BIND 9.x server NSEC3 must be used for all internal DNS zones.V-272385MEDIUMOn the BIND 9.x server, the private keys corresponding to both the zone signing key (ZSK) and the key signing key (KSK) must not be kept on the BIND 9.x DNSSEC-aware primary authoritative name server when the name server does not support dynamic updates.V-272386MEDIUMThe two files generated by the BIND 9.x server dnssec-keygen program must be owned by the administrator account or deleted once they have been copied to the key file in the name server.V-272387MEDIUMThe two files generated by the BIND 9.x server dnssec-keygen program must be group owned by the server administrator account or deleted once they have been copied to the key file in the name server.V-272388MEDIUMPermissions assigned to the dnssec-keygen keys used with the BIND 9.x implementation must enforce read-only access to the key owner and deny access to all other users.V-272389MEDIUMA BIND 9.x server validity period for the RRSIGs covering a zones DNSKEY RRSet must be no less than two days and no more than one week.V-272390MEDIUMOn the BIND 9.x server, the private key corresponding to the zone signing key (ZSK), stored on name servers accepting dynamic updates, must be owned by named.V-272391MEDIUMOn the BIND 9.x server, the private key corresponding to the zone signing key (ZSK), stored on name servers accepting dynamic updates, must be group owned by named.V-272392MEDIUMThe BIND 9.x server implementation must prohibit the forwarding of queries to servers controlled by organizations outside of the U.S. government.V-272393MEDIUMThe secondary name servers in a BIND 9.x implementation must be configured to initiate zone update notifications to other authoritative zone name servers.V-272394MEDIUMA BIND 9.x server implementation must prohibit recursion on authoritative name servers.V-272395MEDIUMThe primary servers in a BIND 9.x implementation must notify authorized secondary name servers when zone files are updated.V-272396MEDIUMOn a BIND 9.x server, all root name servers listed in the local root zone file hosted on a BIND 9.x authoritative name server must be valid for that zone.V-272397MEDIUMOn a BIND 9.x server, all root name servers listed in the local root zone file hosted on a BIND 9.x authoritative name server must be empty or removed.V-272399MEDIUMThe BIND 9.x server implementation must implement internal/external role separation.V-272400MEDIUMEvery NS record in a zone file on a BIND 9.x server must point to an active name server and that name server must be authoritative for the domain specified in that record.V-272401MEDIUMOn a BIND 9.x server, all authoritative name servers for a zone must be located on different network segments.V-272402MEDIUMOn the BIND 9.x server, the platform on which the name server software is hosted must be configured to send outgoing DNS messages from a random port.V-272403MEDIUMA BIND 9.x server implementation must be operating on a Current-Stable version as defined by ISC.V-272404MEDIUMThe host running a BIND 9.x implementation must use a dedicated management interface to separate management traffic from DNS-specific traffic.V-272405MEDIUMThe host running a BIND 9.x implementation must use an interface that is configured to process only DNS traffic.V-272406MEDIUMThe platform on which the name server software is hosted must only run processes and services needed to support the BIND 9.x implementation.V-272407MEDIUMThe core BIND 9.x server files must be group owned by a group designated for DNS administration only.V-272408MEDIUMThe core BIND 9.x server files must be owned by the root or BIND 9.x process account.V-272410MEDIUMOn a BIND 9.x server, all authoritative name servers for a zone must have the same version of zone information.V-272411MEDIUMOn the BIND 9.x server, CNAME records must not point to a zone with lesser security for more than six months.V-272412MEDIUMOn the BIND 9.x server, a zone file must not include resource records that resolve to a fully qualified domain name residing in another zone.V-272413MEDIUMThe BIND 9.x name server software must run with restricted privileges.V-272414MEDIUMThe BIND 9.x implementation must not use a TSIG or DNSSEC key for more than one year.V-272415MEDIUMThe permissions assigned to the core BIND 9.x server files must be set to use the least privilege possible.V-272416MEDIUMThe host running a BIND 9.x implementation must implement a set of firewall rules that restrict traffic on the DNS interface.V-272417HIGHA BIND 9.x server implementation must maintain the integrity and confidentiality of DNS information while it is being prepared for transmission, in transmission, and in use and must perform integrity verification and data origin verification for all DNS information.V-272418MEDIUMIn the event of an error when validating the binding of other DNS servers' identity to the BIND 9.x information, when anomalies in the operation of the signed zone transfers are discovered, for the success and failure of start and stop of the name server service or daemon, and for the success and failure of all name server events, a BIND 9.x server implementation must generate a log entry.V-272419MEDIUMThe BIND 9.x server implementation must be configured to use only approved ports and protocols.V-272421MEDIUMThe BIND 9.x server implementation must use separate TSIG key-pairs when securing server-to-server transactions.V-272422MEDIUMA BIND 9.x server implementation must be running in a chroot(ed) directory structure.V-272423MEDIUMA BIND 9.x implementation configured as a caching name server must restrict recursive queries to only the IP addresses and IP address ranges of known supported clients.V-272424MEDIUMA BIND 9.x server implementation must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks.V-272425MEDIUMA BIND 9.x server must provide secure delegation to all child zones.V-272426MEDIUMThe BIND 9.x server validity period for the RRSIGs covering the DS RR for zones delegated children must be no less than two days and no more than one week.V-272427MEDIUMPermissions assigned to the DNSSEC keys used with the BIND 9.x implementation must enforce read-only access to the key owner and deny access to all other users.V-272428MEDIUMThe DNSSEC keys used with the BIND 9.x implementation must be owned by a privileged account.V-272429MEDIUMThe DNSSEC keys used with the BIND 9.x implementation must be group owned by a privileged account.V-272430MEDIUMThe BIND 9.x server implementation must maintain at least three file versions of the local log file.V-272431MEDIUMThe BIND 9.x server implementation must be configured with a channel to send audit records to a local file.V-272432HIGHThe BIND 9.x server implementation must be configured with a channel to send audit records to at least two remote syslogs.V-272433MEDIUMThe BIND 9.x server implementation must not be configured with a channel to send audit records to null.V-272435HIGHThe BIND 9.x server implementation must uniquely identify and authenticate the other DNS server before responding to a server-to-server transaction, zone transfer, and/or dynamic update request using cryptographically based bidirectional authentication to protect the integrity of the information in transit.V-272436MEDIUMA BIND 9.x server must implement NIST FIPS-validated cryptography for provisioning digital signatures and generating cryptographic hashes.V-275935MEDIUMThe BIND 9.x server implementation must have QNAME minimization set to "strict".V-275936MEDIUMThe BIND 9.x server implementation must have fetches-per-zone enabled.V-275937MEDIUMThe BIND 9.x server implementation must have fetches-per-server enabled.V-275938MEDIUMThe host running a BIND 9.x implementation must have DNS cookies enabled.V-275939MEDIUMThe BIND 9.x server implementation must limit the number of allowed dynamic update clients.