STIGQter: STIG Summary: Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The DNS Name Server software must be configured to refuse queries for its version information.

DISA Rule

SV-259403r1001264_rule

Vulnerability Number

V-259403

Group Title

SRG-APP-000333-DNS-000104

Rule Version

WDNS-22-000075

Severity

CAT II

CCI(s)

CCI-002201 - When transferring information between different security domains, use organization-defined data type identifiers to validate data essential for information flow decisions.

Weight

Fix Recommendation

To disable the version being returned in queries, execute the following command:

dnscmd /config /EnableVersionQuery 0 <enter>

Check Contents

The "EnableVersionQuery" property controls what version information the DNS server will respond with when a DNS query with class set to "CHAOS" and type set to "TXT" is received.

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Open a command window and execute the command:

nslookup <enter>
Note: Confirm the Default Server is the DNS server on which the command is being run.

At the nslookup prompt, type:

set type=TXT <enter>
set class=CHAOS <enter>
version.bind <enter>

If the response returns something similar to text = "Microsoft DNS 6.1.7601 (1DB14556)", this is a finding.

Vulnerability Number

V-259403

Documentable

False

Rule Version

WDNS-22-000075

Severity Override Guidance

Check Content Reference

Target Key

5576