STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

A BIND 9.x primary name server must limit the number of concurrent zone transfers between authorized secondary name servers.

DISA Rule

SV-272364r1124029_rule

Vulnerability Number

V-272364

Group Title

SRG-APP-000001-DNS-000001

Rule Version

BIND-9X-001010

Severity

CAT II

CCI(s)

• CCI-000054 - Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.

Weight

10

Fix Recommendation

Edit the "named.conf" file.

Add the "transfers" sub-statement to each "server" statement block.

The value of the "transfers" option can be increased to a value no greater than three based on organizational requirements needed to support DNS operations.

Restart the BIND 9.x process.

Check Contents

If this is not a primary name server, this requirement is not applicable.

Verify that the name server is configured to limit the number of zone transfers from authorized secondary name servers.

Inspect the "named.conf" file for the following:

server <ip_address> {
transfers 2;
};

If each "server" statement does not contain a "transfers" sub-statement, this is a finding.

If the transfers value is greater than three, this is a finding.

Vulnerability Number

V-272364

Documentable

False

Rule Version

BIND-9X-001010

Severity Override Guidance

If this is not a primary name server, this requirement is not applicable.

Verify that the name server is configured to limit the number of zone transfers from authorized secondary name servers.

Inspect the "named.conf" file for the following:

server <ip_address> {
transfers 2;
};

If each "server" statement does not contain a "transfers" sub-statement, this is a finding.

If the transfers value is greater than three, this is a finding.

Check Content Reference

M

Target Key

5687