STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

The BIND 9.x secondary name server must limit the number of zones requested from a single primary name server.

DISA Rule

SV-272365r1124031_rule

Vulnerability Number

V-272365

Group Title

SRG-APP-000001-DNS-000001

Rule Version

BIND-9X-001020

Severity

CAT II

CCI(s)

• CCI-000054 - Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.

Weight

10

Fix Recommendation

Edit the "named.conf" file.

Add the "transfers-per-ns" sub-statement to the "options" statement block.

The value of the "transfers-per-ns" option can be increased to a value no greater than three based on organizational requirements needed to support DNS operations.

Restart the BIND 9.x process.

Check Contents

If this is not a secondary name server, this requirement is not applicable.

Verify that the secondary name server is configured to limit the number of zones requested from a single primary name server.

Inspect the "named.conf" file for the following:

options {
transfers-per-ns 2;
};

If the "options" statement does not contain a "transfers-per-ns" sub-statement, this is a finding.

If the transfers-per-ns value is greater than three, this is a finding.

Vulnerability Number

V-272365

Documentable

False

Rule Version

BIND-9X-001020

Severity Override Guidance

If this is not a secondary name server, this requirement is not applicable.

Verify that the secondary name server is configured to limit the number of zones requested from a single primary name server.

Inspect the "named.conf" file for the following:

options {
transfers-per-ns 2;
};

If the "options" statement does not contain a "transfers-per-ns" sub-statement, this is a finding.

If the transfers-per-ns value is greater than three, this is a finding.

Check Content Reference

M

Target Key

5687