STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

The BIND 9.x server private key corresponding to the zone-signing key (ZSK) pair must be the only DNSSEC key kept on a name server that supports dynamic updates.

DISA Rule

SV-272372r1123853_rule

Vulnerability Number

V-272372

Group Title

SRG-APP-000176-DNS-000094

Rule Version

BIND-9X-001140

Severity

CAT II

CCI(s)

• CCI-000186 - For public key-based authentication, enforce authorized access to the corresponding private key.

Weight

10

Fix Recommendation

Remove any ZSK private keys existing on the server other than the one corresponding to the active ZSK pair.

Check Contents

Verify that the ZSK private key is the only key stored on the name server.

For each signed zone file, identify the ZSK "key id" number:

# cat <signed_zone_file> | grep -i "zsk"
ZSK; alg = ECDSAP256SHA256; key id = 22335

Using the ZSK "key id", verify that the only private key stored on the system matches the "key id".

Kexample.com.+008+22335.private

If any ZSK private keys exist on the server other than the one corresponding to the active ZSK pair, this is a finding.

Vulnerability Number

V-272372

Documentable

False

Rule Version

BIND-9X-001140

Severity Override Guidance

Verify that the ZSK private key is the only key stored on the name server.

For each signed zone file, identify the ZSK "key id" number:

# cat <signed_zone_file> | grep -i "zsk"
ZSK; alg = ECDSAP256SHA256; key id = 22335

Using the ZSK "key id", verify that the only private key stored on the system matches the "key id".

Kexample.com.+008+22335.private

If any ZSK private keys exist on the server other than the one corresponding to the active ZSK pair, this is a finding.

Check Content Reference

M

Target Key

5687