STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

The BIND 9.x server signature generation using the key signing key (KSK) must be done offline, using the KSK-private key stored offline.

DISA Rule

SV-272373r1192864_rule

Vulnerability Number

V-272373

Group Title

SRG-APP-000176-DNS-000096

Rule Version

BIND-9X-001150

Severity

CAT II

CCI(s)

• CCI-000186 - For public key-based authentication, enforce authorized access to the corresponding private key.

Weight

10

Fix Recommendation

Remove all private KSKs from the name server and ensure they are stored offline in a secure location.

Check Contents

Verify that no private KSKs are stored on the name server.

With the assistance of the DNS administrator, obtain a list of all DNSSEC private keys that are stored on the name server.

Inspect the signed zone files(s) and if there are local zones, look for the KSK key ID:

DNSKEY 257 3 8 ( <hash_algorithm) ; KSK ; alg = ECDSAP256SHA256; key id = 52807

Verify that none of the identified private keys are KSKs.

An example private KSK would look like the following:

Kexample.com.+008+52807.private

If private KSKs are stored on the name server, this is a finding.

Vulnerability Number

V-272373

Documentable

False

Rule Version

BIND-9X-001150

Severity Override Guidance

Verify that no private KSKs are stored on the name server.

With the assistance of the DNS administrator, obtain a list of all DNSSEC private keys that are stored on the name server.

Inspect the signed zone files(s) and if there are local zones, look for the KSK key ID:

DNSKEY 257 3 8 ( <hash_algorithm) ; KSK ; alg = ECDSAP256SHA256; key id = 52807

Verify that none of the identified private keys are KSKs.

An example private KSK would look like the following:

Kexample.com.+008+52807.private

If private KSKs are stored on the name server, this is a finding.

Check Content Reference

M

Target Key

5687