STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

On the BIND 9.x server the IP address for hidden primary authoritative name servers must not appear in the name servers set in the zone database.

DISA Rule

SV-272383r1124043_rule

Vulnerability Number

V-272383

Group Title

SRG-APP-000516-DNS-000108

Rule Version

BIND-9X-001260

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Edit the zone file(s).

Remove all references to the hidden primary name server.

Restart the BIND 9.x process.

Check Contents

With the assistance of the DNS administrator, identify if the BIND 9.x implementation is using a hidden primary name server. If it is not, this is not applicable.

In a split DNS configuration that is using a hidden primary name server, verify that the name server IP address is not listed in the zone file.

With the assistance of the DNS administrator, obtain the IP address of the hidden primary name server.

Inspect each zone file used by the hidden primary name server and its secondary zones.

If the IP address for the hidden primary name server is listed in any of the zone files, this is a finding.

Vulnerability Number

V-272383

Documentable

False

Rule Version

BIND-9X-001260

Severity Override Guidance

With the assistance of the DNS administrator, identify if the BIND 9.x implementation is using a hidden primary name server. If it is not, this is not applicable.

In a split DNS configuration that is using a hidden primary name server, verify that the name server IP address is not listed in the zone file.

With the assistance of the DNS administrator, obtain the IP address of the hidden primary name server.

Inspect each zone file used by the hidden primary name server and its secondary zones.

If the IP address for the hidden primary name server is listed in any of the zone files, this is a finding.

Check Content Reference

M

Target Key

5687