STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

A BIND 9.x server implementation must prohibit recursion on authoritative name servers.

DISA Rule

SV-272394r1156949_rule

Vulnerability Number

V-272394

Group Title

SRG-APP-000383-DNS-000047

Rule Version

BIND-9X-001380

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-001094 - Restrict the ability of individuals to launch organization-defined denial of service attacks against other systems.

Weight

10

Fix Recommendation

Configure the authoritative name server to prohibit recursion.

Edit the "named.conf" file and add the following sub-statements to the options statement:

recursion no;

Restart the BIND 9.x process.

Check Contents

If this is a recursive name server, this is not applicable.

Note: A recursive name server must NOT be configured as an authoritative name server for any zone.

Verify that the BIND 9.x server is configured to prohibit recursion on authoritative name servers.

Inspect the "named.conf" file for the following:

options {
recursion no;
allow-recursion {none;};
allow-query {none;};
};

If the "recursion" sub-statement is missing or set to "yes", this is a finding.

Vulnerability Number

V-272394

Documentable

False

Rule Version

BIND-9X-001380

Severity Override Guidance

If this is a recursive name server, this is not applicable.

Note: A recursive name server must NOT be configured as an authoritative name server for any zone.

Verify that the BIND 9.x server is configured to prohibit recursion on authoritative name servers.

Inspect the "named.conf" file for the following:

options {
recursion no;
allow-recursion {none;};
allow-query {none;};
};

If the "recursion" sub-statement is missing or set to "yes", this is a finding.

Check Content Reference

M

Target Key

5687