STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

On a BIND 9.x server, all root name servers listed in the local root zone file hosted on a BIND 9.x authoritative name server must be empty or removed.

DISA Rule

SV-272397r1124056_rule

Vulnerability Number

V-272397

Group Title

SRG-APP-000516-DNS-000102

Rule Version

BIND-9X-001410

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Remove the local root zone file from the name server.

Check Contents

If this server is a caching name server, this is not applicable.

Verify there is not a local root zone on the name server.

Inspect the "named.conf" file for the following:

zone "." IN {
type hint;
file "<file_name>"
};

If the file name identified is not empty or does exist, this is a finding.

Vulnerability Number

V-272397

Documentable

False

Rule Version

BIND-9X-001410

Severity Override Guidance

If this server is a caching name server, this is not applicable.

Verify there is not a local root zone on the name server.

Inspect the "named.conf" file for the following:

zone "." IN {
type hint;
file "<file_name>"
};

If the file name identified is not empty or does exist, this is a finding.

Check Content Reference

M

Target Key

5687