STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

On the BIND 9.x server, the platform on which the name server software is hosted must be configured to send outgoing DNS messages from a random port.

DISA Rule

SV-272402r1124060_rule

Vulnerability Number

V-272402

Group Title

SRG-APP-000516-DNS-000110

Rule Version

BIND-9X-001490

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Edit the "named.conf" file.

Configure the BIND 9.x server to not specify ports for the query-source address or query-source-v6 address statements:

options {
query-source address <v4_address>;
query-source-v6 address <v6_address>;
};

Restart the BIND 9.x process.

Check Contents

Verify that the BIND 9.x server does not limit outgoing DNS messages to a specific port.

Inspect the "named.conf" file. The "query-source" and "query-source-v6" must not limit the ports available to be used.

options {
query-source address <v4_address>;
query-source-v6 address <v6_address>;
};

If the port flag is used on the query-source address or query-source-v6 address, this is a finding.

Vulnerability Number

V-272402

Documentable

False

Rule Version

BIND-9X-001490

Severity Override Guidance

Verify that the BIND 9.x server does not limit outgoing DNS messages to a specific port.

Inspect the "named.conf" file. The "query-source" and "query-source-v6" must not limit the ports available to be used.

options {
query-source address <v4_address>;
query-source-v6 address <v6_address>;
};

If the port flag is used on the query-source address or query-source-v6 address, this is a finding.

Check Content Reference

M

Target Key

5687