A BIND 9.x server implementation must maintain the integrity and confidentiality of DNS information while it is being prepared for transmission, in transmission, and in use and must perform integrity verification and data origin verification for all DNS information.
DISA Rule
SV-272417r1156947_rule
Vulnerability Number
V-272417
Group Title
SRG-APP-000348-DNS-000042
Rule Version
BIND-9X-001650
Severity
CAT I
CCI(s)
- CCI-000366 - Implement the security configuration settings.
- CCI-001902 - Provide the means for authorized individuals to determine the identity of the producer of the information.
- CCI-002463 - Provide data origin artifacts for internal name/address resolution queries.
- CCI-001178 - Provide additional data origin authentication artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.
- CCI-001184 - Protect the authenticity of communications sessions.
- CCI-001663 - Provide the means to enable verification of a chain of trust among parent and child domains (if the child supports secure resolution services), when operating as part of a distributed, hierarchical namespace.
- CCI-001901 - Bind the identity of the information producer with the information to an organization-defined strength of binding.
- CCI-001904 - Validates the binding of the information producer identity to the information at an organization-defined frequency.
- CCI-002420 - Maintain the confidentiality and/or integrity of information during preparation for transmission.
- CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.
- CCI-002462 - Provide additional data integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.
- CCI-002464 - Provide data integrity protection artifacts for internal name/address resolution queries.
- CCI-002465 - Request data origin authentication verification on the name/address resolution responses the system receives from authoritative sources.
- CCI-002466 - Request data integrity verification on the name/address resolution responses the system receives from authoritative sources.
- CCI-002467 - Perform data integrity verification on the name/address resolution responses the system receives from authoritative sources.
- CCI-002468 - Perform data origin verification authentication on the name/address resolution responses the system receives from authoritative sources.
- CCI-001310 - Checks the validity of organization-defined information inputs to the system.
Weight
10
Fix Recommendation
Set the "dnssec-validation" option to "yes".
Sign each zone file for which the name server is responsible.
Configure each zone for which the name server is responsible to use a DNSSEC signed zone.
Check Contents
For a recursive server, verify that dnssec-validation yes is enabled.
Inspect the "named.conf" file for the following:
dnssec-validation yes;
If "dnssec-validation yes" does not exist or is not set to "yes", this is a finding.
For an authoritative server, verify that each zone on the name server has been signed.
Identify each zone file for which the name server is responsible and search each file for the "DNSKEY" entries:
# less <signed_zone_file>
86400 DNSKEY 257 3 8 ( HASHED_KEY ) ; KSK; alg = ECDSAP256SHA256; key id = 31225
86400 DNSKEY 256 3 8 ( HASHED_KEY ) ; ZSK; alg = ECDSAP256SHA256; key id = 52179
Verify that there are separate "DNSKEY" entries for the "KSK" and the "ZSK".
If the "DNSKEY" entries are missing, the zone file is not signed.
If the zone files are not signed, this is a finding.
Vulnerability Number
V-272417
Documentable
False
Rule Version
BIND-9X-001650
Severity Override Guidance
For a recursive server, verify that dnssec-validation yes is enabled.
Inspect the "named.conf" file for the following:
dnssec-validation yes;
If "dnssec-validation yes" does not exist or is not set to "yes", this is a finding.
For an authoritative server, verify that each zone on the name server has been signed.
Identify each zone file for which the name server is responsible and search each file for the "DNSKEY" entries:
# less <signed_zone_file>
86400 DNSKEY 257 3 8 ( HASHED_KEY ) ; KSK; alg = ECDSAP256SHA256; key id = 31225
86400 DNSKEY 256 3 8 ( HASHED_KEY ) ; ZSK; alg = ECDSAP256SHA256; key id = 52179
Verify that there are separate "DNSKEY" entries for the "KSK" and the "ZSK".
If the "DNSKEY" entries are missing, the zone file is not signed.
If the zone files are not signed, this is a finding.
Check Content Reference
M
Target Key
5687
STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026: