STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

A BIND 9.x implementation configured as a caching name server must restrict recursive queries to only the IP addresses and IP address ranges of known supported clients.

DISA Rule

SV-272423r1123940_rule

Vulnerability Number

V-272423

Group Title

SRG-APP-000246-DNS-000035

Rule Version

BIND-9X-001740

Severity

CAT II

CCI(s)

• CCI-001094 - Restrict the ability of individuals to launch organization-defined denial of service attacks against other systems.

Weight

10

Fix Recommendation

Configure the caching name server to accept recursive queries only from the IP addresses and address ranges of known supported clients.

Edit the "named.conf" file and add the following to the options statement:

allow-query {trustworthy_hosts;};
allow-recursion {trustworthy_hosts;};

Restart the BIND 9.x process.

Check Contents

This check is only applicable to caching name servers.

Verify the allow-query and allow-recursion phrases are properly configured.

Inspect the "named.conf" file for the following:

allow-query {trustworthy_hosts;};
allow-recursion {trustworthy_hosts;};

The name of the ACL does not need to be "trustworthy_hosts", but the name must match the ACL name defined earlier in "named.conf" for this purpose. If not, this is a finding.

Verify noninternal IP addresses do not appear in either the referenced ACL (e.g., trustworthy_hosts) or directly in the statements themselves.

If noninternal IP addresses appear, this is a finding.

Vulnerability Number

V-272423

Documentable

False

Rule Version

BIND-9X-001740

Severity Override Guidance

This check is only applicable to caching name servers.

Verify the allow-query and allow-recursion phrases are properly configured.

Inspect the "named.conf" file for the following:

allow-query {trustworthy_hosts;};
allow-recursion {trustworthy_hosts;};

The name of the ACL does not need to be "trustworthy_hosts", but the name must match the ACL name defined earlier in "named.conf" for this purpose. If not, this is a finding.

Verify noninternal IP addresses do not appear in either the referenced ACL (e.g., trustworthy_hosts) or directly in the statements themselves.

If noninternal IP addresses appear, this is a finding.

Check Content Reference

M

Target Key

5687