STIGQter STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

A BIND 9.x server implementation must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks.

DISA Rule

SV-272424r1124066_rule

Vulnerability Number

V-272424

Group Title

SRG-APP-000247-DNS-000036

Rule Version

BIND-9X-001750

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the authoritative name server to prohibit recursion.

Edit the "named.conf" file and add the following sub-statements to the options statement:

options {
rate-limit {
responses-per-second <integer>;
window <integer>;
};

Restart the BIND 9.x process.

Check Contents

If this is a recursive name server, this is not applicable.

Excessive, almost-identical UDP responses can be controlled by configuring a rate-limit clause in an options or view statement. This mechanism keeps authoritative BIND 9 from being used to amplify reflection denial-of-service (DoS) attacks.

Inspect the "named.conf" file for the following:

options {
...
rate-limit {
responses-per-second <integer>;
window <integer>;
};

If the rate-limit sub-statements are missing, this is a finding.

Vulnerability Number

V-272424

Documentable

False

Rule Version

BIND-9X-001750

Severity Override Guidance

If this is a recursive name server, this is not applicable.

Excessive, almost-identical UDP responses can be controlled by configuring a rate-limit clause in an options or view statement. This mechanism keeps authoritative BIND 9 from being used to amplify reflection denial-of-service (DoS) attacks.

Inspect the "named.conf" file for the following:

options {
...
rate-limit {
responses-per-second <integer>;
window <integer>;
};

If the rate-limit sub-statements are missing, this is a finding.

Check Content Reference

M

Target Key

5687