STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

A BIND 9.x server must provide secure delegation to all child zones.

DISA Rule

SV-272425r1123944_rule

Vulnerability Number

V-272425

Group Title

SRG-APP-000214-DNS-000025

Rule Version

BIND-9X-001770

Severity

CAT II

CCI(s)

• CCI-001179 - Provides the means to indicate the security status of child zones, when operating as part of a distributed, hierarchical namespace.

Weight

10

Fix Recommendation

Sign each child zone. During the zone signing process, ensure that a DS record is created and is stored on the parent zone name server.

Check Contents

Verify that there is a DS record set for each child zone defined in "/etc/named.conf" file.

For each child zone listed in "/etc/named.conf" file, verify there is a corresponding "dsset-zone_name" file.

If any child zone does not have a corresponding DS record set, this is a finding.

Vulnerability Number

V-272425

Documentable

False

Rule Version

BIND-9X-001770

Severity Override Guidance

Verify that there is a DS record set for each child zone defined in "/etc/named.conf" file.

For each child zone listed in "/etc/named.conf" file, verify there is a corresponding "dsset-zone_name" file.

If any child zone does not have a corresponding DS record set, this is a finding.

Check Content Reference

M

Target Key

5687