STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

The BIND 9.x server implementation must have QNAME minimization set to "strict".

DISA Rule

SV-275935r1124025_rule

Vulnerability Number

V-275935

Group Title

SRG-APP-000516-DNS-000500

Rule Version

BIND-9X-002440

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Edit the named.conf file

options {

qname-minimization strict;
};

After making changes, save the named.conf file and restart the BIND service to apply the changes.

Check Contents

Verify QNAME minimization is set to "strict".

Inspect the named.conf file for the following:

options {
qname-minimization strict;

If the qname minimization is not set to "strict", this is a finding.

Vulnerability Number

V-275935

Documentable

False

Rule Version

BIND-9X-002440

Severity Override Guidance

Verify QNAME minimization is set to "strict".

Inspect the named.conf file for the following:

options {
qname-minimization strict;

If the qname minimization is not set to "strict", this is a finding.

Check Content Reference

M

Target Key

5687