STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

The BIND 9.x server implementation must have fetches-per-zone enabled.

DISA Rule

SV-275936r1156959_rule

Vulnerability Number

V-275936

Group Title

SRG-APP-000516-DNS-000109

Rule Version

BIND-9X-002450

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Modify the BIND configuration file (/etc/named.conf ).

Add the fetches-per-zone option to the options section of the configuration file:

fetches-per-zone <integer> drop;

After making changes, reload or restart BIND to apply the new settings.

Check Contents

Verify fetches-per-zone is enabled with an organization-defined number.

Inspect the named.conf file for the following:

options {
fetches-per-zone <integer> drop ;

If fetches-per-zone is not enabled and set to drop, this is a finding.

Vulnerability Number

V-275936

Documentable

False

Rule Version

BIND-9X-002450

Severity Override Guidance

Verify fetches-per-zone is enabled with an organization-defined number.

Inspect the named.conf file for the following:

options {
fetches-per-zone <integer> drop ;

If fetches-per-zone is not enabled and set to drop, this is a finding.

Check Content Reference

M

Target Key

5687