STIGQter: STIG Summary: BIND 9.x Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 01 Jul 2026:

The host running a BIND 9.x implementation must have DNS cookies enabled.

DISA Rule

SV-275938r1156959_rule

Vulnerability Number

V-275938

Group Title

SRG-APP-000516-DNS-000109

Rule Version

BIND-9X-002470

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Edit the named.conf file:

options {
answer-cookie yes;
};

After making changes, save the named.conf file and restart the BIND service to apply the changes.

Check Contents

Verify answer-cookie is enabled.

Inspect the named.conf file for the following:

options {
answer-cookie yes;

If answer-cookie is missing or set to "no", this is a finding.

Vulnerability Number

V-275938

Documentable

False

Rule Version

BIND-9X-002470

Severity Override Guidance

Verify answer-cookie is enabled.

Inspect the named.conf file for the following:

options {
answer-cookie yes;

If answer-cookie is missing or set to "no", this is a finding.

Check Content Reference

Target Key

5687