BIND 9.x STIG

BIND 9.x Security Technical Implementation Guide

The BIND 9.x Security Technical Implementation Guide (V3 R4) has 73 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

73STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R4

CurrentPublished Wed Sep 30 2026

On a BIND 9.x server, all root name servers listed in the local root zone file hosted on a BIND 9.x authoritative name server must be valid for that zone.

BIND 9.x Security Technical Implementation Guide

Assessment Title

Rule Text

On a BIND 9.x server, all root name servers listed in the local root zone file hosted on a BIND 9.x authoritative name server must be valid for that zone.

Description

Discussion Text

All caching name servers must be authoritative for the root zone because, without this starting point, they would have no knowledge of the DNS infrastructure and thus would be unable to respond to any queries. The security risk is that an adversary could change the root hints and direct the caching name server to a bogus root server. At that point, every query response from that name server is suspect, which would give the adversary substantial control over the network communication of the name servers' clients.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-272396

Rule

SV-272396r1192866_rule

Severity

medium

Rule Version

BIND-9X-001400

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

If this is an authoritative name server, this is not applicable.

Use command dig @<serverip> . ns and examine results.

Answer results
.                       518400  IN      NS      e.root-servers.net.
.                       518400  IN      NS      a.root-servers.net.
.                       518400  IN      NS      g.root-servers.net.
.                       518400  IN      NS      i.root-servers.net.
.                       518400  IN      NS      h.root-servers.net.
.                       518400  IN      NS      d.root-servers.net.
.                       518400  IN      NS      c.root-servers.net.
.                       518400  IN      NS      k.root-servers.net.
.                       518400  IN      NS      f.root-servers.net.
.                       518400  IN      NS      m.root-servers.net.
.                       518400  IN      NS      b.root-servers.net.
.                       518400  IN      NS      j.root-servers.net.
.                       518400  IN      NS      l.root-servers.net.
 
;; ADDITIONAL SECTION:
m.root-servers.net.     518400  IN      A       202.12.27.33
l.root-servers.net.     518400  IN      A       199.7.83.42
k.root-servers.net.     518400  IN      A       193.0.14.129
j.root-servers.net.     518400  IN      A       192.58.128.30
i.root-servers.net.     518400  IN      A       192.36.148.17
h.root-servers.net.     518400  IN      A       198.97.190.53
g.root-servers.net.     518400  IN      A       192.112.36.4
f.root-servers.net.     518400  IN      A       192.5.5.241
e.root-servers.net.     518400  IN      A       192.203.230.10
d.root-servers.net.     518400  IN      A       199.7.91.13
c.root-servers.net.     518400  IN      A       192.33.4.12
b.root-servers.net.     518400  IN      A       170.247.170.2
a.root-servers.net.     518400  IN      A       198.41.0.4
m.root-servers.net.     518400  IN      AAAA    2001:dc3::35
l.root-servers.net.     518400  IN      AAAA    2001:500:9f::42
k.root-servers.net.     518400  IN      AAAA    2001:7fd::1
j.root-servers.net.     518400  IN      AAAA    2001:503:c27::2:30
i.root-servers.net.     518400  IN      AAAA    2001:7fe::53
h.root-servers.net.     518400  IN      AAAA    2001:500:1::53
g.root-servers.net.     518400  IN      AAAA    2001:500:12::d0d
f.root-servers.net.     518400  IN      AAAA    2001:500:2f::f
e.root-servers.net.     518400  IN      AAAA    2001:500:a8::e
d.root-servers.net.     518400  IN      AAAA    2001:500:2d::d
c.root-servers.net.     518400  IN      AAAA    2001:500:2::c
b.root-servers.net.     518400  IN      AAAA    2801:1b8:10::b
a.root-servers.net.     518400  IN      AAAA    2001:503:ba3e::2:30

If names and addresses do not match the current IANA list, this is a finding.

Perform command dig @<serverip> . dnskey +multi and examine results.

answer results
77555 IN DNSKEY 257 3 8 (
                                AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTO
                                iW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN
                                7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5
                                LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8
                                efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7
                                pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLY
                                A4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws
                                9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
                                ) ; KSK; alg = RSASHA256 ; key id = 20326
.                       77555 IN DNSKEY 256 3 8 (
                                AwEAAbEbGCpGTDrcZTWqWWE72nphyshpRcILdzCVlBGU
                                9Ln1Fui9kkseUOP+g5GLUeVFKdTloeRTA9+EYiQdXgWX
                                mXmuW/nGxZjAikluF/O9NzLVrr5iZnth2xu+F48nrJlA
                                gWWiMNau54NI5sZ3iVQfhFsq2pZmf43RauRPniYMShOL
                                O7EBWWXr5glDSgZGS9fSm6xHwwF+g8D4m8oanjvdCBNx
                                XzSEKS31ibxjLifTfvwCg3y4XXcNW9U6Nu3JmoKUdxqp
                                PPIkBvVQbIz4UO2FwaR13uXC03ALP1Yx2QNSS4SZlcIM
                                tAftQR9wtCiuPWQnFv4jkzWqlhp1Lmf7bcoL9yk=
                                ) ; ZSK; alg = RSASHA256 ; key id = 53148
.                       77555 IN DNSKEY 257 3 8 (
                                AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC
                                6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeH
                                spaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vr
                                hbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAx
                                m9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7
                                CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+
                                u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxP
                                vYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=
                                ) ; KSK; alg = RSASHA256 ; key id = 38696

Note: May use "nslookup" as an alternative to "dig".

If the DNSSEC keys and root anchors do not match the IANA list, this is a finding.

Implementation Procedure

Fix Text

Edit the local root zone file.

Ensure that the root servers listed match the IANA list.

Ensure that the DNS keys and trust anchors listed match the IANA list.

Restart the BIND 9.x process.

STIG check 32 of 73 in the BIND 9.x STIG checklist

← Previous · V-272395The primary servers in a BIND 9.x implementation must notify authorized secondary name servers when zone files are updated.Next · V-272397 →On a BIND 9.x server, all root name servers listed in the local root zone file hosted on a BIND 9.x authoritative name server must be empty or removed.