Checklist Summary:

The Berkeley Internet Name Domain (BIND) 9.x Security Technical Implementation Guide (STIG) is published as a tool to improve the security of the Department of Defense (DoD) Domain Name System (DNS) infrastructure. The requirements were developed from Federal and DoD consensus based on the Domain Name System Security Requirements Guide (DNS SRG). The vulnerabilities discussed in this document are applicable to a BIND 9.x DNS implementation installed on a UNIX/Linux Operating System (OS). This document should be applied to all DoD DNS implementations that are running BIND 9.x as an external name server, an internal name server, or as a caching (recursive) name server.

Checklist Role:

• DNS Server

Known Issues:

Not provided.

Target Audience:

Not provided.

Target Operational Environment:

• Managed
• Specialized Security-Limited Functionality (SSLF)

Testing Information:

Not provided.

Regulatory Compliance:

DoD Instruction (DoDI) 8500.01 requires that “all IT that receives, processes, stores, displays, or transmits DoD information will be […] configured […] consistent with applicable DoD cybersecurity policies, standards, and architectures” and tasks that Defense Information Systems Agency (DISA) “develops and maintains control correlation identifiers (CCIs), security requirements guides (SRGs), security technical implementation guides (STIGs), and mobile code risk categories and usage guides that implement and are consistent with DoD cybersecurity policies, standards, architectures, security controls, and validation procedures, with the support of the NSA/CSS, using input from stakeholders, and using automation whenever possible.” This document is provided under the authority of DoDI 8500.01.

Comments/Warnings/Miscellaneous:

Not provided.

Disclaimer:

Although the use of the principles and guidelines in these SRGs/STIGs provides an environment that contributes to the security requirements of DoD systems, applicable NIST SP 800-53 cybersecurity controls need to be applied to all systems and architectures based on the Committee on National Security Systems (CNSS) Instruction (CNSSI) 1253.

Product Support:

Not provided.

Point of Contact:

Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil. DISA will coordinate all change requests with the relevant DoD organizations before inclusion in this document. Approved changes will be made in accordance with the DISA maintenance release schedule.

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

updated to v1,r3 - 02/16/2018
Updated to FINAL - 3/18/2018
updated to v1,r4 - 4/25/18
Updated to FINAL - 5/25/18
updated to  Ver 1, Rel 5 - 1/22/19
Updated to FINAL - 2/19/19
updated to Ver 1, Rel 6- 4/30/19
Updated URLs - 6/5/19
Updated URLs - 8/12/2019
updated URLs per DISA - 1/21/2020
Updated URLs per DISA - 4/24/2020
Updated resource per DISA - 1/27/21
Updated resource per DISA - 7/29/21

Dependency/Requirements:

URL	Description

References:

Reference URL	Description

NIST checklist record last modified on 07/29/2021