CIS BIND 9 DNS Server Benchmark

This recommendation verifies that Latest Stable BIND Version Is Installed on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

named -v
# Verify BIND version — should be latest stable release

apt list --installed 2>/dev/null | grep bind9
rpm -q bind 2>/dev/null

# Debian/Ubuntu:
apt update && apt install -y bind9

# RHEL/CentOS:
dnf update -y bind

This recommendation verifies that Named Runs As Non-Root User on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ps aux | grep named | grep -v grep
# Verify named runs as a non-root user (typically 'named' or 'bind')

grep '^User\|^Group' /etc/bind/named.conf* 2>/dev/null
grep 'OPTIONS' /etc/sysconfig/named 2>/dev/null

# Ensure named runs as non-root:
# In /etc/sysconfig/named (RHEL):
echo 'OPTIONS="-u named"' > /etc/sysconfig/named

# Or in named.conf:
# options { ... };
# Start with: named -u named

systemctl restart named

This recommendation verifies that Configuration Syntax Is Valid on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

named-checkconf
# Should return no errors

named-checkconf -p | head -30

# Fix any configuration errors reported:
named-checkconf 2>&1 | head -20

# After fixing:
systemctl restart named

This recommendation verifies that Named Runs in a Chroot Jail on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ps aux | grep named | grep chroot
# Check if named is running in a chroot

ls -la /var/named/chroot/ 2>/dev/null

# Install chroot package (RHEL):
dnf install -y bind-chroot

# Or manually configure chroot:
mkdir -p /var/named/chroot/{etc,var/named,var/run/named,dev}
cp /etc/named.conf /var/named/chroot/etc/
# Start with: named -u named -t /var/named/chroot

This setting ensures that Zone Transfers Are Restricted on the BIND 9 DNS server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the BIND 9 DNS server is essential for defense in depth.

named-checkconf -p | grep 'allow-transfer'
# Should show: allow-transfer { <specific IPs>; };
# NOT: allow-transfer { any; };

# In named.conf options or per-zone:
# options {
#     allow-transfer { 192.168.1.2; 10.0.0.2; none; };
# };

# For specific zone:
# zone "example.com" {
#     allow-transfer { 192.168.1.2; };
# };

rndc reload

This setting ensures that Query Access Is Appropriately Restricted on the BIND 9 DNS server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the BIND 9 DNS server is essential for defense in depth.

named-checkconf -p | grep 'allow-query'
# Verify query access is restricted appropriately
# For authoritative: allow-query { any; };
# For recursive: allow-query { internal-nets; };

# In named.conf:
# For recursive resolver (restrict to internal):
# options {
#     allow-query { 10.0.0.0/8; 192.168.0.0/16; 172.16.0.0/12; localhost; };
# };

rndc reload

This setting ensures that Dynamic Updates Are Restricted on the BIND 9 DNS server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the BIND 9 DNS server is essential for defense in depth.

named-checkconf -p | grep -A5 'allow-update'
# Should NOT show: allow-update { any; };
# Verify dynamic updates are restricted

# In each zone definition:
# zone "example.com" {
#     type master;
#     allow-update { key "update-key"; };
#     # Or: allow-update { none; };
# };

rndc reload

This recommendation verifies that Zone File Integrity Is Verified on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

named-checkzone example.com /var/named/example.com.zone
# Verify zone file syntax

named-checkzone -i full example.com /var/named/example.com.zone

# Fix zone file errors:
named-checkzone example.com /var/named/example.com.zone 2>&1

# Common fixes:
# - Ensure SOA serial is incremented
# - Fix missing trailing dots on FQDNs
# - Check record syntax

rndc reload example.com

This recommendation verifies that DNSSEC Validation Is Enabled on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

named-checkconf -p | grep 'dnssec-validation'
# Should return: dnssec-validation auto; (or yes)

dig +dnssec example.com @localhost | grep -E 'ad |RRSIG'

# In named.conf options:
# options {
#     dnssec-validation auto;
# };

rndc reload

This recommendation verifies that Zones Are Signed with DNSSEC on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if zones are signed:
dig +dnssec DNSKEY example.com @localhost

# Check for NSEC/NSEC3 records:
dig +dnssec NSEC example.com @localhost

# Generate DNSSEC keys:
dnssec-keygen -a ECDSAP256SHA256 -b 256 -n ZONE example.com
dnssec-keygen -a ECDSAP256SHA256 -b 256 -n ZONE -f KSK example.com

# Sign the zone:
dnssec-signzone -A -3 $(head -c 16 /dev/urandom | od -A n -t x | tr -d ' ') -N INCREMENT -o example.com -t example.com.zone

rndc reload

This recommendation verifies that Recursion Is Disabled on Authoritative Servers on the BIND 9 DNS server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the BIND 9 DNS server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

named-checkconf -p | grep recursion
# For authoritative-only: recursion no;
# For recursive resolver: recursion yes; with allow-recursion

# For authoritative-only servers:
# options {
#     recursion no;
# };

# For recursive resolvers:
# options {
#     recursion yes;
#     allow-recursion { 10.0.0.0/8; 192.168.0.0/16; localhost; };
# };

rndc reload

This setting ensures that Recursion Is Restricted to Internal Networks on the BIND 9 DNS server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the BIND 9 DNS server is essential for defense in depth.

named-checkconf -p | grep 'allow-recursion'
# Should restrict recursion to internal networks

named-checkconf -p | grep 'allow-query-cache'

# In named.conf:
# options {
#     allow-recursion { 10.0.0.0/8; 192.168.0.0/16; localhost; };
#     allow-query-cache { 10.0.0.0/8; 192.168.0.0/16; localhost; };
# };

rndc reload

This recommendation verifies that Response Rate Limiting Is Configured on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

named-checkconf -p | grep 'rate-limit'
# Verify response rate limiting is configured

# In named.conf:
# options {
#     rate-limit {
#         responses-per-second 5;
#         window 5;
#     };
# };

rndc reload

This recommendation verifies that Logging Channels Are Configured on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

named-checkconf -p | grep -A20 'logging'
# Verify logging channels are configured

# In named.conf:
# logging {
#     channel default_log {
#         file "/var/log/named/named.log" versions 5 size 50m;
#         severity info;
#         print-time yes;
#         print-category yes;
#     };
#     category default { default_log; };
#     category queries { default_log; };
# };

mkdir -p /var/log/named
chown named:named /var/log/named
rndc reload

This recommendation verifies that Query Logging Is Enabled on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

named-checkconf -p | grep -A5 'category queries'
# Verify query logging is enabled for security monitoring

# In named.conf logging section:
# category queries { default_log; };
# category security { default_log; };
# category client { default_log; };

rndc querylog on
rndc reload

This recommendation verifies that BIND Version Is Hidden on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

dig @localhost version.bind txt chaos
# Should NOT reveal actual BIND version
dig @localhost hostname.bind txt chaos

# In named.conf:
# options {
#     version "not disclosed";
#     hostname "not disclosed";
# };

rndc reload

This recommendation verifies that Minimal Responses Are Configured on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

named-checkconf -p | grep 'fetch-glue\|additional-from-auth\|additional-from-cache'
# Verify minimal responses is configured

# In named.conf:
# options {
#     minimal-responses yes;
# };

rndc reload

This recommendation verifies that TSIG Keys Are Used for Zone Transfers on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

named-checkconf -p | grep -A5 'key '
# Review configured TSIG keys

ls /etc/bind/rndc.key /etc/rndc.key 2>/dev/null
cat /etc/bind/rndc.key 2>/dev/null || cat /etc/rndc.key 2>/dev/null

# Generate a TSIG key for zone transfers:
tsig-keygen -a hmac-sha256 transfer-key > /etc/bind/transfer.key

# In named.conf, include the key:
# include "/etc/bind/transfer.key";
# server 192.168.1.2 { keys { transfer-key; }; };

chmod 640 /etc/bind/transfer.key
chown root:named /etc/bind/transfer.key
rndc reload

This recommendation verifies that Key File Permissions Are Restrictive on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/bind/rndc.key 2>/dev/null || stat -c '%a %U %G' /etc/rndc.key 2>/dev/null
# Should be 640 root:named (or bind)

ls -la /etc/bind/*.key 2>/dev/null

chmod 640 /etc/bind/rndc.key
chown root:named /etc/bind/rndc.key
chmod 640 /etc/bind/transfer.key 2>/dev/null
chown root:named /etc/bind/transfer.key 2>/dev/null

This recommendation verifies that Configuration File Permissions Are Correct on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/named.conf 2>/dev/null || stat -c '%a %U %G' /etc/bind/named.conf 2>/dev/null
# Should be 640 root:named (or bind)

chmod 640 /etc/named.conf 2>/dev/null || chmod 640 /etc/bind/named.conf 2>/dev/null
chown root:named /etc/named.conf 2>/dev/null || chown root:bind /etc/bind/named.conf 2>/dev/null

This recommendation verifies that Zone File Permissions Are Correct on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ls -la /var/named/ 2>/dev/null || ls -la /var/cache/bind/ 2>/dev/null
# Zone files should be owned by named/bind, perms 640

find /var/named -type f -exec chmod 640 {} \; 2>/dev/null
find /var/named -type f -exec chown root:named {} \; 2>/dev/null
find /var/cache/bind -type f -exec chmod 640 {} \; 2>/dev/null
find /var/cache/bind -type f -exec chown root:bind {} \; 2>/dev/null

This recommendation verifies that Log File Permissions Are Correct on the BIND 9 DNS server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the BIND 9 DNS server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ls -la /var/log/named/ 2>/dev/null
stat -c '%a %U %G' /var/log/named/named.log 2>/dev/null
# Should be 640 named:named

chmod 640 /var/log/named/*.log 2>/dev/null
chown named:named /var/log/named/*.log 2>/dev/null