The DNS Name Server software must be configured to refuse queries for its version information.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-259403 | WDNS-22-000075 | SV-259403r1001264_rule | CCI-002201 | medium |
| Description | ||||
| Each newer version of the name server software, especially the BIND software, generally is devoid of vulnerabilities found in earlier versions because it has design changes incorporated to address those vulnerabilities. The vulnerabilities have been exploited (i.e., some form of attack was launched), and sufficient information has been generated with respect to the nature of those exploits. It makes good business sense to run the latest version of name server software because theoretically it is the safest version. In some installations, it may not be possible to switch to the latest version of name server software immediately. If the version of the name server software is revealed in queries, this information may be used by attackers looking for a specific version of the software that has a discovered weakness. To prevent information about which version of name server software is running on a system, name servers should be configured to refuse queries for its version information. | ||||
| STIG | Date | |||
| Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide | 2026-02-23 | |||
Related Frameworks
1 mapping across 3 frameworks
Related Frameworks
SCF0 mappings
No source states a mapping between these directly.
Also reachable in 3 hops (1) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V2R4intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to
NIST 800-530 mappings
No source states a mapping between these directly.
Also reachable in 2 hops (2) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V2R4intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V2R4intersects(normalised)
- DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
CCI1 mapping
CCI-002201
1.00
- DISA STIG Benchmark (XCCDF)V2R4intersects(normalised)
Details
Check Text (C-259403r1001264_chk)
The "EnableVersionQuery" property controls what version information the DNS server will respond with when a DNS query with class set to "CHAOS" and type set to "TXT" is received.
Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.
Open a command window and execute the command:
nslookup <enter>
Note: Confirm the Default Server is the DNS server on which the command is being run.
At the nslookup prompt, type:
set type=TXT <enter>
set class=CHAOS <enter>
version.bind <enter>
If the response returns something similar to text = "Microsoft DNS 6.1.7601 (1DB14556)", this is a finding.
Fix Text (F-63050r939913_fix)
To disable the version being returned in queries, execute the following command:
dnscmd /config /EnableVersionQuery 0 <enter>