Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've bind 9.3.6.

How can I disable hostname disclosure ?

Issue link http://www.iss.net/security_center/reference/vuln/bind-hostname-disclosure.htm


share|improve this question
The document you link to says There is no remedy as of December 18, 2010 –  Iain Dec 23 '10 at 16:51
@Iain even though that message was updated 2 days ago, and remains unchanged, it is still incorrect. –  NOTjust -- user4304 Dec 3 '13 at 18:20

2 Answers 2

up vote 2 down vote accepted

You can hide hostname and version this way:

# /etc/named.conf
options {
    // hide bind info
    hostname "unknown";
    version "unknown";

Hostname querying example:

[vitalie@silver ~]$ dig @ns1.kappa.ro hostname.bind chaos txt

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_5.3 <<>> @ns1.kappa.ro hostname.bind chaos txt
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46430
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;hostname.bind.                 CH      TXT

hostname.bind.          0       CH      TXT     "linux.kappa.ro"

hostname.bind.          0       CH      NS      hostname.bind.

;; Query time: 6 msec
;; WHEN: Wed Jan  5 15:08:14 2011
;; MSG SIZE  rcvd: 72
share|improve this answer
version "unknown" will return the string "unknown". version "none" will actually disable the feature. –  TomOnTime Aug 20 '13 at 14:49

"There is no remedy as of December 18, 2010." Wrong, so very wrong. There has been a fix since February 2006 (at least). Put this in your BIND config (it probably is there already):

options {
  version "none";

Let me "craft" this "special" query (don't attempt this at home):

$ nslookup -q=txt -class=CHAOS authors.bind. localhost
Server:         localhost

*** Can't find authors.bind.: No answer

For more info on securing BIND have a look at http://www.cymru.com/Documents/secure-bind-template.html

share|improve this answer
To be clear... the string "none" is special in that it disables the feature. This does not happen if you set it to "unknown" or anything else. –  TomOnTime Aug 20 '13 at 14:51
Is there a way to disable hostname.bind query as well? –  RustyX Aug 27 '14 at 20:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.