How to check / hide BIND version & hostname

The Berkeley Internet Name Domain (BIND) name server return their version number / host name when queried for it. This expose the DNS server for a know venerability straight way. This tutorial shows you how to query DNS servers for their version / host name and how to stop your BIND server from exposing the version / hostname.

Query to a BIND server for a TXT resource record in class 3 (CHAOS) for the domain name "VERSION.BIND." will return a version of the BIND server & the  Query to a BIND server for a TXT resource record in class 3 (CHAOS) for the domain name "HOSTNAME.BIND." will return a host name of the DNS server.



The following DIG and NSLOOKUP queries will show the version of BIND follow by host name.

Perform a "dig" to get the BIND version.

Perform a "nslookup" to get the BIND version.

Perform a "dig" to get the BIND host name.

Perform a "nslookup" to get the BIND host name.

When running a BIND nameserver, edit your /etc/named.conf file (the location of the file "named.conf" will change) and add the following option followed by any string within quotes & reload the "named" service

options {
    [...]
    version "Not supported";
    hostname "Not supported";
}

Perform a "dig" and followed by "nslookup" to get the BIND version & host name and you can see the DNS server is no longer giving the version & host name.

To disable the TXT query for class 3 "CHAOS" add the following option followed by string none without quotes & reload the "named" service

options {
    [...]
    version none;
    hostname none;
}

Leave your comment below