Hide BIND sever version from nmap

Security fix for the DNS infrastructure to hide the the sensible information about the version and potential security critical bugs.

Edit your named.conf.options and add the following additional 3 lines from below.

1
2
3
4
5
6

cat /etc/bind/named.conf.options
options {
  version "0";
  hostname none;
  server-id none;
}

Verification of the bind version can proceed with nmap:

1

nmap 45.44.33.1 -p 53 -A

fpdns – DNS server fingeprinting tool is also able to find out the version and additional information related to a DNS server.

It check authoritative servers of the specified domain name:

1
2

aptitude install fpdns
fpdns -D exeample.com

Example output:
fingerprint (example.org, 45.44.33.1): ISC BIND 9.2.3rc1 — 9.6.1-P1
fingerprint (example.org, 2a01:4f8:101:265:0:0:0:2): ISC BIND 9.2.3rc1 — 9.6.1-P1