Skip to content
HackIndex.io

DNS Server Version Fingerprinting

3 min read Created Jan 3, 2026 Last updated Jan 3, 2026

DNS servers expose version information through a special CHAOS class TXT record. BIND implements this by default and many administrators leave it enabled. The version string identifies the exact software and release, which maps directly to published CVEs. Unpatched BIND releases carry severe vulnerabilities including remote code execution and cache poisoning. Other implementations such as PowerDNS, Unbound, and Microsoft DNS may or may not respond to this query. Check the response before assuming anything about the underlying software.

  • CHAOS TXT query the standard method to pull the version string from BIND servers via dig or nslookup.
  • Version-to-CVE mapping the returned string maps directly to published vulnerabilities including RCE and cache poisoning.
  • Disabled disclosure no response means hardening, not patching. Fall back to passive fingerprinting or nmap service probes.
  • Distribution backports distro-patched releases may include fixes without bumping the upstream version number.

CHAOS TXT Query with dig

┌──(kali㉿kali)-[~]
└─$ dig version.bind CHAOS TXT @$TARGET_IP

A successful response returns the version string in the answer section. It looks like: version.bind. 0 CH TXT "9.11.3-1ubuntu1.2-Ubuntu". That string tells you the exact BIND release and often the distribution and patch level. Take it directly into the NVD or search for "BIND 9.xx CVE" to find known vulnerabilities applicable to that version. Distribution-patched releases sometimes include backported fixes without bumping the major version number, so check the full string against distro security advisories, not just the upstream changelog.

No response or SERVFAIL means the administrator has disabled version disclosure. This is a common hardening step recommended in CIS and DISA STIGs. NXDOMAIN means the CHAOS class is not handled at all, which suggests a non-BIND implementation or strict query filtering at the network level. If you receive a version string, record it and move to vulnerability discovery. If the query is blocked, shift to passive fingerprinting or service version scanning.

Alternative with nslookup

┌──(kali㉿kali)-[~]
└─$ nslookup -type=TXT -class=CHAOS version.bind $TARGET_IP

nslookup formats its output differently from dig. The version string still appears in the answer section, but some servers block EDNS-extended queries from dig while responding normally to nslookup's simpler wire format. Try both when one returns nothing.

If neither returns a version, fall back to nmap service detection on port 53. The service probe can identify DNS software and approximate version without using CHAOS queries at all. A hidden version string does not mean the server is patched. Version hiding is a hardening measure, not a patch. Do not skip vulnerability research just because the disclosure is suppressed. Combine any version data you collect with zone transfer attempts, subdomain enumeration, and record analysis to build a complete picture of the DNS infrastructure before moving on.