The BIND 9.x server implementation must have QNAME minimization set to "strict".

QNAME minimization limits the amount of information sent in DNS queries to intermediate nameservers, improving privacy by reducing the potential for DNS leak. It modifies the flow of DNS queries to reveal only what is necessary for the current server to find the next one in the resolution chain.

Verify QNAME minimization is set to "strict".

Inspect the named.conf file for the following:

options { qname-minimization strict;

If the qname minimization is not set to "strict", this is a finding.

Edit the named.conf file

    options {

        qname-minimization strict; 
    };

After making changes, save the named.conf file and restart the BIND service to apply the changes.