How do I restrict only remote users from looking up the server version?

BIND has a built-in _bind view that provides the following zones:

view "_bind" chaos {
        recursion no;
        notify no;
        allow-new-zones no;

        # Prevent use of this zone in DNS amplified reflection DoS attacks
        rate-limit {
                responses-per-second 3;
                slip 0;
                min-table-size 10;
        };

        zone "version.bind" chaos {
                type primary;
                database "_builtin version";
        };

        zone "hostname.bind" chaos {
                type primary;
                database "_builtin hostname";
        };

        zone "authors.bind" chaos {
                type primary;
                database "_builtin authors";
        };

        zone "id.server" chaos {
                type primary;
                database "_builtin id";
        };
};

Some of the configuration can be overridden without needing to configure the zone manually by using these named.conf options :

version ( <quoted_string> | none );

server-id ( <quoted_string> | none | hostname );

hostname ( <quoted_string> | none );

Ordinarily, queries to this view are not restricted.

Adding the following view statement will intercept lookups as the internal view that holds the version information will be matched last.

view "chaos" chaos {
     match-clients { <those to be refused>; };
     allow-query { none; };
     zone "." {
             type hint;
             file "/dev/null";  // or any empty file
     };
};