named.html revision 7911e6f9de303bca5a3d8b34f4330c8f7cecffae
6ea1b817e31b89a627e146fe69e23ea0a64c89ecBob Halley<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews - Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - This Source Code Form is subject to the terms of the Mozilla Public
6ea1b817e31b89a627e146fe69e23ea0a64c89ecBob Halley - License, v. 2.0. If a copy of the MPL was not distributed with this
6ea1b817e31b89a627e146fe69e23ea0a64c89ecBob Halley - file, You can obtain one at http://mozilla.org/MPL/2.0/.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
6ea1b817e31b89a627e146fe69e23ea0a64c89ecBob Halley<a name="man.named"></a><div class="titlepage"></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein — Internet domain name server
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-D <em class="replaceable"><code>string</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-E <em class="replaceable"><code>engine-name</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-L <em class="replaceable"><code>logfile</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-M <em class="replaceable"><code>option</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-p <em class="replaceable"><code>port</code></em></code>]
8ec3c085233cedb22b05da36e2773c8f357a7e45Automatic Updater [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-U <em class="replaceable"><code>#listeners</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-X <em class="replaceable"><code>lock-file</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <p><span class="command"><strong>named</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is a Domain Name System (DNS) server,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein part of the BIND 9 distribution from ISC. For more
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein information on the DNS, see RFCs 1033, 1034, and 1035.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When invoked without arguments, <span class="command"><strong>named</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein read the default configuration file
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename">/etc/named.conf</code>, read any initial
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein data, and listen for queries.
8ec3c085233cedb22b05da36e2773c8f357a7e45Automatic Updater <div class="variablelist"><dl class="variablelist">
8ec3c085233cedb22b05da36e2773c8f357a7e45Automatic Updater Use IPv4 only even if the host machine is capable of IPv6.
8ec3c085233cedb22b05da36e2773c8f357a7e45Automatic Updater <code class="option">-4</code> and <code class="option">-6</code> are mutually
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Use IPv6 only even if the host machine is capable of IPv4.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">-4</code> and <code class="option">-6</code> are mutually
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews<dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews Use <em class="replaceable"><code>config-file</code></em> as the
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews configuration file instead of the default,
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews <code class="filename">/etc/named.conf</code>. To
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews ensure that reloading the configuration file continues
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews to work after the server has changed its working
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews directory due to to a possible
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews <code class="option">directory</code> option in the configuration
a1b05dea35aa30b152a47115e18bbe679d3fcf19Mark Andrews file, <em class="replaceable"><code>config-file</code></em> should be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein an absolute pathname.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-d <em class="replaceable"><code>debug-level</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Set the daemon's debug level to <em class="replaceable"><code>debug-level</code></em>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Debugging traces from <span class="command"><strong>named</strong></span> become
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein more verbose as the debug level increases.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-D <em class="replaceable"><code>string</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specifies a string that is used to identify a instance of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>named</strong></span> in a process listing. The contents
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of <em class="replaceable"><code>string</code></em> are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein not examined.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-E <em class="replaceable"><code>engine-name</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When applicable, specifies the hardware to use for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cryptographic operations, such as a secure key store used
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for signing.
c4d99a62407cebca29653666ae11f87e4f56ebbcAutomatic Updater When BIND is built with OpenSSL PKCS#11 support, this defaults
c4d99a62407cebca29653666ae11f87e4f56ebbcAutomatic Updater to the string "pkcs11", which identifies an OpenSSL engine
c4d99a62407cebca29653666ae11f87e4f56ebbcAutomatic Updater that can drive a cryptographic accelerator or hardware service
c4d99a62407cebca29653666ae11f87e4f56ebbcAutomatic Updater module. When BIND is built with native PKCS#11 cryptography
c4d99a62407cebca29653666ae11f87e4f56ebbcAutomatic Updater (--enable-native-pkcs11), it defaults to the path of the PKCS#11
c4d99a62407cebca29653666ae11f87e4f56ebbcAutomatic Updater provider library specified via "--with-pkcs11".
c4d99a62407cebca29653666ae11f87e4f56ebbcAutomatic Updater Run the server in the foreground (i.e. do not daemonize).
c4d99a62407cebca29653666ae11f87e4f56ebbcAutomatic Updater Run the server in the foreground and force all logging
c4d99a62407cebca29653666ae11f87e4f56ebbcAutomatic Updater<dt><span class="term">-L <em class="replaceable"><code>logfile</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Log to the file <code class="option">logfile</code> by default
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein instead of the system log.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-M <em class="replaceable"><code>option</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Sets the default memory context options. Currently
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the only supported option is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <em class="replaceable"><code>external</code></em>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which causes the internal memory manager to be bypassed
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in favor of system-provided memory allocation functions.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Turn on memory usage debugging flags. Possible flags are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <em class="replaceable"><code>usage</code></em>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <em class="replaceable"><code>trace</code></em>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <em class="replaceable"><code>record</code></em>,
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews <em class="replaceable"><code>size</code></em>, and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein These correspond to the ISC_MEM_DEBUGXXXX flags described in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="filename"><isc/mem.h></code>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-n <em class="replaceable"><code>#cpus</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Create <em class="replaceable"><code>#cpus</code></em> worker threads
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews to take advantage of multiple CPUs. If not specified,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>named</strong></span> will try to determine the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein number of CPUs present and create one thread per CPU.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If it is unable to determine the number of CPUs, a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein single worker thread will be created.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Listen for queries on port <em class="replaceable"><code>port</code></em>. If not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specified, the default is port 53.
824f38c0310fddef55f0f691580154022a7852f5Automatic Updater Write memory usage statistics to <code class="filename">stdout</code> on exit.
824f38c0310fddef55f0f691580154022a7852f5Automatic Updater <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This option is mainly of interest to BIND 9 developers
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and may be removed or changed in a future release.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-S <em class="replaceable"><code>#max-socks</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Allow <span class="command"><strong>named</strong></span> to use up to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <em class="replaceable"><code>#max-socks</code></em> sockets.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The default value is 4096 on systems built with default
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein configuration options, and 21000 on systems built with
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "configure --with-tuning=large".
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This option should be unnecessary for the vast majority
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The use of this option could even be harmful because the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specified value may exceed the limitation of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein underlying system API.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein It is therefore set only when the default configuration
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein causes exhaustion of file descriptors and the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein operational environment is known to support the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specified number of sockets.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Note also that the actual maximum number is normally a little
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein fewer than the specified value because
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="command"><strong>named</strong></span> reserves some file descriptors
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for its internal use.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to <em class="replaceable"><code>directory</code></em> after
8ec3c085233cedb22b05da36e2773c8f357a7e45Automatic Updater processing the command line arguments, but before
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein reading the configuration file.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This option should be used in conjunction with the
a9a054302dd8a52fa9023cc98cc565e9c0008527Automatic Updater <code class="option">-u</code> option, as chrooting a process
a9a054302dd8a52fa9023cc98cc565e9c0008527Automatic Updater running as root doesn't enhance security on most
a9a054302dd8a52fa9023cc98cc565e9c0008527Automatic Updater systems; the way <code class="function">chroot(2)</code> is
a9a054302dd8a52fa9023cc98cc565e9c0008527Automatic Updater defined allows a process with root privileges to
a9a054302dd8a52fa9023cc98cc565e9c0008527Automatic Updater escape a chroot jail.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-U <em class="replaceable"><code>#listeners</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Use <em class="replaceable"><code>#listeners</code></em>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein worker threads to listen for incoming UDP packets on each
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein address. If not specified, <span class="command"><strong>named</strong></span> will
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein calculate a default value based on the number of detected
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein CPUs: 1 for 1 CPU, and the number of detected CPUs
18fa75b694d056da4be3ebfc2185d007d4882752Automatic Updater minus one for machines with more than 1 CPU. This cannot
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein be increased to a value higher than the number of CPUs.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If <code class="option">-n</code> has been set to a higher value than
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the number of detected CPUs, then <code class="option">-U</code> may
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein be increased as high as that value, but no higher.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein On Windows, the number of UDP listeners is hardwired to 1
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and this option has no effect.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt>
1224c3b69b3d18f7127aa042644936af25a2d679Mark Andrews to <em class="replaceable"><code>user</code></em> after completing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein privileged operations, such as creating sockets that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein listen on privileged ports.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein On Linux, <span class="command"><strong>named</strong></span> uses the kernel's
8ec3c085233cedb22b05da36e2773c8f357a7e45Automatic Updater capability mechanism to drop all root privileges
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein except the ability to <code class="function">bind(2)</code> to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein privileged port and set process resource limits.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Unfortunately, this means that the <code class="option">-u</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein option only works when <span class="command"><strong>named</strong></span> is