named.html revision e68c527dff2f1f7df2a542f8d6f9181a27e05eb7
7d5ac94fda90b837211dadf2585c0fe8c5dc3e5djerenkrantz - Copyright (C) 2004-2009, 2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
c330021bf3f45cbf187fa644781e67f7e470a58awrowe - Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
62f7716b14b71603a8004434ca3536902bfb8899wrowe - Permission to use, copy, modify, and/or distribute this software for any
366616a5cc6212cbf7134ccf877f965d668c6b04wrowe - purpose with or without fee is hereby granted, provided that the above
366616a5cc6212cbf7134ccf877f965d668c6b04wrowe - copyright notice and this permission notice appear in all copies.
366616a5cc6212cbf7134ccf877f965d668c6b04wrowe - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
366616a5cc6212cbf7134ccf877f965d668c6b04wrowe - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
366616a5cc6212cbf7134ccf877f965d668c6b04wrowe - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
366616a5cc6212cbf7134ccf877f965d668c6b04wrowe - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
366616a5cc6212cbf7134ccf877f965d668c6b04wrowe - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
366616a5cc6212cbf7134ccf877f965d668c6b04wrowe - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
366616a5cc6212cbf7134ccf877f965d668c6b04wrowe - PERFORMANCE OF THIS SOFTWARE.
366616a5cc6212cbf7134ccf877f965d668c6b04wrowe<!-- $Id$ -->
366616a5cc6212cbf7134ccf877f965d668c6b04wrowe<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
38dc50ae00a1ea57fa41500d74f4e818747e3cefpquerna<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
ecf8d72af432e53e4c0661fb99dfda8061507bfajerenkrantz<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
ecf8d72af432e53e4c0661fb99dfda8061507bfajerenkrantz<a name="man.named"></a><div class="titlepage"></div>
38dc50ae00a1ea57fa41500d74f4e818747e3cefpquerna<p><span class="application">named</span> — Internet domain name server</p>
065757c0cc6d9cc01ba3dbd465d91f3c0652ed21jim<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-D <em class="replaceable"><code>string</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine-name</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-L <em class="replaceable"><code>logfile</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-U <em class="replaceable"><code>#listeners</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-V</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
cd365a1ad6798c1faef19b445c00ae97eb94a234pquerna<p><span><strong class="command">named</strong></span>
6507aa1a5709a9122f2e0b9be8bb9bd6d78715c3pquerna is a Domain Name System (DNS) server,
6507aa1a5709a9122f2e0b9be8bb9bd6d78715c3pquerna part of the BIND 9 distribution from ISC. For more
b6c98ce4a43f123af0a691fd7b833efcf0ce1d6apquerna information on the DNS, see RFCs 1033, 1034, and 1035.
f610c7c704235bc327dbe9b62982f5b3f8e30a77wrowe When invoked without arguments, <span><strong class="command">named</strong></span>
d96ee8cda2799e1f2743c1603adeb4833ed0e15fslive read the default configuration file
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe <code class="filename">/etc/named.conf</code>, read any initial
ecf8d72af432e53e4c0661fb99dfda8061507bfajerenkrantz data, and listen for queries.
f610c7c704235bc327dbe9b62982f5b3f8e30a77wrowe Use IPv4 only even if the host machine is capable of IPv6.
dc287e6d736b5998068addfb712936f51818cc0frbowen <code class="option">-4</code> and <code class="option">-6</code> are mutually
62f7716b14b71603a8004434ca3536902bfb8899wrowe Use IPv6 only even if the host machine is capable of IPv4.
45b0e1c775c1cfed6473c9e5304179ccb9609f53stoddard <code class="option">-4</code> and <code class="option">-6</code> are mutually
a74ee4396fe11ffc1ca05837a59e497c905eedc3sf<dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
e84aedcb9f389f94263ca602b1f6c36e3575699bsf Use <em class="replaceable"><code>config-file</code></em> as the
e84aedcb9f389f94263ca602b1f6c36e3575699bsf configuration file instead of the default,
e84aedcb9f389f94263ca602b1f6c36e3575699bsf ensure that reloading the configuration file continues
7ac1ffe4121328055c55cc1db7fc4aeae0fcc3d6sf to work after the server has changed its working
7ac1ffe4121328055c55cc1db7fc4aeae0fcc3d6sf directory due to to a possible
7ac1ffe4121328055c55cc1db7fc4aeae0fcc3d6sf <code class="option">directory</code> option in the configuration
a74ee4396fe11ffc1ca05837a59e497c905eedc3sf file, <em class="replaceable"><code>config-file</code></em> should be
a74ee4396fe11ffc1ca05837a59e497c905eedc3sf an absolute pathname.
a74ee4396fe11ffc1ca05837a59e497c905eedc3sf<dt><span class="term">-d <em class="replaceable"><code>debug-level</code></em></span></dt>
cdccf2ac94172d1a4a54bc2e17324e1ef682ccf3pquerna Set the daemon's debug level to <em class="replaceable"><code>debug-level</code></em>.
cdccf2ac94172d1a4a54bc2e17324e1ef682ccf3pquerna Debugging traces from <span><strong class="command">named</strong></span> become
a28e3e624e7a5673405fe03868ed073b1ab37f8ejim more verbose as the debug level increases.
cdccf2ac94172d1a4a54bc2e17324e1ef682ccf3pquerna<dt><span class="term">-D <em class="replaceable"><code>string</code></em></span></dt>
a74ee4396fe11ffc1ca05837a59e497c905eedc3sf Specifies a string that is used to identify a instance of
42ed359b3cec14d50bec77d6a0de2320215fd006minfrin <span><strong class="command">named</strong></span> in a process listing. The contents
42ed359b3cec14d50bec77d6a0de2320215fd006minfrin of <em class="replaceable"><code>string</code></em> are
42ed359b3cec14d50bec77d6a0de2320215fd006minfrin not examined.
ab5b666cf1382c8c3e58797524fdece77e8e17a8minfrin<dt><span class="term">-E <em class="replaceable"><code>engine-name</code></em></span></dt>
a74ee4396fe11ffc1ca05837a59e497c905eedc3sf When applicable, specifies the hardware to use for
a74ee4396fe11ffc1ca05837a59e497c905eedc3sf cryptographic operations, such as a secure key store used
a74ee4396fe11ffc1ca05837a59e497c905eedc3sf for signing.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe When BIND is built with OpenSSL PKCS#11 support, this defaults
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe to the string "pkcs11", which identifies an OpenSSL engine
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe that can drive a cryptographic accelerator or hardware service
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe module. When BIND is built with native PKCS#11 cryptography
f6a9b598f78b2e745456bfc4bbc4afd2d1572aa9stas (--enable-native-pkcs11), it defaults to the path of the PKCS#11
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe provider library specified via "--with-pkcs11".
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe Run the server in the foreground (i.e. do not daemonize).
bce58f79020e39e5ac5de398fe08b4f8a1e19970pgollucci Run the server in the foreground and force all logging
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz<dt><span class="term">-L <em class="replaceable"><code>logfile</code></em></span></dt>
53e66a2931d02e84628ba946055cc92e56b43db8wrowe Log to the file <code class="option">logfile</code> by default
53e66a2931d02e84628ba946055cc92e56b43db8wrowe instead of the system log.
828333c93c6c11a4b46154302515e35cc6982f12sctemme<dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt>
1b3f48fd6b1ccb8745f908e40156c5a85ca3c347jerenkrantz Turn on memory usage debugging flags. Possible flags are
e1c6982304adafcec09d2627755be15b87a6b425sf These correspond to the ISC_MEM_DEBUGXXXX flags described in
e1c6982304adafcec09d2627755be15b87a6b425sf<dt><span class="term">-n <em class="replaceable"><code>#cpus</code></em></span></dt>
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe Create <em class="replaceable"><code>#cpus</code></em> worker threads
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe to take advantage of multiple CPUs. If not specified,
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe <span><strong class="command">named</strong></span> will try to determine the
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe number of CPUs present and create one thread per CPU.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe If it is unable to determine the number of CPUs, a
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe single worker thread will be created.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe Listen for queries on port <em class="replaceable"><code>port</code></em>. If not
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe specified, the default is port 53.
979b5dac648b2e3eef4b5a514b3711b58640026bsctemme Write memory usage statistics to <code class="filename">stdout</code> on exit.
766b0a4793197ccef3dfa202d1fee1e1f929ffa7sf<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe This option is mainly of interest to BIND 9 developers
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe and may be removed or changed in a future release.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe<dt><span class="term">-S <em class="replaceable"><code>#max-socks</code></em></span></dt>
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe Allow <span><strong class="command">named</strong></span> to use up to
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe <em class="replaceable"><code>#max-socks</code></em> sockets.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe The default value is 4096 on systems built with default
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe configuration options, and 21000 on systems built with
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe "configure --with-tuning=large".
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe This option should be unnecessary for the vast majority
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe The use of this option could even be harmful because the
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe specified value may exceed the limitation of the
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe underlying system API.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe It is therefore set only when the default configuration
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe causes exhaustion of file descriptors and the
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe operational environment is known to support the
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe specified number of sockets.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe Note also that the actual maximum number is normally a little
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe fewer than the specified value because
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe <span><strong class="command">named</strong></span> reserves some file descriptors
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe for its internal use.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe<dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe to <em class="replaceable"><code>directory</code></em> after
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe processing the command line arguments, but before
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe reading the configuration file.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe This option should be used in conjunction with the
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe <code class="option">-u</code> option, as chrooting a process
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe running as root doesn't enhance security on most
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe systems; the way <code class="function">chroot(2)</code> is
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe defined allows a process with root privileges to
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe escape a chroot jail.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe<dt><span class="term">-U <em class="replaceable"><code>#listeners</code></em></span></dt>
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe Use <em class="replaceable"><code>#listeners</code></em>
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe worker threads to listen for incoming UDP packets on each
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe address. If not specified, <span><strong class="command">named</strong></span> will
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe calculate a default value based on the number of detected
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe CPUs: 1 for 1 CPU, 2 for 2-4 CPUs, and the number of
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe detected CPUs divided by 2 for values higher than 4.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe If <code class="option">-n</code> has been set to a higher value than
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe the number of detected CPUs, then <code class="option">-U</code> may
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe be increased as high as that value, but no higher.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe<dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt>
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe to <em class="replaceable"><code>user</code></em> after completing
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe privileged operations, such as creating sockets that
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe listen on privileged ports.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe On Linux, <span><strong class="command">named</strong></span> uses the kernel's
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe capability mechanism to drop all root privileges
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe except the ability to <code class="function">bind(2)</code> to
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe privileged port and set process resource limits.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe Unfortunately, this means that the <code class="option">-u</code>
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe option only works when <span><strong class="command">named</strong></span> is
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe later, since previous kernels did not allow privileges
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe to be retained after <code class="function">setuid(2)</code>.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe Report the version number and exit.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe Report the version number and build options, and exit.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe<dt><span class="term">-x <em class="replaceable"><code>cache-file</code></em></span></dt>
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe Load data from <em class="replaceable"><code>cache-file</code></em> into the
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe cache of the default view.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe This option must not be used. It is only of interest
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe to BIND 9 developers and may be removed or changed in a
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe future release.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe In routine operation, signals should not be used to control
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe the nameserver; <span><strong class="command">rndc</strong></span> should be used
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe Force a reload of the server.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe Shut down the server.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe The result of sending any other signals to the server is undefined.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe The <span><strong class="command">named</strong></span> configuration file is too complex
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe to describe in detail here. A complete description is provided
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe <span><strong class="command">named</strong></span> inherits the <code class="function">umask</code>
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe (file creation mode mask) from the parent process. If files
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe created by <span><strong class="command">named</strong></span>, such as journal files,
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe need to have custom permissions, the <code class="function">umask</code>
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe should be set explicitly in the script used to start the
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe <span><strong class="command">named</strong></span> process.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe<dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe The default configuration file.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe<dt><span class="term"><code class="filename">/var/run/named/named.pid</code></span></dt>
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe The default process-id file.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>,
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe <span class="citerefentry"><span class="refentrytitle">lwresd</span>(8)</span>,
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
9e86ff266f053757dd96dab7cf4bc53aaaaa583ewrowe<p><span class="corpauthor">Internet Systems Consortium</span>