Bv9ARM.ch06.html revision 0ddeab91cf922fd977f37318620b4c69dccf8364
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
c78c39caab4cf8b5daefc9c65878f7f5ed3eb7a0Tinderbox User - Copyright (C) 2000-2003 Internet Software Consortium.
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User - Permission to use, copy, modify, and distribute this software for any
7c1468ed500356839a4a222517364e6ce18cb1a2Tinderbox User - purpose with or without fee is hereby granted, provided that the above
c57668a2fbbe558c1bd21652813616f2f517c469Tinderbox User - copyright notice and this permission notice appear in all copies.
1f4c645185bd8fc70048e0a69eee46193a284e5cTinderbox User - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
8de3f14f1c300c3e1ed99084cc03485b42c92bf1Tinderbox User - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews - PERFORMANCE OF THIS SOFTWARE.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<!-- $Id: Bv9ARM.ch06.html,v 1.206 2009/01/10 01:11:54 tbox Exp $ -->
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<title>Chapter�6.�BIND 9 Configuration Reference</title>
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<link rel="prev" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<link rel="next" href="Bv9ARM.ch07.html" title="Chapter�7.�BIND 9 Security Considerations">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<table width="100%" summary="Navigation header">
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<tr><th colspan="3" align="center">Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</th></tr>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<a accesskey="p" href="Bv9ARM.ch05.html">Prev</a>�</td>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch07.html">Next</a>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<div class="titlepage"><div><div><h2 class="title">
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<a name="Bv9ARM.ch06"></a>Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</h2></div></div></div>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573722">Comment Syntax</a></span></dt>
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574361"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574551"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574912"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574929"><span><strong class="command">include</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575089"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575112"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575203"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575329"><span><strong class="command">logging</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577244"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577386"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577450"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577562"><span><strong class="command">masters</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577577"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#statschannels"><span><strong class="command">statistics-channels</strong></span> Statement Grammar</a></span></dt>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586098"><span><strong class="command">statistics-channels</strong></span> Statement Definition and
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt>
95637507c3d47481fbf0a8a8c750a57f944f677fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586986"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587037"><span><strong class="command">trusted-keys</strong></span> Statement Definition
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587120"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2588657"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2591187">Zone File</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2593349">Discussion of MX Records</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2593969">Inverse Mapping in IPv4</a></span></dt>
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2594164">Other Zone File Directives</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2594421"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch06.html#statistics">BIND9 Statistics</a></span></dt>
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch06.html#statistics_counters">Statistics Counters</a></span></dt></dl></dd>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <acronym class="acronym">BIND</acronym> 9 configuration is broadly similar
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews to <acronym class="acronym">BIND</acronym> 8; however, there are a few new
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews of configuration, such as views. <acronym class="acronym">BIND</acronym>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User 8 configuration files should work with few alterations in <acronym class="acronym">BIND</acronym>
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews 9, although more complex configurations should be reviewed to check
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews if they can be more efficiently implemented using the new features
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User found in <acronym class="acronym">BIND</acronym> 9.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson <acronym class="acronym">BIND</acronym> 4 configuration files can be
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User converted to the new format
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews using the shell script
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <code class="filename">contrib/named-bootconf/named-bootconf.sh</code>.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson<div class="titlepage"><div><div><h2 class="title" style="clear: both">
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<a name="configuration_file_elements"></a>Configuration File Elements</h2></div></div></div>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User Following is a list of elements used throughout the <acronym class="acronym">BIND</acronym> configuration
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews file documentation:
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User The name of an <code class="varname">address_match_list</code> as
5747235bf35e7398984fd6b4632743396895ea7aTinderbox User defined by the <span><strong class="command">acl</strong></span> statement.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User <code class="varname">address_match_list</code>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews A list of one or more
e20788e1216ed720aefa84f3295f7899d9f28c22Mark Andrews <code class="varname">ip_prefix</code>, <code class="varname">key_id</code>,
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User or <code class="varname">acl_name</code> elements, see
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews A named list of one or more <code class="varname">ip_addr</code>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User with optional <code class="varname">key_id</code> and/or
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User A <code class="varname">masters_list</code> may include other
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson A quoted string which will be used as
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User a DNS name, for example "<code class="literal">my.test.domain</code>".
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User One to four integers valued 0 through
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews 255 separated by dots (`.'), such as <span><strong class="command">123</strong></span>,
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <span><strong class="command">45.67</strong></span> or <span><strong class="command">89.123.45.67</strong></span>.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User An IPv4 address with exactly four elements
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews in <code class="varname">dotted_decimal</code> notation.
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User An IPv6 address, such as <span><strong class="command">2001:db8::1234</strong></span>.
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater IPv6 scoped addresses that have ambiguity on their
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater scope zones must be disambiguated by an appropriate
bac4435d473c9a0281507524f084480c34aa942aTinderbox User zone ID with the percent character (`%') as
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews delimiter. It is strongly recommended to use
933799f3641f4f78445d015008bad0038900a82aTinderbox User string zone names rather than numeric identifiers,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews in order to be robust against system configuration
933799f3641f4f78445d015008bad0038900a82aTinderbox User changes. However, since there is no standard
4151211e6649332f7b5a55870cbe37128bcc7b29Tinderbox User mapping for such names and identifier values,
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews currently only interface names as link identifiers
bc0a53583d92309bebcf93c408e2f3247ebd3d3cAutomatic Updater are supported, assuming one-to-one mapping between
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater interfaces and links. For example, a link-local
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater address <span><strong class="command">fe80::1</strong></span> on the link
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater attached to the interface <span><strong class="command">ne0</strong></span>
b02be031b9ff37b042adc8e68e36b8bbc1f672b7Tinderbox User can be specified as <span><strong class="command">fe80::1%ne0</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Note that on most systems link-local addresses
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews always have the ambiguity, and need to be
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater disambiguated.
bac4435d473c9a0281507524f084480c34aa942aTinderbox User An <code class="varname">ip4_addr</code> or <code class="varname">ip6_addr</code>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews An IP port <code class="varname">number</code>.
b02be031b9ff37b042adc8e68e36b8bbc1f672b7Tinderbox User The <code class="varname">number</code> is limited to 0
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User through 65535, with values
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews below 1024 typically restricted to use by processes running
e08cdffb3ae4ad409f37e3e5a218fe4b7e0e3904Tinderbox User In some cases, an asterisk (`*') character can be used as a
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews placeholder to
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews select a random high-numbered port.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User An IP network specified as an <code class="varname">ip_addr</code>,
757ff043760e4743dda1a10e7d58349275934902Tinderbox User followed by a slash (`/') and then the number of bits in the
6025cbbe8408f4b09d53d5ec1e95cb6da97e0a8dTinderbox User Trailing zeros in a <code class="varname">ip_addr</code>
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews may omitted.
757ff043760e4743dda1a10e7d58349275934902Tinderbox User For example, <span><strong class="command">127/8</strong></span> is the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater network <span><strong class="command">127.0.0.0</strong></span> with
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews netmask <span><strong class="command">255.0.0.0</strong></span> and <span><strong class="command">1.2.3.0/28</strong></span> is
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews network <span><strong class="command">1.2.3.0</strong></span> with netmask <span><strong class="command">255.255.255.240</strong></span>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews When specifying a prefix involving a IPv6 scoped address
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews the scope may be omitted. In that case the prefix will
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews match packets from any scope.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson A <code class="varname">domain_name</code> representing
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User the name of a shared key, to be used for transaction
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews A list of one or more
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews separated by semicolons and ending with a semicolon.
e8fc8c884b44371784805e1e0d3100da403dd3f1Automatic Updater A non-negative 32-bit integer
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews (i.e., a number between 0 and 4294967295, inclusive).
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Its acceptable value might further
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews be limited by the context in which it is used.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews A quoted string which will be used as
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews a pathname, such as <code class="filename">zones/master/my.test.domain</code>.
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews A list of an <code class="varname">ip_port</code> or a port
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User A port range is specified in the form of
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User <strong class="userinput"><code>range</code></strong> followed by
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <code class="varname">port_high</code>, which represents
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater port numbers from <code class="varname">port_low</code> through
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <code class="varname">port_high</code>, inclusive.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User <code class="varname">port_low</code> must not be larger than
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews For example,
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User <strong class="userinput"><code>range 1024 65535</code></strong> represents
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews ports from 1024 through 65535.
933799f3641f4f78445d015008bad0038900a82aTinderbox User In either case an asterisk (`*') character is not
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews allowed as a valid <code class="varname">ip_port</code>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews A number, the word <strong class="userinput"><code>unlimited</code></strong>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews or the word <strong class="userinput"><code>default</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington An <code class="varname">unlimited</code> <code class="varname">size_spec</code> requests unlimited
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews use, or the maximum available amount. A <code class="varname">default size_spec</code> uses
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews the limit that was in force when the server was started.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews A <code class="varname">number</code> can optionally be
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews followed by a scaling factor:
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <strong class="userinput"><code>K</code></strong> or <strong class="userinput"><code>k</code></strong>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews for kilobytes,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <strong class="userinput"><code>M</code></strong> or <strong class="userinput"><code>m</code></strong>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews for megabytes, and
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <strong class="userinput"><code>G</code></strong> or <strong class="userinput"><code>g</code></strong> for gigabytes,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User which scale by 1024, 1024*1024, and 1024*1024*1024
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews respectively.
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews The value must be representable as a 64-bit unsigned integer
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews (0 to 18446744073709551615, inclusive).
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews Using <code class="varname">unlimited</code> is the best
f7369b2881b5e63d69600adcedc8ba938303d30cTinderbox User to safely set a really large number.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Either <strong class="userinput"><code>yes</code></strong> or <strong class="userinput"><code>no</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The words <strong class="userinput"><code>true</code></strong> and <strong class="userinput"><code>false</code></strong> are
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington also accepted, as are the numbers <strong class="userinput"><code>1</code></strong>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington and <strong class="userinput"><code>0</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington One of <strong class="userinput"><code>yes</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>no</code></strong>, <strong class="userinput"><code>notify</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>notify-passive</code></strong>, <strong class="userinput"><code>refresh</code></strong> or
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>passive</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington When used in a zone, <strong class="userinput"><code>notify-passive</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>refresh</code></strong>, and <strong class="userinput"><code>passive</code></strong>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington are restricted to slave and stub zones.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h3 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="address_match_lists"></a>Address Match Lists</h3></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573500"></a>Syntax</h4></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ;
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> address_match_list_element; ... </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] |
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington key key_id | acl_name | { address_match_list } )
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573528"></a>Definition and Usage</h4></div></div></div>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Address match lists are primarily used to determine access
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews control for various server operations. They are also used in
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the <span><strong class="command">listen-on</strong></span> and <span><strong class="command">sortlist</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews statements. The elements which constitute an address match
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews list can be any of the following:
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater a key ID, as defined by the <span><strong class="command">key</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<li>the name of an address match list defined with
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater the <span><strong class="command">acl</strong></span> statement
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater<li>a nested address match list enclosed in braces</li>
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater Elements can be negated with a leading exclamation mark (`!'),
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater and the match list names "any", "none", "localhost", and
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater "localnets" are predefined. More information on those names
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews can be found in the description of the acl statement.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User The addition of the key clause made the name of this syntactic
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User element something of a misnomer, since security keys can be used
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User to validate access without regard to a host or network address.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User Nonetheless, the term "address match list" is still used
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User throughout the documentation.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User When a given IP address or prefix is compared to an address
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews match list, the comparison takes place in approximately O(1)
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User time. However, key comparisons require that the list of keys
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews be traversed until a matching key is found, and therefore may
0accdb26ead1fe520a9820b52efbea64bdf564e3Tinderbox User be somewhat slower.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User The interpretation of a match depends on whether the list is being
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User used for access control, defining listen-on ports, or in a
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews sortlist, and whether the element was negated.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews When used as an access control list, a non-negated match
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews allows access and a negated match denies access. If
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews there is no match, access is denied. The clauses
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">allow-notify</strong></span>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">allow-recursion</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-recursion-on</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-query</strong></span>,
febbdb34a7f7759922e239655e7429d78d3a8d26Tinderbox User <span><strong class="command">allow-query-on</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-query-cache</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-query-cache-on</strong></span>,
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">allow-transfer</strong></span>,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span><strong class="command">allow-update</strong></span>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">allow-update-forwarding</strong></span>, and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">blackhole</strong></span> all use address match
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews lists. Similarly, the listen-on option will cause the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews server to refuse queries on any of the machine's
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews addresses which do not match the list.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Order of insertion is significant. If more than one element
c01dec514a81ecf8c17ca3ef8c3ba95e437295ebAutomatic Updater in an ACL is found to match a given IP address or prefix,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater preference will be given to the one that came
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="emphasis"><em>first</em></span> in the ACL definition.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Because of this first-match behavior, an element that
e8c42d50cdaf3a3b841074d8bf72b40ffbae2a4bTinderbox User defines a subset of another element in the list should
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater come before the broader element, regardless of whether
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater either is negated. For example, in
e20309353e6246485c521278131d3fced73d7957Tinderbox User <span><strong class="command">1.2.3/24; ! 1.2.3.13;</strong></span>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews the 1.2.3.13 element is completely useless because the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington algorithm will match any lookup for 1.2.3.13 to the 1.2.3/24
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington element. Using <span><strong class="command">! 1.2.3.13; 1.2.3/24</strong></span> fixes
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington that problem by having 1.2.3.13 blocked by the negation, but
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington all other 1.2.3.* hosts fall through.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h3 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573722"></a>Comment Syntax</h3></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington comments to appear
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington file. To appeal to programmers of all kinds, they can be written
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews<div class="titlepage"><div><div><h4 class="title">
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews<a name="id2573737"></a>Syntax</h4></div></div></div>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<pre class="programlisting">// This is a <acronym class="acronym">BIND</acronym> comment as in C++</pre>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<pre class="programlisting"># This is a <acronym class="acronym">BIND</acronym> comment as in common UNIX shells and perl</pre>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<div class="titlepage"><div><div><h4 class="title">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<a name="id2573767"></a>Definition and Usage</h4></div></div></div>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Comments may appear anywhere that whitespace may appear in
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews a <acronym class="acronym">BIND</acronym> configuration file.
bac4435d473c9a0281507524f084480c34aa942aTinderbox User C-style comments start with the two characters /* (slash,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews star) and end with */ (star, slash). Because they are completely
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington delimited with these characters, they can be used to comment only
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews a portion of a line or to span multiple lines.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington C-style comments cannot be nested. For example, the following
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington is not valid because the entire comment ends with the first */:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting">/* This is the start of a comment.
b7aab05edae933e169d5f83c653935b17c7f0a8bMark Andrews This is still part of the comment.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington/* This is an incorrect attempt at nesting a comment. */
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington This is no longer in any comment. */
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews C++-style comments start with the two characters // (slash,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington slash) and continue to the end of the physical line. They cannot
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington be continued across multiple physical lines; to have one logical
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington comment span multiple lines, each line must use the // pair.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews For example:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting">// This is the start of a comment. The next line
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington// is a new comment, even though it is logically
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington// part of the previous comment.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Shell-style (or perl-style, if you prefer) comments start
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater with the character <code class="literal">#</code> (number sign)
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater and continue to the end of the
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews physical line, as in C++ comments.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<pre class="programlisting"># This is the start of a comment. The next line
0e91f17da8a29086876a88962e0a3482094b6057Evan Hunt# is a new comment, even though it is logically
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews# part of the previous comment.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews You cannot use the semicolon (`;') character
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews to start a comment such as you would in a zone file. The
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews semicolon indicates the end of a configuration
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h2 class="title" style="clear: both">
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews<a name="Configuration_File_Grammar"></a>Configuration File Grammar</h2></div></div></div>
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews A <acronym class="acronym">BIND</acronym> 9 configuration consists of
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington statements and comments.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews Statements end with a semicolon. Statements and comments are the
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews only elements that can appear without enclosing braces. Many
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews statements contain a block of sub-statements, which are also
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews terminated with a semicolon.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The following statements are supported:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="informaltable"><table border="1">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <p><span><strong class="command">acl</strong></span></p>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews defines a named IP address
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews matching list, for access control and other uses.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <p><span><strong class="command">controls</strong></span></p>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews declares control channels to be used
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews by the <span><strong class="command">rndc</strong></span> utility.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span><strong class="command">include</strong></span></p>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews includes a file.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <p><span><strong class="command">key</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User specifies key information for use in
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User authentication and authorization using TSIG.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <p><span><strong class="command">logging</strong></span></p>
532d27b39244fadfcf8d8b4593f4c65434c9c664Automatic Updater specifies what the server logs, and where
532d27b39244fadfcf8d8b4593f4c65434c9c664Automatic Updater the log messages are sent.
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews <p><span><strong class="command">lwres</strong></span></p>
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews configures <span><strong class="command">named</strong></span> to
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews also act as a light-weight resolver daemon (<span><strong class="command">lwresd</strong></span>).
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews <p><span><strong class="command">masters</strong></span></p>
e8c17c74535be290abaaa160a434ed80bf0ad2feMark Andrews defines a named masters list for
93089a352d6903b0d7845a039de4ec2df9a0e35aTinderbox User inclusion in stub and slave zone masters clauses.
933799f3641f4f78445d015008bad0038900a82aTinderbox User <p><span><strong class="command">options</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater controls global server configuration
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater options and sets defaults for other statements.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">statistics-channels</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater declares communication channels to get access to
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <span><strong class="command">named</strong></span> statistics.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">server</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater sets certain configuration options on
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater a per-server basis.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">trusted-keys</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater defines trusted DNSSEC keys.
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User <p><span><strong class="command">view</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User defines a view.
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater <p><span><strong class="command">zone</strong></span></p>
bf8c3776f1bf1a1270e5e0443ae5a8df022632a8Mark Andrews defines a zone.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews The <span><strong class="command">logging</strong></span> and
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <span><strong class="command">options</strong></span> statements may only occur once
ec8755f605d7dcb2de1076040e77bc2d7ec33b4aTinderbox User configuration.
60d5d17479b47c03b9c7c86f54269718103750b8Automatic Updater<div class="titlepage"><div><div><h3 class="title">
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater<a name="id2574361"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<pre class="programlisting"><span><strong class="command">acl</strong></span> acl-name {
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User address_match_list
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater<div class="titlepage"><div><div><h3 class="title">
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater<a name="acl"></a><span><strong class="command">acl</strong></span> Statement Definition and
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater The <span><strong class="command">acl</strong></span> statement assigns a symbolic
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater name to an address match list. It gets its name from a primary
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater use of address match lists: Access Control Lists (ACLs).
19dbf2e20df03f2b81ed1f347e27718084374059Automatic Updater Note that an address match list's name must be defined
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater with <span><strong class="command">acl</strong></span> before it can be used
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater elsewhere; no forward references are allowed.
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater The following ACLs are built-in:
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater<div class="informaltable"><table border="1">
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews <p><span><strong class="command">any</strong></span></p>
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews Matches all hosts.
4fe0411487e8e4401477684c0a2bac041ca7c2d5Tinderbox User <p><span><strong class="command">none</strong></span></p>
4fe0411487e8e4401477684c0a2bac041ca7c2d5Tinderbox User Matches no hosts.
f45f40ec2814a5ff1ed443c968772a1b2e25c462Mark Andrews <p><span><strong class="command">localhost</strong></span></p>
2bd56b2684882faf74a2b29cb0914e6671d8005bTinderbox User Matches the IPv4 and IPv6 addresses of all network
d642d3857129678797a01adee14fbd70335b05a9Mark Andrews interfaces on the system.
a8677ecad546c955406b341eb8344ed06768b11eTinderbox User <p><span><strong class="command">localnets</strong></span></p>
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews Matches any host on an IPv4 or IPv6 network
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User for which the system has an interface.
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews Some systems do not provide a way to determine the prefix
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews local IPv6 addresses.
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews In such a case, <span><strong class="command">localnets</strong></span>
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews only matches the local
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews IPv6 addresses, just like <span><strong class="command">localhost</strong></span>.
789875a1bd6d50c00d3bd883cad17ead1d3c21cdMark Andrews<div class="titlepage"><div><div><h3 class="title">
789875a1bd6d50c00d3bd883cad17ead1d3c21cdMark Andrews<a name="id2574551"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div>
bac4435d473c9a0281507524f084480c34aa942aTinderbox User<pre class="programlisting"><span><strong class="command">controls</strong></span> {
08a1e53c738c425390557196a2ba5039e5afd364Mark Andrews [ inet ( ip_addr | * ) [ port ip_port ] allow { <em class="replaceable"><code> address_match_list </code></em> }
7e8129652903780873ba91f379f9ffca1f59773cMark Andrews keys { <em class="replaceable"><code>key_list</code></em> }; ]
7e8129652903780873ba91f379f9ffca1f59773cMark Andrews [ inet ...; ]
7e8129652903780873ba91f379f9ffca1f59773cMark Andrews [ unix <em class="replaceable"><code>path</code></em> perm <em class="replaceable"><code>number</code></em> owner <em class="replaceable"><code>number</code></em> group <em class="replaceable"><code>number</code></em> keys { <em class="replaceable"><code>key_list</code></em> }; ]
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews [ unix ...; ]
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews<div class="titlepage"><div><div><h3 class="title">
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User<a name="controls_statement_definition_and_usage"></a><span><strong class="command">controls</strong></span> Statement Definition and
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews The <span><strong class="command">controls</strong></span> statement declares control
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User channels to be used by system administrators to control the
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt operation of the name server. These control channels are
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt used by the <span><strong class="command">rndc</strong></span> utility to send
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt commands to and retrieve non-DNS results from a name server.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt An <span><strong class="command">inet</strong></span> control channel is a TCP socket
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt listening at the specified <span><strong class="command">ip_port</strong></span> on the
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt specified <span><strong class="command">ip_addr</strong></span>, which can be an IPv4 or IPv6
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User interpreted as the IPv4 wildcard address; connections will be
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User accepted on any of the system's IPv4 addresses.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt To listen on the IPv6 wildcard address,
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt use an <span><strong class="command">ip_addr</strong></span> of <code class="literal">::</code>.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt If you will only use <span><strong class="command">rndc</strong></span> on the local host,
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews using the loopback address (<code class="literal">127.0.0.1</code>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater or <code class="literal">::1</code>) is recommended for maximum security.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If no port is specified, port 953 is used. The asterisk
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater "<code class="literal">*</code>" cannot be used for <span><strong class="command">ip_port</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The ability to issue commands over the control channel is
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater restricted by the <span><strong class="command">allow</strong></span> and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">keys</strong></span> clauses.
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater Connections to the control channel are permitted based on the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">address_match_list</strong></span>. This is for simple
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews IP address based filtering only; any <span><strong class="command">key_id</strong></span>
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews elements of the <span><strong class="command">address_match_list</strong></span>
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews are ignored.
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews A <span><strong class="command">unix</strong></span> control channel is a UNIX domain
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews socket listening at the specified path in the file system.
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews Access to the socket is specified by the <span><strong class="command">perm</strong></span>,
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User <span><strong class="command">owner</strong></span> and <span><strong class="command">group</strong></span> clauses.
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User Note on some platforms (SunOS and Solaris) the permissions
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews (<span><strong class="command">perm</strong></span>) are applied to the parent directory
5b56652059e2c22185a0b2bb1f5e58eb89a44426Tinderbox User as the permissions on the socket itself are ignored.
8e86e8a779f37378fdb85a92c4ba77e394013729Tinderbox User The primary authorization mechanism of the command
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User channel is the <span><strong class="command">key_list</strong></span>, which
ff62ab3c2e6274f19190ded15548c723d38bbbe3Automatic Updater contains a list of <span><strong class="command">key_id</strong></span>s.
ee23b913b6acccad68cf5af480b9e289a3d00510Tinderbox User Each <span><strong class="command">key_id</strong></span> in the <span><strong class="command">key_list</strong></span>
ee23b913b6acccad68cf5af480b9e289a3d00510Tinderbox User is authorized to execute commands over the control channel.
9a5217f827ac0e006016745e5305b31dc0c7767fTinderbox User See <a href="Bv9ARM.ch03.html#rndc">Remote Name Daemon Control application</a> in <a href="Bv9ARM.ch03.html#admin_tools" title="Administrative Tools">the section called “Administrative Tools”</a>)
e20309353e6246485c521278131d3fced73d7957Tinderbox User for information about configuring keys in <span><strong class="command">rndc</strong></span>.
ee23b913b6acccad68cf5af480b9e289a3d00510Tinderbox User If no <span><strong class="command">controls</strong></span> statement is present,
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User <span><strong class="command">named</strong></span> will set up a default
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews control channel listening on the loopback address 127.0.0.1
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User and its IPv6 counterpart ::1.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User In this case, and also when the <span><strong class="command">controls</strong></span> statement
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User is present but does not have a <span><strong class="command">keys</strong></span> clause,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">named</strong></span> will attempt to load the command channel key
bac4435d473c9a0281507524f084480c34aa942aTinderbox User from the file <code class="filename">rndc.key</code> in
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews <code class="filename">/etc</code> (or whatever <code class="varname">sysconfdir</code>
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews was specified as when <acronym class="acronym">BIND</acronym> was built).
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews To create a <code class="filename">rndc.key</code> file, run
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews <strong class="userinput"><code>rndc-confgen -a</code></strong>.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews The <code class="filename">rndc.key</code> feature was created to
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews ease the transition of systems from <acronym class="acronym">BIND</acronym> 8,
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews which did not have digital signatures on its command channel
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews messages and thus did not have a <span><strong class="command">keys</strong></span> clause.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews It makes it possible to use an existing <acronym class="acronym">BIND</acronym> 8
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews configuration file in <acronym class="acronym">BIND</acronym> 9 unchanged,
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews and still have <span><strong class="command">rndc</strong></span> work the same way
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews <span><strong class="command">ndc</strong></span> worked in BIND 8, simply by executing the
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews command <strong class="userinput"><code>rndc-confgen -a</code></strong> after BIND 9 is
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews Since the <code class="filename">rndc.key</code> feature
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews is only intended to allow the backward-compatible usage of
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews <acronym class="acronym">BIND</acronym> 8 configuration files, this
3040b455151b1e1173193933664b2891b6159f24Mark Andrews feature does not
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt have a high degree of configurability. You cannot easily change
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User the key name or the size of the secret, so you should make a
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User <code class="filename">rndc.conf</code> with your own key if you
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews wish to change
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User those things. The <code class="filename">rndc.key</code> file
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User permissions set such that only the owner of the file (the user that
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">named</strong></span> is running as) can access it.
3f38b58ba4f674afd883eef5d976a7d4e0502673Tinderbox User desire greater flexibility in allowing other users to access
3f38b58ba4f674afd883eef5d976a7d4e0502673Tinderbox User <span><strong class="command">rndc</strong></span> commands, then you need to create
3f38b58ba4f674afd883eef5d976a7d4e0502673Tinderbox User <code class="filename">rndc.conf</code> file and make it group
3f38b58ba4f674afd883eef5d976a7d4e0502673Tinderbox User readable by a group
3f38b58ba4f674afd883eef5d976a7d4e0502673Tinderbox User that contains the users who should have access.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater To disable the command channel, use an empty
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">controls</strong></span> statement:
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">controls { };</strong></span>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<div class="titlepage"><div><div><h3 class="title">
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User<a name="id2574912"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<pre class="programlisting"><span><strong class="command">include</strong></span> <em class="replaceable"><code>filename</code></em>;</pre>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h3 class="title">
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<a name="id2574929"></a><span><strong class="command">include</strong></span> Statement Definition and
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater The <span><strong class="command">include</strong></span> statement inserts the
3040b455151b1e1173193933664b2891b6159f24Mark Andrews specified file at the point where the <span><strong class="command">include</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater statement is encountered. The <span><strong class="command">include</strong></span>
48b36fa08b2b5bc0d552dc2a4425b3f7007b3d59Automatic Updater statement facilitates the administration of configuration
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater by permitting the reading or writing of some things but not
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater others. For example, the statement could include private keys
3040b455151b1e1173193933664b2891b6159f24Mark Andrews that are readable only by the name server.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h3 class="title">
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User<a name="id2575089"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div>
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User<pre class="programlisting"><span><strong class="command">key</strong></span> <em class="replaceable"><code>key_id</code></em> {
48b36fa08b2b5bc0d552dc2a4425b3f7007b3d59Automatic Updater algorithm <em class="replaceable"><code>string</code></em>;
9fa39c73fc1d8bc44fdbbb79a1d26b837e7dd555Mark Andrews secret <em class="replaceable"><code>string</code></em>;
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<div class="titlepage"><div><div><h3 class="title">
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<a name="id2575112"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div>
1959fd489a8832e4e3d311670f64ae18e5d08156Automatic Updater The <span><strong class="command">key</strong></span> statement defines a shared
1959fd489a8832e4e3d311670f64ae18e5d08156Automatic Updater secret key for use with TSIG (see <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
3040b455151b1e1173193933664b2891b6159f24Mark Andrews or the command channel
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
3040b455151b1e1173193933664b2891b6159f24Mark Andrews Usage”</a>).
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews The <span><strong class="command">key</strong></span> statement can occur at the
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews of the configuration file or inside a <span><strong class="command">view</strong></span>
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews statement. Keys defined in top-level <span><strong class="command">key</strong></span>
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews statements can be used in all views. Keys intended for use in
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews a <span><strong class="command">controls</strong></span> statement
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
560d6da48f066000541dd43f5d407644dee12bebTinderbox User Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
7addb3e8b5cf6e0c4df0e3cb8135aa71269f0261Tinderbox User Usage”</a>)
3040b455151b1e1173193933664b2891b6159f24Mark Andrews must be defined at the top level.
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater The <em class="replaceable"><code>key_id</code></em>, also known as the
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User key name, is a domain name uniquely identifying the key. It can
8d8f9f7f86a33a155dd74b9b2c1317afca555d54Evan Hunt be used in a <span><strong class="command">server</strong></span>
8d8f9f7f86a33a155dd74b9b2c1317afca555d54Evan Hunt statement to cause requests sent to that
3040b455151b1e1173193933664b2891b6159f24Mark Andrews server to be signed with this key, or in address match lists to
3040b455151b1e1173193933664b2891b6159f24Mark Andrews verify that incoming requests have been signed with a key
90b25b84f037ec923efaee84d2c0dc599293d04eTinderbox User matching this name, algorithm, and secret.
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont The <em class="replaceable"><code>algorithm_id</code></em> is a string
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont that specifies a security/authentication algorithm. Named
4dca64bb8991502db368028aeeba2f832d3b971dAutomatic Updater supports <code class="literal">hmac-md5</code>,
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews and <code class="literal">hmac-sha512</code> TSIG authentication.
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater Truncated hashes are supported by appending the minimum
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater number of required bits preceded by a dash, e.g.
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater <code class="literal">hmac-sha1-80</code>. The
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater <em class="replaceable"><code>secret_string</code></em> is the secret
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater to be used by the algorithm, and is treated as a base-64
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater encoded string.
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater<a name="id2575203"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div>
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater<pre class="programlisting"><span><strong class="command">logging</strong></span> {
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater [ <span><strong class="command">channel</strong></span> <em class="replaceable"><code>channel_name</code></em> {
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater ( <span><strong class="command">file</strong></span> <em class="replaceable"><code>path_name</code></em>
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User [ <span><strong class="command">versions</strong></span> ( <em class="replaceable"><code>number</code></em> | <span><strong class="command">unlimited</strong></span> ) ]
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater [ <span><strong class="command">size</strong></span> <em class="replaceable"><code>size spec</code></em> ]
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater | <span><strong class="command">syslog</strong></span> <em class="replaceable"><code>syslog_facility</code></em>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews | <span><strong class="command">stderr</strong></span>
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User | <span><strong class="command">null</strong></span> );
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User [ <span><strong class="command">severity</strong></span> (<code class="option">critical</code> | <code class="option">error</code> | <code class="option">warning</code> | <code class="option">notice</code> |
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt <code class="option">info</code> | <code class="option">debug</code> [ <em class="replaceable"><code>level</code></em> ] | <code class="option">dynamic</code> ); ]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [ <span><strong class="command">print-category</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
536da846f6cc03ad8abbb8bb9d5d8a6f607b8c33Mark Andrews [ <span><strong class="command">print-severity</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
229ea4644b3a7d9c7fdaa43888e7f55ba01e2ee3Automatic Updater [ <span><strong class="command">print-time</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [ <span><strong class="command">category</strong></span> <em class="replaceable"><code>category_name</code></em> {
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <em class="replaceable"><code>channel_name</code></em> ; [ <em class="replaceable"><code>channel_name</code></em> ; ... ]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2575329"></a><span><strong class="command">logging</strong></span> Statement Definition and
50fa300826799727204b93cbe63bebc341c5eadeTinderbox User The <span><strong class="command">logging</strong></span> statement configures a
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater variety of logging options for the name server. Its <span><strong class="command">channel</strong></span> phrase
2da2220fe7af2c45724b50b0187523b1fab0cf08Rob Austein associates output methods, format options and severity levels with
3040b455151b1e1173193933664b2891b6159f24Mark Andrews a name that can then be used with the <span><strong class="command">category</strong></span> phrase
e171a4137c6ba348957e61b7c4c3541493c0da02Automatic Updater to select how various classes of messages are logged.
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User Only one <span><strong class="command">logging</strong></span> statement is used to
e21f41f6504b3381be86cbe7f457f9ee1fff947bTinderbox User as many channels and categories as are wanted. If there is no <span><strong class="command">logging</strong></span> statement,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the logging configuration will be:
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User category default { default_syslog; default_debug; };
b3386fba31414344f38f0c30849c056dceb22dceTinderbox User category unmatched { null; };
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater In <acronym class="acronym">BIND</acronym> 9, the logging configuration
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is only established when
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater the entire configuration file has been parsed. In <acronym class="acronym">BIND</acronym> 8, it was
af9cf290cea6ada6ce27b51c724ab77ad5d73fa0Tinderbox User established as soon as the <span><strong class="command">logging</strong></span>
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User was parsed. When the server is starting up, all logging messages
6671e343b8c7e44ac10a7900fde59555fbc71571Automatic Updater regarding syntax errors in the configuration file go to the default
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater channels, or to standard error if the "<code class="option">-g</code>" option
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater was specified.
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater<div class="titlepage"><div><div><h4 class="title">
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater<a name="id2575381"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div>
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater All log output goes to one or more <span class="emphasis"><em>channels</em></span>;
99c231a3bd27893583204cd0a3e3103dc78dbc28Tinderbox User you can make as many of them as you want.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater Every channel definition must include a destination clause that
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User says whether messages selected for the channel go to a file, to a
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater particular syslog facility, to the standard error stream, or are
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater discarded. It can optionally also limit the message severity level
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews that will be accepted by the channel (the default is
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews <span><strong class="command">info</strong></span>), and whether to include a
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews <span><strong class="command">named</strong></span>-generated time stamp, the
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User category name
8e9f3b69914ee02a80b87c97b1f8093edb3e9ae0Automatic Updater and/or severity level (the default is not to include any).
c53a6f37deaa396660adb6a4ca600c4a58adfd3fAutomatic Updater The <span><strong class="command">null</strong></span> destination clause
af9cf290cea6ada6ce27b51c724ab77ad5d73fa0Tinderbox User causes all messages sent to the channel to be discarded;
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User in that case, other options for the channel are meaningless.
50fa300826799727204b93cbe63bebc341c5eadeTinderbox User The <span><strong class="command">file</strong></span> destination clause directs
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater to a disk file. It can include limitations
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User both on how large the file is allowed to become, and how many
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User of the file will be saved each time the file is opened.
e20309353e6246485c521278131d3fced73d7957Tinderbox User If you use the <span><strong class="command">versions</strong></span> log file
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <span><strong class="command">named</strong></span> will retain that many backup
39cad8fb7d7ff3436bb24ce761354afcb80d295aMark Andrews versions of the file by
f8a9a38ee40c139a8d145ac76ecbff3a0f986453Mark Andrews renaming them when opening. For example, if you choose to keep
e628576d3b3d91c8954679077f4c208f1e43b433Automatic Updater three old versions
39cad8fb7d7ff3436bb24ce761354afcb80d295aMark Andrews of the file <code class="filename">lamers.log</code>, then just
39cad8fb7d7ff3436bb24ce761354afcb80d295aMark Andrews before it is opened
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User <code class="filename">lamers.log.1</code> is renamed to
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <code class="filename">lamers.log.2</code>, <code class="filename">lamers.log.0</code> is renamed
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User to <code class="filename">lamers.log.1</code>, and <code class="filename">lamers.log</code> is
9d80d23172c30fd63e5046a7e69b8445e564ff31Automatic Updater renamed to <code class="filename">lamers.log.0</code>.
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User You can say <span><strong class="command">versions unlimited</strong></span> to
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews the number of versions.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews If a <span><strong class="command">size</strong></span> option is associated with
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews the log file,
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews then renaming is only done when the file being opened exceeds the
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews indicated size. No backup versions are kept by default; any
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews log file is simply appended.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews The <span><strong class="command">size</strong></span> option for files is used
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews to limit log
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews growth. If the file ever exceeds the size, then <span><strong class="command">named</strong></span> will
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews stop writing to the file unless it has a <span><strong class="command">versions</strong></span> option
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews associated with it. If backup versions are kept, the files are
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews described above and a new one begun. If there is no
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews <span><strong class="command">versions</strong></span> option, no more data will
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews be written to the log
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews until some out-of-band mechanism removes or truncates the log to
3040b455151b1e1173193933664b2891b6159f24Mark Andrews less than the
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User maximum size. The default behavior is not to limit the size of
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User Example usage of the <span><strong class="command">size</strong></span> and
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <span><strong class="command">versions</strong></span> options:
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User<pre class="programlisting">channel an_example_channel {
61932ed91732417e05c8c6fd335acf1be896c778Mark Andrews file "example.log" versions 3 size 20m;
3040b455151b1e1173193933664b2891b6159f24Mark Andrews print-time yes;
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User print-category yes;
3040b455151b1e1173193933664b2891b6159f24Mark Andrews The <span><strong class="command">syslog</strong></span> destination clause
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt channel to the system log. Its argument is a
3040b455151b1e1173193933664b2891b6159f24Mark Andrews syslog facility as described in the <span><strong class="command">syslog</strong></span> man
e80c7005e3d59dfeb04dad186d36f3c15622954cTinderbox User page. Known facilities are <span><strong class="command">kern</strong></span>, <span><strong class="command">user</strong></span>,
182bfea3ae9912f6d5e2f4fe3e13737719e06f97Tinderbox User <span><strong class="command">mail</strong></span>, <span><strong class="command">daemon</strong></span>, <span><strong class="command">auth</strong></span>,
182bfea3ae9912f6d5e2f4fe3e13737719e06f97Tinderbox User <span><strong class="command">syslog</strong></span>, <span><strong class="command">lpr</strong></span>, <span><strong class="command">news</strong></span>,
182bfea3ae9912f6d5e2f4fe3e13737719e06f97Tinderbox User <span><strong class="command">uucp</strong></span>, <span><strong class="command">cron</strong></span>, <span><strong class="command">authpriv</strong></span>,
182bfea3ae9912f6d5e2f4fe3e13737719e06f97Tinderbox User <span><strong class="command">ftp</strong></span>, <span><strong class="command">local0</strong></span>, <span><strong class="command">local1</strong></span>,
af60449fe472b8bea5ad04bf538c777c6b151112Tinderbox User <span><strong class="command">local2</strong></span>, <span><strong class="command">local3</strong></span>, <span><strong class="command">local4</strong></span>,
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews <span><strong class="command">local5</strong></span>, <span><strong class="command">local6</strong></span> and
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews <span><strong class="command">local7</strong></span>, however not all facilities
af60449fe472b8bea5ad04bf538c777c6b151112Tinderbox User are supported on
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews all operating systems.
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews How <span><strong class="command">syslog</strong></span> will handle messages
af60449fe472b8bea5ad04bf538c777c6b151112Tinderbox User this facility is described in the <span><strong class="command">syslog.conf</strong></span> man
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User page. If you have a system which uses a very old version of <span><strong class="command">syslog</strong></span> that
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User only uses two arguments to the <span><strong class="command">openlog()</strong></span> function,
3040b455151b1e1173193933664b2891b6159f24Mark Andrews then this clause is silently ignored.
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews The <span><strong class="command">severity</strong></span> clause works like <span><strong class="command">syslog</strong></span>'s
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews "priorities", except that they can also be used if you are writing
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews straight to a file rather than using <span><strong class="command">syslog</strong></span>.
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews Messages which are not at least of the severity level given will
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews not be selected for the channel; messages of higher severity
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews will be accepted.
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews If you are using <span><strong class="command">syslog</strong></span>, then the <span><strong class="command">syslog.conf</strong></span> priorities
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews will also determine what eventually passes through. For example,
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews defining a channel facility and severity as <span><strong class="command">daemon</strong></span> and <span><strong class="command">debug</strong></span> but
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User only logging <span><strong class="command">daemon.warning</strong></span> via <span><strong class="command">syslog.conf</strong></span> will
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User cause messages of severity <span><strong class="command">info</strong></span> and
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <span><strong class="command">notice</strong></span> to
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater be dropped. If the situation were reversed, with <span><strong class="command">named</strong></span> writing
3040b455151b1e1173193933664b2891b6159f24Mark Andrews messages of only <span><strong class="command">warning</strong></span> or higher,
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater then <span><strong class="command">syslogd</strong></span> would
f09f1bf18e3ad40a0e8a6cc3dabf1c11f04992cbMark Andrews print all messages it received from the channel.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User The <span><strong class="command">stderr</strong></span> destination clause
8c9c79e5fea0cb698026a74821695907c8312a46Mark Andrews channel to the server's standard error stream. This is intended
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User use when the server is running as a foreground process, for
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User when debugging a configuration.
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater The server can supply extensive debugging information when
f09f1bf18e3ad40a0e8a6cc3dabf1c11f04992cbMark Andrews it is in debugging mode. If the server's global debug level is
3040b455151b1e1173193933664b2891b6159f24Mark Andrews than zero, then debugging mode will be active. The global debug
3040b455151b1e1173193933664b2891b6159f24Mark Andrews level is set either by starting the <span><strong class="command">named</strong></span> server
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater with the <code class="option">-d</code> flag followed by a positive integer,
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews or by running <span><strong class="command">rndc trace</strong></span>.
6025cbbe8408f4b09d53d5ec1e95cb6da97e0a8dTinderbox User The global debug level
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews can be set to zero, and debugging mode turned off, by running <span><strong class="command">rndc
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrewsnotrace</strong></span>. All debugging messages in the server have a debug
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews level, and higher debug levels give more detailed output. Channels
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews that specify a specific debug severity, for example:
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews<pre class="programlisting">channel specific_debug_level {
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington severity debug 3;
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews will get debugging output of level 3 or less any time the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater server is in debugging mode, regardless of the global debugging
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater level. Channels with <span><strong class="command">dynamic</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater severity use the
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews server's global debug level to determine what messages to print.
e007e3e5b0316c6c05698a71101885743aca22bdAutomatic Updater If <span><strong class="command">print-time</strong></span> has been turned on,
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User the date and time will be logged. <span><strong class="command">print-time</strong></span> may
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews be specified for a <span><strong class="command">syslog</strong></span> channel,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews but is usually
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User pointless since <span><strong class="command">syslog</strong></span> also prints
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews the date and
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews time. If <span><strong class="command">print-category</strong></span> is
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews requested, then the
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews category of the message will be logged as well. Finally, if <span><strong class="command">print-severity</strong></span> is
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews on, then the severity level of the message will be logged. The <span><strong class="command">print-</strong></span> options may
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews be used in any combination, and will always be printed in the
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews order: time, category, severity. Here is an example where all
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews three <span><strong class="command">print-</strong></span> options
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <code class="computeroutput">28-Feb-2000 15:05:32.863 general: notice: running</code>
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews There are four predefined channels that are used for
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <span><strong class="command">named</strong></span>'s default logging as follows.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews How they are
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews used is described in <a href="Bv9ARM.ch06.html#the_category_phrase" title="The category Phrase">the section called “The <span><strong class="command">category</strong></span> Phrase”</a>.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews<pre class="programlisting">channel default_syslog {
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews syslog daemon; // send to syslog's daemon
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews severity info; // only send priority info
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews // and higher
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrewschannel default_debug {
7019b0441a234153dde155622c405960b0d35946Tinderbox User // the working directory
180319f572fb6c1ca7000d22ea79a8dd77ae3f91Evan Hunt // Note: stderr is used instead
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews // if the server is started
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews // with the '-f' option.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews severity dynamic; // log at the server's
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews // current debug level
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrewschannel default_stderr {
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews stderr; // writes to stderr
95de440e8d2b07bb130505b4146059e5734e2eeaTinderbox User severity info; // only send priority info
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User // and higher
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellingtonchannel null {
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington null; // toss anything sent to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater // this channel
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">default_debug</strong></span> channel has the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User property that it only produces output when the server's debug
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington nonzero. It normally writes to a file called <code class="filename">named.run</code>
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews in the server's working directory.
95cfad51a3f71246d263af79a7861a6821f7a0beAutomatic Updater For security reasons, when the "<code class="option">-u</code>"
3040b455151b1e1173193933664b2891b6159f24Mark Andrews command line option is used, the <code class="filename">named.run</code> file
95cfad51a3f71246d263af79a7861a6821f7a0beAutomatic Updater is created only after <span><strong class="command">named</strong></span> has
61932ed91732417e05c8c6fd335acf1be896c778Mark Andrews changed to the
3040b455151b1e1173193933664b2891b6159f24Mark Andrews new UID, and any debug output generated while <span><strong class="command">named</strong></span> is
e80c7005e3d59dfeb04dad186d36f3c15622954cTinderbox User starting up and still running as root is discarded. If you need
e135e3c4b1f4f986f00997f5ad5866effb203139Tinderbox User to capture this output, you must run the server with the "<code class="option">-g</code>"
bec9d04b657e1582d2531bdc02503bebde2aa978Tinderbox User option and redirect standard error to a file.
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater Once a channel is defined, it cannot be redefined. Thus you
99c231a3bd27893583204cd0a3e3103dc78dbc28Tinderbox User cannot alter the built-in channels directly, but you can modify
3040b455151b1e1173193933664b2891b6159f24Mark Andrews the default logging by pointing categories at channels you have
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater<div class="titlepage"><div><div><h4 class="title">
ec7751119a08c6a7250f3187beed69a8b836d349Tinderbox User<a name="the_category_phrase"></a>The <span><strong class="command">category</strong></span> Phrase</h4></div></div></div>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews There are many categories, so you can send the logs you want
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater to see wherever you want, without seeing logs you don't want. If
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater you don't specify a list of channels for a category, then log
07d9d0dbcc0c79deb3c34f4a8af05ac68a6800e4Mark Andrews in that category will be sent to the <span><strong class="command">default</strong></span> category
a66012b52c20200f118781463db4e4ee44454298Automatic Updater instead. If you don't specify a default category, the following
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt "default default" is used:
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<pre class="programlisting">category default { default_syslog; default_debug; };
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User As an example, let's say you want to log security events to
e135e3c4b1f4f986f00997f5ad5866effb203139Tinderbox User a file, but you also want keep the default logging behavior. You'd
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater specify the following:
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater<pre class="programlisting">channel my_security_channel {
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User file "my_security_file";
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater severity info;
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox Usercategory security {
3040b455151b1e1173193933664b2891b6159f24Mark Andrews my_security_channel;
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User default_syslog;
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User default_debug;
f0877b0237674d0519006ca7f8436e5f92250d30Mark Andrews To discard all messages in a category, specify the <span><strong class="command">null</strong></span> channel:
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User<pre class="programlisting">category xfer-out { null; };
f0877b0237674d0519006ca7f8436e5f92250d30Mark Andrewscategory notify { null; };
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User Following are the available categories and brief descriptions
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User of the types of log information they contain. More
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User categories may be added in future <acronym class="acronym">BIND</acronym> releases.
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User <p><span><strong class="command">default</strong></span></p>
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User The default category defines the logging
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User options for those categories where no specific
fdd0516065be2316409d0cc7dfb4e4f54eadc5afMark Andrews configuration has been
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews <p><span><strong class="command">general</strong></span></p>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The catch-all. Many things still aren't
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington classified into categories, and they all end up here.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <p><span><strong class="command">database</strong></span></p>
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User Messages relating to the databases used
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User internally by the name server to store zone and cache
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">security</strong></span></p>
d145b64cacc8d9cda51f9924ec70cd4661c3e2cfAutomatic Updater Approval and denial of requests.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">config</strong></span></p>
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews Configuration file parsing and processing.
2cdbfcdad94eba75f3f8e77343a0eefabf553b8eAutomatic Updater <p><span><strong class="command">resolver</strong></span></p>
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User DNS resolution, such as the recursive
52cfbde0bd391cfb37e3c1a1b460c16ba6bf1a73Automatic Updater lookups performed on behalf of clients by a caching name
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <p><span><strong class="command">xfer-in</strong></span></p>
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater Zone transfers the server is receiving.
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User <p><span><strong class="command">xfer-out</strong></span></p>
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User Zone transfers the server is sending.
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User <p><span><strong class="command">notify</strong></span></p>
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater The NOTIFY protocol.
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater <p><span><strong class="command">client</strong></span></p>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User Processing of client requests.
ac2ad7b4e4e41e7e788dbe103c581f1605209d3bTinderbox User <p><span><strong class="command">unmatched</strong></span></p>
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews Messages that named was unable to determine the
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater class of or for which there was no matching <span><strong class="command">view</strong></span>.
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater A one line summary is also logged to the <span><strong class="command">client</strong></span> category.
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews This category is best sent to a file or stderr, by
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews default it is sent to
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews the <span><strong class="command">null</strong></span> channel.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <p><span><strong class="command">network</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Network operations.
c95f536d78842fbc8ebcef653d88e1f2270054f8Automatic Updater <p><span><strong class="command">update</strong></span></p>
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater Dynamic updates.
c95f536d78842fbc8ebcef653d88e1f2270054f8Automatic Updater <p><span><strong class="command">update-security</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Approval and denial of update requests.
bac4435d473c9a0281507524f084480c34aa942aTinderbox User <p><span><strong class="command">queries</strong></span></p>
bac4435d473c9a0281507524f084480c34aa942aTinderbox User Specify where queries should be logged to.
ff62d4458acda2110a3763ec576a4f728450662cEvan Hunt At startup, specifying the category <span><strong class="command">queries</strong></span> will also
bac4435d473c9a0281507524f084480c34aa942aTinderbox User enable query logging unless <span><strong class="command">querylog</strong></span> option has been
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The query log entry reports the client's IP
45c349c278fd83acd4dcb91eec3482401a623e47Automatic Updater address and port number, and the query name,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews class and type. It also reports whether the
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Recursion Desired flag was set (+ if set, -
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews if not set), if the query was signed (S),
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews EDNS was in use (E), if DO (DNSSEC Ok) was
bf8c3776f1bf1a1270e5e0443ae5a8df022632a8Mark Andrews set (D), or if CD (Checking Disabled) was set
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <code class="computeroutput">client 127.0.0.1#62536: query: www.example.com IN AAAA +SE</code>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <code class="computeroutput">client ::1#62537: query: www.example.net IN AAAA -SE</code>
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User <p><span><strong class="command">query-errors</strong></span></p>
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User Information about queries that resulted in some
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater <p><span><strong class="command">dispatch</strong></span></p>
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater Dispatching of incoming packets to the
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater server modules where they are to be processed.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <p><span><strong class="command">dnssec</strong></span></p>
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt DNSSEC and TSIG protocol processing.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">lame-servers</strong></span></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Lame servers. These are misconfigurations
e0bf4fc289705375be65c05a8fb085d514a98c97Tinderbox User in remote servers, discovered by BIND 9 when trying to
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater those servers during resolution.
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater <p><span><strong class="command">delegation-only</strong></span></p>
e0bf4fc289705375be65c05a8fb085d514a98c97Tinderbox User Delegation only. Logs queries that have
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User been forced to NXDOMAIN as the result of a
3040b455151b1e1173193933664b2891b6159f24Mark Andrews delegation-only zone or
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater a <span><strong class="command">delegation-only</strong></span> in a
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User hint or stub zone declaration.
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews <p><span><strong class="command">edns-disabled</strong></span></p>
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater Log queries that have been forced to use plain
3040b455151b1e1173193933664b2891b6159f24Mark Andrews DNS due to timeouts. This is often due to
3040b455151b1e1173193933664b2891b6159f24Mark Andrews the remote servers not being RFC 1034 compliant
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User (not always returning FORMERR or similar to
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User EDNS queries and other extensions to the DNS
b779e1efb14f9616a35befd2b1cfc2578f1a4d70Tinderbox User when they are not understood). In other words, this is
3040b455151b1e1173193933664b2891b6159f24Mark Andrews targeted at servers that fail to respond to
b779e1efb14f9616a35befd2b1cfc2578f1a4d70Tinderbox User DNS queries that they don't understand.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User Note: the log message can also be due to
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User packet loss. Before reporting servers for
6ce070d74c160218ee6c864e75235a4f535320c3Tinderbox User non-RFC 1034 compliance they should be re-tested
3040b455151b1e1173193933664b2891b6159f24Mark Andrews to determine the nature of the non-compliance.
6ce070d74c160218ee6c864e75235a4f535320c3Tinderbox User This testing should prevent or reduce the
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User number of false-positive reports.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews Note: eventually named will have to stop
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews treating such timeouts as due to RFC 1034 non
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews compliance and start treating it as plain
e8e87ede5c36b95806c77bcd34894ad9c4b39a78Tinderbox User packet loss. Falsely classifying packet
e8e87ede5c36b95806c77bcd34894ad9c4b39a78Tinderbox User loss as due to RFC 1034 non compliance impacts
e8e87ede5c36b95806c77bcd34894ad9c4b39a78Tinderbox User on DNSSEC validation which requires EDNS for
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews the DNSSEC records to be returned.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews<div class="titlepage"><div><div><h4 class="title">
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews<a name="id2576663"></a>The <span><strong class="command">query-errors</strong></span> Category</h4></div></div></div>
eac5382be368b43df62e4ac32075131fb4997f03Tinderbox User The <span><strong class="command">query-errors</strong></span> category is
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews specifically intended for debugging purposes: To identify
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews why and how specific queries result in responses which
eac5382be368b43df62e4ac32075131fb4997f03Tinderbox User indicate an error.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews Messages of this category are therefore only logged
536da846f6cc03ad8abbb8bb9d5d8a6f607b8c33Mark Andrews with <span><strong class="command">debug</strong></span> levels.
ac5ed748602c890d596bed07b0b23b8b5f42b2f6Mark Andrews At the debug levels of 1 or higher, each response with the
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt rcode of SERVFAIL is logged as follows:
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <code class="computeroutput">client 127.0.0.1#61502: query failed (SERVFAIL) for www.example.com/IN/AAAA at query.c:3880</code>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews This means an error resulting in SERVFAIL was
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews detected at line 3880 of source file
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews Log messages of this level will particularly
d98b4b724343547314bde32a54966c8f124a5f03Mark Andrews help identify the cause of SERVFAIL for an
4fe0411487e8e4401477684c0a2bac041ca7c2d5Tinderbox User authoritative server.
015f044f7f916eb18d053f2e5dcbee481425bc66Mark Andrews At the debug levels of 2 or higher, detailed context
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User information of recursive resolutions that resulted in
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User SERVFAIL is logged.
bec9d04b657e1582d2531bdc02503bebde2aa978Tinderbox User The log message will look like as follows:
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <code class="computeroutput">fetch completed at resolver.c:2970 for www.example.com/A in 30.000183: timed out/success [domain:example.com,referral:2,restart:7,qrysent:8,timeout:5,lame:0,neterr:0,badresp:1,adberr:0,findfail:0,valfail:0]</code>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews The first part before the colon shows that a recursive
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews resolution for AAAA records of www.example.com completed
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews in 30.000183 seconds and the final result that led to the
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews SERVFAIL was determined at line 2970 of source file
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews The following part shows the detected final result and the
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews latest result of DNSSEC validation.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews The latter is always success when no validation attempt
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews In this example, this query resulted in SERVFAIL probably
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews because all name servers are down or unreachable, leading
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews to a timeout in 30 seconds.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews DNSSEC validation was probably not attempted.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews The last part enclosed in square brackets shows statistics
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews information collected for this particular resolution
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews The <code class="varname">domain</code> field shows the deepest zone
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews that the resolver reached;
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews it is the zone where the error was finally detected.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews The meaning of the other fields is summarized in the
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews following table.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><code class="varname">referral</code></p>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The number of referrals the resolver received
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews throughout the resolution process.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews In the above example this is 2, which are most
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews likely com and example.com.
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews The number of cycles that the resolver tried
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews remote servers at the <code class="varname">domain</code>
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews In each cycle the resolver sends one query
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews (possibly resending it, depending on the response)
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews to each known name server of
4ba21f60009e18c5950d18546a127e70be537effMark Andrews The number of queries the resolver sent at the
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews The number of timeouts since the resolver
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews received the last response.
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews The number of lame servers the resolver detected
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews at the <code class="varname">domain</code> zone.
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews A server is detected to be lame either by an
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews invalid response or as a result of lookup in
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews BIND9's address database (ADB), where lame
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews servers are cached.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The number of erroneous results that the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater resolver encountered in sending queries
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater at the <code class="varname">domain</code> zone.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User One common case is the remote server is
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews unreachable and the resolver receives an ICMP
9a5217f827ac0e006016745e5305b31dc0c7767fTinderbox User unreachable error message.
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater <p><code class="varname">badresp</code></p>
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater The number of unexpected responses (other than
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater <code class="varname">lame</code>) to queries sent by the
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater resolver at the <code class="varname">domain</code> zone.
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater <p><code class="varname">adberr</code></p>
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews Failures in finding remote server addresses
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater of the <code class="varname">domain</code> zone in the ADB.
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater One common case of this is that the remote
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater server's name does not have any address records.
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater <p><code class="varname">findfail</code></p>
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater Failures of resolving remote server addresses.
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt This is a total number of failures throughout
3040b455151b1e1173193933664b2891b6159f24Mark Andrews the resolution process.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User Failures of DNSSEC validation.
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User Validation failures are counted throughout
3040b455151b1e1173193933664b2891b6159f24Mark Andrews the resolution process (not limited to
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User the <code class="varname">domain</code> zone), but should
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User only happen in <code class="varname">domain</code>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User At the debug levels of 3 or higher, the same messages
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User as those at the debug 1 level are logged for other errors
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User than SERVFAIL.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Note that negative responses such as NXDOMAIN are not
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews regarded as errors here.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater At the debug levels of 4 or higher, the same messages
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater as those at the debug 2 level are logged for other errors
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater than SERVFAIL.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Unlike the above case of level 3, messages are logged for
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater negative responses.
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater This is because any unexpected results can be difficult to
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews debug in the recursion case.
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont<div class="titlepage"><div><div><h3 class="title">
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont<a name="id2577244"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div>
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont This is the grammar of the <span><strong class="command">lwres</strong></span>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews statement in the <code class="filename">named.conf</code> file:
95de440e8d2b07bb130505b4146059e5734e2eeaTinderbox User<pre class="programlisting"><span><strong class="command">lwres</strong></span> {
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews [<span class="optional"> listen-on { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> view <em class="replaceable"><code>view_name</code></em>; </span>]
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews [<span class="optional"> search { <em class="replaceable"><code>domain_name</code></em> ; [<span class="optional"> <em class="replaceable"><code>domain_name</code></em> ; ... </span>] }; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> ndots <em class="replaceable"><code>number</code></em>; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<div class="titlepage"><div><div><h3 class="title">
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<a name="id2577386"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div>
ec7751119a08c6a7250f3187beed69a8b836d349Tinderbox User The <span><strong class="command">lwres</strong></span> statement configures the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User server to also act as a lightweight resolver server. (See
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be multiple
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">lwres</strong></span> statements configuring
3040b455151b1e1173193933664b2891b6159f24Mark Andrews lightweight resolver servers with different properties.
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater The <span><strong class="command">listen-on</strong></span> statement specifies a
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User addresses (and ports) that this instance of a lightweight resolver
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt should accept requests on. If no port is specified, port 921 is
3040b455151b1e1173193933664b2891b6159f24Mark Andrews If this statement is omitted, requests will be accepted on
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">view</strong></span> statement binds this
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater lightweight resolver daemon to a view in the DNS namespace, so that
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater response will be constructed in the same manner as a normal DNS
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User matching this view. If this statement is omitted, the default view
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User used, and if there is no default view, an error is triggered.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews The <span><strong class="command">search</strong></span> statement is equivalent to
c5f7f6aa6c51d35353a9485b32abbabfe8358b4eMark Andrews <span><strong class="command">search</strong></span> statement in
c5f7f6aa6c51d35353a9485b32abbabfe8358b4eMark Andrews <code class="filename">/etc/resolv.conf</code>. It provides a
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User list of domains
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User which are appended to relative names in queries.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The <span><strong class="command">ndots</strong></span> statement is equivalent to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">ndots</strong></span> statement in
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User <code class="filename">/etc/resolv.conf</code>. It indicates the
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User number of dots in a relative domain name that should result in an
63654fea53d6a58a65112234bc8d0c322e0c81b5Automatic Updater exact match lookup before search path elements are appended.
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews<div class="titlepage"><div><div><h3 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2577450"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] };
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater<div class="titlepage"><div><div><h3 class="title">
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<a name="id2577562"></a><span><strong class="command">masters</strong></span> Statement Definition and
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<p><span><strong class="command">masters</strong></span>
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt lists allow for a common set of masters to be easily used by
3040b455151b1e1173193933664b2891b6159f24Mark Andrews multiple stub and slave zones.
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User<div class="titlepage"><div><div><h3 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2577577"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div>
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User This is the grammar of the <span><strong class="command">options</strong></span>
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews statement in the <code class="filename">named.conf</code> file:
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<pre class="programlisting"><span><strong class="command">options</strong></span> {
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User [<span class="optional"> attach-cache <em class="replaceable"><code>cache_name</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> version <em class="replaceable"><code>version_string</code></em>; </span>]
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User [<span class="optional"> hostname <em class="replaceable"><code>hostname_string</code></em>; </span>]
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews [<span class="optional"> server-id <em class="replaceable"><code>server_id_string</code></em>; </span>]
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User [<span class="optional"> directory <em class="replaceable"><code>path_name</code></em>; </span>]
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User [<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews [<span class="optional"> named-xfer <em class="replaceable"><code>path_name</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> tkey-gssapi-credential <em class="replaceable"><code>principal</code></em>; </span>]
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [<span class="optional"> tkey-domain <em class="replaceable"><code>domainname</code></em>; </span>]
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [<span class="optional"> tkey-dhkey <em class="replaceable"><code>key_name</code></em> <em class="replaceable"><code>key_tag</code></em>; </span>]
80f05de86cd3cd8e4a4215c4501643891b942dafTinderbox User [<span class="optional"> cache-file <em class="replaceable"><code>path_name</code></em>; </span>]
80f05de86cd3cd8e4a4215c4501643891b942dafTinderbox User [<span class="optional"> dump-file <em class="replaceable"><code>path_name</code></em>; </span>]
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User [<span class="optional"> memstatistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User [<span class="optional"> memstatistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> pid-file <em class="replaceable"><code>path_name</code></em>; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews [<span class="optional"> recursing-file <em class="replaceable"><code>path_name</code></em>; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews [<span class="optional"> statistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User [<span class="optional"> auth-nxdomain <em class="replaceable"><code>yes_or_no</code></em>; </span>]
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User [<span class="optional"> deallocate-on-exit <em class="replaceable"><code>yes_or_no</code></em>; </span>]
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em>; </span>]
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User [<span class="optional"> fake-iquery <em class="replaceable"><code>yes_or_no</code></em>; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> fetch-glue <em class="replaceable"><code>yes_or_no</code></em>; </span>]
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews [<span class="optional"> flush-zones-on-shutdown <em class="replaceable"><code>yes_or_no</code></em>; </span>]
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews [<span class="optional"> has-old-clients <em class="replaceable"><code>yes_or_no</code></em>; </span>]
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews [<span class="optional"> host-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews [<span class="optional"> host-statistics-max <em class="replaceable"><code>number</code></em>; </span>]
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews [<span class="optional"> minimal-responses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews [<span class="optional"> multiple-cnames <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews [<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em>; </span>]
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt [<span class="optional"> recursion <em class="replaceable"><code>yes_or_no</code></em>; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> rfc2308-type1 <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews [<span class="optional"> use-id-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater [<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em>; </span>]
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater [<span class="optional"> ixfr-from-differences (<em class="replaceable"><code>yes_or_no</code></em> | <code class="constant">master</code> | <code class="constant">slave</code>); </span>]
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater [<span class="optional"> dnssec-enable <em class="replaceable"><code>yes_or_no</code></em>; </span>]
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater [<span class="optional"> dnssec-validation <em class="replaceable"><code>yes_or_no</code></em>; </span>]
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater [<span class="optional"> dnssec-lookaside <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em>; </span>]
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater [<span class="optional"> dnssec-must-be-secure <em class="replaceable"><code>domain yes_or_no</code></em>; </span>]
9563f388c8ca1bb9ebb04db54e122815b0008c8aTinderbox User [<span class="optional"> dnssec-accept-expired <em class="replaceable"><code>yes_or_no</code></em>; </span>]
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User [<span class="optional"> forward ( <em class="replaceable"><code>only</code></em> | <em class="replaceable"><code>first</code></em> ); </span>]
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User [<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
9563f388c8ca1bb9ebb04db54e122815b0008c8aTinderbox User [<span class="optional"> dual-stack-servers [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] {
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater ( <em class="replaceable"><code>domain_name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] |
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ) ;
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User ... }; </span>]
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [<span class="optional"> check-names ( <em class="replaceable"><code>master</code></em> | <em class="replaceable"><code>slave</code></em> | <em class="replaceable"><code>response</code></em> )
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
183b6c7fca54001820078f324d102fc33e64bbc6Automatic Updater [<span class="optional"> check-mx ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
9563f388c8ca1bb9ebb04db54e122815b0008c8aTinderbox User [<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9563f388c8ca1bb9ebb04db54e122815b0008c8aTinderbox User [<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em>; </span>]
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews [<span class="optional"> check-mx-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User [<span class="optional"> check-srv-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User [<span class="optional"> check-sibling <em class="replaceable"><code>yes_or_no</code></em>; </span>]
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews [<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> allow-query-cache { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> allow-query-cache-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> allow-recursion { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> allow-recursion-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> allow-v6-synthesis { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> blackhole { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> use-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> avoid-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> use-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User [<span class="optional"> avoid-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> listen-on [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> listen-on-v6 [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> query-source ( ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> )
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> address ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> query-source-v6 ( ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> )
64f2afc2c63a59461d11b581a208efdbeec124adTinderbox User [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [<span class="optional"> address ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt [<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
64f2afc2c63a59461d11b581a208efdbeec124adTinderbox User [<span class="optional"> queryport-pool-interval <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em>; </span>]
859148b72a22e4221c3e918d15c7fdd5e78b6d8dTinderbox User [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em>; </span>]
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em>; </span>]
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> tcp-clients <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> reserved-sockets <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> recursive-clients <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> serial-query-rate <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> serial-queries <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> tcp-listen-queue <em class="replaceable"><code>number</code></em>; </span>]
859148b72a22e4221c3e918d15c7fdd5e78b6d8dTinderbox User [<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em>; </span>]
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews [<span class="optional"> transfers-in <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfers-out <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfers-per-ns <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>]
17198e77b87667f796e910d31a4f47a80e256d09Mark Andrews [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> coresize <em class="replaceable"><code>size_spec</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> datasize <em class="replaceable"><code>size_spec</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> files <em class="replaceable"><code>size_spec</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> stacksize <em class="replaceable"><code>size_spec</code></em> ; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> heartbeat-interval <em class="replaceable"><code>number</code></em>; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> interface-interval <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> statistics-interval <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> topology { <em class="replaceable"><code>address_match_list</code></em> }</span>];
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> sortlist { <em class="replaceable"><code>address_match_list</code></em> }</span>];
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> rrset-order { <em class="replaceable"><code>order_spec</code></em> ; [<span class="optional"> <em class="replaceable"><code>order_spec</code></em> ; ... </span>] </span>] };
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> lame-ttl <em class="replaceable"><code>number</code></em>; </span>]
de73ef7ecdb9e009155993a6fa8dee5cd1bde319Mark Andrews [<span class="optional"> max-ncache-ttl <em class="replaceable"><code>number</code></em>; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> max-cache-ttl <em class="replaceable"><code>number</code></em>; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> min-roots <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> use-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> treat-cr-as-space <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> min-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
0e98665878103743dac92b6e8e1556d927e5bc30Tinderbox User [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> additional-from-auth <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> additional-from-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> random-device <em class="replaceable"><code>path_name</code></em> ; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> max-cache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> match-mapped-addresses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> preferred-glue ( <em class="replaceable"><code>A</code></em> | <em class="replaceable"><code>AAAA</code></em> | <em class="replaceable"><code>NONE</code></em> ); </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> edns-udp-size <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-udp-size <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> root-delegation-only [<span class="optional"> exclude { <em class="replaceable"><code>namelist</code></em> } </span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> querylog <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> disable-algorithms <em class="replaceable"><code>domain</code></em> { <em class="replaceable"><code>algorithm</code></em>; [<span class="optional"> <em class="replaceable"><code>algorithm</code></em>; </span>] }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> acache-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> acache-cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-acache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> empty-server <em class="replaceable"><code>name</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> empty-contact <em class="replaceable"><code>name</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> empty-zones-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> disable-empty-zone <em class="replaceable"><code>zone_name</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> zero-no-soa-ttl-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<div class="titlepage"><div><div><h3 class="title">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<a name="options"></a><span><strong class="command">options</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The <span><strong class="command">options</strong></span> statement sets up global
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews to be used by <acronym class="acronym">BIND</acronym>. This statement
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews may appear only
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews once in a configuration file. If there is no <span><strong class="command">options</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews statement, an options block with each option set to its default will
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">attach-cache</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Allows multiple views to share a single cache
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Each view has its own cache database by default, but
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater if multiple views have the same operational policy
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington for name resolution and caching, those views can
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington share a single cache to save memory and possibly
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington improve resolution efficiency by using this option.
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User The <span><strong class="command">attach-cache</strong></span> option
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User may also be specified in <span><strong class="command">view</strong></span>
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews statements, in which case it overrides the
0df8ead472f207020f8da22a185fe4b945248ab8Automatic Updater global <span><strong class="command">attach-cache</strong></span> option.
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews The <em class="replaceable"><code>cache_name</code></em> specifies
0accdb26ead1fe520a9820b52efbea64bdf564e3Tinderbox User the cache to be shared.
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User When the <span><strong class="command">named</strong></span> server configures
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews views which are supposed to share a cache, it
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews creates a cache with the specified name for the
e213b38b48486b3a6349329655d9169085001fa0Tinderbox User first view of these sharing views.
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User The rest of the views will simply refer to the
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews already created cache.
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont One common configuration to share a cache would be to
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont allow all views to share a single cache.
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews This can be done by specifying
71ba75c604df3604673232828a68bb28c420e698Mark Andrews the <span><strong class="command">attach-cache</strong></span> as a global
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User option with an arbitrary name.
e7d35dad55e8deae14f29aabfb20d540b4b6ab3dMark Andrews Another possible operation is to allow a subset of
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User all views to share a cache while the others to
c5a97a549c89d562e999d4f906b882c5a2a474e1Tinderbox User retain their own caches.
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews For example, if there are three views A, B, and C,
757ff043760e4743dda1a10e7d58349275934902Tinderbox User and only A and B should share a cache, specify the
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User <span><strong class="command">attach-cache</strong></span> option as a view A (or
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews B)'s option, referring to the other view name:
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews // this view has its own cache
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater // this view refers to A's cache
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews attach-cache "A";
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews // this view has its own cache
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User Views that share a cache must have the same policy
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews on configurable parameters that may affect caching.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The current implementation requires the following
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater configurable options be consistent among these
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">check-names</strong></span>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">cleaning-interval</strong></span>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">dnssec-accept-expired</strong></span>,
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont <span><strong class="command">dnssec-validation</strong></span>,
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont <span><strong class="command">max-cache-ttl</strong></span>,
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont <span><strong class="command">max-ncache-ttl</strong></span>,
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont <span><strong class="command">max-cache-size</strong></span>, and
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont <span><strong class="command">zero-no-soa-ttl</strong></span>.
c7f686829f05e44169d46746cfb25cadcf078585Tinderbox User Note that there may be other parameters that may
c7f686829f05e44169d46746cfb25cadcf078585Tinderbox User cause confusion if they are inconsistent for
c7f686829f05e44169d46746cfb25cadcf078585Tinderbox User different views that share a single cache.
c7f686829f05e44169d46746cfb25cadcf078585Tinderbox User For example, if these views define different sets of
c7f686829f05e44169d46746cfb25cadcf078585Tinderbox User forwarders that can return different answers for the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews same question, sharing the answer does not make
51901858be9d4632c1d0bed28cfa8f29932c1967Tinderbox User sense or could even be harmful.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews It is administrator's responsibility to ensure
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews configuration differences in different views do
347333bc39e9e2df63cc4e7309cef5354d52b1fbTinderbox User not cause disruption with a shared cache.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">directory</strong></span></span></dt>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The working directory of the server.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson Any non-absolute pathnames in the configuration file will be
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews as relative to this directory. The default location for most
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews output files (e.g. <code class="filename">named.run</code>)
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews is this directory.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews If a directory is not specified, the working directory
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews defaults to `<code class="filename">.</code>', the directory from
3a9593055ead76cbbb417aee2d2e656c2c92cf46Automatic Updater which the server
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater was started. The directory specified should be an absolute
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">key-directory</strong></span></span></dt>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson When performing dynamic update of secure zones, the
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson directory where the public and private key files should be
3a9593055ead76cbbb417aee2d2e656c2c92cf46Automatic Updater if different than the current working directory. The
229ea4644b3a7d9c7fdaa43888e7f55ba01e2ee3Automatic Updater directory specified
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews must be an absolute path.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<dt><span class="term"><span><strong class="command">named-xfer</strong></span></span></dt>
8bc3d252395842452a6d2c775cf8445f6349e331Tinderbox User <span class="emphasis"><em>This option is obsolete.</em></span> It
de7b9a1dac0c293b39994c91d4376883da25554fTinderbox User was used in <acronym class="acronym">BIND</acronym> 8 to specify
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User the pathname to the <span><strong class="command">named-xfer</strong></span>
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User program. In <acronym class="acronym">BIND</acronym> 9, no separate
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">named-xfer</strong></span> program is needed;
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater its functionality is built into the name server.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">tkey-gssapi-credential</strong></span></span></dt>
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User The security credential with which the server should
467a823e57af687ebd486dfd73ea32f9d2a145beTinderbox User authenticate keys requested by the GSS-TSIG protocol.
467a823e57af687ebd486dfd73ea32f9d2a145beTinderbox User Currently only Kerberos 5 authentication is available
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User and the credential is a Kerberos principal which
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User the server can acquire through the default system
7d704e522860496310bb29c28e76064868401a9cMark Andrews key file, normally <code class="filename">/etc/krb5.keytab</code>.
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews Normally this principal is of the form
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User "<strong class="userinput"><code>dns/</code></strong><code class="varname">server.domain</code>".
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User To use GSS-TSIG, <span><strong class="command">tkey-domain</strong></span>
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews must also be set.
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater<dt><span class="term"><span><strong class="command">tkey-domain</strong></span></span></dt>
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User The domain appended to the names of all shared keys
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User generated with <span><strong class="command">TKEY</strong></span>. When a
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User client requests a <span><strong class="command">TKEY</strong></span> exchange,
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User it may or may not specify the desired name for the
402eda3e7d4254ffac1543bf2917c71248a09e4cTinderbox User key. If present, the name of the shared key will
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews will be <code class="varname">client specified part</code> +
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews <code class="varname">tkey-domain</code>. Otherwise, the
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews name of the shared key will be <code class="varname">random hex
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater digits</code> + <code class="varname">tkey-domain</code>.
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews In most cases, the <span><strong class="command">domainname</strong></span>
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews should be the server's domain name, or an otherwise
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews non-existent subdomain like
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews "_tkey.<code class="varname">domainname</code>". If you are
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews using GSS-TSIG, this variable must be defined.
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews<dt><span class="term"><span><strong class="command">tkey-dhkey</strong></span></span></dt>
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater The Diffie-Hellman key used by the server
409ba95e573b40cf36acf97dd62ee7e9c7775851Tinderbox User to generate shared keys with clients using the Diffie-Hellman
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User of <span><strong class="command">TKEY</strong></span>. The server must be
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User able to load the
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User public and private keys from files in the working directory.
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater most cases, the keyname should be the server's host name.
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User<dt><span class="term"><span><strong class="command">cache-file</strong></span></span></dt>
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User This is for testing only. Do not use.
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User<dt><span class="term"><span><strong class="command">dump-file</strong></span></span></dt>
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User The pathname of the file the server dumps
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User the database to when instructed to do so with
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User <span><strong class="command">rndc dumpdb</strong></span>.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User If not specified, the default is <code class="filename">named_dump.db</code>.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User<dt><span class="term"><span><strong class="command">memstatistics-file</strong></span></span></dt>
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User The pathname of the file the server writes memory
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User usage statistics to on exit. If not specified,
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User the default is <code class="filename">named.memstats</code>.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User<dt><span class="term"><span><strong class="command">pid-file</strong></span></span></dt>
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User The pathname of the file the server writes its process ID
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User in. If not specified, the default is
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User <code class="filename">/var/run/named/named.pid</code>.
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User The pid-file is used by programs that want to send signals to
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User name server. Specifying <span><strong class="command">pid-file none</strong></span> disables the
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User use of a PID file — no file will be written and any
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User existing one will be removed. Note that <span><strong class="command">none</strong></span>
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User is a keyword, not a filename, and therefore is not enclosed
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User double quotes.
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User<dt><span class="term"><span><strong class="command">recursing-file</strong></span></span></dt>
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User The pathname of the file the server dumps
b8cc0c5d896c361525708a2be2e5af7df76c96d7Tinderbox User the queries that are currently recursing when instructed
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User to do so with <span><strong class="command">rndc recursing</strong></span>.
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User If not specified, the default is <code class="filename">named.recursing</code>.
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User<dt><span class="term"><span><strong class="command">statistics-file</strong></span></span></dt>
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User The pathname of the file the server appends statistics
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User to when instructed to do so using <span><strong class="command">rndc stats</strong></span>.
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User If not specified, the default is <code class="filename">named.stats</code> in the
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User server's current directory. The format of the file is
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User in <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User<dt><span class="term"><span><strong class="command">port</strong></span></span></dt>
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User receiving and sending DNS protocol traffic.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User The default is 53. This option is mainly intended for server
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User a server using a port other than 53 will not be able to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews communicate with
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the global DNS.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">random-device</strong></span></span></dt>
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews The source of entropy to be used by the server. Entropy is
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews primarily needed
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews for DNSSEC operations, such as TKEY transactions and dynamic
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews update of signed
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews zones. This options specifies the device (or file) from which
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews entropy. If this is a file, operations requiring entropy will
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews fail when the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews file has been exhausted. If not specified, the default value
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews (or equivalent) when present, and none otherwise. The
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">random-device</strong></span> option takes
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews effect during
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the initial configuration load at server startup time and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews is ignored on subsequent reloads.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">preferred-glue</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If specified, the listed type (A or AAAA) will be emitted
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews before other glue
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews in the additional section of a query response.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The default is not to prefer any type (NONE).
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">root-delegation-only</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Turn on enforcement of delegation-only in TLDs (top level domains) and root zones
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews with an optional
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews exclude list.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Note some TLDs are not delegation only (e.g. "DE", "LV", "US"
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews and "MUSEUM").
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">disable-algorithms</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Disable the specified DNSSEC algorithms at and below the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews specified name.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Multiple <span><strong class="command">disable-algorithms</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews statements are allowed.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Only the most specific will be applied.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">dnssec-lookaside</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews When set, <span><strong class="command">dnssec-lookaside</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews provides the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews validator with an alternate method to validate DNSKEY records
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews top of a zone. When a DNSKEY is at or below a domain
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews specified by the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews deepest <span><strong class="command">dnssec-lookaside</strong></span>, and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the normal dnssec validation
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews has left the key untrusted, the trust-anchor will be append to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews name and a DLV record will be looked up to see if it can
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews validate the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews key. If the DLV record validates a DNSKEY (similarly to the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews record does) the DNSKEY RRset is deemed to be trusted.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">dnssec-must-be-secure</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Specify hierarchies which must be or may not be secure (signed and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If <strong class="userinput"><code>yes</code></strong>, then named will only accept
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews answers if they
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If <strong class="userinput"><code>no</code></strong>, then normal dnssec validation
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews allowing for insecure answers to be accepted.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The specified domain must be under a <span><strong class="command">trusted-key</strong></span> or
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">dnssec-lookaside</strong></span> must be
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<div class="titlepage"><div><div><h4 class="title">
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<a name="boolean_options"></a>Boolean Options</h4></div></div></div>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">auth-nxdomain</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If <strong class="userinput"><code>yes</code></strong>, then the <span><strong class="command">AA</strong></span> bit
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews is always set on NXDOMAIN responses, even if the server is
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews not actually
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews authoritative. The default is <strong class="userinput"><code>no</code></strong>;
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews a change from <acronym class="acronym">BIND</acronym> 8. If you
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews are using very old DNS software, you
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews may need to set it to <strong class="userinput"><code>yes</code></strong>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">deallocate-on-exit</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews This option was used in <acronym class="acronym">BIND</acronym>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews 8 to enable checking
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews for memory leaks on exit. <acronym class="acronym">BIND</acronym> 9 ignores the option and always performs
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">memstatistics</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Write memory statistics to the file specified by
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">memstatistics-file</strong></span> at exit.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The default is <strong class="userinput"><code>no</code></strong> unless
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews '-m record' is specified on the command line in
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews which case it is <strong class="userinput"><code>yes</code></strong>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">dialup</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If <strong class="userinput"><code>yes</code></strong>, then the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews server treats all zones as if they are doing zone transfers
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews a dial-on-demand dialup link, which can be brought up by
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews originating from this server. This has different effects
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews to zone type and concentrates the zone maintenance so that
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews happens in a short interval, once every <span><strong class="command">heartbeat-interval</strong></span> and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews hopefully during the one call. It also suppresses some of
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews zone maintenance traffic. The default is <strong class="userinput"><code>no</code></strong>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The <span><strong class="command">dialup</strong></span> option
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews may also be specified in the <span><strong class="command">view</strong></span> and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">zone</strong></span> statements,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews in which case it overrides the global <span><strong class="command">dialup</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If the zone is a master zone, then the server will send out a
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews request to all the slaves (default). This should trigger the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews number check in the slave (providing it supports NOTIFY)
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews allowing the slave
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews to verify the zone while the connection is active.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The set of servers to which NOTIFY is sent can be controlled
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">notify</strong></span> and <span><strong class="command">also-notify</strong></span>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews zone is a slave or stub zone, then the server will suppress
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User "zone up to date" (refresh) queries and only perform them
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">heartbeat-interval</strong></span> expires in
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews addition to sending
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews NOTIFY requests.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Finer control can be achieved by using
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <strong class="userinput"><code>notify</code></strong> which only sends NOTIFY
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <strong class="userinput"><code>notify-passive</code></strong> which sends NOTIFY
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews messages and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews suppresses the normal refresh queries, <strong class="userinput"><code>refresh</code></strong>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews which suppresses normal refresh processing and sends refresh
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews when the <span><strong class="command">heartbeat-interval</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews expires, and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <strong class="userinput"><code>passive</code></strong> which just disables normal
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt normal refresh
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt heart-beat refresh
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt heart-beat notify
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt <p><span><strong class="command">no</strong></span> (default)</p>
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater <p><span><strong class="command">yes</strong></span></p>
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User <p><span><strong class="command">notify</strong></span></p>
f6056ad06781c95198505ae3a361e6dd98df4b91Automatic Updater <p><span><strong class="command">refresh</strong></span></p>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <p><span><strong class="command">passive</strong></span></p>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <p><span><strong class="command">notify-passive</strong></span></p>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Note that normal NOTIFY processing is not affected by
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <span><strong class="command">dialup</strong></span>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">fake-iquery</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User In <acronym class="acronym">BIND</acronym> 8, this option
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User enabled simulating the obsolete DNS query type
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User IQUERY. <acronym class="acronym">BIND</acronym> 9 never does
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User IQUERY simulation.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">fetch-glue</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User This option is obsolete.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User In BIND 8, <strong class="userinput"><code>fetch-glue yes</code></strong>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User caused the server to attempt to fetch glue resource records
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User didn't have when constructing the additional
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User data section of a response. This is now considered a bad
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User and BIND 9 never does it.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">flush-zones-on-shutdown</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User When the nameserver exits due receiving SIGTERM,
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User flush or do not flush any pending zone writes. The default
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <span><strong class="command">flush-zones-on-shutdown</strong></span> <strong class="userinput"><code>no</code></strong>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">has-old-clients</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User This option was incorrectly implemented
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User in <acronym class="acronym">BIND</acronym> 8, and is ignored by <acronym class="acronym">BIND</acronym> 9.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User To achieve the intended effect
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <span><strong class="command">has-old-clients</strong></span> <strong class="userinput"><code>yes</code></strong>, specify
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User the two separate options <span><strong class="command">auth-nxdomain</strong></span> <strong class="userinput"><code>yes</code></strong>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User and <span><strong class="command">rfc2308-type1</strong></span> <strong class="userinput"><code>no</code></strong> instead.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">host-statistics</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User In BIND 8, this enables keeping of
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User statistics for every host that the name server interacts
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Not implemented in BIND 9.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">maintain-ixfr-base</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <span class="emphasis"><em>This option is obsolete</em></span>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User It was used in <acronym class="acronym">BIND</acronym> 8 to
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User determine whether a transaction log was
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User kept for Incremental Zone Transfer. <acronym class="acronym">BIND</acronym> 9 maintains a transaction
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User log whenever possible. If you need to disable outgoing
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User incremental zone
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User transfers, use <span><strong class="command">provide-ixfr</strong></span> <strong class="userinput"><code>no</code></strong>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">minimal-responses</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User If <strong class="userinput"><code>yes</code></strong>, then when generating
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User responses the server will only add records to the authority
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User and additional data sections when they are required (e.g.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User delegations, negative responses). This may improve the
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User performance of the server.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The default is <strong class="userinput"><code>no</code></strong>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">multiple-cnames</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User This option was used in <acronym class="acronym">BIND</acronym> 8 to allow
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User a domain name to have multiple CNAME records in violation of
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User the DNS standards. <acronym class="acronym">BIND</acronym> 9.2 onwards
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User always strictly enforces the CNAME rules both in master
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User files and dynamic updates.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">notify</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User If <strong class="userinput"><code>yes</code></strong> (the default),
933799f3641f4f78445d015008bad0038900a82aTinderbox User DNS NOTIFY messages are sent when a zone the server is
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User authoritative for
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User changes, see <a href="Bv9ARM.ch04.html#notify" title="Notify">the section called “Notify”</a>. The messages are
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User servers listed in the zone's NS records (except the master
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User server identified
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User in the SOA MNAME field), and to any servers listed in the
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User <span><strong class="command">also-notify</strong></span> option.
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User If <strong class="userinput"><code>master-only</code></strong>, notifies are only
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User for master zones.
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User If <strong class="userinput"><code>explicit</code></strong>, notifies are sent only
6a0d2961c04b20f0114cca12157cfed64c5b126fTinderbox User servers explicitly listed using <span><strong class="command">also-notify</strong></span>.
39a3b65090ccfc86b66e416c949c6a938c7f1d4aTinderbox User If <strong class="userinput"><code>no</code></strong>, no notifies are sent.
5747235bf35e7398984fd6b4632743396895ea7aTinderbox User The <span><strong class="command">notify</strong></span> option may also be
644973f327e9db74779e7c0426db90909173b284Automatic Updater specified in the <span><strong class="command">zone</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User in which case it overrides the <span><strong class="command">options notify</strong></span> statement.
3a26bfc09c833a8dc4d4c12b7cd271ed6d0843cbTinderbox User It would only be necessary to turn off this option if it
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User caused slaves
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User<dt><span class="term"><span><strong class="command">notify-to-soa</strong></span></span></dt>
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User If <strong class="userinput"><code>yes</code></strong> do not check the nameservers
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User in the NS RRset against the SOA MNAME. Normally a NOTIFY
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User message is not sent to the SOA MNAME (SOA ORIGIN) as it is
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User supposed to contain the name of the ultimate master.
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User Sometimes, however, a slave is listed as the SOA MNAME in
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User hidden master configurations and in that case you would
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User want the ultimate master to still send NOTIFY messages to
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User all the nameservers listed in the NS RRset.
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User<dt><span class="term"><span><strong class="command">recursion</strong></span></span></dt>
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User If <strong class="userinput"><code>yes</code></strong>, and a
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User DNS query requests recursion, then the server will attempt
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User all the work required to answer the query. If recursion is
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User and the server does not already know the answer, it will
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User referral response. The default is
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User <strong class="userinput"><code>yes</code></strong>.
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User Note that setting <span><strong class="command">recursion no</strong></span> does not prevent
6a3d68b02c16c3d83fed31d3d6a1d7613a71305fTinderbox User clients from getting data from the server's cache; it only
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User prevents new data from being cached as an effect of client
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews Caching may still occur as an effect the server's internal
933799f3641f4f78445d015008bad0038900a82aTinderbox User operation, such as NOTIFY address lookups.
af60449fe472b8bea5ad04bf538c777c6b151112Tinderbox User See also <span><strong class="command">fetch-glue</strong></span> above.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<dt><span class="term"><span><strong class="command">rfc2308-type1</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Setting this to <strong class="userinput"><code>yes</code></strong> will
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews cause the server to send NS records along with the SOA
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews record for negative
90863a6f9bfb06062c7fdf269bb675e7b674fc31Mark Andrews answers. The default is <strong class="userinput"><code>no</code></strong>.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Not yet implemented in <acronym class="acronym">BIND</acronym>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<dt><span class="term"><span><strong class="command">use-id-pool</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <span class="emphasis"><em>This option is obsolete</em></span>.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <acronym class="acronym">BIND</acronym> 9 always allocates query
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews IDs from a pool.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<dt><span class="term"><span><strong class="command">zone-statistics</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <strong class="userinput"><code>yes</code></strong>, the server will collect
8de3f14f1c300c3e1ed99084cc03485b42c92bf1Tinderbox User statistical data on all zones (unless specifically turned
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews on a per-zone basis by specifying <span><strong class="command">zone-statistics no</strong></span>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews in the <span><strong class="command">zone</strong></span> statement).
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User These statistics may be accessed
45eca3a5d46ed15aee14d81f6cb6c9fb6f365344Mark Andrews using <span><strong class="command">rndc stats</strong></span>, which will
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User dump them to the file listed
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User in the <span><strong class="command">statistics-file</strong></span>. See
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater also <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
45eca3a5d46ed15aee14d81f6cb6c9fb6f365344Mark Andrews<dt><span class="term"><span><strong class="command">use-ixfr</strong></span></span></dt>
6306dd073e0eba562491222821c4d3b39f440718Evan Hunt <span class="emphasis"><em>This option is obsolete</em></span>.
6306dd073e0eba562491222821c4d3b39f440718Evan Hunt If you need to disable IXFR to a particular server or
6306dd073e0eba562491222821c4d3b39f440718Evan Hunt servers, see
6306dd073e0eba562491222821c4d3b39f440718Evan Hunt the information on the <span><strong class="command">provide-ixfr</strong></span> option
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User in <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
f4193c2021ab0aeaad33fe0b3d1d49c80db5c725Mark Andrews Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Usage”</a>.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <a href="Bv9ARM.ch04.html#incremental_zone_transfers" title="Incremental Zone Transfers (IXFR)">the section called “Incremental Zone Transfers (IXFR)”</a>.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<dt><span class="term"><span><strong class="command">provide-ixfr</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews See the description of
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <span><strong class="command">provide-ixfr</strong></span> in
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
5de1cdae8a44312ca0dbb2a0fd0388fa35676a84Tinderbox User Usage”</a>.
cff0e0b52cf0928123bad6f3bccf56e22bbc07f5Automatic Updater<dt><span class="term"><span><strong class="command">request-ixfr</strong></span></span></dt>
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews See the description of
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">request-ixfr</strong></span> in
616c05f95f9a9683d73c108df2eda56bf70b77ccTinderbox User <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
c28a1243429dfaf8dc5f6c1db0dccdc6ce386baeMark Andrews Usage”</a>.
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User<dt><span class="term"><span><strong class="command">treat-cr-as-space</strong></span></span></dt>
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews This option was used in <acronym class="acronym">BIND</acronym>
5f7e0eb1cb917b788906d3e2aa01bfc4885dcae4Mark Andrews the server treat carriage return ("<span><strong class="command">\r</strong></span>") characters the same way
bf1263835e8e35421960f65088c043f42aacef13Mark Andrews as a space or tab character,
15ae68f3db8261770fc33b8e0f83f5d8c7021e84Mark Andrews to facilitate loading of zone files on a UNIX system that
ac4e70ff8955669341f435bc0a734a17c01af124Mark Andrews were generated
c5a97a549c89d562e999d4f906b882c5a2a474e1Tinderbox User on an NT or DOS machine. In <acronym class="acronym">BIND</acronym> 9, both UNIX "<span><strong class="command">\n</strong></span>"
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User and NT/DOS "<span><strong class="command">\r\n</strong></span>" newlines
c5a97a549c89d562e999d4f906b882c5a2a474e1Tinderbox User are always accepted,
9bc394fffdd50f6e47614b2d317da7274122366fTinderbox User and the option is ignored.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<span class="term"><span><strong class="command">additional-from-auth</strong></span>, </span><span class="term"><span><strong class="command">additional-from-cache</strong></span></span>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User These options control the behavior of an authoritative
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User answering queries which have additional data, or when
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater following CNAME
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater and DNAME chains.
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater When both of these options are set to <strong class="userinput"><code>yes</code></strong>
10640b2e3efc7bc8034108136d7487f7407fbf37Andreas Gustafsson (the default) and a
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews query is being answered from authoritative data (a zone
10640b2e3efc7bc8034108136d7487f7407fbf37Andreas Gustafsson configured into the server), the additional data section of
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews reply will be filled in using data from other authoritative
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews and from the cache. In some situations this is undesirable,
436aad11e01e916f75e68a2e9cb89ac217a990d3Tinderbox User as when there is concern over the correctness of the cache,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews in servers where slave zones may be added and modified by
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews untrusted third parties. Also, avoiding
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User the search for this additional data will speed up server
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User at the possible expense of additional queries to resolve
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User otherwise be provided in the additional section.
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User For example, if a query asks for an MX record for host <code class="literal">foo.example.com</code>,
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User and the record found is "<code class="literal">MX 10 mail.example.net</code>", normally the address
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater records (A and AAAA) for <code class="literal">mail.example.net</code> will be provided as well,
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews if known, even though they are not in the example.com zone.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Setting these options to <span><strong class="command">no</strong></span>
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User disables this behavior and makes
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User the server only search for additional data in the zone it
bac4435d473c9a0281507524f084480c34aa942aTinderbox User answers from.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User These options are intended for use in authoritative-only
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews servers, or in authoritative-only views. Attempts to set
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews them to <span><strong class="command">no</strong></span> without also
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span><strong class="command">recursion no</strong></span> will cause the
e10d61d84e0b735f1e8eca18644cfdb1b06cad33Tinderbox User ignore the options and log a warning message.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Specifying <span><strong class="command">additional-from-cache no</strong></span> actually
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User disables the use of the cache not only for additional data
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews but also when looking up the answer. This is usually the
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User behavior in an authoritative-only server where the
ee9c470ca0902ed8fb913eb714a928878b1f0099Tinderbox User correctness of
90cde4c188ac5bdea4f402b241c387c9cc9d4cc4Tinderbox User the cached data is an issue.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User When a name server is non-recursively queried for a name
4c9f230f7ca5b2b08ea8fd7a6944135801dbe152Tinderbox User below the apex of any served zone, it normally answers with
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User "upwards referral" to the root servers or the servers of
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews known parent of the query name. Since the data in an
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater upwards referral
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater comes from the cache, the server will not be able to provide
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews referrals when <span><strong class="command">additional-from-cache no</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater has been specified. Instead, it will respond to such
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User with REFUSED. This should not cause any problems since
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater upwards referrals are not required for the resolution
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews<dt><span class="term"><span><strong class="command">match-mapped-addresses</strong></span></span></dt>
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews If <strong class="userinput"><code>yes</code></strong>, then an
dc5552b4df5e3821783821c8d4e734c1608c446eTinderbox User IPv4-mapped IPv6 address will match any address match
e23761df2059ed612c8fb7cc248d93bb2c4f62dbTinderbox User list entries that match the corresponding IPv4 address.
ad1d4c904f8e8dcb4db68ae1ac2f83ac53ea380dTinderbox User Enabling this option is sometimes useful on IPv6-enabled
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User systems, to work around a kernel quirk that causes IPv4
02b3e44a996e9753d86306b6a1b6b579a73787fcTinderbox User TCP connections such as zone transfers to be accepted
2c1632c71e2f4d8afa35efce3080b31602a6608cTinderbox User on an IPv6 socket using mapped addresses, causing
616c05f95f9a9683d73c108df2eda56bf70b77ccTinderbox User address match lists designed for IPv4 to fail to match.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The use of this option for any other purpose is discouraged.
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater When <strong class="userinput"><code>yes</code></strong> and the server loads a new version of a master
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater zone from its zone file or receives a new version of a slave
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User file by a non-incremental zone transfer, it will compare
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User the new version to the previous one and calculate a set
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater of differences. The differences are then logged in the
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User zone's journal file such that the changes can be transmitted
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater to downstream slaves as an incremental zone transfer.
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User By allowing incremental zone transfers to be used for
cd34c1adb0fa2120327fc8c11cda0d4a5f722aeeTinderbox User non-dynamic zones, this option saves bandwidth at the
e20309353e6246485c521278131d3fced73d7957Tinderbox User expense of increased CPU and memory consumption at the
c74518d655c1c563060f49569dce71e4a00f5f4eTinderbox User In particular, if the new version of a zone is completely
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User different from the previous one, the set of differences
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater will be of a size comparable to the combined size of the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater old and new zone version, and the server will need to
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews temporarily allocate memory to hold this complete
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater difference set.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<p><span><strong class="command">ixfr-from-differences</strong></span>
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater also accepts <span><strong class="command">master</strong></span> and
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews <span><strong class="command">slave</strong></span> at the view and options
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater levels which causes
ca904804e43f663f08eb1ac9d6d617930b9a3cd3Automatic Updater <span><strong class="command">ixfr-from-differences</strong></span> to be enabled for
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User all <span><strong class="command">master</strong></span> or
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">slave</strong></span> zones respectively.
713a5e3080f112b3efde9235e9c92035056ff966Automatic Updater It is off by default.
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User<dt><span class="term"><span><strong class="command">multi-master</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This should be set when you have multiple masters for a zone
f8b9948a4116226ac41b5509cca152849006c66cAutomatic Updater addresses refer to different machines. If <strong class="userinput"><code>yes</code></strong>, named will
be46cb4bee9253ee4832340c719920642e00c41aTinderbox User when the serial number on the master is less than what named
c243d779731a410f8dc2d2feeed20c15f299b6e3Automatic Updater has. The default is <strong class="userinput"><code>no</code></strong>.
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater<dt><span class="term"><span><strong class="command">dnssec-enable</strong></span></span></dt>
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews Enable DNSSEC support in named. Unless set to <strong class="userinput"><code>yes</code></strong>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater named behaves as if it does not support DNSSEC.
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater The default is <strong class="userinput"><code>yes</code></strong>.
572cb2c1c931f6bc6a4a019c103ae88239b0eb96Automatic Updater<dt><span class="term"><span><strong class="command">dnssec-validation</strong></span></span></dt>
3e5340279d8875d136a4dd815cccad0044aa2644Automatic Updater Enable DNSSEC validation in named.
c2abd6efeb9affa70aabb63da2acb23e135cf7f2Mark Andrews Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
b7fcdb0bee7680fe9536bec3b204aea094bc514eTinderbox User set to <strong class="userinput"><code>yes</code></strong> to be effective.
f22980c16f244b7d7f33b5248f2d38bd4885f108Automatic Updater The default is <strong class="userinput"><code>yes</code></strong>.
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews<dt><span class="term"><span><strong class="command">dnssec-accept-expired</strong></span></span></dt>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews Accept expired signatures when verifying DNSSEC signatures.
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews The default is <strong class="userinput"><code>no</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Setting this option to "yes" leaves named vulnerable to replay attacks.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">querylog</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Specify whether query logging should be started when named
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User If <span><strong class="command">querylog</strong></span> is not specified,
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews then the query logging
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User is determined by the presence of the logging category <span><strong class="command">queries</strong></span>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">check-names</strong></span></span></dt>
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User This option is used to restrict the character set and syntax
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews certain domain names in master files and/or DNS responses
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User from the network. The default varies according to usage
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>.
b577ce9ed2153db6539fb975b4a7aa16d9b3baeeTinderbox User For <span><strong class="command">slave</strong></span> zones the default
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User is <span><strong class="command">warn</strong></span>.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User For answers received from the network (<span><strong class="command">response</strong></span>)
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User the default is <span><strong class="command">ignore</strong></span>.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The rules for legal hostnames and mail domains are derived
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User from RFC 952 and RFC 821 as modified by RFC 1123.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<p><span><strong class="command">check-names</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater applies to the owner names of A, AAAA and MX records.
90b25b84f037ec923efaee84d2c0dc599293d04eTinderbox User It also applies to the domain names in the RDATA of NS, SOA
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews and MX records.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews It also applies to the RDATA of PTR records where the owner
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews name indicated that it is a reverse lookup of a hostname
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT).
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">check-mx</strong></span></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User Check whether the MX record appears to refer to a IP address.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User The default is to <span><strong class="command">warn</strong></span>. Other possible
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User values are <span><strong class="command">fail</strong></span> and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">ignore</strong></span>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">check-wildcard</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User This option is used to check for non-terminal wildcards.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The use of non-terminal wildcards is almost always as a
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User result of a failure
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to understand the wildcard matching algorithm (RFC 1034).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater affects master zones. The default (<span><strong class="command">yes</strong></span>) is to check
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User for non-terminal wildcards and issue a warning.
00ce5d1add91ba5664de4da3cda8c3a5017ba6a7Tinderbox User<dt><span class="term"><span><strong class="command">check-integrity</strong></span></span></dt>
00ce5d1add91ba5664de4da3cda8c3a5017ba6a7Tinderbox User Perform post load zone integrity checks on master
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User zones. This checks that MX and SRV records refer
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User to address (A or AAAA) records and that glue
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater address records exist for delegated zones. For
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater MX and SRV records only in-zone hostnames are
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater checked (for out-of-zone hostnames use
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span><strong class="command">named-checkzone</strong></span>).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater For NS records only names below top of zone are
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater checked (for out-of-zone names and glue consistency
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater checks use <span><strong class="command">named-checkzone</strong></span>).
f89eb76a7516649f8717c6397fc496ca906ddb57Tinderbox User The default is <span><strong class="command">yes</strong></span>.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<dt><span class="term"><span><strong class="command">check-mx-cname</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User If <span><strong class="command">check-integrity</strong></span> is set then
a61158fed2e0281a40e3e97e0b7c3f9789a07b4eTinderbox User fail, warn or ignore MX records that refer
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User to CNAMES. The default is to <span><strong class="command">warn</strong></span>.
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User<dt><span class="term"><span><strong class="command">check-srv-cname</strong></span></span></dt>
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User If <span><strong class="command">check-integrity</strong></span> is set then
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater fail, warn or ignore SRV records that refer
a48cf7debd16396cd764139772b0226eec05347fTinderbox User to CNAMES. The default is to <span><strong class="command">warn</strong></span>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">check-sibling</strong></span></span></dt>
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User When performing integrity checks, also check that
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater sibling glue exists. The default is <span><strong class="command">yes</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">zero-no-soa-ttl</strong></span></span></dt>
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater When returning authoritative negative responses to
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User SOA queries set the TTL of the SOA record returned in
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews the authority section to zero.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User The default is <span><strong class="command">yes</strong></span>.
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater<dt><span class="term"><span><strong class="command">zero-no-soa-ttl-cache</strong></span></span></dt>
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews When caching a negative response to a SOA query
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews set the TTL to zero.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater The default is <span><strong class="command">no</strong></span>.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater<dt><span class="term"><span><strong class="command">update-check-ksk</strong></span></span></dt>
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater When regenerating the RRSIGs following a UPDATE
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater request to a secure zone, check the KSK flag on
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater the DNSKEY RR to determine if this key should be
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater used to generate the RRSIG. This flag is ignored
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater if there are not DNSKEY RRs both with and without
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater The default is <span><strong class="command">yes</strong></span>.
c762a0e4141c8eb9d7567c614cf6dde994f6a76dTinderbox User<dt><span class="term"><span><strong class="command">try-tcp-refresh</strong></span></span></dt>
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User Try to refresh the zone using TCP if UDP queries fail.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User For BIND 8 compatibility, the default is
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">yes</strong></span>.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<div class="titlepage"><div><div><h4 class="title">
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater<a name="id2581870"></a>Forwarding</h4></div></div></div>
3f616e6f846be57b1717c6beaba0f74de9d5a7c6Automatic Updater The forwarding facility can be used to create a large site-wide
1b670d35282f1b9352692ad212be3c0aa97b0689Automatic Updater cache on a few servers, reducing traffic over links to external
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User name servers. It can also be used to allow queries by servers that
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater do not have direct access to the Internet, but wish to look up
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater names anyway. Forwarding occurs only on those queries for which
316cd2460aa66e157f72890974ca5c21d65e70e6Tinderbox User the server is not authoritative and does not have the answer in
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater<dt><span class="term"><span><strong class="command">forward</strong></span></span></dt>
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater This option is only meaningful if the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater forwarders list is not empty. A value of <code class="varname">first</code>,
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater the default, causes the server to query the forwarders
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater first — and
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User if that doesn't answer the question, the server will then
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User the answer itself. If <code class="varname">only</code> is
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater specified, the
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User server will only query the forwarders.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">forwarders</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Specifies the IP addresses to be used
6ee455a915d0e5cab50865da23152efe59ea1decTinderbox User for forwarding. The default is the empty list (no
79b627f399ce925988bb326315e6742d5316cb6bTinderbox User Forwarding can also be configured on a per-domain basis, allowing
79b627f399ce925988bb326315e6742d5316cb6bTinderbox User for the global forwarding options to be overridden in a variety
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User of ways. You can set particular domains to use different
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater or have a different <span><strong class="command">forward only/first</strong></span> behavior,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater or not forward at all, see <a href="Bv9ARM.ch06.html#zone_statement_grammar" title="zone
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User Statement Grammar">the section called “<span><strong class="command">zone</strong></span>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Statement Grammar”</a>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h4 class="title">
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<a name="id2581929"></a>Dual-stack Servers</h4></div></div></div>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Dual-stack servers are used as servers of last resort to work
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User problems in reachability due the lack of support for either IPv4
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User on the host machine.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">dual-stack-servers</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Specifies host names or addresses of machines with access to
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater both IPv4 and IPv6 transports. If a hostname is used, the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater server must be able
324a8797b46d646fe8d3b2eef6785e0b2b3ac956Tinderbox User to resolve the name using only the transport it has. If the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater machine is dual
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater stacked, then the <span><strong class="command">dual-stack-servers</strong></span> have no effect unless
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater access to a transport has been disabled on the command line
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater (e.g. <span><strong class="command">named -4</strong></span>).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h4 class="title">
b577ce9ed2153db6539fb975b4a7aa16d9b3baeeTinderbox User<a name="access_control"></a>Access Control</h4></div></div></div>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User Access to the server can be restricted based on the IP address
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater of the requesting system. See <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a> for
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User details on how to specify IP address lists.
a98018050a8dfb234c22664f673e50bc3066aa9eTinderbox User<dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Specifies which hosts are allowed to
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User notify this server, a slave, of zone changes in addition
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User to the zone masters.
b577ce9ed2153db6539fb975b4a7aa16d9b3baeeTinderbox User <span><strong class="command">allow-notify</strong></span> may also be
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User specified in the
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater <span><strong class="command">zone</strong></span> statement, in which case
0d3490f93bb980fde704055e74c1b508987a5fe4Mark Andrews it overrides the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">options allow-notify</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater statement. It is only meaningful
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User for a slave zone. If not specified, the default is to
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User process notify messages
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User only from a zone's master.
114f7780384371121918624ae2c80ecfce545683Tinderbox User<dt><span class="term"><span><strong class="command">allow-query</strong></span></span></dt>
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews Specifies which hosts are allowed to ask ordinary
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews DNS questions. <span><strong class="command">allow-query</strong></span> may
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User also be specified in the <span><strong class="command">zone</strong></span>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User statement, in which case it overrides the
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span><strong class="command">options allow-query</strong></span> statement.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User If not specified, the default is to allow queries
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews from all hosts.
757ff043760e4743dda1a10e7d58349275934902Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User <span><strong class="command">allow-query-cache</strong></span> is now
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User used to specify access to the cache.
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt<dt><span class="term"><span><strong class="command">allow-query-on</strong></span></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User Specifies which local addresses can accept ordinary
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User DNS questions. This makes it possible, for instance,
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews to allow queries on internal-facing interfaces but
19ad308d84cbf446a144e5a91f2032389a9d65c1Tinderbox User disallow them on external-facing ones, without
114f7780384371121918624ae2c80ecfce545683Tinderbox User necessarily knowing the internal network's addresses.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span><strong class="command">allow-query-on</strong></span> may
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User also be specified in the <span><strong class="command">zone</strong></span>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User statement, in which case it overrides the
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span><strong class="command">options allow-query-on</strong></span> statement.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater If not specified, the default is to allow queries
71fc4775d04aea66809e3eb5b5159c55413bdc5cMark Andrews on all addresses.
71fc4775d04aea66809e3eb5b5159c55413bdc5cMark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews <span><strong class="command">allow-query-cache</strong></span> is
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater used to specify access to the cache.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater<dt><span class="term"><span><strong class="command">allow-query-cache</strong></span></span></dt>
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater Specifies which hosts are allowed to get answers
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater from the cache. If <span><strong class="command">allow-query-cache</strong></span>
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater is not set then <span><strong class="command">allow-recursion</strong></span>
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater is used if set, otherwise <span><strong class="command">allow-query</strong></span>
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater is used if set, otherwise the default
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater (<span><strong class="command">localnets;</strong></span>
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater <span><strong class="command">localhost;</strong></span>) is used.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">allow-query-cache-on</strong></span></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User Specifies which local addresses can give answers
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User from the cache. If not specified, the default is
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User to allow cache queries on any address,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">localnets</strong></span> and
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User <span><strong class="command">localhost</strong></span>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">allow-recursion</strong></span></span></dt>
b7fcdb0bee7680fe9536bec3b204aea094bc514eTinderbox User Specifies which hosts are allowed to make recursive
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User queries through this server. If
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews <span><strong class="command">allow-recursion</strong></span> is not set
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User then <span><strong class="command">allow-query-cache</strong></span> is
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater used if set, otherwise <span><strong class="command">allow-query</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews is used if set, otherwise the default
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson (<span><strong class="command">localnets;</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">localhost;</strong></span>) is used.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">allow-recursion-on</strong></span></span></dt>
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User Specifies which local addresses can accept recursive
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews queries. If not specified, the default is to allow
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson recursive queries on all addresses.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<dt><span class="term"><span><strong class="command">allow-update</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Specifies which hosts are allowed to
8bc3d252395842452a6d2c775cf8445f6349e331Tinderbox User submit Dynamic DNS updates for master zones. The default is
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User updates from all hosts. Note that allowing updates based
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater on the requestor's IP address is insecure; see
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a> for details.
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User Specifies which hosts are allowed to
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User submit Dynamic DNS updates to slave zones to be forwarded to
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User master. The default is <strong class="userinput"><code>{ none; }</code></strong>,
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater means that no update forwarding will be performed. To
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater update forwarding, specify
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater <strong class="userinput"><code>allow-update-forwarding { any; };</code></strong>.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Specifying values other than <strong class="userinput"><code>{ none; }</code></strong> or
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater <strong class="userinput"><code>{ any; }</code></strong> is usually
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater counterproductive, since
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User the responsibility for update access control should rest
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt master server, not the slaves.
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User Note that enabling the update forwarding feature on a slave
a8677ecad546c955406b341eb8344ed06768b11eTinderbox User may expose master servers relying on insecure IP address
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt access control to attacks; see <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a>
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt for more details.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt<dt><span class="term"><span><strong class="command">allow-v6-synthesis</strong></span></span></dt>
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt This option was introduced for the smooth transition from
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User to A6 and from "nibble labels" to binary labels.
1fdd58445074579ee3b65c871137a7a1740eb542Mark Andrews However, since both A6 and binary labels were then
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews this option was also deprecated.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User It is now ignored with some warning messages.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">allow-transfer</strong></span></span></dt>
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User Specifies which hosts are allowed to
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User receive zone transfers from the server. <span><strong class="command">allow-transfer</strong></span> may
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater also be specified in the <span><strong class="command">zone</strong></span>
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater statement, in which
757ff043760e4743dda1a10e7d58349275934902Tinderbox User case it overrides the <span><strong class="command">options allow-transfer</strong></span> statement.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User If not specified, the default is to allow transfers to all
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User<dt><span class="term"><span><strong class="command">blackhole</strong></span></span></dt>
7711228a135a2fe85765ba13a67b8e397ed73489Mark Andrews Specifies a list of addresses that the
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User server will not accept queries from or use to resolve a
9692d283bb43c9eab49a7fadfc1b74a6e20e6151Tinderbox User query. Queries
b5423cbff7175727ed9046c8c670d8a7bb4d01eaTinderbox User from these addresses will not be responded to. The default
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews is <strong class="userinput"><code>none</code></strong>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<div class="titlepage"><div><div><h4 class="title">
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<a name="id2582357"></a>Interfaces</h4></div></div></div>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User The interfaces and ports that the server will answer queries
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User an optional port, and an <code class="varname">address_match_list</code>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The server will listen on all interfaces allowed by the address
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User match list. If a port is not specified, port 53 will be used.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Multiple <span><strong class="command">listen-on</strong></span> statements are
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater<pre class="programlisting">listen-on { 5.6.7.8; };
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater will enable the name server on port 53 for the IP address
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User 5.6.7.8, and on port 1234 of an address on the machine in net
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater 1.2 that is not 1.2.3.4.
b5423cbff7175727ed9046c8c670d8a7bb4d01eaTinderbox User If no <span><strong class="command">listen-on</strong></span> is specified, the
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater server will listen on port 53 on all IPv4 interfaces.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">listen-on-v6</strong></span> option is used to
fae2925c4d1b45056302be96e5e334f3ad5809c5Tinderbox User specify the interfaces and the ports on which the server will
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater for incoming queries sent using IPv6.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater as the <code class="varname">address_match_list</code> for the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">listen-on-v6</strong></span> option,
0accdb26ead1fe520a9820b52efbea64bdf564e3Tinderbox User the server does not bind a separate socket to each IPv6 interface
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User address as it does for IPv4 if the operating system has enough API
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater support for IPv6 (specifically if it conforms to RFC 3493 and RFC
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Instead, it listens on the IPv6 wildcard address.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater If the system only has incomplete API support for IPv6, however,
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User the behavior is the same as that for IPv4.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews A list of particular IPv6 addresses can also be specified, in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the server listens on a separate socket for each specified
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater regardless of whether the desired API is supported by the system.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Multiple <span><strong class="command">listen-on-v6</strong></span> options can
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User<pre class="programlisting">listen-on-v6 { any; };
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updaterlisten-on-v6 port 1234 { !2001:db8::/32; any; };
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater will enable the name server on port 53 for any IPv6 addresses
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User (with a single wildcard socket),
1fff4d36fb18ccdca15acb0bae20c2aa8e833ceeTinderbox User and on port 1234 of IPv6 addresses that is not in the prefix
11b6b0d74bb8dd6bd1ce0b60ba7f9b66323f06d4Tinderbox User 2001:db8::/32 (with separate sockets for each matched address.)
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews To make the server not listen on any IPv6 address, use
64f2afc2c63a59461d11b581a208efdbeec124adTinderbox User<pre class="programlisting">listen-on-v6 { none; };
d3ba57ed92b7095fdeabc444af5dd18ac4781064Tinderbox User If no <span><strong class="command">listen-on-v6</strong></span> option is
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater specified, the server will not listen on any IPv6 address
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews unless <span><strong class="command">-6</strong></span> is specified when named is
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews invoked. If <span><strong class="command">-6</strong></span> is specified then
6c910bd5e4a85a56e3a61fdf7b237a45bb2553eeTinderbox User named will listen on port 53 on all IPv6 interfaces by default.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h4 class="title">
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews<a name="query_address"></a>Query Address</h4></div></div></div>
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User If the server doesn't know the answer to a question, it will
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User query other name servers. <span><strong class="command">query-source</strong></span> specifies
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User the address and port used for such queries. For queries sent over
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews IPv6, there is a separate <span><strong class="command">query-source-v6</strong></span> option.
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews If <span><strong class="command">address</strong></span> is <span><strong class="command">*</strong></span> (asterisk) or is omitted,
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User a wildcard IP address (<span><strong class="command">INADDR_ANY</strong></span>)
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt If <span><strong class="command">port</strong></span> is <span><strong class="command">*</strong></span> or is omitted,
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt a random port number from a pre-configured
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt range is picked up and will be used for each query.
a8677ecad546c955406b341eb8344ed06768b11eTinderbox User The port range(s) is that specified in
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt the <span><strong class="command">use-v4-udp-ports</strong></span> (for IPv4)
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt and <span><strong class="command">use-v6-udp-ports</strong></span> (for IPv6)
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt options, excluding the ranges specified in
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt the <span><strong class="command">avoid-v4-udp-ports</strong></span>
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User and <span><strong class="command">avoid-v6-udp-ports</strong></span> options, respectively.
2bb3422dc683c013db7042f5736240de6b86f182Automatic Updater The defaults of the <span><strong class="command">query-source</strong></span> and
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">query-source-v6</strong></span> options
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<pre class="programlisting">query-source address * port *;
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox Userquery-source-v6 address * port *;
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User If <span><strong class="command">use-v4-udp-ports</strong></span> or
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">use-v6-udp-ports</strong></span> is unspecified,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">named</strong></span> will check if the operating
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User system provides a programming interface to retrieve the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User system's default range for ephemeral ports.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If such an interface is available,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">named</strong></span> will use the corresponding system
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater default range; otherwise, it will use its own defaults:
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<pre class="programlisting">use-v4-udp-ports { range 1024 65535; };
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox Useruse-v6-udp-ports { range 1024 65535; };
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Note: make sure the ranges be sufficiently large for
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User security. A desirable size depends on various parameters,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User but we generally recommend it contain at least 16384 ports
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater (14 bits of entropy).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Note also that the system's default range when used may be
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater too small for this purpose, and that the range may even be
4cde88fbf4c5e78a785d40f364cdcf60f3575f0cTinderbox User changed while <span><strong class="command">named</strong></span> is running; the new
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater range will automatically be applied when <span><strong class="command">named</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater It is encouraged to
1ac49378a458420bc685293d12e567d7222d17b6Tinderbox User configure <span><strong class="command">use-v4-udp-ports</strong></span> and
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt <span><strong class="command">use-v6-udp-ports</strong></span> explicitly so that the
a8677ecad546c955406b341eb8344ed06768b11eTinderbox User ranges are sufficiently large and are reasonably
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User independent from the ranges used by other applications.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Note: the operational configuration
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User where <span><strong class="command">named</strong></span> runs may prohibit the use
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User of some ports. For example, UNIX systems will not allow
904890e38b74005395451501400718d759bfc064Tinderbox User <span><strong class="command">named</strong></span> running without a root privilege
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User to use ports less than 1024.
b3386fba31414344f38f0c30849c056dceb22dceTinderbox User If such ports are included in the specified (or detected)
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User set of query ports, the corresponding query attempts will
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User fail, resulting in resolution failures or delay.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater It is therefore important to configure the set of ports
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that can be safely used in the expected operational environment.
572048aa7bf7b449d60dfb2dbebf861454626f96Tinderbox User The defaults of the <span><strong class="command">avoid-v4-udp-ports</strong></span> and
83e281baf1b4149dc637d24dd41141129ae712c6Tinderbox User <span><strong class="command">avoid-v6-udp-ports</strong></span> options
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User<pre class="programlisting">avoid-v4-udp-ports {};
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox Useravoid-v6-udp-ports {};
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Note: BIND 9.5.0 introduced
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User the <span><strong class="command">use-queryport-pool</strong></span>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User option to support a pool of such random ports, but this
d3ba57ed92b7095fdeabc444af5dd18ac4781064Tinderbox User option is now obsolete because reusing the same ports in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the pool may not be sufficiently secure.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User For the same reason, it is generally strongly discouraged to
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User specify a particular port for the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">query-source</strong></span> or
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User <span><strong class="command">query-source-v6</strong></span> options;
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User it implicitly disables the use of randomized port numbers.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews<dt><span class="term"><span><strong class="command">use-queryport-pool</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User This option is obsolete.
ca5ba35827e475a824ec79d489dbcdb3341a35ccTinderbox User<dt><span class="term"><span><strong class="command">queryport-pool-ports</strong></span></span></dt>
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews This option is obsolete.
1fdd58445074579ee3b65c871137a7a1740eb542Mark Andrews<dt><span class="term"><span><strong class="command">queryport-pool-updateinterval</strong></span></span></dt>
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews This option is obsolete.
5ee9f7f23852d92772c08ca6e4b46c549beaf660Mark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User The address specified in the <span><strong class="command">query-source</strong></span> option
b6e12209e3e7df826f5f8f949ad400ec6d1f6371Tinderbox User is used for both UDP and TCP queries, but the port applies only
e08cdffb3ae4ad409f37e3e5a218fe4b7e0e3904Tinderbox User to UDP queries. TCP queries always use a random
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User unprivileged port.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews Solaris 2.5.1 and earlier does not support setting the source
d3ba57ed92b7095fdeabc444af5dd18ac4781064Tinderbox User address for TCP sockets.
049728912c39135db248f9b48f8f26675f456e9dTinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
5ee9f7f23852d92772c08ca6e4b46c549beaf660Mark Andrews See also <span><strong class="command">transfer-source</strong></span> and
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User <span><strong class="command">notify-source</strong></span>.
af60449fe472b8bea5ad04bf538c777c6b151112Tinderbox User<div class="titlepage"><div><div><h4 class="title">
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<a name="zone_transfers"></a>Zone Transfers</h4></div></div></div>
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox User <acronym class="acronym">BIND</acronym> has mechanisms in place to
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User facilitate zone transfers
4f538e852f20912e629338e911e46ce26de3e965Tinderbox User and set limits on the amount of load that transfers place on the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater system. The following options apply to zone transfers.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">also-notify</strong></span></span></dt>
c288e47fb7d4baa1ed887156b1c5e5db394d4f52Tinderbox User Defines a global list of IP addresses of name servers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that are also sent NOTIFY messages whenever a fresh copy of
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater zone is loaded, in addition to the servers listed in the
fae2925c4d1b45056302be96e5e334f3ad5809c5Tinderbox User zone's NS records.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This helps to ensure that copies of the zones will
90ff38a0d8deaf5f9c2aa5916d99b2e572d28738Automatic Updater quickly converge on stealth servers. If an <span><strong class="command">also-notify</strong></span> list
c288e47fb7d4baa1ed887156b1c5e5db394d4f52Tinderbox User is given in a <span><strong class="command">zone</strong></span> statement,
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User it will override
90ff38a0d8deaf5f9c2aa5916d99b2e572d28738Automatic Updater the <span><strong class="command">options also-notify</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater statement. When a <span><strong class="command">zone notify</strong></span>
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt is set to <span><strong class="command">no</strong></span>, the IP
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt addresses in the global <span><strong class="command">also-notify</strong></span> list will
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User not be sent NOTIFY messages for that zone. The default is
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater list (no global notification list).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
ce0fd07045292942bfa3e755d9ce596941528a63Automatic Updater Inbound zone transfers running longer than
bac4435d473c9a0281507524f084480c34aa942aTinderbox User this many minutes will be terminated. The default is 120
6ee455a915d0e5cab50865da23152efe59ea1decTinderbox User (2 hours). The maximum value is 28 days (40320 minutes).
96713299d08c0735c18ebe8772dd2cc1ecd4356aAutomatic Updater<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User Inbound zone transfers making no progress
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in this many minutes will be terminated. The default is 60
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User (1 hour). The maximum value is 28 days (40320 minutes).
c6517a807173827b8f638d31303805ee4c1d8054Automatic Updater<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews Outbound zone transfers running longer than
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox User this many minutes will be terminated. The default is 120
4f538e852f20912e629338e911e46ce26de3e965Tinderbox User (2 hours). The maximum value is 28 days (40320 minutes).
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Outbound zone transfers making no progress
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in this many minutes will be terminated. The default is 60
c6517a807173827b8f638d31303805ee4c1d8054Automatic Updater hour). The maximum value is 28 days (40320 minutes).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">serial-query-rate</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Slave servers will periodically query master servers
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater to find out if zone serial numbers have changed. Each such
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater a minute amount of the slave server's network bandwidth. To
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater amount of bandwidth used, BIND 9 limits the rate at which
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater sent. The value of the <span><strong class="command">serial-query-rate</strong></span> option,
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews an integer, is the maximum number of queries sent per
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User The default is 20.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">serial-queries</strong></span></span></dt>
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User In BIND 8, the <span><strong class="command">serial-queries</strong></span>
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt set the maximum number of concurrent serial number queries
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt allowed to be outstanding at any given time.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User BIND 9 does not limit the number of outstanding
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater serial queries and ignores the <span><strong class="command">serial-queries</strong></span> option.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Instead, it limits the rate at which the queries are sent
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater as defined using the <span><strong class="command">serial-query-rate</strong></span> option.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<dt><span class="term"><span><strong class="command">transfer-format</strong></span></span></dt>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Zone transfers can be sent using two different formats,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span><strong class="command">one-answer</strong></span> and
d97783f18169fc9c5220a0b91fe53653efcd6b10Tinderbox User <span><strong class="command">many-answers</strong></span>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The <span><strong class="command">transfer-format</strong></span> option is used
757ff043760e4743dda1a10e7d58349275934902Tinderbox User on the master server to determine which format it sends.
cd6e9010079a4e58f7e30063df3dec0ff154ad59Tinderbox User <span><strong class="command">one-answer</strong></span> uses one DNS message per
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews resource record transferred.
757ff043760e4743dda1a10e7d58349275934902Tinderbox User <span><strong class="command">many-answers</strong></span> packs as many resource
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater records as possible into a message.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <span><strong class="command">many-answers</strong></span> is more efficient, but is
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt only supported by relatively new slave servers,
e705db6d5d886dc14f4a75a2046a075c0750e7eeAutomatic Updater such as <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
bac4435d473c9a0281507524f084480c34aa942aTinderbox User 8.x and <acronym class="acronym">BIND</acronym> 4.9.5 onwards.
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox User The <span><strong class="command">many-answers</strong></span> format is also supported by
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews recent Microsoft Windows nameservers.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <span><strong class="command">many-answers</strong></span>.
757ff043760e4743dda1a10e7d58349275934902Tinderbox User <span><strong class="command">transfer-format</strong></span> may be overridden on a
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater per-server basis by using the <span><strong class="command">server</strong></span>
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<dt><span class="term"><span><strong class="command">transfers-in</strong></span></span></dt>
bac4435d473c9a0281507524f084480c34aa942aTinderbox User The maximum number of inbound zone transfers
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User that can be running concurrently. The default value is <code class="literal">10</code>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Increasing <span><strong class="command">transfers-in</strong></span> may
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User speed up the convergence
40696c4c389a780082fb77840c173b201ce696d6Automatic Updater of slave zones, but it also may increase the load on the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User local system.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">transfers-out</strong></span></span></dt>
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews The maximum number of outbound zone transfers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that can be running concurrently. Zone transfer requests in
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews of the limit will be refused. The default value is <code class="literal">10</code>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">transfers-per-ns</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The maximum number of inbound zone transfers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that can be concurrently transferring from a given remote
b779e1efb14f9616a35befd2b1cfc2578f1a4d70Tinderbox User The default value is <code class="literal">2</code>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Increasing <span><strong class="command">transfers-per-ns</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater speed up the convergence of slave zones, but it also may
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the load on the remote name server. <span><strong class="command">transfers-per-ns</strong></span> may
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater be overridden on a per-server basis by using the <span><strong class="command">transfers</strong></span> phrase
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater of the <span><strong class="command">server</strong></span> statement.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">transfer-source</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<p><span><strong class="command">transfer-source</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater determines which local address will be bound to IPv4
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User TCP connections used to fetch zones transferred
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater inbound by the server. It also determines the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater source IPv4 address, and optionally the UDP port,
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater used for the refresh queries and forwarded dynamic
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson updates. If not set, it defaults to a system
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews controlled value which will usually be the address
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson of the interface "closest to" the remote end. This
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews address must appear in the remote end's
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">allow-transfer</strong></span> option for the
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews zone being transferred, if one is specified. This
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews statement sets the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">transfer-source</strong></span> for all zones,
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews but can be overridden on a per-view or per-zone
e213b38b48486b3a6349329655d9169085001fa0Tinderbox User basis by including a
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User <span><strong class="command">transfer-source</strong></span> statement within
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater the <span><strong class="command">view</strong></span> or
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">zone</strong></span> block in the configuration
933799f3641f4f78445d015008bad0038900a82aTinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater Solaris 2.5.1 and earlier does not support setting the
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews source address for TCP sockets.
933799f3641f4f78445d015008bad0038900a82aTinderbox User<dt><span class="term"><span><strong class="command">transfer-source-v6</strong></span></span></dt>
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater The same as <span><strong class="command">transfer-source</strong></span>,
933799f3641f4f78445d015008bad0038900a82aTinderbox User except zone transfers are performed using IPv6.
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews An alternate transfer source if the one listed in
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">transfer-source</strong></span> fails and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">use-alt-transfer-source</strong></span> is
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews If you do not wish the alternate transfer source
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User to be used, you should set
a900e4f99ff134b567b6df5ac2c841c7d0c551d3Automatic Updater <span><strong class="command">use-alt-transfer-source</strong></span>
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User appropriately and you should not depend upon
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User getting a answer back to the first refresh
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User An alternate transfer source if the one listed in
c288e47fb7d4baa1ed887156b1c5e5db394d4f52Tinderbox User <span><strong class="command">transfer-source-v6</strong></span> fails and
a900e4f99ff134b567b6df5ac2c841c7d0c551d3Automatic Updater <span><strong class="command">use-alt-transfer-source</strong></span> is
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Use the alternate transfer sources or not. If views are
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater specified this defaults to <span><strong class="command">no</strong></span>
4fda24d843edac463c98785ec0c850d912592dc1Tinderbox User otherwise it defaults to
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User <span><strong class="command">yes</strong></span> (for BIND 8
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews compatibility).
550d89df4dd30f214eedd18f399e280fd1b15953Evan Hunt<dt><span class="term"><span><strong class="command">notify-source</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<p><span><strong class="command">notify-source</strong></span>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User determines which local source address, and
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User optionally UDP port, will be used to send NOTIFY
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User messages. This address must appear in the slave
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater server's <span><strong class="command">masters</strong></span> zone clause or
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User in an <span><strong class="command">allow-notify</strong></span> clause. This
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater statement sets the <span><strong class="command">notify-source</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews for all zones, but can be overridden on a per-zone or
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews per-view basis by including a
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">notify-source</strong></span> statement within
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the <span><strong class="command">zone</strong></span> or
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">view</strong></span> block in the configuration
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User Solaris 2.5.1 and earlier does not support setting the
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews source address for TCP sockets.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><span><strong class="command">notify-source-v6</strong></span></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Like <span><strong class="command">notify-source</strong></span>,
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews but applies to notify messages sent to IPv6 addresses.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<div class="titlepage"><div><div><h4 class="title">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<a name="id2583688"></a>UDP Port Lists</h4></div></div></div>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">use-v4-udp-ports</strong></span>,
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">avoid-v4-udp-ports</strong></span>,
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User <span><strong class="command">use-v6-udp-ports</strong></span>, and
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">avoid-v6-udp-ports</strong></span>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews specify a list of IPv4 and IPv6 UDP ports that will be
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User used or not used as source ports for UDP messages.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews See <a href="Bv9ARM.ch06.html#query_address" title="Query Address">the section called “Query Address”</a> about how the
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews available ports are determined.
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User For example, with the following configuration
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox Useruse-v6-udp-ports { range 32768 65535; };
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrewsavoid-v6-udp-ports { 40000; range 50000 60000; };
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews UDP ports of IPv6 messages sent
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews from <span><strong class="command">named</strong></span> will be in one
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User of the following ranges: 32768 to 39999, 40001 to 49999,
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews and 60001 to 65535.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">avoid-v4-udp-ports</strong></span> and
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">avoid-v6-udp-ports</strong></span> can be used
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User to prevent <span><strong class="command">named</strong></span> from choosing as its random source port a
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews port that is blocked by your firewall or a port that is
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews used by other applications;
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User if a query went out with a source port blocked by a
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews firewall, the
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews answer would not get by the firewall and the name server would
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User have to query again.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Note: the desired range can also be represented only with
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">use-v4-udp-ports</strong></span> and
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews <span><strong class="command">use-v6-udp-ports</strong></span>, and the
e23256e740b238bddb4ba41ffac5f81a01c92245Automatic Updater <span><strong class="command">avoid-</strong></span> options are redundant in that
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews sense; they are provided for backward compatibility and
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews to possibly simplify the port specification.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<div class="titlepage"><div><div><h4 class="title">
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<a name="id2583748"></a>Operating System Resource Limits</h4></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The server's usage of many system resources can be limited.
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater Scaled values are allowed when specifying resource limits. For
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User example, <span><strong class="command">1G</strong></span> can be used instead of
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">1073741824</strong></span> to specify a limit of
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User gigabyte. <span><strong class="command">unlimited</strong></span> requests
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater unlimited use, or the
cd6e9010079a4e58f7e30063df3dec0ff154ad59Tinderbox User maximum available amount. <span><strong class="command">default</strong></span>
cd6e9010079a4e58f7e30063df3dec0ff154ad59Tinderbox User uses the limit
f33f2b8afe60de897c53cdcb17911f10b552699fTinderbox User that was in force when the server was started. See the description
397c35b074ed59592cac25bafeb7e082f50f9ac1Tinderbox User of <span><strong class="command">size_spec</strong></span> in <a href="Bv9ARM.ch06.html#configuration_file_elements" title="Configuration File Elements">the section called “Configuration File Elements”</a>.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The following options set operating system resource limits for
f33f2b8afe60de897c53cdcb17911f10b552699fTinderbox User the name server process. Some operating systems don't support
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews any of the limits. On such systems, a warning will be issued if
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater unsupported limit is used.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<dt><span class="term"><span><strong class="command">coresize</strong></span></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User The maximum size of a core dump. The default
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User<dt><span class="term"><span><strong class="command">datasize</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User The maximum amount of data memory the server
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User may use. The default is <code class="literal">default</code>.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt This is a hard limit on server memory usage.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt If the server attempts to allocate memory in excess of this
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt limit, the allocation will fail, which may in turn leave
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt the server unable to perform DNS service. Therefore,
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt this option is rarely useful as a way of limiting the
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt amount of memory used by the server, but it can be used
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt to raise an operating system data size limit that is
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt too small by default. If you wish to limit the amount
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt of memory used by the server, use the
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt <span><strong class="command">max-cache-size</strong></span> and
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt <span><strong class="command">recursive-clients</strong></span>
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt options instead.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt<dt><span class="term"><span><strong class="command">files</strong></span></span></dt>
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt The maximum number of files the server
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt may have open concurrently. The default is <code class="literal">unlimited</code>.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt<dt><span class="term"><span><strong class="command">stacksize</strong></span></span></dt>
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt The maximum amount of stack memory the server
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt may use. The default is <code class="literal">default</code>.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt<div class="titlepage"><div><div><h4 class="title">
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt<a name="server_resource_limits"></a>Server Resource Limits</h4></div></div></div>
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt The following options set limits on the server's
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt resource consumption that are enforced internally by the
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt server rather than the operating system.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt<dt><span class="term"><span><strong class="command">max-ixfr-log-size</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User This option is obsolete; it is accepted
713c3d5b18463f2479973e4d14f73248e60a5df7Mark Andrews and ignored for BIND 8 compatibility. The option
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">max-journal-size</strong></span> performs a
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User similar function in BIND 9.
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User<dt><span class="term"><span><strong class="command">max-journal-size</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Sets a maximum size for each journal file
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews (see <a href="Bv9ARM.ch04.html#journal" title="The journal file">the section called “The journal file”</a>). When the journal file
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the specified size, some of the oldest transactions in the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews will be automatically removed. The default is
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This may also be set on a per-zone basis.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson<dt><span class="term"><span><strong class="command">host-statistics-max</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater In BIND 8, specifies the maximum number of host statistics
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews entries to be kept.
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User Not implemented in BIND 9.
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews<dt><span class="term"><span><strong class="command">recursive-clients</strong></span></span></dt>
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews The maximum number of simultaneous recursive lookups
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews the server will perform on behalf of clients. The default
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews <code class="literal">1000</code>. Because each recursing
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User client uses a fair
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User bit of memory, on the order of 20 kilobytes, the value of
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User <span><strong class="command">recursive-clients</strong></span> option may
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User have to be decreased
922e6a3c2ac4ef900dd9dc99f0cc137f18372583Andreas Gustafsson on hosts with limited memory.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">tcp-clients</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The maximum number of simultaneous client TCP
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User connections that the server will accept.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default is <code class="literal">100</code>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">reserved-sockets</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The number of file descriptors reserved for TCP, stdio,
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews etc. This needs to be big enough to cover the number of
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interfaces named listens on, tcp-clients as well as
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to provide room for outgoing TCP queries and incoming zone
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User transfers. The default is <code class="literal">512</code>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The minimum value is <code class="literal">128</code> and the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User maximum value is <code class="literal">128</code> less than
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User maxsockets (-S). This option may be removed in the future.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User This option has little effect on Windows.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<dt><span class="term"><span><strong class="command">max-cache-size</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The maximum amount of memory to use for the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User server's cache, in bytes.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User When the amount of data in the cache
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User reaches this limit, the server will cause records to expire
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews prematurely based on an LRU based strategy so that
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the limit is not exceeded.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User A value of 0 is special, meaning that
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User records are purged from the cache only when their
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Another special keyword <strong class="userinput"><code>unlimited</code></strong>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews means the maximum value of 32-bit unsigned integers
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews (0xffffffff), which may not have the same effect as
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews 0 on machines that support more than 32 bits of
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews memory space.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Any positive values less than 2MB will be ignored reset
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User In a server with multiple views, the limit applies
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User separately to the cache of each view.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default is 0.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">tcp-listen-queue</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The listen queue depth. The default and minimum is 3.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If the kernel supports the accept filter "dataready" this
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User also controls how
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User many TCP connections that will be queued in kernel space
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User some data before being passed to accept. Values less than 3
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User silently raised.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="id2584027"></a>Periodic Task Intervals</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">cleaning-interval</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User This interval is effectively obsolete. Previously,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the server would remove expired resource records
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User from the cache every <span><strong class="command">cleaning-interval</strong></span> minutes.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <acronym class="acronym">BIND</acronym> 9 now manages cache
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User memory in a more sophisticated manner and does not
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User rely on the periodic cleaning any more.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specifying this option therefore has no effect on
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the server's behavior.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">heartbeat-interval</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The server will perform zone maintenance tasks
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User for all zones marked as <span><strong class="command">dialup</strong></span> whenever this
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interval expires. The default is 60 minutes. Reasonable
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews values are up
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to 1 day (1440 minutes). The maximum value is 28 days
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater (40320 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If set to 0, no zone maintenance for these zones will occur.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">interface-interval</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The server will scan the network interface list
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User every <span><strong class="command">interface-interval</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User minutes. The default
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is 60 minutes. The maximum value is 28 days (40320 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If set to 0, interface scanning will only occur when
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the configuration file is loaded. After the scan, the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User begin listening for queries on any newly discovered
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interfaces (provided they are allowed by the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">listen-on</strong></span> configuration), and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User stop listening on interfaces that have gone away.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">statistics-interval</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Name server statistics will be logged
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews every <span><strong class="command">statistics-interval</strong></span>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews minutes. The default is
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews 60. The maximum value is 28 days (40320 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If set to 0, no statistics will be logged.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Not yet implemented in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<a name="topology"></a>Topology</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User All other things being equal, when the server chooses a name
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to query from a list of name servers, it prefers the one that is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User topologically closest to itself. The <span><strong class="command">topology</strong></span> statement
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User takes an <span><strong class="command">address_match_list</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interprets it
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in a special way. Each top-level list element is assigned a
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Non-negated elements get a distance based on their position in the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User list, where the closer the match is to the start of the list, the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User shorter the distance is between it and the server. A negated match
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User will be assigned the maximum distance from the server. If there
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is no match, the address will get a distance which is further than
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews any non-negated list element, and closer than any negated element.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User will prefer servers on network 10 the most, followed by hosts
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on network 1.2.0.0 (netmask 255.255.0.0) and network 3, with the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User exception of hosts on network 1.2.3 (netmask 255.255.255.0), which
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is preferred least of all.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default topology is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<pre class="programlisting"> topology { localhost; localnets; };
3d2e052eb879189e6d853097f8b568d887323bebTinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The <span><strong class="command">topology</strong></span> option
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is not implemented in <acronym class="acronym">BIND</acronym> 9.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="the_sortlist_statement"></a>The <span><strong class="command">sortlist</strong></span> Statement</h4></div></div></div>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews The response to a DNS query may consist of multiple resource
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User records (RRs) forming a resource records set (RRset).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The name server will normally return the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User RRs within the RRset in an indeterminate order
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (but see the <span><strong class="command">rrset-order</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User statement in <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>).
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews The client resolver code should rearrange the RRs as appropriate,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User that is, using any addresses on the local net in preference to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User other addresses.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User However, not all resolvers can do this or are correctly
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User When a client is using a local server, the sorting can be performed
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in the server, based on the client's address. This only requires
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User configuring the name servers, not all the clients.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The <span><strong class="command">sortlist</strong></span> statement (see below)
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User an <span><strong class="command">address_match_list</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interprets it even
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User more specifically than the <span><strong class="command">topology</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User does (<a href="Bv9ARM.ch06.html#topology" title="Topology">the section called “Topology”</a>).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Each top level statement in the <span><strong class="command">sortlist</strong></span> must
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User itself be an explicit <span><strong class="command">address_match_list</strong></span> with
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User one or two elements. The first element (which may be an IP
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User an IP prefix, an ACL name or a nested <span><strong class="command">address_match_list</strong></span>)
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of each top level list is checked against the source address of
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater the query until a match is found.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Once the source address of the query has been matched, if
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews the top level statement contains only one element, the actual
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User element that matched the source address is used to select the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in the response to move to the beginning of the response. If the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User statement is a list of two elements, then the second element is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User treated the same as the <span><strong class="command">address_match_list</strong></span> in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User a <span><strong class="command">topology</strong></span> statement. Each top
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User level element
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is assigned a distance and the address in the response with the
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews distance is moved to the beginning of the response.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater In the following example, any queries received from any of
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the addresses of the host itself will get responses preferring
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on any of the locally connected networks. Next most preferred are
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on the 192.168.1/24 network, and after that either the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User 192.168.3/24 network with no preference shown between these two
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User networks. Queries received from a host on the 192.168.1/24 network
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User will prefer other addresses on that network to the 192.168.2/24
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User 192.168.3/24 networks. Queries received from a host on the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User or the 192.168.5/24 network will only prefer other addresses on
3e1a17d65ec6227900f388ba2f7561365f7d4f5cTinderbox User their directly connected networks.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User { localhost; // IF the local host
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User { localnets; // THEN first fit on the
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater { 192.168.3/24; // THEN use .3, or .1 or .2
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User { { 192.168.4/24; 192.168.5/24; }; // if .4 or .5, prefer that net
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The following example will give reasonable behavior for the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User local host and hosts on directly connected networks. It is similar
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to the behavior of the address sort in <acronym class="acronym">BIND</acronym> 4.9.x. Responses sent
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to queries from the local host will favor any of the directly
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User networks. Responses sent to queries from any other hosts on a
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User connected network will prefer addresses on that same network.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews to other queries will not be sorted.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews { localhost; localnets; };
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews { localnets; };
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="rrset_ordering"></a>RRset Ordering</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User When multiple records are returned in an answer it may be
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User useful to configure the order of the records placed into the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The <span><strong class="command">rrset-order</strong></span> statement permits
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User configuration
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of the ordering of the records in a multiple record response.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User See also the <span><strong class="command">sortlist</strong></span> statement,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User An <span><strong class="command">order_spec</strong></span> is defined as
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User [<span class="optional">class <em class="replaceable"><code>class_name</code></em></span>]
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews [<span class="optional">type <em class="replaceable"><code>type_name</code></em></span>]
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews [<span class="optional">name <em class="replaceable"><code>"domain_name"</code></em></span>]
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews order <em class="replaceable"><code>ordering</code></em>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If no class is specified, the default is <span><strong class="command">ANY</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If no type is specified, the default is <span><strong class="command">ANY</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If no name is specified, the default is "<span><strong class="command">*</strong></span>" (asterisk).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The legal values for <span><strong class="command">ordering</strong></span> are:
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <p><span><strong class="command">fixed</strong></span></p>
017d755d7a606dfb1e02a9d6e2b29e49e39fde16Tinderbox User Records are returned in the order they
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater are defined in the zone file.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <p><span><strong class="command">random</strong></span></p>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Records are returned in some random order.
af9dbf1ccdd53933aaae9300d13ce0965d39b067Evan Hunt <p><span><strong class="command">cyclic</strong></span></p>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Records are returned in a cyclic round-robin order.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User If <acronym class="acronym">BIND</acronym> is configured with the
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User "--enable-fixed-rrset" option at compile time, then
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User the initial ordering of the RRset will match the
af9dbf1ccdd53933aaae9300d13ce0965d39b067Evan Hunt one specified in the zone file.
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User class IN type A name "host.example.com" order random;
7ac34650fa344f42211d6da744ae486b0145a083Tinderbox User order cyclic;
16f6050f29b6b0422cee858e609f65e474e70ef2Tinderbox User will cause any responses for type A records in class IN that
d97783f18169fc9c5220a0b91fe53653efcd6b10Tinderbox User have "<code class="literal">host.example.com</code>" as a
4fe0411487e8e4401477684c0a2bac041ca7c2d5Tinderbox User suffix, to always be returned
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User in random order. All other records are returned in cyclic order.
<span><strong class="command">max-ncache-ttl</strong></span> is <code class="literal">10800</code> seconds (3 hours).
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
result of dynamic updates (<a href="Bv9ARM.ch04.html#dynamic_update" title="Dynamic Update">the section called “Dynamic Update”</a>) will expire. There
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
<a href="Bv9ARM.ch06.html#zonefile_format" title="Additional File Formats">the section called “Additional File Formats”</a>).
<span class="term"><span><strong class="command">clients-per-query</strong></span>, </span><span class="term"><span><strong class="command">max-clients-per-query</strong></span></span>
built-in view (see <a href="Bv9ARM.ch06.html#view_statement_grammar" title="view Statement Grammar">the section called “<span><strong class="command">view</strong></span> Statement Grammar”</a>) of
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
<span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
The default <span><strong class="command">server-id</strong></span> is <span><strong class="command">none</strong></span>.
<dt><span class="term"><span><strong class="command">acache-cleaning-interval</strong></span></span></dt>
<a name="statschannels"></a><span><strong class="command">statistics-channels</strong></span> Statement Grammar</h3></div></div></div>
[ inet ( ip_addr | * ) [ port ip_port ] [allow { <em class="replaceable"><code> address_match_list </code></em> } ]; ]
<a name="id2586098"></a><span><strong class="command">statistics-channels</strong></span> Statement Definition and
address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
<a name="server_statement_grammar"></a><span><strong class="command">server</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">server</strong></span> <em class="replaceable"><code>ip_addr[/prefixlen]</code></em> {
[<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em> ; ]</span>]
[<span class="optional"> keys <em class="replaceable"><code>{ string ; [<span class="optional"> string ; [<span class="optional">...</span>]</span>] }</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> query-source [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
[<span class="optional"> query-source-v6 [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
[<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> queryport-pool-interval <em class="replaceable"><code>number</code></em>; </span>]
<a name="server_statement_definition_and_usage"></a><span><strong class="command">server</strong></span> Statement Definition and
value of <span><strong class="command">bogus</strong></span> is <span><strong class="command">no</strong></span>.
The server supports two zone transfer methods. The first, <span><strong class="command">one-answer</strong></span>,
uses one DNS message per resource record transferred. <span><strong class="command">many-answers</strong></span> packs
as many resource records as possible into a message. <span><strong class="command">many-answers</strong></span> is
more efficient, but is only known to be understood by <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
<span><strong class="command">key_id</strong></span> defined by the <span><strong class="command">key</strong></span> statement,
to be used for transaction security (TSIG, <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
<a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<a name="id2586986"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div>
<em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
[<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
<a name="id2587037"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition
DNSSEC security roots. DNSSEC is described in <a href="Bv9ARM.ch04.html#DNSSEC" title="DNSSEC">the section called “DNSSEC”</a>. A security root is defined when the
<a name="view_statement_grammar"></a><span><strong class="command">view</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">view</strong></span> <em class="replaceable"><code>view_name</code></em>
<a name="id2587120"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
// Provide a complete view of the example.com zone
zone "example.com" {
file "example-internal.db";
// Provide a restricted view of the example.com zone
zone "example.com" {
file "example-external.db";
<pre class="programlisting"><span><strong class="command">zone</strong></span> <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-policy { <em class="replaceable"><code>update_policy_rule</code></em> [<span class="optional">...</span>] }; </span>]
[<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-mx (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; // Not Implemented. </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
<a name="id2588657"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div>
status of infrastructure zones (e.g. COM, NET, ORG).
a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>),
in the mid-1970s. Zone data for it can be specified with the <code class="literal">CHAOS</code> class.
<span><strong class="command">allow-notify</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query-on</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>.
<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
network. The default varies according to zone type. For <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>. For <span><strong class="command">slave</strong></span>
<span><strong class="command">check-mx</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-wildcard</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-integrity</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-sibling</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">zero-no-soa-ttl</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">update-check-ksk</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">try-tcp-refresh</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">dialup</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
after trying the forwarders and getting no answer, while <span><strong class="command">first</strong></span> would
This is applicable to <span><strong class="command">master</strong></span> and <span><strong class="command">slave</strong></span> zones.
<span><strong class="command">max-journal-size</strong></span> in <a href="Bv9ARM.ch06.html#server_resource_limits" title="Server Resource Limits">the section called “Server Resource Limits”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
<span><strong class="command">max-transfer-time-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
<span><strong class="command">max-transfer-time-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">notify-delay</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
zones when they are loaded from disk. <acronym class="acronym">BIND</acronym> 9 does not verify signatures
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
<span><strong class="command">sig-validity-interval</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-nodes</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span><strong class="command">sig-signing-signatures</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-type</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
<span><strong class="command">alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
<span><strong class="command">alt-transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
<span><strong class="command">use-alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
See the description in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
<span><strong class="command">ixfr-from-differences</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">key-directory</strong></span> in <a href="Bv9ARM.ch06.html#options" title="options Statement Definition and
Usage">the section called “<span><strong class="command">options</strong></span> Statement Definition and
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
( <span><strong class="command">grant</strong></span> | <span><strong class="command">deny</strong></span> ) <em class="replaceable"><code>identity</code></em> <em class="replaceable"><code>nametype</code></em> <em class="replaceable"><code>name</code></em> [<span class="optional"> <em class="replaceable"><code>types</code></em> </span>]
<a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div>
that a particular nearby server be tried first. See <a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a> and <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>.
built-in server information zones, e.g.,
any order), and if neither of those succeed, delivery to <code class="literal">mail.backup.org</code> will
and PTR records. Entries in the in-addr.arpa domain are made in
in-addr.arpa name of
3.2.1.10.in-addr.arpa. This name should have a PTR resource record
Master File Directives include <span><strong class="command">$ORIGIN</strong></span>, <span><strong class="command">$INCLUDE</strong></span>,
<a name="id2594186"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div>
$ORIGIN example.com.
<a name="id2594315"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div>
if it were included into the file at this point. If <span><strong class="command">origin</strong></span> is
revert to the values they had prior to the <span><strong class="command">$INCLUDE</strong></span> once
<a name="id2594385"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div>
<a name="id2594421"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div>
Classless IN-ADDR.ARPA delegation.
HOST-1.EXAMPLE. MX 0 .
HOST-2.EXAMPLE. A 1.2.3.2
HOST-2.EXAMPLE. MX 0 .
HOST-3.EXAMPLE. A 1.2.3.3
HOST-3.EXAMPLE. MX 0 .
HOST-127.EXAMPLE. A 1.2.3.127
HOST-127.EXAMPLE. MX 0 .
The <span><strong class="command">$GENERATE</strong></span> directive is a <acronym class="acronym">BIND</acronym> extension
(see <a href="Bv9ARM.ch06.html#statschannels" title="statistics-channels Statement Grammar">the section called “<span><strong class="command">statistics-channels</strong></span> Statement Grammar”</a>.)
<a name="id2598102"></a>Compatibility with <span class="emphasis"><em>BIND</em></span> 8 Counters</h4></div></div></div>
<td width="40%" align="left" valign="top">Chapter�5.�The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver�</td>