Bv9ARM.ch06.html revision ac93437301f55ed69bf85883a497a75598c628f9
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor - Copyright (C) 2000-2003 Internet Software Consortium.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor - Permission to use, copy, modify, and distribute this software for any
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor - purpose with or without fee is hereby granted, provided that the above
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor - copyright notice and this permission notice appear in all copies.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor - PERFORMANCE OF THIS SOFTWARE.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<!-- $Id: Bv9ARM.ch06.html,v 1.220 2009/05/15 01:15:47 tbox Exp $ -->
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<title>Chapter�6.�BIND 9 Configuration Reference</title>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<link rel="prev" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<link rel="next" href="Bv9ARM.ch07.html" title="Chapter�7.�BIND 9 Security Considerations">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<tr><th colspan="3" align="center">Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</th></tr>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a accesskey="p" href="Bv9ARM.ch05.html">Prev</a>�</td>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch07.html">Next</a>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h2 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="Bv9ARM.ch06"></a>Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</h2></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573737">Comment Syntax</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574436"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574626"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575053"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575070"><span><strong class="command">include</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575094"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575117"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575208"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575334"><span><strong class="command">logging</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577401"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577475"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577539"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577582"><span><strong class="command">masters</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577597"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#statschannels"><span><strong class="command">statistics-channels</strong></span> Statement Grammar</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587051"><span><strong class="command">statistics-channels</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587206"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587257"><span><strong class="command">trusted-keys</strong></span> Statement Definition
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587362"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2588899"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2591361">Zone File</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2593591">Discussion of MX Records</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2594206">Inverse Mapping in IPv4</a></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2594402">Other Zone File Directives</a></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2594743"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="sect1"><a href="Bv9ARM.ch06.html#statistics">BIND9 Statistics</a></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch06.html#statistics_counters">Statistics Counters</a></span></dt></dl></dd>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <acronym class="acronym">BIND</acronym> 9 configuration is broadly similar
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to <acronym class="acronym">BIND</acronym> 8; however, there are a few new
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor of configuration, such as views. <acronym class="acronym">BIND</acronym>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor 8 configuration files should work with few alterations in <acronym class="acronym">BIND</acronym>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor 9, although more complex configurations should be reviewed to check
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor if they can be more efficiently implemented using the new features
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor found in <acronym class="acronym">BIND</acronym> 9.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <acronym class="acronym">BIND</acronym> 4 configuration files can be
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor converted to the new format
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor using the shell script
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="filename">contrib/named-bootconf/named-bootconf.sh</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h2 class="title" style="clear: both">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="configuration_file_elements"></a>Configuration File Elements</h2></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Following is a list of elements used throughout the <acronym class="acronym">BIND</acronym> configuration
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor file documentation:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The name of an <code class="varname">address_match_list</code> as
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor defined by the <span><strong class="command">acl</strong></span> statement.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor A list of one or more
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="varname">ip_prefix</code>, <code class="varname">key_id</code>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor or <code class="varname">acl_name</code> elements, see
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor A named list of one or more <code class="varname">ip_addr</code>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor with optional <code class="varname">key_id</code> and/or
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor A <code class="varname">masters_list</code> may include other
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor A quoted string which will be used as
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor a DNS name, for example "<code class="literal">my.test.domain</code>".
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor One to four integers valued 0 through
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor 255 separated by dots (`.'), such as <span><strong class="command">123</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">45.67</strong></span> or <span><strong class="command">89.123.45.67</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor An IPv4 address with exactly four elements
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in <code class="varname">dotted_decimal</code> notation.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor An IPv6 address, such as <span><strong class="command">2001:db8::1234</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor IPv6 scoped addresses that have ambiguity on their
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor scope zones must be disambiguated by an appropriate
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor zone ID with the percent character (`%') as
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor delimiter. It is strongly recommended to use
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor string zone names rather than numeric identifiers,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in order to be robust against system configuration
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor changes. However, since there is no standard
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor mapping for such names and identifier values,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor currently only interface names as link identifiers
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor are supported, assuming one-to-one mapping between
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor interfaces and links. For example, a link-local
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor address <span><strong class="command">fe80::1</strong></span> on the link
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor attached to the interface <span><strong class="command">ne0</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor can be specified as <span><strong class="command">fe80::1%ne0</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Note that on most systems link-local addresses
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor always have the ambiguity, and need to be
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor disambiguated.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor An <code class="varname">ip4_addr</code> or <code class="varname">ip6_addr</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <code class="varname">number</code> is limited to 0
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor through 65535, with values
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor below 1024 typically restricted to use by processes running
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor In some cases, an asterisk (`*') character can be used as a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor placeholder to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor select a random high-numbered port.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor An IP network specified as an <code class="varname">ip_addr</code>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor followed by a slash (`/') and then the number of bits in the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Trailing zeros in a <code class="varname">ip_addr</code>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor may omitted.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor For example, <span><strong class="command">127/8</strong></span> is the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor network <span><strong class="command">127.0.0.0</strong></span> with
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor netmask <span><strong class="command">255.0.0.0</strong></span> and <span><strong class="command">1.2.3.0/28</strong></span> is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor network <span><strong class="command">1.2.3.0</strong></span> with netmask <span><strong class="command">255.255.255.240</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor When specifying a prefix involving a IPv6 scoped address
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the scope may be omitted. In that case the prefix will
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor match packets from any scope.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor A <code class="varname">domain_name</code> representing
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the name of a shared key, to be used for transaction
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor A list of one or more
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor separated by semicolons and ending with a semicolon.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor A non-negative 32-bit integer
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor (i.e., a number between 0 and 4294967295, inclusive).
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor Its acceptable value might further
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor be limited by the context in which it is used.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor A quoted string which will be used as
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor a pathname, such as <code class="filename">zones/master/my.test.domain</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor A list of an <code class="varname">ip_port</code> or a port
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor A port range is specified in the form of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>range</code></strong> followed by
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="varname">port_high</code>, which represents
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor port numbers from <code class="varname">port_low</code> through
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="varname">port_high</code>, inclusive.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="varname">port_low</code> must not be larger than
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor For example,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>range 1024 65535</code></strong> represents
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor ports from 1024 through 65535.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor In either case an asterisk (`*') character is not
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor allowed as a valid <code class="varname">ip_port</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor A number, the word <strong class="userinput"><code>unlimited</code></strong>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor or the word <strong class="userinput"><code>default</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor An <code class="varname">unlimited</code> <code class="varname">size_spec</code> requests unlimited
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor use, or the maximum available amount. A <code class="varname">default size_spec</code> uses
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the limit that was in force when the server was started.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor A <code class="varname">number</code> can optionally be
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor followed by a scaling factor:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>K</code></strong> or <strong class="userinput"><code>k</code></strong>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor for kilobytes,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>M</code></strong> or <strong class="userinput"><code>m</code></strong>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor for megabytes, and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>G</code></strong> or <strong class="userinput"><code>g</code></strong> for gigabytes,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor which scale by 1024, 1024*1024, and 1024*1024*1024
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor respectively.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The value must be representable as a 64-bit unsigned integer
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor (0 to 18446744073709551615, inclusive).
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Using <code class="varname">unlimited</code> is the best
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to safely set a really large number.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Either <strong class="userinput"><code>yes</code></strong> or <strong class="userinput"><code>no</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The words <strong class="userinput"><code>true</code></strong> and <strong class="userinput"><code>false</code></strong> are
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor also accepted, as are the numbers <strong class="userinput"><code>1</code></strong>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and <strong class="userinput"><code>0</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor One of <strong class="userinput"><code>yes</code></strong>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>no</code></strong>, <strong class="userinput"><code>notify</code></strong>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>notify-passive</code></strong>, <strong class="userinput"><code>refresh</code></strong> or
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>passive</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor When used in a zone, <strong class="userinput"><code>notify-passive</code></strong>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>refresh</code></strong>, and <strong class="userinput"><code>passive</code></strong>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor are restricted to slave and stub zones.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="address_match_lists"></a>Address Match Lists</h3></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h4 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2573504"></a>Syntax</h4></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> address_match_list_element; ... </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] |
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor key key_id | acl_name | { address_match_list } )
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h4 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2573600"></a>Definition and Usage</h4></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Address match lists are primarily used to determine access
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor control for various server operations. They are also used in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the <span><strong class="command">listen-on</strong></span> and <span><strong class="command">sortlist</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statements. The elements which constitute an address match
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor list can be any of the following:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor a key ID, as defined by the <span><strong class="command">key</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<li>the name of an address match list defined with
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the <span><strong class="command">acl</strong></span> statement
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<li>a nested address match list enclosed in braces</li>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Elements can be negated with a leading exclamation mark (`!'),
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and the match list names "any", "none", "localhost", and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor "localnets" are predefined. More information on those names
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor can be found in the description of the acl statement.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The addition of the key clause made the name of this syntactic
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor element something of a misnomer, since security keys can be used
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to validate access without regard to a host or network address.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Nonetheless, the term "address match list" is still used
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor throughout the documentation.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor When a given IP address or prefix is compared to an address
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor match list, the comparison takes place in approximately O(1)
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor time. However, key comparisons require that the list of keys
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor be traversed until a matching key is found, and therefore may
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor be somewhat slower.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The interpretation of a match depends on whether the list is being
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor used for access control, defining <span><strong class="command">listen-on</strong></span> ports, or in a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">sortlist</strong></span>, and whether the element was negated.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor When used as an access control list, a non-negated match
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor allows access and a negated match denies access. If
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor there is no match, access is denied. The clauses
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">allow-notify</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">allow-recursion</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">allow-recursion-on</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">allow-query</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">allow-query-on</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">allow-query-cache</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">allow-query-cache-on</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">allow-transfer</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">allow-update</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">allow-update-forwarding</strong></span>, and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">blackhole</strong></span> all use address match
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor lists. Similarly, the <span><strong class="command">listen-on</strong></span> option will cause the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor server to refuse queries on any of the machine's
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor addresses which do not match the list.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Order of insertion is significant. If more than one element
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in an ACL is found to match a given IP address or prefix,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor preference will be given to the one that came
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span class="emphasis"><em>first</em></span> in the ACL definition.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Because of this first-match behavior, an element that
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor defines a subset of another element in the list should
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor come before the broader element, regardless of whether
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor either is negated. For example, in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">1.2.3/24; ! 1.2.3.13;</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the 1.2.3.13 element is completely useless because the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor algorithm will match any lookup for 1.2.3.13 to the 1.2.3/24
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor element. Using <span><strong class="command">! 1.2.3.13; 1.2.3/24</strong></span> fixes
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor that problem by having 1.2.3.13 blocked by the negation, but
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor all other 1.2.3.* hosts fall through.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2573737"></a>Comment Syntax</h3></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor comments to appear
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor file. To appeal to programmers of all kinds, they can be written
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h4 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2573752"></a>Syntax</h4></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting">// This is a <acronym class="acronym">BIND</acronym> comment as in C++</pre>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting"># This is a <acronym class="acronym">BIND</acronym> comment as in common UNIX shells
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor# and perl</pre>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h4 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2573782"></a>Definition and Usage</h4></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Comments may appear anywhere that whitespace may appear in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor a <acronym class="acronym">BIND</acronym> configuration file.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor C-style comments start with the two characters /* (slash,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor star) and end with */ (star, slash). Because they are completely
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor delimited with these characters, they can be used to comment only
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor a portion of a line or to span multiple lines.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor C-style comments cannot be nested. For example, the following
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is not valid because the entire comment ends with the first */:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting">/* This is the start of a comment.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This is still part of the comment.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor/* This is an incorrect attempt at nesting a comment. */
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This is no longer in any comment. */
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor C++-style comments start with the two characters // (slash,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor slash) and continue to the end of the physical line. They cannot
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor be continued across multiple physical lines; to have one logical
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor comment span multiple lines, each line must use the // pair.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor For example:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting">// This is the start of a comment. The next line
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor// is a new comment, even though it is logically
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor// part of the previous comment.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Shell-style (or perl-style, if you prefer) comments start
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor with the character <code class="literal">#</code> (number sign)
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and continue to the end of the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor physical line, as in C++ comments.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor For example:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting"># This is the start of a comment. The next line
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor# is a new comment, even though it is logically
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor# part of the previous comment.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor You cannot use the semicolon (`;') character
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to start a comment such as you would in a zone file. The
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor semicolon indicates the end of a configuration
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h2 class="title" style="clear: both">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="Configuration_File_Grammar"></a>Configuration File Grammar</h2></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor A <acronym class="acronym">BIND</acronym> 9 configuration consists of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statements and comments.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Statements end with a semicolon. Statements and comments are the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor only elements that can appear without enclosing braces. Many
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statements contain a block of sub-statements, which are also
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor terminated with a semicolon.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The following statements are supported:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">acl</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor defines a named IP address
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor matching list, for access control and other uses.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">controls</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor declares control channels to be used
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor by the <span><strong class="command">rndc</strong></span> utility.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">include</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor includes a file.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">key</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor specifies key information for use in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor authentication and authorization using TSIG.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">logging</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor specifies what the server logs, and where
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the log messages are sent.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">lwres</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor configures <span><strong class="command">named</strong></span> to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor also act as a light-weight resolver daemon (<span><strong class="command">lwresd</strong></span>).
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">masters</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor defines a named masters list for
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor inclusion in stub and slave zone masters clauses.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">options</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor controls global server configuration
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor options and sets defaults for other statements.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">server</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor sets certain configuration options on
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor a per-server basis.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">statistics-channels</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor declares communication channels to get access to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">named</strong></span> statistics.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">trusted-keys</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor defines trusted DNSSEC keys.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">view</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor defines a view.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">zone</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor defines a zone.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">logging</strong></span> and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">options</strong></span> statements may only occur once
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor configuration.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2574436"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting"><span><strong class="command">acl</strong></span> acl-name {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor address_match_list
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="acl"></a><span><strong class="command">acl</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">acl</strong></span> statement assigns a symbolic
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor name to an address match list. It gets its name from a primary
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor use of address match lists: Access Control Lists (ACLs).
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Note that an address match list's name must be defined
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor with <span><strong class="command">acl</strong></span> before it can be used
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor elsewhere; no forward references are allowed.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The following ACLs are built-in:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">any</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Matches all hosts.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">none</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Matches no hosts.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">localhost</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Matches the IPv4 and IPv6 addresses of all network
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor interfaces on the system.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">localnets</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Matches any host on an IPv4 or IPv6 network
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor for which the system has an interface.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Some systems do not provide a way to determine the prefix
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor local IPv6 addresses.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor In such a case, <span><strong class="command">localnets</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor only matches the local
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor IPv6 addresses, just like <span><strong class="command">localhost</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2574626"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting"><span><strong class="command">controls</strong></span> {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [ inet ( ip_addr | * ) [ port ip_port ]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor allow { <em class="replaceable"><code> address_match_list </code></em> }
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor keys { <em class="replaceable"><code>key_list</code></em> }; ]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [ inet ...; ]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [ unix <em class="replaceable"><code>path</code></em> perm <em class="replaceable"><code>number</code></em> owner <em class="replaceable"><code>number</code></em> group <em class="replaceable"><code>number</code></em>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor keys { <em class="replaceable"><code>key_list</code></em> }; ]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [ unix ...; ]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="controls_statement_definition_and_usage"></a><span><strong class="command">controls</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">controls</strong></span> statement declares control
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor channels to be used by system administrators to control the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor operation of the name server. These control channels are
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor used by the <span><strong class="command">rndc</strong></span> utility to send
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor commands to and retrieve non-DNS results from a name server.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor An <span><strong class="command">inet</strong></span> control channel is a TCP socket
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor listening at the specified <span><strong class="command">ip_port</strong></span> on the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor specified <span><strong class="command">ip_addr</strong></span>, which can be an IPv4 or IPv6
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor interpreted as the IPv4 wildcard address; connections will be
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor accepted on any of the system's IPv4 addresses.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor To listen on the IPv6 wildcard address,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor use an <span><strong class="command">ip_addr</strong></span> of <code class="literal">::</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If you will only use <span><strong class="command">rndc</strong></span> on the local host,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor using the loopback address (<code class="literal">127.0.0.1</code>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor or <code class="literal">::1</code>) is recommended for maximum security.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If no port is specified, port 953 is used. The asterisk
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor "<code class="literal">*</code>" cannot be used for <span><strong class="command">ip_port</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The ability to issue commands over the control channel is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor restricted by the <span><strong class="command">allow</strong></span> and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">keys</strong></span> clauses.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Connections to the control channel are permitted based on the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">address_match_list</strong></span>. This is for simple
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor IP address based filtering only; any <span><strong class="command">key_id</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor elements of the <span><strong class="command">address_match_list</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor are ignored.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor A <span><strong class="command">unix</strong></span> control channel is a UNIX domain
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor socket listening at the specified path in the file system.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Access to the socket is specified by the <span><strong class="command">perm</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">owner</strong></span> and <span><strong class="command">group</strong></span> clauses.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Note on some platforms (SunOS and Solaris) the permissions
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor (<span><strong class="command">perm</strong></span>) are applied to the parent directory
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor as the permissions on the socket itself are ignored.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The primary authorization mechanism of the command
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor channel is the <span><strong class="command">key_list</strong></span>, which
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor contains a list of <span><strong class="command">key_id</strong></span>s.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Each <span><strong class="command">key_id</strong></span> in the <span><strong class="command">key_list</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is authorized to execute commands over the control channel.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor See <a href="Bv9ARM.ch03.html#rndc">Remote Name Daemon Control application</a> in <a href="Bv9ARM.ch03.html#admin_tools" title="Administrative Tools">the section called “Administrative Tools”</a>)
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor for information about configuring keys in <span><strong class="command">rndc</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If no <span><strong class="command">controls</strong></span> statement is present,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">named</strong></span> will set up a default
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor control channel listening on the loopback address 127.0.0.1
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and its IPv6 counterpart ::1.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor In this case, and also when the <span><strong class="command">controls</strong></span> statement
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is present but does not have a <span><strong class="command">keys</strong></span> clause,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">named</strong></span> will attempt to load the command channel key
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor from the file <code class="filename">rndc.key</code> in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="filename">/etc</code> (or whatever <code class="varname">sysconfdir</code>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor was specified as when <acronym class="acronym">BIND</acronym> was built).
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor To create a <code class="filename">rndc.key</code> file, run
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>rndc-confgen -a</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <code class="filename">rndc.key</code> feature was created to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor ease the transition of systems from <acronym class="acronym">BIND</acronym> 8,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor which did not have digital signatures on its command channel
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor messages and thus did not have a <span><strong class="command">keys</strong></span> clause.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor It makes it possible to use an existing <acronym class="acronym">BIND</acronym> 8
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor configuration file in <acronym class="acronym">BIND</acronym> 9 unchanged,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and still have <span><strong class="command">rndc</strong></span> work the same way
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">ndc</strong></span> worked in BIND 8, simply by executing the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor command <strong class="userinput"><code>rndc-confgen -a</code></strong> after BIND 9 is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Since the <code class="filename">rndc.key</code> feature
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is only intended to allow the backward-compatible usage of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <acronym class="acronym">BIND</acronym> 8 configuration files, this
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor feature does not
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor have a high degree of configurability. You cannot easily change
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the key name or the size of the secret, so you should make a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="filename">rndc.conf</code> with your own key if you
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor wish to change
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor those things. The <code class="filename">rndc.key</code> file
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor also has its
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor permissions set such that only the owner of the file (the user that
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">named</strong></span> is running as) can access it.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor desire greater flexibility in allowing other users to access
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">rndc</strong></span> commands, then you need to create
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="filename">rndc.conf</code> file and make it group
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor readable by a group
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor that contains the users who should have access.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor To disable the command channel, use an empty
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">controls</strong></span> statement:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">controls { };</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2575053"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting"><span><strong class="command">include</strong></span> <em class="replaceable"><code>filename</code></em>;</pre>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2575070"></a><span><strong class="command">include</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">include</strong></span> statement inserts the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor specified file at the point where the <span><strong class="command">include</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statement is encountered. The <span><strong class="command">include</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statement facilitates the administration of configuration
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor by permitting the reading or writing of some things but not
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor others. For example, the statement could include private keys
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor that are readable only by the name server.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2575094"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting"><span><strong class="command">key</strong></span> <em class="replaceable"><code>key_id</code></em> {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor algorithm <em class="replaceable"><code>string</code></em>;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor secret <em class="replaceable"><code>string</code></em>;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2575117"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">key</strong></span> statement defines a shared
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor secret key for use with TSIG (see <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor or the command channel
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Usage”</a>).
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">key</strong></span> statement can occur at the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor of the configuration file or inside a <span><strong class="command">view</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statement. Keys defined in top-level <span><strong class="command">key</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statements can be used in all views. Keys intended for use in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor a <span><strong class="command">controls</strong></span> statement
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Usage”</a>)
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor must be defined at the top level.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <em class="replaceable"><code>key_id</code></em>, also known as the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor key name, is a domain name uniquely identifying the key. It can
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor be used in a <span><strong class="command">server</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statement to cause requests sent to that
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor server to be signed with this key, or in address match lists to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor verify that incoming requests have been signed with a key
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor matching this name, algorithm, and secret.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <em class="replaceable"><code>algorithm_id</code></em> is a string
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor that specifies a security/authentication algorithm. Named
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and <code class="literal">hmac-sha512</code> TSIG authentication.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Truncated hashes are supported by appending the minimum
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor number of required bits preceded by a dash, e.g.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <em class="replaceable"><code>secret_string</code></em> is the secret
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to be used by the algorithm, and is treated as a base-64
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor encoded string.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2575208"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting"><span><strong class="command">logging</strong></span> {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [ <span><strong class="command">channel</strong></span> <em class="replaceable"><code>channel_name</code></em> {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor ( <span><strong class="command">file</strong></span> <em class="replaceable"><code>path_name</code></em>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [ <span><strong class="command">versions</strong></span> ( <em class="replaceable"><code>number</code></em> | <span><strong class="command">unlimited</strong></span> ) ]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [ <span><strong class="command">size</strong></span> <em class="replaceable"><code>size spec</code></em> ]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor | <span><strong class="command">syslog</strong></span> <em class="replaceable"><code>syslog_facility</code></em>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor | <span><strong class="command">stderr</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor | <span><strong class="command">null</strong></span> );
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [ <span><strong class="command">severity</strong></span> (<code class="option">critical</code> | <code class="option">error</code> | <code class="option">warning</code> | <code class="option">notice</code> |
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="option">info</code> | <code class="option">debug</code> [ <em class="replaceable"><code>level</code></em> ] | <code class="option">dynamic</code> ); ]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [ <span><strong class="command">print-category</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [ <span><strong class="command">print-severity</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [ <span><strong class="command">print-time</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [ <span><strong class="command">category</strong></span> <em class="replaceable"><code>category_name</code></em> {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <em class="replaceable"><code>channel_name</code></em> ; [ <em class="replaceable"><code>channel_name</code></em> ; ... ]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2575334"></a><span><strong class="command">logging</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">logging</strong></span> statement configures a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor variety of logging options for the name server. Its <span><strong class="command">channel</strong></span> phrase
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor associates output methods, format options and severity levels with
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor a name that can then be used with the <span><strong class="command">category</strong></span> phrase
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to select how various classes of messages are logged.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Only one <span><strong class="command">logging</strong></span> statement is used to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor as many channels and categories as are wanted. If there is no <span><strong class="command">logging</strong></span> statement,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the logging configuration will be:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor category default { default_syslog; default_debug; };
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor category unmatched { null; };
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor In <acronym class="acronym">BIND</acronym> 9, the logging configuration
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is only established when
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the entire configuration file has been parsed. In <acronym class="acronym">BIND</acronym> 8, it was
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor established as soon as the <span><strong class="command">logging</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor was parsed. When the server is starting up, all logging messages
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor regarding syntax errors in the configuration file go to the default
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor channels, or to standard error if the "<code class="option">-g</code>" option
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor was specified.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h4 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2575386"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor All log output goes to one or more <span class="emphasis"><em>channels</em></span>;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor you can make as many of them as you want.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Every channel definition must include a destination clause that
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor says whether messages selected for the channel go to a file, to a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor particular syslog facility, to the standard error stream, or are
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor discarded. It can optionally also limit the message severity level
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor that will be accepted by the channel (the default is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">info</strong></span>), and whether to include a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">named</strong></span>-generated time stamp, the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor category name
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and/or severity level (the default is not to include any).
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">null</strong></span> destination clause
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor causes all messages sent to the channel to be discarded;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in that case, other options for the channel are meaningless.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">file</strong></span> destination clause directs
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to a disk file. It can include limitations
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor both on how large the file is allowed to become, and how many
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor of the file will be saved each time the file is opened.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If you use the <span><strong class="command">versions</strong></span> log file
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor option, then
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">named</strong></span> will retain that many backup
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor versions of the file by
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor renaming them when opening. For example, if you choose to keep
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor three old versions
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor of the file <code class="filename">lamers.log</code>, then just
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor before it is opened
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="filename">lamers.log.1</code> is renamed to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="filename">lamers.log.2</code>, <code class="filename">lamers.log.0</code> is renamed
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to <code class="filename">lamers.log.1</code>, and <code class="filename">lamers.log</code> is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor renamed to <code class="filename">lamers.log.0</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor You can say <span><strong class="command">versions unlimited</strong></span> to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the number of versions.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If a <span><strong class="command">size</strong></span> option is associated with
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the log file,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor then renaming is only done when the file being opened exceeds the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor indicated size. No backup versions are kept by default; any
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor log file is simply appended.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">size</strong></span> option for files is used
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to limit log
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor growth. If the file ever exceeds the size, then <span><strong class="command">named</strong></span> will
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor stop writing to the file unless it has a <span><strong class="command">versions</strong></span> option
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor associated with it. If backup versions are kept, the files are
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor described above and a new one begun. If there is no
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">versions</strong></span> option, no more data will
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor be written to the log
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor until some out-of-band mechanism removes or truncates the log to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor less than the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor maximum size. The default behavior is not to limit the size of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Example usage of the <span><strong class="command">size</strong></span> and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">versions</strong></span> options:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting">channel an_example_channel {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor file "example.log" versions 3 size 20m;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor print-time yes;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor print-category yes;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">syslog</strong></span> destination clause
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor channel to the system log. Its argument is a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor syslog facility as described in the <span><strong class="command">syslog</strong></span> man
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor page. Known facilities are <span><strong class="command">kern</strong></span>, <span><strong class="command">user</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">mail</strong></span>, <span><strong class="command">daemon</strong></span>, <span><strong class="command">auth</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">syslog</strong></span>, <span><strong class="command">lpr</strong></span>, <span><strong class="command">news</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">uucp</strong></span>, <span><strong class="command">cron</strong></span>, <span><strong class="command">authpriv</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">ftp</strong></span>, <span><strong class="command">local0</strong></span>, <span><strong class="command">local1</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">local2</strong></span>, <span><strong class="command">local3</strong></span>, <span><strong class="command">local4</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">local5</strong></span>, <span><strong class="command">local6</strong></span> and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">local7</strong></span>, however not all facilities
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor are supported on
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor all operating systems.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor How <span><strong class="command">syslog</strong></span> will handle messages
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor this facility is described in the <span><strong class="command">syslog.conf</strong></span> man
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor page. If you have a system which uses a very old version of <span><strong class="command">syslog</strong></span> that
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor only uses two arguments to the <span><strong class="command">openlog()</strong></span> function,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor then this clause is silently ignored.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">severity</strong></span> clause works like <span><strong class="command">syslog</strong></span>'s
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor "priorities", except that they can also be used if you are writing
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor straight to a file rather than using <span><strong class="command">syslog</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Messages which are not at least of the severity level given will
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor not be selected for the channel; messages of higher severity
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor will be accepted.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If you are using <span><strong class="command">syslog</strong></span>, then the <span><strong class="command">syslog.conf</strong></span> priorities
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor will also determine what eventually passes through. For example,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor defining a channel facility and severity as <span><strong class="command">daemon</strong></span> and <span><strong class="command">debug</strong></span> but
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor only logging <span><strong class="command">daemon.warning</strong></span> via <span><strong class="command">syslog.conf</strong></span> will
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor cause messages of severity <span><strong class="command">info</strong></span> and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">notice</strong></span> to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor be dropped. If the situation were reversed, with <span><strong class="command">named</strong></span> writing
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor messages of only <span><strong class="command">warning</strong></span> or higher,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor then <span><strong class="command">syslogd</strong></span> would
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor print all messages it received from the channel.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">stderr</strong></span> destination clause
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor channel to the server's standard error stream. This is intended
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor use when the server is running as a foreground process, for
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor when debugging a configuration.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The server can supply extensive debugging information when
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor it is in debugging mode. If the server's global debug level is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor than zero, then debugging mode will be active. The global debug
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor level is set either by starting the <span><strong class="command">named</strong></span> server
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor with the <code class="option">-d</code> flag followed by a positive integer,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor or by running <span><strong class="command">rndc trace</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The global debug level
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor can be set to zero, and debugging mode turned off, by running <span><strong class="command">rndc
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylornotrace</strong></span>. All debugging messages in the server have a debug
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor level, and higher debug levels give more detailed output. Channels
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor that specify a specific debug severity, for example:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting">channel specific_debug_level {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor severity debug 3;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor will get debugging output of level 3 or less any time the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor server is in debugging mode, regardless of the global debugging
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor level. Channels with <span><strong class="command">dynamic</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor severity use the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor server's global debug level to determine what messages to print.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If <span><strong class="command">print-time</strong></span> has been turned on,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the date and time will be logged. <span><strong class="command">print-time</strong></span> may
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor be specified for a <span><strong class="command">syslog</strong></span> channel,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor but is usually
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor pointless since <span><strong class="command">syslog</strong></span> also logs
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the date and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor time. If <span><strong class="command">print-category</strong></span> is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor requested, then the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor category of the message will be logged as well. Finally, if <span><strong class="command">print-severity</strong></span> is
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor on, then the severity level of the message will be logged. The <span><strong class="command">print-</strong></span> options may
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor be used in any combination, and will always be printed in the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor order: time, category, severity. Here is an example where all
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor three <span><strong class="command">print-</strong></span> options
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="computeroutput">28-Feb-2000 15:05:32.863 general: notice: running</code>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor There are four predefined channels that are used for
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">named</strong></span>'s default logging as follows.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor How they are
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor used is described in <a href="Bv9ARM.ch06.html#the_category_phrase" title="The category Phrase">the section called “The <span><strong class="command">category</strong></span> Phrase”</a>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting">channel default_syslog {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor // send to syslog's daemon facility
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor syslog daemon;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor // only send priority info and higher
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor severity info;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylorchannel default_debug {
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor // write to named.run in the working directory
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor // Note: stderr is used instead of "named.run" if
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor // the server is started with the '-f' option.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor // log at the server's current debug level
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor severity dynamic;
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylorchannel default_stderr {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor // writes to stderr
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor // only send priority info and higher
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor severity info;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylorchannel null {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor // toss anything sent to this channel
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">default_debug</strong></span> channel has the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor property that it only produces output when the server's debug
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor nonzero. It normally writes to a file called <code class="filename">named.run</code>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in the server's working directory.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor For security reasons, when the "<code class="option">-u</code>"
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor command line option is used, the <code class="filename">named.run</code> file
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is created only after <span><strong class="command">named</strong></span> has
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor changed to the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor new UID, and any debug output generated while <span><strong class="command">named</strong></span> is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor starting up and still running as root is discarded. If you need
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to capture this output, you must run the server with the "<code class="option">-g</code>"
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor option and redirect standard error to a file.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Once a channel is defined, it cannot be redefined. Thus you
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor cannot alter the built-in channels directly, but you can modify
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the default logging by pointing categories at channels you have
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h4 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="the_category_phrase"></a>The <span><strong class="command">category</strong></span> Phrase</h4></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor There are many categories, so you can send the logs you want
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to see wherever you want, without seeing logs you don't want. If
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor you don't specify a list of channels for a category, then log
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in that category will be sent to the <span><strong class="command">default</strong></span> category
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor instead. If you don't specify a default category, the following
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor "default default" is used:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting">category default { default_syslog; default_debug; };
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor As an example, let's say you want to log security events to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor a file, but you also want keep the default logging behavior. You'd
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor specify the following:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting">channel my_security_channel {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor file "my_security_file";
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor severity info;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylorcategory security {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor my_security_channel;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor default_syslog;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor default_debug;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor To discard all messages in a category, specify the <span><strong class="command">null</strong></span> channel:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting">category xfer-out { null; };
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylorcategory notify { null; };
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Following are the available categories and brief descriptions
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor of the types of log information they contain. More
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor categories may be added in future <acronym class="acronym">BIND</acronym> releases.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">default</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The default category defines the logging
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor options for those categories where no specific
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor configuration has been
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">general</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The catch-all. Many things still aren't
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor classified into categories, and they all end up here.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">database</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Messages relating to the databases used
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor internally by the name server to store zone and cache
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">security</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Approval and denial of requests.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">config</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Configuration file parsing and processing.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">resolver</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor DNS resolution, such as the recursive
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor lookups performed on behalf of clients by a caching name
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">xfer-in</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Zone transfers the server is receiving.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">xfer-out</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Zone transfers the server is sending.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">notify</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The NOTIFY protocol.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">client</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Processing of client requests.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">unmatched</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Messages that <span><strong class="command">named</strong></span> was unable to determine the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor class of or for which there was no matching <span><strong class="command">view</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor A one line summary is also logged to the <span><strong class="command">client</strong></span> category.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This category is best sent to a file or stderr, by
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor default it is sent to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the <span><strong class="command">null</strong></span> channel.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">network</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Network operations.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">update</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Dynamic updates.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">update-security</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Approval and denial of update requests.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">queries</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specify where queries should be logged to.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor At startup, specifying the category <span><strong class="command">queries</strong></span> will also
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor enable query logging unless <span><strong class="command">querylog</strong></span> option has been
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The query log entry reports the client's IP
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor address and port number, and the query name,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor class and type. Next it reports whether the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Recursion Desired flag was set (+ if set, -
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor if not set), if the query was signed (S),
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor EDNS was in use (E), if DO (DNSSEC Ok) was
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor set (D), or if CD (Checking Disabled) was set
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor (C). After this the destination address the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor query was sent to is reported.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="computeroutput">client 127.0.0.1#62536: query: www.example.com IN AAAA +SE</code>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="computeroutput">client ::1#62537: query: www.example.net IN AAAA -SE</code>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">query-errors</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Information about queries that resulted in some
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">dispatch</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Dispatching of incoming packets to the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor server modules where they are to be processed.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">dnssec</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor DNSSEC and TSIG protocol processing.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">lame-servers</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Lame servers. These are misconfigurations
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in remote servers, discovered by BIND 9 when trying to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor query those servers during resolution.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">delegation-only</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Delegation only. Logs queries that have
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor been forced to NXDOMAIN as the result of a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor delegation-only zone or
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor a <span><strong class="command">delegation-only</strong></span> in a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor hint or stub zone declaration.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">edns-disabled</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Log queries that have been forced to use plain
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor DNS due to timeouts. This is often due to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the remote servers not being RFC 1034 compliant
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor (not always returning FORMERR or similar to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor EDNS queries and other extensions to the DNS
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor when they are not understood). In other words, this is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor targeted at servers that fail to respond to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor DNS queries that they don't understand.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Note: the log message can also be due to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor packet loss. Before reporting servers for
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor non-RFC 1034 compliance they should be re-tested
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to determine the nature of the non-compliance.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This testing should prevent or reduce the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor number of false-positive reports.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Note: eventually <span><strong class="command">named</strong></span> will have to stop
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor treating such timeouts as due to RFC 1034 non
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor compliance and start treating it as plain
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor packet loss. Falsely classifying packet
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor loss as due to RFC 1034 non compliance impacts
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor on DNSSEC validation which requires EDNS for
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the DNSSEC records to be returned.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h4 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2576882"></a>The <span><strong class="command">query-errors</strong></span> Category</h4></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">query-errors</strong></span> category is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor specifically intended for debugging purposes: To identify
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor why and how specific queries result in responses which
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor indicate an error.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Messages of this category are therefore only logged
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor with <span><strong class="command">debug</strong></span> levels.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor At the debug levels of 1 or higher, each response with the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor rcode of SERVFAIL is logged as follows:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="computeroutput">client 127.0.0.1#61502: query failed (SERVFAIL) for www.example.com/IN/AAAA at query.c:3880</code>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This means an error resulting in SERVFAIL was
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor detected at line 3880 of source file
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Log messages of this level will particularly
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor help identify the cause of SERVFAIL for an
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor authoritative server.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor At the debug levels of 2 or higher, detailed context
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor information of recursive resolutions that resulted in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor SERVFAIL is logged.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The log message will look like as follows:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylorfetch completed at resolver.c:2970 for www.example.com/A
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylorin 30.000183: timed out/success [domain:example.com,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylorreferral:2,restart:7,qrysent:8,timeout:5,lame:0,neterr:0,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylorbadresp:1,adberr:0,findfail:0,valfail:0]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The first part before the colon shows that a recursive
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor resolution for AAAA records of www.example.com completed
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in 30.000183 seconds and the final result that led to the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor SERVFAIL was determined at line 2970 of source file
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The following part shows the detected final result and the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor latest result of DNSSEC validation.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The latter is always success when no validation attempt
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor In this example, this query resulted in SERVFAIL probably
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor because all name servers are down or unreachable, leading
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to a timeout in 30 seconds.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor DNSSEC validation was probably not attempted.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The last part enclosed in square brackets shows statistics
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor information collected for this particular resolution
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <code class="varname">domain</code> field shows the deepest zone
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor that the resolver reached;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor it is the zone where the error was finally detected.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The meaning of the other fields is summarized in the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor following table.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The number of referrals the resolver received
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor throughout the resolution process.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor In the above example this is 2, which are most
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor likely com and example.com.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The number of cycles that the resolver tried
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor remote servers at the <code class="varname">domain</code>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor In each cycle the resolver sends one query
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor (possibly resending it, depending on the response)
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to each known name server of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The number of queries the resolver sent at the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The number of timeouts since the resolver
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor received the last response.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The number of lame servers the resolver detected
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor at the <code class="varname">domain</code> zone.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor A server is detected to be lame either by an
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor invalid response or as a result of lookup in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor BIND9's address database (ADB), where lame
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor servers are cached.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The number of erroneous results that the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor resolver encountered in sending queries
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor at the <code class="varname">domain</code> zone.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor One common case is the remote server is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor unreachable and the resolver receives an ICMP
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor unreachable error message.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The number of unexpected responses (other than
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="varname">lame</code>) to queries sent by the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor resolver at the <code class="varname">domain</code> zone.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Failures in finding remote server addresses
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor of the <code class="varname">domain</code> zone in the ADB.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor One common case of this is that the remote
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor server's name does not have any address records.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Failures of resolving remote server addresses.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This is a total number of failures throughout
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the resolution process.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Failures of DNSSEC validation.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Validation failures are counted throughout
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the resolution process (not limited to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the <code class="varname">domain</code> zone), but should
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor only happen in <code class="varname">domain</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor At the debug levels of 3 or higher, the same messages
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor as those at the debug 1 level are logged for other errors
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor than SERVFAIL.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Note that negative responses such as NXDOMAIN are not
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor regarded as errors here.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor At the debug levels of 4 or higher, the same messages
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor as those at the debug 2 level are logged for other errors
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor than SERVFAIL.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Unlike the above case of level 3, messages are logged for
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor negative responses.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This is because any unexpected results can be difficult to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor debug in the recursion case.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2577401"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This is the grammar of the <span><strong class="command">lwres</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statement in the <code class="filename">named.conf</code> file:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting"><span><strong class="command">lwres</strong></span> {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> listen-on { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> view <em class="replaceable"><code>view_name</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> search { <em class="replaceable"><code>domain_name</code></em> ; [<span class="optional"> <em class="replaceable"><code>domain_name</code></em> ; ... </span>] }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> ndots <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2577475"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">lwres</strong></span> statement configures the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor server to also act as a lightweight resolver server. (See
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be multiple
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">lwres</strong></span> statements configuring
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor lightweight resolver servers with different properties.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">listen-on</strong></span> statement specifies a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor addresses (and ports) that this instance of a lightweight resolver
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor should accept requests on. If no port is specified, port 921 is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If this statement is omitted, requests will be accepted on
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">view</strong></span> statement binds this
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor instance of a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor lightweight resolver daemon to a view in the DNS namespace, so that
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor response will be constructed in the same manner as a normal DNS
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor matching this view. If this statement is omitted, the default view
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor used, and if there is no default view, an error is triggered.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">search</strong></span> statement is equivalent to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">search</strong></span> statement in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="filename">/etc/resolv.conf</code>. It provides a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor list of domains
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor which are appended to relative names in queries.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">ndots</strong></span> statement is equivalent to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">ndots</strong></span> statement in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="filename">/etc/resolv.conf</code>. It indicates the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor number of dots in a relative domain name that should result in an
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor exact match lookup before search path elements are appended.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2577539"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> |
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] };
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2577582"></a><span><strong class="command">masters</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<p><span><strong class="command">masters</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor lists allow for a common set of masters to be easily used by
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor multiple stub and slave zones.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h3 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2577597"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This is the grammar of the <span><strong class="command">options</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statement in the <code class="filename">named.conf</code> file:
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting"><span><strong class="command">options</strong></span> {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> attach-cache <em class="replaceable"><code>cache_name</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> version <em class="replaceable"><code>version_string</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> hostname <em class="replaceable"><code>hostname_string</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> server-id <em class="replaceable"><code>server_id_string</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> directory <em class="replaceable"><code>path_name</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> named-xfer <em class="replaceable"><code>path_name</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> tkey-gssapi-credential <em class="replaceable"><code>principal</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> tkey-domain <em class="replaceable"><code>domainname</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> tkey-dhkey <em class="replaceable"><code>key_name</code></em> <em class="replaceable"><code>key_tag</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> cache-file <em class="replaceable"><code>path_name</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> dump-file <em class="replaceable"><code>path_name</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> bindkeys-file <em class="replaceable"><code>path_name</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> memstatistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> memstatistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> pid-file <em class="replaceable"><code>path_name</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> recursing-file <em class="replaceable"><code>path_name</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> statistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> auth-nxdomain <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> deallocate-on-exit <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> fake-iquery <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> fetch-glue <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> flush-zones-on-shutdown <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> has-old-clients <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> host-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> host-statistics-max <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> minimal-responses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> multiple-cnames <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> recursion <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> rfc2308-type1 <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> use-id-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> ixfr-from-differences (<em class="replaceable"><code>yes_or_no</code></em> | <code class="constant">master</code> | <code class="constant">slave</code>); </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> dnssec-enable <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> dnssec-validation <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> dnssec-lookaside ( <em class="replaceable"><code>auto</code></em> |
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em> ); </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> dnssec-must-be-secure <em class="replaceable"><code>domain yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> dnssec-accept-expired <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> forward ( <em class="replaceable"><code>only</code></em> | <em class="replaceable"><code>first</code></em> ); </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> dual-stack-servers [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] {
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor ( <em class="replaceable"><code>domain_name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] |
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ) ;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor ... }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> check-names ( <em class="replaceable"><code>master</code></em> | <em class="replaceable"><code>slave</code></em> | <em class="replaceable"><code>response</code></em> )
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> check-mx ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> check-mx-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> check-srv-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> check-sibling <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> allow-query-cache { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> allow-query-cache-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> allow-recursion { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> allow-recursion-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> allow-v6-synthesis { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> blackhole { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> use-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> avoid-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> use-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> avoid-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> listen-on [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> listen-on-v6 [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> query-source ( ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> )
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> address ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> query-source-v6 ( ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> )
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> address ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> queryport-pool-interval <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> tcp-clients <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> reserved-sockets <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> recursive-clients <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> serial-query-rate <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> serial-queries <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> tcp-listen-queue <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> transfers-in <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> transfers-out <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> transfers-per-ns <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> coresize <em class="replaceable"><code>size_spec</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> datasize <em class="replaceable"><code>size_spec</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> files <em class="replaceable"><code>size_spec</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> stacksize <em class="replaceable"><code>size_spec</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> heartbeat-interval <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> interface-interval <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> statistics-interval <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> topology { <em class="replaceable"><code>address_match_list</code></em> }</span>];
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> sortlist { <em class="replaceable"><code>address_match_list</code></em> }</span>];
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> rrset-order { <em class="replaceable"><code>order_spec</code></em> ; [<span class="optional"> <em class="replaceable"><code>order_spec</code></em> ; ... </span>] </span>] };
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> lame-ttl <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> max-ncache-ttl <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> max-cache-ttl <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> min-roots <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> use-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> treat-cr-as-space <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> min-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> additional-from-auth <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> additional-from-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> random-device <em class="replaceable"><code>path_name</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> max-cache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> match-mapped-addresses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> preferred-glue ( <em class="replaceable"><code>A</code></em> | <em class="replaceable"><code>AAAA</code></em> | <em class="replaceable"><code>NONE</code></em> ); </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> edns-udp-size <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> max-udp-size <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> root-delegation-only [<span class="optional"> exclude { <em class="replaceable"><code>namelist</code></em> } </span>] ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> querylog <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> disable-algorithms <em class="replaceable"><code>domain</code></em> { <em class="replaceable"><code>algorithm</code></em>;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> <em class="replaceable"><code>algorithm</code></em>; </span>] }; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> acache-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> acache-cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> max-acache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> max-clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor [<span class="optional"> empty-server <em class="replaceable"><code>name</code></em> ; </span>]
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor [<span class="optional"> empty-contact <em class="replaceable"><code>name</code></em> ; </span>]
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor [<span class="optional"> empty-zones-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor [<span class="optional"> disable-empty-zone <em class="replaceable"><code>zone_name</code></em> ; </span>]
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor [<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor [<span class="optional"> zero-no-soa-ttl-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<div class="titlepage"><div><div><h3 class="title">
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<a name="options"></a><span><strong class="command">options</strong></span> Statement Definition and
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The <span><strong class="command">options</strong></span> statement sets up global
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor to be used by <acronym class="acronym">BIND</acronym>. This statement
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor may appear only
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor once in a configuration file. If there is no <span><strong class="command">options</strong></span>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor statement, an options block with each option set to its default will
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">attach-cache</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor Allows multiple views to share a single cache
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor Each view has its own cache database by default, but
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor if multiple views have the same operational policy
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor for name resolution and caching, those views can
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor share a single cache to save memory and possibly
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor improve resolution efficiency by using this option.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The <span><strong class="command">attach-cache</strong></span> option
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor may also be specified in <span><strong class="command">view</strong></span>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor statements, in which case it overrides the
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor global <span><strong class="command">attach-cache</strong></span> option.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The <em class="replaceable"><code>cache_name</code></em> specifies
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor the cache to be shared.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor When the <span><strong class="command">named</strong></span> server configures
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor views which are supposed to share a cache, it
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor creates a cache with the specified name for the
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor first view of these sharing views.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The rest of the views will simply refer to the
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor already created cache.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor One common configuration to share a cache would be to
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor allow all views to share a single cache.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor This can be done by specifying
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor the <span><strong class="command">attach-cache</strong></span> as a global
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor option with an arbitrary name.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor Another possible operation is to allow a subset of
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor all views to share a cache while the others to
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor retain their own caches.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor For example, if there are three views A, B, and C,
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor and only A and B should share a cache, specify the
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor <span><strong class="command">attach-cache</strong></span> option as a view A (or
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor B)'s option, referring to the other view name:
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor // this view has its own cache
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor // this view refers to A's cache
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor attach-cache "A";
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor // this view has its own cache
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Views that share a cache must have the same policy
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor on configurable parameters that may affect caching.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The current implementation requires the following
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor configurable options be consistent among these
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">check-names</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">cleaning-interval</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">dnssec-accept-expired</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">dnssec-validation</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">max-cache-ttl</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">max-ncache-ttl</strong></span>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">max-cache-size</strong></span>, and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">zero-no-soa-ttl</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Note that there may be other parameters that may
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor cause confusion if they are inconsistent for
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor different views that share a single cache.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor For example, if these views define different sets of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor forwarders that can return different answers for the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor same question, sharing the answer does not make
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor sense or could even be harmful.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor It is administrator's responsibility to ensure
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor configuration differences in different views do
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor not cause disruption with a shared cache.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">directory</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The working directory of the server.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Any non-absolute pathnames in the configuration file will be
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor as relative to this directory. The default location for most
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor output files (e.g. <code class="filename">named.run</code>)
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is this directory.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If a directory is not specified, the working directory
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor defaults to `<code class="filename">.</code>', the directory from
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor which the server
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor was started. The directory specified should be an absolute
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">key-directory</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor When performing dynamic update of secure zones, the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor directory where the public and private key files should be
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor if different than the current working directory. The
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor directory specified
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor must be an absolute path.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">named-xfer</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span class="emphasis"><em>This option is obsolete.</em></span> It
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor was used in <acronym class="acronym">BIND</acronym> 8 to specify
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the pathname to the <span><strong class="command">named-xfer</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor program. In <acronym class="acronym">BIND</acronym> 9, no separate
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">named-xfer</strong></span> program is needed;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor its functionality is built into the name server.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">tkey-gssapi-credential</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The security credential with which the server should
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor authenticate keys requested by the GSS-TSIG protocol.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Currently only Kerberos 5 authentication is available
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and the credential is a Kerberos principal which
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the server can acquire through the default system
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor key file, normally <code class="filename">/etc/krb5.keytab</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Normally this principal is of the form
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor "<strong class="userinput"><code>dns/</code></strong><code class="varname">server.domain</code>".
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor To use GSS-TSIG, <span><strong class="command">tkey-domain</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor must also be set.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">tkey-domain</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The domain appended to the names of all shared keys
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor generated with <span><strong class="command">TKEY</strong></span>. When a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor client requests a <span><strong class="command">TKEY</strong></span> exchange,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor it may or may not specify the desired name for the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor key. If present, the name of the shared key will
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor be <code class="varname">client specified part</code> +
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="varname">tkey-domain</code>. Otherwise, the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor name of the shared key will be <code class="varname">random hex
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor digits</code> + <code class="varname">tkey-domain</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor In most cases, the <span><strong class="command">domainname</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor should be the server's domain name, or an otherwise
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor non-existent subdomain like
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor "_tkey.<code class="varname">domainname</code>". If you are
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor using GSS-TSIG, this variable must be defined.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">tkey-dhkey</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The Diffie-Hellman key used by the server
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to generate shared keys with clients using the Diffie-Hellman
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor of <span><strong class="command">TKEY</strong></span>. The server must be
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor able to load the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor public and private keys from files in the working directory.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor most cases, the keyname should be the server's host name.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">cache-file</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This is for testing only. Do not use.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">dump-file</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The pathname of the file the server dumps
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the database to when instructed to do so with
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">rndc dumpdb</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If not specified, the default is <code class="filename">named_dump.db</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">memstatistics-file</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The pathname of the file the server writes memory
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor usage statistics to on exit. If not specified,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the default is <code class="filename">named.memstats</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">pid-file</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The pathname of the file the server writes its process ID
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in. If not specified, the default is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <code class="filename">/var/run/named/named.pid</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The PID file is used by programs that want to send signals to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor name server. Specifying <span><strong class="command">pid-file none</strong></span> disables the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor use of a PID file — no file will be written and any
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor existing one will be removed. Note that <span><strong class="command">none</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is a keyword, not a filename, and therefore is not enclosed
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor double quotes.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">recursing-file</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The pathname of the file the server dumps
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the queries that are currently recursing when instructed
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to do so with <span><strong class="command">rndc recursing</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If not specified, the default is <code class="filename">named.recursing</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">statistics-file</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The pathname of the file the server appends statistics
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to when instructed to do so using <span><strong class="command">rndc stats</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If not specified, the default is <code class="filename">named.stats</code> in the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor server's current directory. The format of the file is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">bindkeys-file</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The pathname of a file to override the built-in trusted
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor keys provided by named. See the discussion of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">dnssec-lookaside</strong></span> for details.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If not specified, the default is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">port</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor receiving and sending DNS protocol traffic.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The default is 53. This option is mainly intended for server
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor a server using a port other than 53 will not be able to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor communicate with
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the global DNS.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">random-device</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The source of entropy to be used by the server. Entropy is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor primarily needed
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor for DNSSEC operations, such as TKEY transactions and dynamic
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor update of signed
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor zones. This options specifies the device (or file) from which
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor entropy. If this is a file, operations requiring entropy will
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor fail when the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor file has been exhausted. If not specified, the default value
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor (or equivalent) when present, and none otherwise. The
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">random-device</strong></span> option takes
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor effect during
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the initial configuration load at server startup time and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is ignored on subsequent reloads.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">preferred-glue</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If specified, the listed type (A or AAAA) will be emitted
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor before other glue
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in the additional section of a query response.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The default is not to prefer any type (NONE).
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">root-delegation-only</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Turn on enforcement of delegation-only in TLDs (top level domains) and root zones
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor with an optional
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor exclude list.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Note some TLDs are not delegation only (e.g. "DE", "LV", "US"
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and "MUSEUM").
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">disable-algorithms</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Disable the specified DNSSEC algorithms at and below the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor specified name.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Multiple <span><strong class="command">disable-algorithms</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statements are allowed.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Only the most specific will be applied.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">dnssec-lookaside</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor When set, <span><strong class="command">dnssec-lookaside</strong></span> provides the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor validator with an alternate method to validate DNSKEY
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor records at the top of a zone. When a DNSKEY is at or
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor below a domain specified by the deepest
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">dnssec-lookaside</strong></span>, and the normal dnssec
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor validation has left the key untrusted, the trust-anchor
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor will be append to the key name and a DLV record will be
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor looked up to see if it can validate the key. If the DLV
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor record validates a DNSKEY (similarly to the way a DS record
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor does) the DNSKEY RRset is deemed to be trusted.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If <span><strong class="command">dnssec-lookaside</strong></span> is set to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor "auto", then built-in default values for
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the domain and trust anchor will be used, along
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor with a built-in key for validation.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor NOTE: Since the built-in key may expire, it can be
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor overridden without recompiling named by placing a new key
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in the file <code class="filename">bind.keys</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">dnssec-must-be-secure</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specify hierarchies which must be or may not be secure
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor (signed and validated). If <strong class="userinput"><code>yes</code></strong>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor then <span><strong class="command">named</strong></span> will only accept answers if
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor they are secure. If <strong class="userinput"><code>no</code></strong>, then normal
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor DNSSEC validation applies allowing for insecure answers to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor be accepted. The specified domain must be under a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">trusted-key</strong></span> or
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">dnssec-lookaside</strong></span> must be active.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h4 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="boolean_options"></a>Boolean Options</h4></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">auth-nxdomain</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If <strong class="userinput"><code>yes</code></strong>, then the <span><strong class="command">AA</strong></span> bit
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is always set on NXDOMAIN responses, even if the server is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor not actually
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor authoritative. The default is <strong class="userinput"><code>no</code></strong>;
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor a change from <acronym class="acronym">BIND</acronym> 8. If you
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor are using very old DNS software, you
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor may need to set it to <strong class="userinput"><code>yes</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">deallocate-on-exit</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This option was used in <acronym class="acronym">BIND</acronym>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor 8 to enable checking
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor for memory leaks on exit. <acronym class="acronym">BIND</acronym> 9 ignores the option and always performs
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">memstatistics</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Write memory statistics to the file specified by
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">memstatistics-file</strong></span> at exit.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The default is <strong class="userinput"><code>no</code></strong> unless
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor '-m record' is specified on the command line in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor which case it is <strong class="userinput"><code>yes</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">dialup</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If <strong class="userinput"><code>yes</code></strong>, then the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor server treats all zones as if they are doing zone transfers
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor a dial-on-demand dialup link, which can be brought up by
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor originating from this server. This has different effects
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to zone type and concentrates the zone maintenance so that
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor happens in a short interval, once every <span><strong class="command">heartbeat-interval</strong></span> and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor hopefully during the one call. It also suppresses some of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor zone maintenance traffic. The default is <strong class="userinput"><code>no</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">dialup</strong></span> option
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor may also be specified in the <span><strong class="command">view</strong></span> and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">zone</strong></span> statements,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in which case it overrides the global <span><strong class="command">dialup</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If the zone is a master zone, then the server will send out a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor request to all the slaves (default). This should trigger the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor number check in the slave (providing it supports NOTIFY)
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor allowing the slave
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to verify the zone while the connection is active.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The set of servers to which NOTIFY is sent can be controlled
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">notify</strong></span> and <span><strong class="command">also-notify</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor zone is a slave or stub zone, then the server will suppress
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor "zone up to date" (refresh) queries and only perform them
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">heartbeat-interval</strong></span> expires in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor addition to sending
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor NOTIFY requests.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Finer control can be achieved by using
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>notify</code></strong> which only sends NOTIFY
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>notify-passive</code></strong> which sends NOTIFY
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor messages and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor suppresses the normal refresh queries, <strong class="userinput"><code>refresh</code></strong>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor which suppresses normal refresh processing and sends refresh
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor when the <span><strong class="command">heartbeat-interval</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor expires, and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>passive</code></strong> which just disables normal
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor normal refresh
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor heart-beat refresh
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor heart-beat notify
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">no</strong></span> (default)</p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">yes</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">notify</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">refresh</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">passive</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <p><span><strong class="command">notify-passive</strong></span></p>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Note that normal NOTIFY processing is not affected by
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">dialup</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">fake-iquery</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor In <acronym class="acronym">BIND</acronym> 8, this option
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor enabled simulating the obsolete DNS query type
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor IQUERY. <acronym class="acronym">BIND</acronym> 9 never does
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor IQUERY simulation.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">fetch-glue</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This option is obsolete.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor In BIND 8, <strong class="userinput"><code>fetch-glue yes</code></strong>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor caused the server to attempt to fetch glue resource records
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor didn't have when constructing the additional
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor data section of a response. This is now considered a bad
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and BIND 9 never does it.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">flush-zones-on-shutdown</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor When the nameserver exits due receiving SIGTERM,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor flush or do not flush any pending zone writes. The default
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">flush-zones-on-shutdown</strong></span> <strong class="userinput"><code>no</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">has-old-clients</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This option was incorrectly implemented
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in <acronym class="acronym">BIND</acronym> 8, and is ignored by <acronym class="acronym">BIND</acronym> 9.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor To achieve the intended effect
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">has-old-clients</strong></span> <strong class="userinput"><code>yes</code></strong>, specify
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the two separate options <span><strong class="command">auth-nxdomain</strong></span> <strong class="userinput"><code>yes</code></strong>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and <span><strong class="command">rfc2308-type1</strong></span> <strong class="userinput"><code>no</code></strong> instead.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">host-statistics</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor In BIND 8, this enables keeping of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statistics for every host that the name server interacts
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Not implemented in BIND 9.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">maintain-ixfr-base</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span class="emphasis"><em>This option is obsolete</em></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor It was used in <acronym class="acronym">BIND</acronym> 8 to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor determine whether a transaction log was
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor kept for Incremental Zone Transfer. <acronym class="acronym">BIND</acronym> 9 maintains a transaction
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor log whenever possible. If you need to disable outgoing
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor incremental zone
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor transfers, use <span><strong class="command">provide-ixfr</strong></span> <strong class="userinput"><code>no</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">minimal-responses</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If <strong class="userinput"><code>yes</code></strong>, then when generating
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor responses the server will only add records to the authority
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and additional data sections when they are required (e.g.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor delegations, negative responses). This may improve the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor performance of the server.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The default is <strong class="userinput"><code>no</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">multiple-cnames</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This option was used in <acronym class="acronym">BIND</acronym> 8 to allow
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor a domain name to have multiple CNAME records in violation of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the DNS standards. <acronym class="acronym">BIND</acronym> 9.2 onwards
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor always strictly enforces the CNAME rules both in master
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor files and dynamic updates.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">notify</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If <strong class="userinput"><code>yes</code></strong> (the default),
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor DNS NOTIFY messages are sent when a zone the server is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor authoritative for
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor changes, see <a href="Bv9ARM.ch04.html#notify" title="Notify">the section called “Notify”</a>. The messages are
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor servers listed in the zone's NS records (except the master
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor server identified
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in the SOA MNAME field), and to any servers listed in the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">also-notify</strong></span> option.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If <strong class="userinput"><code>master-only</code></strong>, notifies are only
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor for master zones.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If <strong class="userinput"><code>explicit</code></strong>, notifies are sent only
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor servers explicitly listed using <span><strong class="command">also-notify</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If <strong class="userinput"><code>no</code></strong>, no notifies are sent.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">notify</strong></span> option may also be
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor specified in the <span><strong class="command">zone</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in which case it overrides the <span><strong class="command">options notify</strong></span> statement.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor It would only be necessary to turn off this option if it
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor caused slaves
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">notify-to-soa</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If <strong class="userinput"><code>yes</code></strong> do not check the nameservers
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in the NS RRset against the SOA MNAME. Normally a NOTIFY
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor message is not sent to the SOA MNAME (SOA ORIGIN) as it is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor supposed to contain the name of the ultimate master.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Sometimes, however, a slave is listed as the SOA MNAME in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor hidden master configurations and in that case you would
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor want the ultimate master to still send NOTIFY messages to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor all the nameservers listed in the NS RRset.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">recursion</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If <strong class="userinput"><code>yes</code></strong>, and a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor DNS query requests recursion, then the server will attempt
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor all the work required to answer the query. If recursion is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and the server does not already know the answer, it will
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor referral response. The default is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>yes</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Note that setting <span><strong class="command">recursion no</strong></span> does not prevent
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor clients from getting data from the server's cache; it only
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor prevents new data from being cached as an effect of client
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Caching may still occur as an effect the server's internal
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor operation, such as NOTIFY address lookups.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor See also <span><strong class="command">fetch-glue</strong></span> above.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">rfc2308-type1</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Setting this to <strong class="userinput"><code>yes</code></strong> will
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor cause the server to send NS records along with the SOA
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor record for negative
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor answers. The default is <strong class="userinput"><code>no</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Not yet implemented in <acronym class="acronym">BIND</acronym>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">use-id-pool</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span class="emphasis"><em>This option is obsolete</em></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <acronym class="acronym">BIND</acronym> 9 always allocates query
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor IDs from a pool.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">zone-statistics</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If <strong class="userinput"><code>yes</code></strong>, the server will collect
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statistical data on all zones (unless specifically turned
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor on a per-zone basis by specifying <span><strong class="command">zone-statistics no</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in the <span><strong class="command">zone</strong></span> statement).
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor These statistics may be accessed
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor using <span><strong class="command">rndc stats</strong></span>, which will
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor dump them to the file listed
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in the <span><strong class="command">statistics-file</strong></span>. See
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor also <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">use-ixfr</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span class="emphasis"><em>This option is obsolete</em></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If you need to disable IXFR to a particular server or
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor servers, see
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the information on the <span><strong class="command">provide-ixfr</strong></span> option
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Usage”</a>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <a href="Bv9ARM.ch04.html#incremental_zone_transfers" title="Incremental Zone Transfers (IXFR)">the section called “Incremental Zone Transfers (IXFR)”</a>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">provide-ixfr</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor See the description of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">provide-ixfr</strong></span> in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Usage”</a>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">request-ixfr</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor See the description of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">request-ixfr</strong></span> in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Usage”</a>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">treat-cr-as-space</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This option was used in <acronym class="acronym">BIND</acronym>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the server treat carriage return ("<span><strong class="command">\r</strong></span>") characters the same way
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor as a space or tab character,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to facilitate loading of zone files on a UNIX system that
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor were generated
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor on an NT or DOS machine. In <acronym class="acronym">BIND</acronym> 9, both UNIX "<span><strong class="command">\n</strong></span>"
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and NT/DOS "<span><strong class="command">\r\n</strong></span>" newlines
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor are always accepted,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and the option is ignored.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<span class="term"><span><strong class="command">additional-from-auth</strong></span>, </span><span class="term"><span><strong class="command">additional-from-cache</strong></span></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor These options control the behavior of an authoritative
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor answering queries which have additional data, or when
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor following CNAME
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and DNAME chains.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor When both of these options are set to <strong class="userinput"><code>yes</code></strong>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor (the default) and a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor query is being answered from authoritative data (a zone
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor configured into the server), the additional data section of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor reply will be filled in using data from other authoritative
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and from the cache. In some situations this is undesirable,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor as when there is concern over the correctness of the cache,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor in servers where slave zones may be added and modified by
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor untrusted third parties. Also, avoiding
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the search for this additional data will speed up server
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor at the possible expense of additional queries to resolve
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor otherwise be provided in the additional section.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor For example, if a query asks for an MX record for host <code class="literal">foo.example.com</code>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor and the record found is "<code class="literal">MX 10 mail.example.net</code>", normally the address
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor records (A and AAAA) for <code class="literal">mail.example.net</code> will be provided as well,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor if known, even though they are not in the example.com zone.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Setting these options to <span><strong class="command">no</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor disables this behavior and makes
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the server only search for additional data in the zone it
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor answers from.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor These options are intended for use in authoritative-only
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor servers, or in authoritative-only views. Attempts to set
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor them to <span><strong class="command">no</strong></span> without also
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">recursion no</strong></span> will cause the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor ignore the options and log a warning message.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specifying <span><strong class="command">additional-from-cache no</strong></span> actually
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor disables the use of the cache not only for additional data
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor but also when looking up the answer. This is usually the
c7facc54c4abed9e554ff80225311e6b7048d3c9Bill Taylor behavior in an authoritative-only server where the
c7facc54c4abed9e554ff80225311e6b7048d3c9Bill Taylor correctness of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the cached data is an issue.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor When a name server is non-recursively queried for a name
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor below the apex of any served zone, it normally answers with
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor "upwards referral" to the root servers or the servers of
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor known parent of the query name. Since the data in an
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor upwards referral
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor comes from the cache, the server will not be able to provide
c7facc54c4abed9e554ff80225311e6b7048d3c9Bill Taylor referrals when <span><strong class="command">additional-from-cache no</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor has been specified. Instead, it will respond to such
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor with REFUSED. This should not cause any problems since
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor upwards referrals are not required for the resolution
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">match-mapped-addresses</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor If <strong class="userinput"><code>yes</code></strong>, then an
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor IPv4-mapped IPv6 address will match any address match
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor list entries that match the corresponding IPv4 address.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor Enabling this option is sometimes useful on IPv6-enabled
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor systems, to work around a kernel quirk that causes IPv4
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor TCP connections such as zone transfers to be accepted
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor on an IPv6 socket using mapped addresses, causing
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor address match lists designed for IPv4 to fail to match.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The use of this option for any other purpose is discouraged.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor When <strong class="userinput"><code>yes</code></strong> and the server loads a new version of a master
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor zone from its zone file or receives a new version of a slave
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor file by a non-incremental zone transfer, it will compare
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor the new version to the previous one and calculate a set
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor of differences. The differences are then logged in the
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor zone's journal file such that the changes can be transmitted
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor to downstream slaves as an incremental zone transfer.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor By allowing incremental zone transfers to be used for
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor non-dynamic zones, this option saves bandwidth at the
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor expense of increased CPU and memory consumption at the
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor In particular, if the new version of a zone is completely
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor different from the previous one, the set of differences
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor will be of a size comparable to the combined size of the
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor old and new zone version, and the server will need to
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor temporarily allocate memory to hold this complete
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor difference set.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<p><span><strong class="command">ixfr-from-differences</strong></span>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor also accepts <span><strong class="command">master</strong></span> and
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor <span><strong class="command">slave</strong></span> at the view and options
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor levels which causes
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor <span><strong class="command">ixfr-from-differences</strong></span> to be enabled for
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor all <span><strong class="command">master</strong></span> or
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor <span><strong class="command">slave</strong></span> zones respectively.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor It is off by default.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">multi-master</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor This should be set when you have multiple masters for a zone
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor addresses refer to different machines. If <strong class="userinput"><code>yes</code></strong>, <span><strong class="command">named</strong></span> will
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor when the serial number on the master is less than what <span><strong class="command">named</strong></span>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor has. The default is <strong class="userinput"><code>no</code></strong>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">dnssec-enable</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor Enable DNSSEC support in <span><strong class="command">named</strong></span>. Unless set to <strong class="userinput"><code>yes</code></strong>,
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor <span><strong class="command">named</strong></span> behaves as if it does not support DNSSEC.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The default is <strong class="userinput"><code>yes</code></strong>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">dnssec-validation</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor Enable DNSSEC validation in <span><strong class="command">named</strong></span>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor set to <strong class="userinput"><code>yes</code></strong> to be effective.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The default is <strong class="userinput"><code>yes</code></strong>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">dnssec-accept-expired</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor Accept expired signatures when verifying DNSSEC signatures.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The default is <strong class="userinput"><code>no</code></strong>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor Setting this option to "yes" leaves <span><strong class="command">named</strong></span> vulnerable to replay attacks.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">querylog</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor Specify whether query logging should be started when <span><strong class="command">named</strong></span>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor If <span><strong class="command">querylog</strong></span> is not specified,
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor then the query logging
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor is determined by the presence of the logging category <span><strong class="command">queries</strong></span>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">check-names</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor This option is used to restrict the character set and syntax
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor certain domain names in master files and/or DNS responses
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor from the network. The default varies according to usage
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor For <span><strong class="command">slave</strong></span> zones the default
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor is <span><strong class="command">warn</strong></span>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor For answers received from the network (<span><strong class="command">response</strong></span>)
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor the default is <span><strong class="command">ignore</strong></span>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The rules for legal hostnames and mail domains are derived
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor from RFC 952 and RFC 821 as modified by RFC 1123.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<p><span><strong class="command">check-names</strong></span>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor applies to the owner names of A, AAAA and MX records.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor It also applies to the domain names in the RDATA of NS, SOA,
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor MX, and SRV records.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor It also applies to the RDATA of PTR records where the owner
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor name indicated that it is a reverse lookup of a hostname
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT).
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">check-mx</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor Check whether the MX record appears to refer to a IP address.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The default is to <span><strong class="command">warn</strong></span>. Other possible
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor values are <span><strong class="command">fail</strong></span> and
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor <span><strong class="command">ignore</strong></span>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">check-wildcard</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor This option is used to check for non-terminal wildcards.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The use of non-terminal wildcards is almost always as a
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor result of a failure
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor to understand the wildcard matching algorithm (RFC 1034).
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor affects master zones. The default (<span><strong class="command">yes</strong></span>) is to check
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor for non-terminal wildcards and issue a warning.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">check-integrity</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor Perform post load zone integrity checks on master
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor zones. This checks that MX and SRV records refer
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor to address (A or AAAA) records and that glue
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor address records exist for delegated zones. For
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor MX and SRV records only in-zone hostnames are
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor checked (for out-of-zone hostnames use
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor <span><strong class="command">named-checkzone</strong></span>).
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor For NS records only names below top of zone are
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor checked (for out-of-zone names and glue consistency
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor checks use <span><strong class="command">named-checkzone</strong></span>).
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The default is <span><strong class="command">yes</strong></span>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">check-mx-cname</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor If <span><strong class="command">check-integrity</strong></span> is set then
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor fail, warn or ignore MX records that refer
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor to CNAMES. The default is to <span><strong class="command">warn</strong></span>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">check-srv-cname</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor If <span><strong class="command">check-integrity</strong></span> is set then
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor fail, warn or ignore SRV records that refer
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor to CNAMES. The default is to <span><strong class="command">warn</strong></span>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">check-sibling</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor When performing integrity checks, also check that
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor sibling glue exists. The default is <span><strong class="command">yes</strong></span>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">zero-no-soa-ttl</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor When returning authoritative negative responses to
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor SOA queries set the TTL of the SOA record returned in
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor the authority section to zero.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The default is <span><strong class="command">yes</strong></span>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">zero-no-soa-ttl-cache</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor When caching a negative response to a SOA query
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor set the TTL to zero.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The default is <span><strong class="command">no</strong></span>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<dt><span class="term"><span><strong class="command">update-check-ksk</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor When regenerating the RRSIGs following a UPDATE
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor request to a secure zone, check the KSK flag on
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor the DNSKEY RR to determine if this key should be
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor used to generate the RRSIG. This flag is ignored
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor if there are not DNSKEY RRs both with and without
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The default is <span><strong class="command">yes</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">try-tcp-refresh</strong></span></span></dt>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor Try to refresh the zone using TCP if UDP queries fail.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor For BIND 8 compatibility, the default is
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor <span><strong class="command">yes</strong></span>.
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<div class="titlepage"><div><div><h4 class="title">
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor<a name="id2581964"></a>Forwarding</h4></div></div></div>
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor The forwarding facility can be used to create a large site-wide
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor cache on a few servers, reducing traffic over links to external
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor name servers. It can also be used to allow queries by servers that
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor do not have direct access to the Internet, but wish to look up
17a2b317610f531d565bf4e940433aab2d9e6985Bill Taylor names anyway. Forwarding occurs only on those queries for which
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the server is not authoritative and does not have the answer in
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">forward</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This option is only meaningful if the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor forwarders list is not empty. A value of <code class="varname">first</code>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the default, causes the server to query the forwarders
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor first — and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor if that doesn't answer the question, the server will then
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the answer itself. If <code class="varname">only</code> is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor specified, the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor server will only query the forwarders.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">forwarders</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specifies the IP addresses to be used
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor for forwarding. The default is the empty list (no
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor forwarding).
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Forwarding can also be configured on a per-domain basis, allowing
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor for the global forwarding options to be overridden in a variety
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor of ways. You can set particular domains to use different
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor or have a different <span><strong class="command">forward only/first</strong></span> behavior,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor or not forward at all, see <a href="Bv9ARM.ch06.html#zone_statement_grammar" title="zone
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Statement Grammar">the section called “<span><strong class="command">zone</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Statement Grammar”</a>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h4 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2582091"></a>Dual-stack Servers</h4></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Dual-stack servers are used as servers of last resort to work
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor problems in reachability due the lack of support for either IPv4
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor on the host machine.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">dual-stack-servers</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specifies host names or addresses of machines with access to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor both IPv4 and IPv6 transports. If a hostname is used, the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor server must be able
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to resolve the name using only the transport it has. If the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor machine is dual
c7facc54c4abed9e554ff80225311e6b7048d3c9Bill Taylor stacked, then the <span><strong class="command">dual-stack-servers</strong></span> have no effect unless
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor access to a transport has been disabled on the command line
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor (e.g. <span><strong class="command">named -4</strong></span>).
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h4 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="access_control"></a>Access Control</h4></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Access to the server can be restricted based on the IP address
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor of the requesting system. See <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a> for
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor details on how to specify IP address lists.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt>
c7facc54c4abed9e554ff80225311e6b7048d3c9Bill Taylor Specifies which hosts are allowed to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor notify this server, a slave, of zone changes in addition
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to the zone masters.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">allow-notify</strong></span> may also be
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor specified in the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">zone</strong></span> statement, in which case
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor it overrides the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">options allow-notify</strong></span>
c7facc54c4abed9e554ff80225311e6b7048d3c9Bill Taylor statement. It is only meaningful
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor for a slave zone. If not specified, the default is to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor process notify messages
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor only from a zone's master.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">allow-query</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specifies which hosts are allowed to ask ordinary
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor DNS questions. <span><strong class="command">allow-query</strong></span> may
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor also be specified in the <span><strong class="command">zone</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statement, in which case it overrides the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">options allow-query</strong></span> statement.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If not specified, the default is to allow queries
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor from all hosts.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
c7facc54c4abed9e554ff80225311e6b7048d3c9Bill Taylor <span><strong class="command">allow-query-cache</strong></span> is now
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor used to specify access to the cache.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">allow-query-on</strong></span></span></dt>
c7facc54c4abed9e554ff80225311e6b7048d3c9Bill Taylor Specifies which local addresses can accept ordinary
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor DNS questions. This makes it possible, for instance,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to allow queries on internal-facing interfaces but
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor disallow them on external-facing ones, without
c7facc54c4abed9e554ff80225311e6b7048d3c9Bill Taylor necessarily knowing the internal network's addresses.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">allow-query-on</strong></span> may
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor also be specified in the <span><strong class="command">zone</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statement, in which case it overrides the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">options allow-query-on</strong></span> statement.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If not specified, the default is to allow queries
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor on all addresses.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">allow-query-cache</strong></span> is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor used to specify access to the cache.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">allow-query-cache</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specifies which hosts are allowed to get answers
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor from the cache. If <span><strong class="command">allow-query-cache</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is not set then <span><strong class="command">allow-recursion</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is used if set, otherwise <span><strong class="command">allow-query</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is used if set unless <span><strong class="command">recursion no;</strong></span> is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor set in which case <span><strong class="command">none;</strong></span> is used,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor otherwise the default (<span><strong class="command">localnets;</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">localhost;</strong></span>) is used.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">allow-query-cache-on</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specifies which local addresses can give answers
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor from the cache. If not specified, the default is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to allow cache queries on any address,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">localnets</strong></span> and
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">localhost</strong></span>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">allow-recursion</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specifies which hosts are allowed to make recursive
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor queries through this server. If
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">allow-recursion</strong></span> is not set
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor then <span><strong class="command">allow-query-cache</strong></span> is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor used if set, otherwise <span><strong class="command">allow-query</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is used if set, otherwise the default
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor (<span><strong class="command">localnets;</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <span><strong class="command">localhost;</strong></span>) is used.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">allow-recursion-on</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specifies which local addresses can accept recursive
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor queries. If not specified, the default is to allow
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor recursive queries on all addresses.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">allow-update</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specifies which hosts are allowed to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor submit Dynamic DNS updates for master zones. The default is
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor updates from all hosts. Note that allowing updates based
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor on the requestor's IP address is insecure; see
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a> for details.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specifies which hosts are allowed to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor submit Dynamic DNS updates to slave zones to be forwarded to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor master. The default is <strong class="userinput"><code>{ none; }</code></strong>,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor means that no update forwarding will be performed. To
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor update forwarding, specify
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>allow-update-forwarding { any; };</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specifying values other than <strong class="userinput"><code>{ none; }</code></strong> or
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor <strong class="userinput"><code>{ any; }</code></strong> is usually
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor counterproductive, since
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor the responsibility for update access control should rest
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor master server, not the slaves.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Note that enabling the update forwarding feature on a slave
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor may expose master servers relying on insecure IP address
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor access control to attacks; see <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor for more details.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">allow-v6-synthesis</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor This option was introduced for the smooth transition from
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor to A6 and from "nibble labels" to binary labels.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor However, since both A6 and binary labels were then
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor this option was also deprecated.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor It is now ignored with some warning messages.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">allow-transfer</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specifies which hosts are allowed to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor receive zone transfers from the server. <span><strong class="command">allow-transfer</strong></span> may
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor also be specified in the <span><strong class="command">zone</strong></span>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor statement, in which
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor case it overrides the <span><strong class="command">options allow-transfer</strong></span> statement.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If not specified, the default is to allow transfers to all
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<dt><span class="term"><span><strong class="command">blackhole</strong></span></span></dt>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Specifies a list of addresses that the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor server will not accept queries from or use to resolve a
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor query. Queries
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor from these addresses will not be responded to. The default
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor is <strong class="userinput"><code>none</code></strong>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<div class="titlepage"><div><div><h4 class="title">
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<a name="id2582733"></a>Interfaces</h4></div></div></div>
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The interfaces and ports that the server will answer queries
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor an optional port and an <code class="varname">address_match_list</code>.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The server will listen on all interfaces allowed by the address
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor match list. If a port is not specified, port 53 will be used.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor Multiple <span><strong class="command">listen-on</strong></span> statements are
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor For example,
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor<pre class="programlisting">listen-on { 5.6.7.8; };
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor will enable the name server on port 53 for the IP address
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor 5.6.7.8, and on port 1234 of an address on the machine in net
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor 1.2 that is not 1.2.3.4.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor If no <span><strong class="command">listen-on</strong></span> is specified, the
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor server will listen on port 53 on all IPv4 interfaces.
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor The <span><strong class="command">listen-on-v6</strong></span> option is used to
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor specify the interfaces and the ports on which the server will
9e39c5ba00a55fa05777cc94b148296af305e135Bill Taylor for incoming queries sent using IPv6.
unless <span><strong class="command">-6</strong></span> is specified when <span><strong class="command">named</strong></span> is
<span><strong class="command">named</strong></span> will listen on port 53 on all IPv6 interfaces by default.
If <span><strong class="command">address</strong></span> is <span><strong class="command">*</strong></span> (asterisk) or is omitted,
If <span><strong class="command">port</strong></span> is <span><strong class="command">*</strong></span> or is omitted,
<dt><span class="term"><span><strong class="command">queryport-pool-ports</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">queryport-pool-updateinterval</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
the load on the remote name server. <span><strong class="command">transfers-per-ns</strong></span> may
be overridden on a per-server basis by using the <span><strong class="command">transfers</strong></span> phrase
<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
See <a href="Bv9ARM.ch06.html#query_address" title="Query Address">the section called “Query Address”</a> about how the
to prevent <span><strong class="command">named</strong></span> from choosing as its random source port a
of <span><strong class="command">size_spec</strong></span> in <a href="Bv9ARM.ch06.html#configuration_file_elements" title="Configuration File Elements">the section called “Configuration File Elements”</a>.
(see <a href="Bv9ARM.ch04.html#journal" title="The journal file">the section called “The journal file”</a>). When the journal file
<dt><span class="term"><span><strong class="command">host-statistics-max</strong></span></span></dt>
interfaces <span><strong class="command">named</strong></span> listens on, <span><strong class="command">tcp-clients</strong></span> as well as
<dt><span class="term"><span><strong class="command">statistics-interval</strong></span></span></dt>
topologically closest to itself. The <span><strong class="command">topology</strong></span> statement
<a name="the_sortlist_statement"></a>The <span><strong class="command">sortlist</strong></span> Statement</h4></div></div></div>
statement in <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>).
does (<a href="Bv9ARM.ch06.html#topology" title="Topology">the section called “Topology”</a>).
an IP prefix, an ACL name or a nested <span><strong class="command">address_match_list</strong></span>)
to the behavior of the address sort in <acronym class="acronym">BIND</acronym> 4.9.x. Responses sent
<a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a>.
If no name is specified, the default is "<span><strong class="command">*</strong></span>" (asterisk).
class IN type A name "host.example.com" order random;
<span><strong class="command">max-ncache-ttl</strong></span> is <code class="literal">10800</code> seconds (3 hours).
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
result of dynamic updates (<a href="Bv9ARM.ch04.html#dynamic_update" title="Dynamic Update">the section called “Dynamic Update”</a>) will expire. There
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
<a href="Bv9ARM.ch06.html#zonefile_format" title="Additional File Formats">the section called “Additional File Formats”</a>).
<a name="clients-per-query"></a><span class="term"><span><strong class="command">clients-per-query</strong></span>, </span><span class="term"><span><strong class="command">max-clients-per-query</strong></span></span>
before dropping additional clients. <span><strong class="command">named</strong></span> will attempt to
If the number of queries exceed this value, <span><strong class="command">named</strong></span> will
built-in view (see <a href="Bv9ARM.ch06.html#view_statement_grammar" title="view Statement Grammar">the section called “<span><strong class="command">view</strong></span> Statement Grammar”</a>) of
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
<span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
Specifying <span><strong class="command">server-id hostname;</strong></span> will cause <span><strong class="command">named</strong></span> to
The default <span><strong class="command">server-id</strong></span> is <span><strong class="command">none</strong></span>.
<dt><span class="term"><span><strong class="command">acache-cleaning-interval</strong></span></span></dt>
<a name="server_statement_grammar"></a><span><strong class="command">server</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">server</strong></span> <em class="replaceable"><code>ip_addr[/prefixlen]</code></em> {
[<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em> ; ]</span>]
[<span class="optional"> keys <em class="replaceable"><code>{ string ; [<span class="optional"> string ; [<span class="optional">...</span>]</span>] }</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> query-source [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
[<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
[<span class="optional"> query-source-v6 [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
[<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
[<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> queryport-pool-interval <em class="replaceable"><code>number</code></em>; </span>]
<a name="server_statement_definition_and_usage"></a><span><strong class="command">server</strong></span> Statement Definition and
value of <span><strong class="command">bogus</strong></span> is <span><strong class="command">no</strong></span>.
that is advertised by <span><strong class="command">named</strong></span> when querying the remote server.
The server supports two zone transfer methods. The first, <span><strong class="command">one-answer</strong></span>,
uses one DNS message per resource record transferred. <span><strong class="command">many-answers</strong></span> packs
as many resource records as possible into a message. <span><strong class="command">many-answers</strong></span> is
more efficient, but is only known to be understood by <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
<span><strong class="command">key_id</strong></span> defined by the <span><strong class="command">key</strong></span> statement,
to be used for transaction security (TSIG, <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
<a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<a name="statschannels"></a><span><strong class="command">statistics-channels</strong></span> Statement Grammar</h3></div></div></div>
<a name="id2587051"></a><span><strong class="command">statistics-channels</strong></span> Statement Definition and
address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
<a name="id2587206"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div>
<em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
[<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
<a name="id2587257"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition
DNSSEC security roots. DNSSEC is described in <a href="Bv9ARM.ch04.html#DNSSEC" title="DNSSEC">the section called “DNSSEC”</a>. A security root is defined when the
named will also load a built-in trusted key for dlv.isc.org.
<a name="view_statement_grammar"></a><span><strong class="command">view</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">view</strong></span> <em class="replaceable"><code>view_name</code></em>
<a name="id2587362"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
// Provide a complete view of the example.com
zone "example.com" {
file "example-internal.db";
// Provide a restricted view of the example.com
zone "example.com" {
file "example-external.db";
<pre class="programlisting"><span><strong class="command">zone</strong></span> <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-policy { <em class="replaceable"><code>update_policy_rule</code></em> [<span class="optional">...</span>] }; </span>]
[<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
[<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-mx (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
[<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>] // Not Implemented.
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
<a name="id2588899"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div>
status of infrastructure zones (e.g. COM, NET, ORG).
a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>),
in the mid-1970s. Zone data for it can be specified with the <code class="literal">CHAOS</code> class.
<span><strong class="command">allow-notify</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query-on</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>.
<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
network. The default varies according to zone type. For <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>. For <span><strong class="command">slave</strong></span>
<span><strong class="command">check-mx</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-wildcard</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-integrity</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-sibling</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">zero-no-soa-ttl</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">update-check-ksk</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">try-tcp-refresh</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">dialup</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
after trying the forwarders and getting no answer, while <span><strong class="command">first</strong></span> would
This is applicable to <span><strong class="command">master</strong></span> and <span><strong class="command">slave</strong></span> zones.
<span><strong class="command">max-journal-size</strong></span> in <a href="Bv9ARM.ch06.html#server_resource_limits" title="Server Resource Limits">the section called “Server Resource Limits”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
<span><strong class="command">max-transfer-time-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
<span><strong class="command">max-transfer-time-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">notify-delay</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
zones when they are loaded from disk. <acronym class="acronym">BIND</acronym> 9 does not verify signatures
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
<span><strong class="command">sig-validity-interval</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-nodes</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span><strong class="command">sig-signing-signatures</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-type</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
<span><strong class="command">alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
<span><strong class="command">alt-transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
<span><strong class="command">use-alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
See the description in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
<span><strong class="command">ixfr-from-differences</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">key-directory</strong></span> in <a href="Bv9ARM.ch06.html#options" title="options Statement Definition and
Usage">the section called “<span><strong class="command">options</strong></span> Statement Definition and
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
( <span><strong class="command">grant</strong></span> | <span><strong class="command">deny</strong></span> ) <em class="replaceable"><code>identity</code></em> <em class="replaceable"><code>nametype</code></em> <em class="replaceable"><code>name</code></em> [<span class="optional"> <em class="replaceable"><code>types</code></em> </span>]
<a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div>
that a particular nearby server be tried first. See <a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a> and <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>.
built-in server information zones, e.g.,
any order), and if neither of those succeed, delivery to <code class="literal">mail.backup.org</code> will
and PTR records. Entries in the in-addr.arpa domain are made in
in-addr.arpa name of
3.2.1.10.in-addr.arpa. This name should have a PTR resource record
Master File Directives include <span><strong class="command">$ORIGIN</strong></span>, <span><strong class="command">$INCLUDE</strong></span>,
<a name="id2594424"></a>The <span><strong class="command">@</strong></span> (at-sign)</h4></div></div></div>
<a name="id2594440"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div>
$ORIGIN example.com.
<a name="id2594637"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div>
if it were included into the file at this point. If <span><strong class="command">origin</strong></span> is
revert to the values they had prior to the <span><strong class="command">$INCLUDE</strong></span> once
<a name="id2594707"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div>
<a name="id2594743"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div>
Classless IN-ADDR.ARPA delegation.
HOST-1.EXAMPLE. MX 0 .
HOST-2.EXAMPLE. A 1.2.3.2
HOST-2.EXAMPLE. MX 0 .
HOST-3.EXAMPLE. A 1.2.3.3
HOST-3.EXAMPLE. MX 0 .
HOST-127.EXAMPLE. A 1.2.3.127
HOST-127.EXAMPLE. MX 0 .
(<span><strong class="command">n</strong></span> or <span><strong class="command">N</strong></span>\
The <span><strong class="command">$GENERATE</strong></span> directive is a <acronym class="acronym">BIND</acronym> extension
(see <a href="Bv9ARM.ch06.html#statschannels" title="statistics-channels Statement Grammar">the section called “<span><strong class="command">statistics-channels</strong></span> Statement Grammar”</a>.)
<a href="Bv9ARM.ch06.html#clients-per-query"><span><strong class="command">clients-per-query</strong></span></a>.)
<a name="id2599016"></a>Compatibility with <span class="emphasis"><em>BIND</em></span> 8 Counters</h4></div></div></div>
<td width="40%" align="left" valign="top">Chapter�5.�The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver�</td>