Bv9ARM.ch06.html revision ac93437301f55ed69bf85883a497a75598c628f9
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User - Copyright (C) 2000-2003 Internet Software Consortium.
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User - Permission to use, copy, modify, and distribute this software for any
7c1468ed500356839a4a222517364e6ce18cb1a2Tinderbox User - purpose with or without fee is hereby granted, provided that the above
c57668a2fbbe558c1bd21652813616f2f517c469Tinderbox User - copyright notice and this permission notice appear in all copies.
1f4c645185bd8fc70048e0a69eee46193a284e5cTinderbox User - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
8de3f14f1c300c3e1ed99084cc03485b42c92bf1Tinderbox User - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews - PERFORMANCE OF THIS SOFTWARE.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<!-- $Id: Bv9ARM.ch06.html,v 1.220 2009/05/15 01:15:47 tbox Exp $ -->
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<title>Chapter�6.�BIND 9 Configuration Reference</title>
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<link rel="prev" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<link rel="next" href="Bv9ARM.ch07.html" title="Chapter�7.�BIND 9 Security Considerations">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<table width="100%" summary="Navigation header">
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<tr><th colspan="3" align="center">Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</th></tr>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<a accesskey="p" href="Bv9ARM.ch05.html">Prev</a>�</td>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch07.html">Next</a>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<div class="titlepage"><div><div><h2 class="title">
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<a name="Bv9ARM.ch06"></a>Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</h2></div></div></div>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573737">Comment Syntax</a></span></dt>
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574436"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574626"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575053"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575070"><span><strong class="command">include</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575094"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575117"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575208"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575334"><span><strong class="command">logging</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577401"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577475"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577539"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577582"><span><strong class="command">masters</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577597"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#statschannels"><span><strong class="command">statistics-channels</strong></span> Statement Grammar</a></span></dt>
95637507c3d47481fbf0a8a8c750a57f944f677fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587051"><span><strong class="command">statistics-channels</strong></span> Statement Definition and
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587206"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587257"><span><strong class="command">trusted-keys</strong></span> Statement Definition
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587362"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2588899"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2591361">Zone File</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt>
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2593591">Discussion of MX Records</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt>
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2594206">Inverse Mapping in IPv4</a></span></dt>
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2594402">Other Zone File Directives</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2594743"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt>
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch06.html#statistics">BIND9 Statistics</a></span></dt>
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch06.html#statistics_counters">Statistics Counters</a></span></dt></dl></dd>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <acronym class="acronym">BIND</acronym> 9 configuration is broadly similar
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews to <acronym class="acronym">BIND</acronym> 8; however, there are a few new
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews of configuration, such as views. <acronym class="acronym">BIND</acronym>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User 8 configuration files should work with few alterations in <acronym class="acronym">BIND</acronym>
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews 9, although more complex configurations should be reviewed to check
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews if they can be more efficiently implemented using the new features
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User found in <acronym class="acronym">BIND</acronym> 9.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson <acronym class="acronym">BIND</acronym> 4 configuration files can be
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User converted to the new format
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews using the shell script
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <code class="filename">contrib/named-bootconf/named-bootconf.sh</code>.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson<div class="titlepage"><div><div><h2 class="title" style="clear: both">
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<a name="configuration_file_elements"></a>Configuration File Elements</h2></div></div></div>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User Following is a list of elements used throughout the <acronym class="acronym">BIND</acronym> configuration
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews file documentation:
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The name of an <code class="varname">address_match_list</code> as
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews defined by the <span><strong class="command">acl</strong></span> statement.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <code class="varname">address_match_list</code>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews A list of one or more
e20788e1216ed720aefa84f3295f7899d9f28c22Mark Andrews <code class="varname">ip_prefix</code>, <code class="varname">key_id</code>,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews or <code class="varname">acl_name</code> elements, see
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews A named list of one or more <code class="varname">ip_addr</code>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User with optional <code class="varname">key_id</code> and/or
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User A <code class="varname">masters_list</code> may include other
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson A quoted string which will be used as
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User a DNS name, for example "<code class="literal">my.test.domain</code>".
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User One to four integers valued 0 through
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews 255 separated by dots (`.'), such as <span><strong class="command">123</strong></span>,
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <span><strong class="command">45.67</strong></span> or <span><strong class="command">89.123.45.67</strong></span>.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User An IPv4 address with exactly four elements
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews in <code class="varname">dotted_decimal</code> notation.
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User An IPv6 address, such as <span><strong class="command">2001:db8::1234</strong></span>.
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater IPv6 scoped addresses that have ambiguity on their
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater scope zones must be disambiguated by an appropriate
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews zone ID with the percent character (`%') as
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews delimiter. It is strongly recommended to use
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User string zone names rather than numeric identifiers,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews in order to be robust against system configuration
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews changes. However, since there is no standard
4151211e6649332f7b5a55870cbe37128bcc7b29Tinderbox User mapping for such names and identifier values,
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews currently only interface names as link identifiers
bc0a53583d92309bebcf93c408e2f3247ebd3d3cAutomatic Updater are supported, assuming one-to-one mapping between
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater interfaces and links. For example, a link-local
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater address <span><strong class="command">fe80::1</strong></span> on the link
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater attached to the interface <span><strong class="command">ne0</strong></span>
b02be031b9ff37b042adc8e68e36b8bbc1f672b7Tinderbox User can be specified as <span><strong class="command">fe80::1%ne0</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Note that on most systems link-local addresses
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews always have the ambiguity, and need to be
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater disambiguated.
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater An <code class="varname">ip4_addr</code> or <code class="varname">ip6_addr</code>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews An IP port <code class="varname">number</code>.
b02be031b9ff37b042adc8e68e36b8bbc1f672b7Tinderbox User The <code class="varname">number</code> is limited to 0
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User through 65535, with values
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews below 1024 typically restricted to use by processes running
4fe0411487e8e4401477684c0a2bac041ca7c2d5Tinderbox User In some cases, an asterisk (`*') character can be used as a
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews placeholder to
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews select a random high-numbered port.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User An IP network specified as an <code class="varname">ip_addr</code>,
757ff043760e4743dda1a10e7d58349275934902Tinderbox User followed by a slash (`/') and then the number of bits in the
6025cbbe8408f4b09d53d5ec1e95cb6da97e0a8dTinderbox User Trailing zeros in a <code class="varname">ip_addr</code>
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews may omitted.
757ff043760e4743dda1a10e7d58349275934902Tinderbox User For example, <span><strong class="command">127/8</strong></span> is the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater network <span><strong class="command">127.0.0.0</strong></span> with
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews netmask <span><strong class="command">255.0.0.0</strong></span> and <span><strong class="command">1.2.3.0/28</strong></span> is
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews network <span><strong class="command">1.2.3.0</strong></span> with netmask <span><strong class="command">255.255.255.240</strong></span>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews When specifying a prefix involving a IPv6 scoped address
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews the scope may be omitted. In that case the prefix will
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews match packets from any scope.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson A <code class="varname">domain_name</code> representing
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User the name of a shared key, to be used for transaction
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews A list of one or more
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews separated by semicolons and ending with a semicolon.
e8fc8c884b44371784805e1e0d3100da403dd3f1Automatic Updater A non-negative 32-bit integer
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews (i.e., a number between 0 and 4294967295, inclusive).
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Its acceptable value might further
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews be limited by the context in which it is used.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews A quoted string which will be used as
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews a pathname, such as <code class="filename">zones/master/my.test.domain</code>.
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews A list of an <code class="varname">ip_port</code> or a port
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User A port range is specified in the form of
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User <strong class="userinput"><code>range</code></strong> followed by
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <code class="varname">port_high</code>, which represents
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater port numbers from <code class="varname">port_low</code> through
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <code class="varname">port_high</code>, inclusive.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <code class="varname">port_low</code> must not be larger than
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews For example,
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User <strong class="userinput"><code>range 1024 65535</code></strong> represents
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews ports from 1024 through 65535.
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User In either case an asterisk (`*') character is not
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews allowed as a valid <code class="varname">ip_port</code>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews A number, the word <strong class="userinput"><code>unlimited</code></strong>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews or the word <strong class="userinput"><code>default</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington An <code class="varname">unlimited</code> <code class="varname">size_spec</code> requests unlimited
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews use, or the maximum available amount. A <code class="varname">default size_spec</code> uses
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews the limit that was in force when the server was started.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews A <code class="varname">number</code> can optionally be
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews followed by a scaling factor:
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <strong class="userinput"><code>K</code></strong> or <strong class="userinput"><code>k</code></strong>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews for kilobytes,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <strong class="userinput"><code>M</code></strong> or <strong class="userinput"><code>m</code></strong>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews for megabytes, and
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <strong class="userinput"><code>G</code></strong> or <strong class="userinput"><code>g</code></strong> for gigabytes,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User which scale by 1024, 1024*1024, and 1024*1024*1024
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews respectively.
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews The value must be representable as a 64-bit unsigned integer
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews (0 to 18446744073709551615, inclusive).
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews Using <code class="varname">unlimited</code> is the best
f7369b2881b5e63d69600adcedc8ba938303d30cTinderbox User to safely set a really large number.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Either <strong class="userinput"><code>yes</code></strong> or <strong class="userinput"><code>no</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The words <strong class="userinput"><code>true</code></strong> and <strong class="userinput"><code>false</code></strong> are
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington also accepted, as are the numbers <strong class="userinput"><code>1</code></strong>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington and <strong class="userinput"><code>0</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington One of <strong class="userinput"><code>yes</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>no</code></strong>, <strong class="userinput"><code>notify</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>notify-passive</code></strong>, <strong class="userinput"><code>refresh</code></strong> or
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>passive</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington When used in a zone, <strong class="userinput"><code>notify-passive</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>refresh</code></strong>, and <strong class="userinput"><code>passive</code></strong>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington are restricted to slave and stub zones.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h3 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="address_match_lists"></a>Address Match Lists</h3></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573504"></a>Syntax</h4></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ;
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> address_match_list_element; ... </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] |
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington key key_id | acl_name | { address_match_list } )
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573600"></a>Definition and Usage</h4></div></div></div>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Address match lists are primarily used to determine access
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews control for various server operations. They are also used in
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the <span><strong class="command">listen-on</strong></span> and <span><strong class="command">sortlist</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews statements. The elements which constitute an address match
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews list can be any of the following:
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater a key ID, as defined by the <span><strong class="command">key</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<li>the name of an address match list defined with
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater the <span><strong class="command">acl</strong></span> statement
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater<li>a nested address match list enclosed in braces</li>
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater Elements can be negated with a leading exclamation mark (`!'),
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater and the match list names "any", "none", "localhost", and
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater "localnets" are predefined. More information on those names
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews can be found in the description of the acl statement.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User The addition of the key clause made the name of this syntactic
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User element something of a misnomer, since security keys can be used
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User to validate access without regard to a host or network address.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User Nonetheless, the term "address match list" is still used
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User throughout the documentation.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User When a given IP address or prefix is compared to an address
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews match list, the comparison takes place in approximately O(1)
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User time. However, key comparisons require that the list of keys
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews be traversed until a matching key is found, and therefore may
0accdb26ead1fe520a9820b52efbea64bdf564e3Tinderbox User be somewhat slower.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User The interpretation of a match depends on whether the list is being
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User used for access control, defining <span><strong class="command">listen-on</strong></span> ports, or in a
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span><strong class="command">sortlist</strong></span>, and whether the element was negated.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews When used as an access control list, a non-negated match
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews allows access and a negated match denies access. If
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews there is no match, access is denied. The clauses
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">allow-notify</strong></span>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">allow-recursion</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-recursion-on</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-query</strong></span>,
febbdb34a7f7759922e239655e7429d78d3a8d26Tinderbox User <span><strong class="command">allow-query-on</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-query-cache</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-query-cache-on</strong></span>,
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">allow-transfer</strong></span>,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span><strong class="command">allow-update</strong></span>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">allow-update-forwarding</strong></span>, and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">blackhole</strong></span> all use address match
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews lists. Similarly, the <span><strong class="command">listen-on</strong></span> option will cause the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews server to refuse queries on any of the machine's
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews addresses which do not match the list.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Order of insertion is significant. If more than one element
c01dec514a81ecf8c17ca3ef8c3ba95e437295ebAutomatic Updater in an ACL is found to match a given IP address or prefix,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater preference will be given to the one that came
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="emphasis"><em>first</em></span> in the ACL definition.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Because of this first-match behavior, an element that
e8c42d50cdaf3a3b841074d8bf72b40ffbae2a4bTinderbox User defines a subset of another element in the list should
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater come before the broader element, regardless of whether
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater either is negated. For example, in
e20309353e6246485c521278131d3fced73d7957Tinderbox User <span><strong class="command">1.2.3/24; ! 1.2.3.13;</strong></span>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews the 1.2.3.13 element is completely useless because the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington algorithm will match any lookup for 1.2.3.13 to the 1.2.3/24
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington element. Using <span><strong class="command">! 1.2.3.13; 1.2.3/24</strong></span> fixes
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington that problem by having 1.2.3.13 blocked by the negation, but
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington all other 1.2.3.* hosts fall through.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h3 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573737"></a>Comment Syntax</h3></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington comments to appear
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington file. To appeal to programmers of all kinds, they can be written
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews<div class="titlepage"><div><div><h4 class="title">
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews<a name="id2573752"></a>Syntax</h4></div></div></div>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<pre class="programlisting">// This is a <acronym class="acronym">BIND</acronym> comment as in C++</pre>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<pre class="programlisting"># This is a <acronym class="acronym">BIND</acronym> comment as in common UNIX shells
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater# and perl</pre>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<div class="titlepage"><div><div><h4 class="title">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<a name="id2573782"></a>Definition and Usage</h4></div></div></div>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Comments may appear anywhere that whitespace may appear in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater a <acronym class="acronym">BIND</acronym> configuration file.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews C-style comments start with the two characters /* (slash,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington star) and end with */ (star, slash). Because they are completely
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews delimited with these characters, they can be used to comment only
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews a portion of a line or to span multiple lines.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington C-style comments cannot be nested. For example, the following
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington is not valid because the entire comment ends with the first */:
b7aab05edae933e169d5f83c653935b17c7f0a8bMark Andrews<pre class="programlisting">/* This is the start of a comment.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington This is still part of the comment.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington/* This is an incorrect attempt at nesting a comment. */
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington This is no longer in any comment. */
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington C++-style comments start with the two characters // (slash,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington slash) and continue to the end of the physical line. They cannot
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington be continued across multiple physical lines; to have one logical
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User comment span multiple lines, each line must use the // pair.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews For example:
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<pre class="programlisting">// This is the start of a comment. The next line
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington// is a new comment, even though it is logically
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington// part of the previous comment.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Shell-style (or perl-style, if you prefer) comments start
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington with the character <code class="literal">#</code> (number sign)
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater and continue to the end of the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater physical line, as in C++ comments.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews For example:
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<pre class="programlisting"># This is the start of a comment. The next line
56effd2e3f579fd77b1fb37d47871d1bf1286bc4Automatic Updater# is a new comment, even though it is logically
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User# part of the previous comment.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews You cannot use the semicolon (`;') character
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews to start a comment such as you would in a zone file. The
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews semicolon indicates the end of a configuration
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h2 class="title" style="clear: both">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="Configuration_File_Grammar"></a>Configuration File Grammar</h2></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington A <acronym class="acronym">BIND</acronym> 9 configuration consists of
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews statements and comments.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Statements end with a semicolon. Statements and comments are the
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews only elements that can appear without enclosing braces. Many
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington statements contain a block of sub-statements, which are also
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews terminated with a semicolon.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews The following statements are supported:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="informaltable"><table border="1">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <p><span><strong class="command">acl</strong></span></p>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews defines a named IP address
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews matching list, for access control and other uses.
536da846f6cc03ad8abbb8bb9d5d8a6f607b8c33Mark Andrews <p><span><strong class="command">controls</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User declares control channels to be used
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews by the <span><strong class="command">rndc</strong></span> utility.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <p><span><strong class="command">include</strong></span></p>
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User includes a file.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <p><span><strong class="command">key</strong></span></p>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews specifies key information for use in
1fdd58445074579ee3b65c871137a7a1740eb542Mark Andrews authentication and authorization using TSIG.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span><strong class="command">logging</strong></span></p>
f33f2b8afe60de897c53cdcb17911f10b552699fTinderbox User specifies what the server logs, and where
532d27b39244fadfcf8d8b4593f4c65434c9c664Automatic Updater the log messages are sent.
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews <p><span><strong class="command">lwres</strong></span></p>
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews configures <span><strong class="command">named</strong></span> to
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews also act as a light-weight resolver daemon (<span><strong class="command">lwresd</strong></span>).
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews <p><span><strong class="command">masters</strong></span></p>
93089a352d6903b0d7845a039de4ec2df9a0e35aTinderbox User defines a named masters list for
93089a352d6903b0d7845a039de4ec2df9a0e35aTinderbox User inclusion in stub and slave zone masters clauses.
665ba746c0585088d0c314dcfc4671aa2c7b2dc1Automatic Updater <p><span><strong class="command">options</strong></span></p>
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews controls global server configuration
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater options and sets defaults for other statements.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">server</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater sets certain configuration options on
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater a per-server basis.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">statistics-channels</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater declares communication channels to get access to
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <span><strong class="command">named</strong></span> statistics.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">trusted-keys</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater defines trusted DNSSEC keys.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">view</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater defines a view.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <p><span><strong class="command">zone</strong></span></p>
bf8c3776f1bf1a1270e5e0443ae5a8df022632a8Mark Andrews defines a zone.
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater The <span><strong class="command">logging</strong></span> and
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater <span><strong class="command">options</strong></span> statements may only occur once
3040b455151b1e1173193933664b2891b6159f24Mark Andrews configuration.
ec8755f605d7dcb2de1076040e77bc2d7ec33b4aTinderbox User<div class="titlepage"><div><div><h3 class="title">
4ea3649f028ea6a1e42377082a7ccf8f789fb950Automatic Updater<a name="id2574436"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div>
40072ce70bc4125329addb4aaa56d18a1230bc17Automatic Updater<pre class="programlisting"><span><strong class="command">acl</strong></span> acl-name {
60d5d17479b47c03b9c7c86f54269718103750b8Automatic Updater address_match_list
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater<a name="acl"></a><span><strong class="command">acl</strong></span> Statement Definition and
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater The <span><strong class="command">acl</strong></span> statement assigns a symbolic
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater name to an address match list. It gets its name from a primary
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater use of address match lists: Access Control Lists (ACLs).
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater Note that an address match list's name must be defined
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater with <span><strong class="command">acl</strong></span> before it can be used
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater elsewhere; no forward references are allowed.
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater The following ACLs are built-in:
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater<div class="informaltable"><table border="1">
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <p><span><strong class="command">any</strong></span></p>
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews Matches all hosts.
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington <p><span><strong class="command">none</strong></span></p>
01f91b9cd440833f66e7476e43659655cb52ad10Automatic Updater Matches no hosts.
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User <p><span><strong class="command">localhost</strong></span></p>
f45f40ec2814a5ff1ed443c968772a1b2e25c462Mark Andrews Matches the IPv4 and IPv6 addresses of all network
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User interfaces on the system.
54890cfd30f01bdd33b7fb997f9b89fb084c3438Tinderbox User <p><span><strong class="command">localnets</strong></span></p>
11b6b0d74bb8dd6bd1ce0b60ba7f9b66323f06d4Tinderbox User Matches any host on an IPv4 or IPv6 network
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews for which the system has an interface.
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews Some systems do not provide a way to determine the prefix
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews local IPv6 addresses.
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews In such a case, <span><strong class="command">localnets</strong></span>
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews only matches the local
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews IPv6 addresses, just like <span><strong class="command">localhost</strong></span>.
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User<div class="titlepage"><div><div><h3 class="title">
789875a1bd6d50c00d3bd883cad17ead1d3c21cdMark Andrews<a name="id2574626"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div>
789875a1bd6d50c00d3bd883cad17ead1d3c21cdMark Andrews<pre class="programlisting"><span><strong class="command">controls</strong></span> {
789875a1bd6d50c00d3bd883cad17ead1d3c21cdMark Andrews [ inet ( ip_addr | * ) [ port ip_port ]
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews allow { <em class="replaceable"><code> address_match_list </code></em> }
08a1e53c738c425390557196a2ba5039e5afd364Mark Andrews keys { <em class="replaceable"><code>key_list</code></em> }; ]
7e8129652903780873ba91f379f9ffca1f59773cMark Andrews [ inet ...; ]
7e8129652903780873ba91f379f9ffca1f59773cMark Andrews [ unix <em class="replaceable"><code>path</code></em> perm <em class="replaceable"><code>number</code></em> owner <em class="replaceable"><code>number</code></em> group <em class="replaceable"><code>number</code></em>
7e8129652903780873ba91f379f9ffca1f59773cMark Andrews keys { <em class="replaceable"><code>key_list</code></em> }; ]
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews [ unix ...; ]
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews<div class="titlepage"><div><div><h3 class="title">
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews<a name="controls_statement_definition_and_usage"></a><span><strong class="command">controls</strong></span> Statement Definition and
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews The <span><strong class="command">controls</strong></span> statement declares control
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User channels to be used by system administrators to control the
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt operation of the name server. These control channels are
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt used by the <span><strong class="command">rndc</strong></span> utility to send
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt commands to and retrieve non-DNS results from a name server.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt An <span><strong class="command">inet</strong></span> control channel is a TCP socket
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt listening at the specified <span><strong class="command">ip_port</strong></span> on the
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt specified <span><strong class="command">ip_addr</strong></span>, which can be an IPv4 or IPv6
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User interpreted as the IPv4 wildcard address; connections will be
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User accepted on any of the system's IPv4 addresses.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt To listen on the IPv6 wildcard address,
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt use an <span><strong class="command">ip_addr</strong></span> of <code class="literal">::</code>.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt If you will only use <span><strong class="command">rndc</strong></span> on the local host,
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews using the loopback address (<code class="literal">127.0.0.1</code>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater or <code class="literal">::1</code>) is recommended for maximum security.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If no port is specified, port 953 is used. The asterisk
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater "<code class="literal">*</code>" cannot be used for <span><strong class="command">ip_port</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The ability to issue commands over the control channel is
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater restricted by the <span><strong class="command">allow</strong></span> and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">keys</strong></span> clauses.
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater Connections to the control channel are permitted based on the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">address_match_list</strong></span>. This is for simple
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews IP address based filtering only; any <span><strong class="command">key_id</strong></span>
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews elements of the <span><strong class="command">address_match_list</strong></span>
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews are ignored.
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews A <span><strong class="command">unix</strong></span> control channel is a UNIX domain
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews socket listening at the specified path in the file system.
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews Access to the socket is specified by the <span><strong class="command">perm</strong></span>,
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User <span><strong class="command">owner</strong></span> and <span><strong class="command">group</strong></span> clauses.
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User Note on some platforms (SunOS and Solaris) the permissions
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews (<span><strong class="command">perm</strong></span>) are applied to the parent directory
5b56652059e2c22185a0b2bb1f5e58eb89a44426Tinderbox User as the permissions on the socket itself are ignored.
ff62ab3c2e6274f19190ded15548c723d38bbbe3Automatic Updater The primary authorization mechanism of the command
ee23b913b6acccad68cf5af480b9e289a3d00510Tinderbox User channel is the <span><strong class="command">key_list</strong></span>, which
ee23b913b6acccad68cf5af480b9e289a3d00510Tinderbox User contains a list of <span><strong class="command">key_id</strong></span>s.
9a5217f827ac0e006016745e5305b31dc0c7767fTinderbox User Each <span><strong class="command">key_id</strong></span> in the <span><strong class="command">key_list</strong></span>
e20309353e6246485c521278131d3fced73d7957Tinderbox User is authorized to execute commands over the control channel.
e20309353e6246485c521278131d3fced73d7957Tinderbox User See <a href="Bv9ARM.ch03.html#rndc">Remote Name Daemon Control application</a> in <a href="Bv9ARM.ch03.html#admin_tools" title="Administrative Tools">the section called “Administrative Tools”</a>)
ee23b913b6acccad68cf5af480b9e289a3d00510Tinderbox User for information about configuring keys in <span><strong class="command">rndc</strong></span>.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews If no <span><strong class="command">controls</strong></span> statement is present,
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <span><strong class="command">named</strong></span> will set up a default
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User control channel listening on the loopback address 127.0.0.1
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User and its IPv6 counterpart ::1.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater In this case, and also when the <span><strong class="command">controls</strong></span> statement
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews is present but does not have a <span><strong class="command">keys</strong></span> clause,
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews <span><strong class="command">named</strong></span> will attempt to load the command channel key
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews from the file <code class="filename">rndc.key</code> in
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews <code class="filename">/etc</code> (or whatever <code class="varname">sysconfdir</code>
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews was specified as when <acronym class="acronym">BIND</acronym> was built).
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews To create a <code class="filename">rndc.key</code> file, run
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews <strong class="userinput"><code>rndc-confgen -a</code></strong>.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews The <code class="filename">rndc.key</code> feature was created to
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews ease the transition of systems from <acronym class="acronym">BIND</acronym> 8,
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews which did not have digital signatures on its command channel
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews messages and thus did not have a <span><strong class="command">keys</strong></span> clause.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews It makes it possible to use an existing <acronym class="acronym">BIND</acronym> 8
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews configuration file in <acronym class="acronym">BIND</acronym> 9 unchanged,
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews and still have <span><strong class="command">rndc</strong></span> work the same way
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews <span><strong class="command">ndc</strong></span> worked in BIND 8, simply by executing the
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews command <strong class="userinput"><code>rndc-confgen -a</code></strong> after BIND 9 is
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews Since the <code class="filename">rndc.key</code> feature
3040b455151b1e1173193933664b2891b6159f24Mark Andrews is only intended to allow the backward-compatible usage of
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt <acronym class="acronym">BIND</acronym> 8 configuration files, this
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User feature does not
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User have a high degree of configurability. You cannot easily change
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews the key name or the size of the secret, so you should make a
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <code class="filename">rndc.conf</code> with your own key if you
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User wish to change
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User those things. The <code class="filename">rndc.key</code> file
3f38b58ba4f674afd883eef5d976a7d4e0502673Tinderbox User permissions set such that only the owner of the file (the user that
3f38b58ba4f674afd883eef5d976a7d4e0502673Tinderbox User <span><strong class="command">named</strong></span> is running as) can access it.
3f38b58ba4f674afd883eef5d976a7d4e0502673Tinderbox User desire greater flexibility in allowing other users to access
3f38b58ba4f674afd883eef5d976a7d4e0502673Tinderbox User <span><strong class="command">rndc</strong></span> commands, then you need to create
3f38b58ba4f674afd883eef5d976a7d4e0502673Tinderbox User <code class="filename">rndc.conf</code> file and make it group
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater readable by a group
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that contains the users who should have access.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater To disable the command channel, use an empty
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">controls</strong></span> statement:
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">controls { };</strong></span>.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<div class="titlepage"><div><div><h3 class="title">
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater<a name="id2575053"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div>
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater<pre class="programlisting"><span><strong class="command">include</strong></span> <em class="replaceable"><code>filename</code></em>;</pre>
88d58d79c5bc7ce3c20a42461a5070116c736836Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2575070"></a><span><strong class="command">include</strong></span> Statement Definition and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">include</strong></span> statement inserts the
48b36fa08b2b5bc0d552dc2a4425b3f7007b3d59Automatic Updater specified file at the point where the <span><strong class="command">include</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater statement is encountered. The <span><strong class="command">include</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater statement facilitates the administration of configuration
3040b455151b1e1173193933664b2891b6159f24Mark Andrews by permitting the reading or writing of some things but not
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater others. For example, the statement could include private keys
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that are readable only by the name server.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User<div class="titlepage"><div><div><h3 class="title">
48b36fa08b2b5bc0d552dc2a4425b3f7007b3d59Automatic Updater<a name="id2575094"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div>
9fa39c73fc1d8bc44fdbbb79a1d26b837e7dd555Mark Andrews<pre class="programlisting"><span><strong class="command">key</strong></span> <em class="replaceable"><code>key_id</code></em> {
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater algorithm <em class="replaceable"><code>string</code></em>;
3040b455151b1e1173193933664b2891b6159f24Mark Andrews secret <em class="replaceable"><code>string</code></em>;
1959fd489a8832e4e3d311670f64ae18e5d08156Automatic Updater<div class="titlepage"><div><div><h3 class="title">
1959fd489a8832e4e3d311670f64ae18e5d08156Automatic Updater<a name="id2575117"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews The <span><strong class="command">key</strong></span> statement defines a shared
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User secret key for use with TSIG (see <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt or the command channel
3040b455151b1e1173193933664b2891b6159f24Mark Andrews (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User Usage”</a>).
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews The <span><strong class="command">key</strong></span> statement can occur at the
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews of the configuration file or inside a <span><strong class="command">view</strong></span>
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews statement. Keys defined in top-level <span><strong class="command">key</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User statements can be used in all views. Keys intended for use in
560d6da48f066000541dd43f5d407644dee12bebTinderbox User a <span><strong class="command">controls</strong></span> statement
7addb3e8b5cf6e0c4df0e3cb8135aa71269f0261Tinderbox User (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
3040b455151b1e1173193933664b2891b6159f24Mark Andrews Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater Usage”</a>)
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User must be defined at the top level.
8d8f9f7f86a33a155dd74b9b2c1317afca555d54Evan Hunt The <em class="replaceable"><code>key_id</code></em>, also known as the
8d8f9f7f86a33a155dd74b9b2c1317afca555d54Evan Hunt key name, is a domain name uniquely identifying the key. It can
3040b455151b1e1173193933664b2891b6159f24Mark Andrews be used in a <span><strong class="command">server</strong></span>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews statement to cause requests sent to that
90b25b84f037ec923efaee84d2c0dc599293d04eTinderbox User server to be signed with this key, or in address match lists to
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews verify that incoming requests have been signed with a key
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont matching this name, algorithm, and secret.
4dca64bb8991502db368028aeeba2f832d3b971dAutomatic Updater The <em class="replaceable"><code>algorithm_id</code></em> is a string
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont that specifies a security/authentication algorithm. Named
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User supports <code class="literal">hmac-md5</code>,
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater and <code class="literal">hmac-sha512</code> TSIG authentication.
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater Truncated hashes are supported by appending the minimum
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater number of required bits preceded by a dash, e.g.
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater <code class="literal">hmac-sha1-80</code>. The
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater <em class="replaceable"><code>secret_string</code></em> is the secret
7169f76a893666eb20fc7750782e7f411db742d6Tinderbox User to be used by the algorithm, and is treated as a base-64
7169f76a893666eb20fc7750782e7f411db742d6Tinderbox User encoded string.
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater<a name="id2575208"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div>
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater<pre class="programlisting"><span><strong class="command">logging</strong></span> {
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User [ <span><strong class="command">channel</strong></span> <em class="replaceable"><code>channel_name</code></em> {
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater ( <span><strong class="command">file</strong></span> <em class="replaceable"><code>path_name</code></em>
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater [ <span><strong class="command">versions</strong></span> ( <em class="replaceable"><code>number</code></em> | <span><strong class="command">unlimited</strong></span> ) ]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [ <span><strong class="command">size</strong></span> <em class="replaceable"><code>size spec</code></em> ]
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User | <span><strong class="command">syslog</strong></span> <em class="replaceable"><code>syslog_facility</code></em>
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User | <span><strong class="command">stderr</strong></span>
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt | <span><strong class="command">null</strong></span> );
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [ <span><strong class="command">severity</strong></span> (<code class="option">critical</code> | <code class="option">error</code> | <code class="option">warning</code> | <code class="option">notice</code> |
536da846f6cc03ad8abbb8bb9d5d8a6f607b8c33Mark Andrews <code class="option">info</code> | <code class="option">debug</code> [ <em class="replaceable"><code>level</code></em> ] | <code class="option">dynamic</code> ); ]
229ea4644b3a7d9c7fdaa43888e7f55ba01e2ee3Automatic Updater [ <span><strong class="command">print-category</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [ <span><strong class="command">print-severity</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [ <span><strong class="command">print-time</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
8eb631bc4a219650906a6dc6ca51af3034b6ba54Tinderbox User [ <span><strong class="command">category</strong></span> <em class="replaceable"><code>category_name</code></em> {
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <em class="replaceable"><code>channel_name</code></em> ; [ <em class="replaceable"><code>channel_name</code></em> ; ... ]
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User<div class="titlepage"><div><div><h3 class="title">
8eb631bc4a219650906a6dc6ca51af3034b6ba54Tinderbox User<a name="id2575334"></a><span><strong class="command">logging</strong></span> Statement Definition and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">logging</strong></span> statement configures a
3040b455151b1e1173193933664b2891b6159f24Mark Andrews variety of logging options for the name server. Its <span><strong class="command">channel</strong></span> phrase
e171a4137c6ba348957e61b7c4c3541493c0da02Automatic Updater associates output methods, format options and severity levels with
c53a6f37deaa396660adb6a4ca600c4a58adfd3fAutomatic Updater a name that can then be used with the <span><strong class="command">category</strong></span> phrase
c53a6f37deaa396660adb6a4ca600c4a58adfd3fAutomatic Updater to select how various classes of messages are logged.
e21f41f6504b3381be86cbe7f457f9ee1fff947bTinderbox User Only one <span><strong class="command">logging</strong></span> statement is used to
19ad308d84cbf446a144e5a91f2032389a9d65c1Tinderbox User as many channels and categories as are wanted. If there is no <span><strong class="command">logging</strong></span> statement,
19ad308d84cbf446a144e5a91f2032389a9d65c1Tinderbox User the logging configuration will be:
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater category default { default_syslog; default_debug; };
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater category unmatched { null; };
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater In <acronym class="acronym">BIND</acronym> 9, the logging configuration
af9cf290cea6ada6ce27b51c724ab77ad5d73fa0Tinderbox User is only established when
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater the entire configuration file has been parsed. In <acronym class="acronym">BIND</acronym> 8, it was
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User established as soon as the <span><strong class="command">logging</strong></span>
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater was parsed. When the server is starting up, all logging messages
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater regarding syntax errors in the configuration file go to the default
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater channels, or to standard error if the "<code class="option">-g</code>" option
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater was specified.
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater<div class="titlepage"><div><div><h4 class="title">
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater<a name="id2575386"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div>
4104e236f71eb5108fcfda6711878a97f6f4a8e7Automatic Updater All log output goes to one or more <span class="emphasis"><em>channels</em></span>;
4104e236f71eb5108fcfda6711878a97f6f4a8e7Automatic Updater you can make as many of them as you want.
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater Every channel definition must include a destination clause that
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater says whether messages selected for the channel go to a file, to a
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews particular syslog facility, to the standard error stream, or are
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews discarded. It can optionally also limit the message severity level
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews that will be accepted by the channel (the default is
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <span><strong class="command">info</strong></span>), and whether to include a
8e9f3b69914ee02a80b87c97b1f8093edb3e9ae0Automatic Updater <span><strong class="command">named</strong></span>-generated time stamp, the
664917bedafa65dee4349c84324a31731aa1e228Francis Dupont and/or severity level (the default is not to include any).
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User The <span><strong class="command">null</strong></span> destination clause
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User causes all messages sent to the channel to be discarded;
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User in that case, other options for the channel are meaningless.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">file</strong></span> destination clause directs
e20309353e6246485c521278131d3fced73d7957Tinderbox User to a disk file. It can include limitations
e20309353e6246485c521278131d3fced73d7957Tinderbox User both on how large the file is allowed to become, and how many
39cad8fb7d7ff3436bb24ce761354afcb80d295aMark Andrews of the file will be saved each time the file is opened.
39cad8fb7d7ff3436bb24ce761354afcb80d295aMark Andrews If you use the <span><strong class="command">versions</strong></span> log file
39cad8fb7d7ff3436bb24ce761354afcb80d295aMark Andrews option, then
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span><strong class="command">named</strong></span> will retain that many backup
3040b455151b1e1173193933664b2891b6159f24Mark Andrews versions of the file by
9d80d23172c30fd63e5046a7e69b8445e564ff31Automatic Updater renaming them when opening. For example, if you choose to keep
1f4c645185bd8fc70048e0a69eee46193a284e5cTinderbox User three old versions
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews of the file <code class="filename">lamers.log</code>, then just
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews before it is opened
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <code class="filename">lamers.log.1</code> is renamed to
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <code class="filename">lamers.log.2</code>, <code class="filename">lamers.log.0</code> is renamed
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews to <code class="filename">lamers.log.1</code>, and <code class="filename">lamers.log</code> is
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews renamed to <code class="filename">lamers.log.0</code>.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews You can say <span><strong class="command">versions unlimited</strong></span> to
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews the number of versions.
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews If a <span><strong class="command">size</strong></span> option is associated with
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews the log file,
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews then renaming is only done when the file being opened exceeds the
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews indicated size. No backup versions are kept by default; any
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews log file is simply appended.
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews The <span><strong class="command">size</strong></span> option for files is used
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews to limit log
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews growth. If the file ever exceeds the size, then <span><strong class="command">named</strong></span> will
3040b455151b1e1173193933664b2891b6159f24Mark Andrews stop writing to the file unless it has a <span><strong class="command">versions</strong></span> option
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User associated with it. If backup versions are kept, the files are
3040b455151b1e1173193933664b2891b6159f24Mark Andrews described above and a new one begun. If there is no
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User <span><strong class="command">versions</strong></span> option, no more data will
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User be written to the log
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User until some out-of-band mechanism removes or truncates the log to
3040b455151b1e1173193933664b2891b6159f24Mark Andrews less than the
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User maximum size. The default behavior is not to limit the size of
3040b455151b1e1173193933664b2891b6159f24Mark Andrews Example usage of the <span><strong class="command">size</strong></span> and
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User <span><strong class="command">versions</strong></span> options:
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<pre class="programlisting">channel an_example_channel {
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User file "example.log" versions 3 size 20m;
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt print-time yes;
3040b455151b1e1173193933664b2891b6159f24Mark Andrews print-category yes;
182bfea3ae9912f6d5e2f4fe3e13737719e06f97Tinderbox User The <span><strong class="command">syslog</strong></span> destination clause
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews channel to the system log. Its argument is a
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews syslog facility as described in the <span><strong class="command">syslog</strong></span> man
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews page. Known facilities are <span><strong class="command">kern</strong></span>, <span><strong class="command">user</strong></span>,
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews <span><strong class="command">mail</strong></span>, <span><strong class="command">daemon</strong></span>, <span><strong class="command">auth</strong></span>,
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews <span><strong class="command">syslog</strong></span>, <span><strong class="command">lpr</strong></span>, <span><strong class="command">news</strong></span>,
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews <span><strong class="command">uucp</strong></span>, <span><strong class="command">cron</strong></span>, <span><strong class="command">authpriv</strong></span>,
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews <span><strong class="command">ftp</strong></span>, <span><strong class="command">local0</strong></span>, <span><strong class="command">local1</strong></span>,
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews <span><strong class="command">local2</strong></span>, <span><strong class="command">local3</strong></span>, <span><strong class="command">local4</strong></span>,
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User <span><strong class="command">local5</strong></span>, <span><strong class="command">local6</strong></span> and
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">local7</strong></span>, however not all facilities
3040b455151b1e1173193933664b2891b6159f24Mark Andrews are supported on
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews all operating systems.
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews How <span><strong class="command">syslog</strong></span> will handle messages
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews this facility is described in the <span><strong class="command">syslog.conf</strong></span> man
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews page. If you have a system which uses a very old version of <span><strong class="command">syslog</strong></span> that
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews only uses two arguments to the <span><strong class="command">openlog()</strong></span> function,
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews then this clause is silently ignored.
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews The <span><strong class="command">severity</strong></span> clause works like <span><strong class="command">syslog</strong></span>'s
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews "priorities", except that they can also be used if you are writing
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews straight to a file rather than using <span><strong class="command">syslog</strong></span>.
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews Messages which are not at least of the severity level given will
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews not be selected for the channel; messages of higher severity
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User will be accepted.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews If you are using <span><strong class="command">syslog</strong></span>, then the <span><strong class="command">syslog.conf</strong></span> priorities
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater will also determine what eventually passes through. For example,
f09f1bf18e3ad40a0e8a6cc3dabf1c11f04992cbMark Andrews defining a channel facility and severity as <span><strong class="command">daemon</strong></span> and <span><strong class="command">debug</strong></span> but
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater only logging <span><strong class="command">daemon.warning</strong></span> via <span><strong class="command">syslog.conf</strong></span> will
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews cause messages of severity <span><strong class="command">info</strong></span> and
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <span><strong class="command">notice</strong></span> to
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User be dropped. If the situation were reversed, with <span><strong class="command">named</strong></span> writing
8c9c79e5fea0cb698026a74821695907c8312a46Mark Andrews messages of only <span><strong class="command">warning</strong></span> or higher,
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User then <span><strong class="command">syslogd</strong></span> would
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User print all messages it received from the channel.
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater The <span><strong class="command">stderr</strong></span> destination clause
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater channel to the server's standard error stream. This is intended
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater use when the server is running as a foreground process, for
3040b455151b1e1173193933664b2891b6159f24Mark Andrews when debugging a configuration.
6025cbbe8408f4b09d53d5ec1e95cb6da97e0a8dTinderbox User The server can supply extensive debugging information when
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews it is in debugging mode. If the server's global debug level is
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews than zero, then debugging mode will be active. The global debug
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews level is set either by starting the <span><strong class="command">named</strong></span> server
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews with the <code class="option">-d</code> flag followed by a positive integer,
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews or by running <span><strong class="command">rndc trace</strong></span>.
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews The global debug level
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington can be set to zero, and debugging mode turned off, by running <span><strong class="command">rndc
7cc0a5d21ef046bfd630c4769943d896a7d7472cTinderbox Usernotrace</strong></span>. All debugging messages in the server have a debug
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater level, and higher debug levels give more detailed output. Channels
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington that specify a specific debug severity, for example:
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<pre class="programlisting">channel specific_debug_level {
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater severity debug 3;
e007e3e5b0316c6c05698a71101885743aca22bdAutomatic Updater will get debugging output of level 3 or less any time the
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews server is in debugging mode, regardless of the global debugging
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User level. Channels with <span><strong class="command">dynamic</strong></span>
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews severity use the
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews server's global debug level to determine what messages to print.
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews If <span><strong class="command">print-time</strong></span> has been turned on,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews the date and time will be logged. <span><strong class="command">print-time</strong></span> may
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews be specified for a <span><strong class="command">syslog</strong></span> channel,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews but is usually
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews pointless since <span><strong class="command">syslog</strong></span> also logs
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews the date and
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews time. If <span><strong class="command">print-category</strong></span> is
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews requested, then the
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews category of the message will be logged as well. Finally, if <span><strong class="command">print-severity</strong></span> is
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews on, then the severity level of the message will be logged. The <span><strong class="command">print-</strong></span> options may
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews be used in any combination, and will always be printed in the
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews order: time, category, severity. Here is an example where all
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews three <span><strong class="command">print-</strong></span> options
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <code class="computeroutput">28-Feb-2000 15:05:32.863 general: notice: running</code>
3a26bfc09c833a8dc4d4c12b7cd271ed6d0843cbTinderbox User There are four predefined channels that are used for
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <span><strong class="command">named</strong></span>'s default logging as follows.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews How they are
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews used is described in <a href="Bv9ARM.ch06.html#the_category_phrase" title="The category Phrase">the section called “The <span><strong class="command">category</strong></span> Phrase”</a>.
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews<pre class="programlisting">channel default_syslog {
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews // send to syslog's daemon facility
7019b0441a234153dde155622c405960b0d35946Tinderbox User syslog daemon;
180319f572fb6c1ca7000d22ea79a8dd77ae3f91Evan Hunt // only send priority info and higher
2a3eef7f65270e3f9a954573d866b368b7857584Tinderbox User severity info;
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrewschannel default_debug {
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews // write to named.run in the working directory
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews // Note: stderr is used instead of "named.run" if
2a3eef7f65270e3f9a954573d866b368b7857584Tinderbox User // the server is started with the '-f' option.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews // log at the server's current debug level
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews severity dynamic;
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox Userchannel default_stderr {
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews // writes to stderr
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington // only send priority info and higher
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater severity info;
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater // toss anything sent to this channel
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews The <span><strong class="command">default_debug</strong></span> channel has the
95cfad51a3f71246d263af79a7861a6821f7a0beAutomatic Updater property that it only produces output when the server's debug
3040b455151b1e1173193933664b2891b6159f24Mark Andrews nonzero. It normally writes to a file called <code class="filename">named.run</code>
95cfad51a3f71246d263af79a7861a6821f7a0beAutomatic Updater in the server's working directory.
e80c7005e3d59dfeb04dad186d36f3c15622954cTinderbox User For security reasons, when the "<code class="option">-u</code>"
e135e3c4b1f4f986f00997f5ad5866effb203139Tinderbox User command line option is used, the <code class="filename">named.run</code> file
bec9d04b657e1582d2531bdc02503bebde2aa978Tinderbox User is created only after <span><strong class="command">named</strong></span> has
0e91f17da8a29086876a88962e0a3482094b6057Evan Hunt changed to the
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews new UID, and any debug output generated while <span><strong class="command">named</strong></span> is
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater starting up and still running as root is discarded. If you need
99c231a3bd27893583204cd0a3e3103dc78dbc28Tinderbox User to capture this output, you must run the server with the "<code class="option">-g</code>"
3040b455151b1e1173193933664b2891b6159f24Mark Andrews option and redirect standard error to a file.
08d53af7d51409036462fa80fb1bde7a8c2ac123Automatic Updater Once a channel is defined, it cannot be redefined. Thus you
08d53af7d51409036462fa80fb1bde7a8c2ac123Automatic Updater cannot alter the built-in channels directly, but you can modify
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater the default logging by pointing categories at channels you have
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater<div class="titlepage"><div><div><h4 class="title">
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews<a name="the_category_phrase"></a>The <span><strong class="command">category</strong></span> Phrase</h4></div></div></div>
a66012b52c20200f118781463db4e4ee44454298Automatic Updater There are many categories, so you can send the logs you want
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt to see wherever you want, without seeing logs you don't want. If
3040b455151b1e1173193933664b2891b6159f24Mark Andrews you don't specify a list of channels for a category, then log
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater in that category will be sent to the <span><strong class="command">default</strong></span> category
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User instead. If you don't specify a default category, the following
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User "default default" is used:
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater<pre class="programlisting">category default { default_syslog; default_debug; };
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User As an example, let's say you want to log security events to
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater a file, but you also want keep the default logging behavior. You'd
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater specify the following:
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<pre class="programlisting">channel my_security_channel {
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User file "my_security_file";
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User severity info;
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox Usercategory security {
f0877b0237674d0519006ca7f8436e5f92250d30Mark Andrews my_security_channel;
f0877b0237674d0519006ca7f8436e5f92250d30Mark Andrews default_syslog;
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User default_debug;
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User To discard all messages in a category, specify the <span><strong class="command">null</strong></span> channel:
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User<pre class="programlisting">category xfer-out { null; };
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox Usercategory notify { null; };
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User Following are the available categories and brief descriptions
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User of the types of log information they contain. More
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User categories may be added in future <acronym class="acronym">BIND</acronym> releases.
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User <p><span><strong class="command">default</strong></span></p>
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User The default category defines the logging
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User options for those categories where no specific
f0877b0237674d0519006ca7f8436e5f92250d30Mark Andrews configuration has been
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <p><span><strong class="command">general</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The catch-all. Many things still aren't
c2abd6efeb9affa70aabb63da2acb23e135cf7f2Mark Andrews classified into categories, and they all end up here.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <p><span><strong class="command">database</strong></span></p>
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews Messages relating to the databases used
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews internally by the name server to store zone and cache
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span><strong class="command">security</strong></span></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Approval and denial of requests.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span><strong class="command">config</strong></span></p>
2cdbfcdad94eba75f3f8e77343a0eefabf553b8eAutomatic Updater Configuration file parsing and processing.
52cfbde0bd391cfb37e3c1a1b460c16ba6bf1a73Automatic Updater <p><span><strong class="command">resolver</strong></span></p>
4fda24d843edac463c98785ec0c850d912592dc1Tinderbox User DNS resolution, such as the recursive
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews lookups performed on behalf of clients by a caching name
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <p><span><strong class="command">xfer-in</strong></span></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Zone transfers the server is receiving.
11b6b0d74bb8dd6bd1ce0b60ba7f9b66323f06d4Tinderbox User <p><span><strong class="command">xfer-out</strong></span></p>
b577ce9ed2153db6539fb975b4a7aa16d9b3baeeTinderbox User Zone transfers the server is sending.
ac2ad7b4e4e41e7e788dbe103c581f1605209d3bTinderbox User <p><span><strong class="command">notify</strong></span></p>
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews The NOTIFY protocol.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <p><span><strong class="command">client</strong></span></p>
cd839f5cf5f84cf163f55ff05cb88ce37efd24d1Automatic Updater Processing of client requests.
d642d3857129678797a01adee14fbd70335b05a9Mark Andrews <p><span><strong class="command">unmatched</strong></span></p>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews Messages that <span><strong class="command">named</strong></span> was unable to determine the
c95f536d78842fbc8ebcef653d88e1f2270054f8Automatic Updater class of or for which there was no matching <span><strong class="command">view</strong></span>.
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater A one line summary is also logged to the <span><strong class="command">client</strong></span> category.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews This category is best sent to a file or stderr, by
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater default it is sent to
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater the <span><strong class="command">null</strong></span> channel.
c95f536d78842fbc8ebcef653d88e1f2270054f8Automatic Updater <p><span><strong class="command">network</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Network operations.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <p><span><strong class="command">update</strong></span></p>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Dynamic updates.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <p><span><strong class="command">update-security</strong></span></p>
9692d283bb43c9eab49a7fadfc1b74a6e20e6151Tinderbox User Approval and denial of update requests.
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User <p><span><strong class="command">queries</strong></span></p>
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User Specify where queries should be logged to.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater At startup, specifying the category <span><strong class="command">queries</strong></span> will also
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater enable query logging unless <span><strong class="command">querylog</strong></span> option has been
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater The query log entry reports the client's IP
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater address and port number, and the query name,
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater class and type. Next it reports whether the
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater Recursion Desired flag was set (+ if set, -
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater if not set), if the query was signed (S),
3040b455151b1e1173193933664b2891b6159f24Mark Andrews EDNS was in use (E), if DO (DNSSEC Ok) was
560d6da48f066000541dd43f5d407644dee12bebTinderbox User set (D), or if CD (Checking Disabled) was set
560d6da48f066000541dd43f5d407644dee12bebTinderbox User (C). After this the destination address the
9bc394fffdd50f6e47614b2d317da7274122366fTinderbox User query was sent to is reported.
2c1632c71e2f4d8afa35efce3080b31602a6608cTinderbox User <code class="computeroutput">client 127.0.0.1#62536: query: www.example.com IN AAAA +SE</code>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <code class="computeroutput">client ::1#62537: query: www.example.net IN AAAA -SE</code>
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater <p><span><strong class="command">query-errors</strong></span></p>
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User Information about queries that resulted in some
e0bf4fc289705375be65c05a8fb085d514a98c97Tinderbox User <p><span><strong class="command">dispatch</strong></span></p>
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User Dispatching of incoming packets to the
2c1632c71e2f4d8afa35efce3080b31602a6608cTinderbox User server modules where they are to be processed.
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User <p><span><strong class="command">dnssec</strong></span></p>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews DNSSEC and TSIG protocol processing.
b779e1efb14f9616a35befd2b1cfc2578f1a4d70Tinderbox User <p><span><strong class="command">lame-servers</strong></span></p>
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User Lame servers. These are misconfigurations
6ce070d74c160218ee6c864e75235a4f535320c3Tinderbox User in remote servers, discovered by BIND 9 when trying to
3040b455151b1e1173193933664b2891b6159f24Mark Andrews query those servers during resolution.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <p><span><strong class="command">delegation-only</strong></span></p>
e8e87ede5c36b95806c77bcd34894ad9c4b39a78Tinderbox User Delegation only. Logs queries that have
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews been forced to NXDOMAIN as the result of a
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews delegation-only zone or
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews a <span><strong class="command">delegation-only</strong></span> in a
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews hint or stub zone declaration.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <p><span><strong class="command">edns-disabled</strong></span></p>
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews Log queries that have been forced to use plain
eac5382be368b43df62e4ac32075131fb4997f03Tinderbox User DNS due to timeouts. This is often due to
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews the remote servers not being RFC 1034 compliant
536da846f6cc03ad8abbb8bb9d5d8a6f607b8c33Mark Andrews (not always returning FORMERR or similar to
536da846f6cc03ad8abbb8bb9d5d8a6f607b8c33Mark Andrews EDNS queries and other extensions to the DNS
ac5ed748602c890d596bed07b0b23b8b5f42b2f6Mark Andrews when they are not understood). In other words, this is
ac5ed748602c890d596bed07b0b23b8b5f42b2f6Mark Andrews targeted at servers that fail to respond to
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt DNS queries that they don't understand.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews Note: the log message can also be due to
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews packet loss. Before reporting servers for
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews non-RFC 1034 compliance they should be re-tested
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews to determine the nature of the non-compliance.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews This testing should prevent or reduce the
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews number of false-positive reports.
4fe0411487e8e4401477684c0a2bac041ca7c2d5Tinderbox User Note: eventually <span><strong class="command">named</strong></span> will have to stop
015f044f7f916eb18d053f2e5dcbee481425bc66Mark Andrews treating such timeouts as due to RFC 1034 non
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews compliance and start treating it as plain
015f044f7f916eb18d053f2e5dcbee481425bc66Mark Andrews packet loss. Falsely classifying packet
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User loss as due to RFC 1034 non compliance impacts
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User on DNSSEC validation which requires EDNS for
bec9d04b657e1582d2531bdc02503bebde2aa978Tinderbox User the DNSSEC records to be returned.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews<div class="titlepage"><div><div><h4 class="title">
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews<a name="id2576882"></a>The <span><strong class="command">query-errors</strong></span> Category</h4></div></div></div>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews The <span><strong class="command">query-errors</strong></span> category is
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews specifically intended for debugging purposes: To identify
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews why and how specific queries result in responses which
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews indicate an error.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews Messages of this category are therefore only logged
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews with <span><strong class="command">debug</strong></span> levels.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews At the debug levels of 1 or higher, each response with the
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews rcode of SERVFAIL is logged as follows:
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews <code class="computeroutput">client 127.0.0.1#61502: query failed (SERVFAIL) for www.example.com/IN/AAAA at query.c:3880</code>
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews This means an error resulting in SERVFAIL was
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews detected at line 3880 of source file
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews Log messages of this level will particularly
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews help identify the cause of SERVFAIL for an
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews authoritative server.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews At the debug levels of 2 or higher, detailed context
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews information of recursive resolutions that resulted in
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews SERVFAIL is logged.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews The log message will look like as follows:
3a988722ad9e209ba4064604d482dc4efe0e19ebTinderbox Userfetch completed at resolver.c:2970 for www.example.com/A
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrewsin 30.000183: timed out/success [domain:example.com,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrewsreferral:2,restart:7,qrysent:8,timeout:5,lame:0,neterr:0,
3040b455151b1e1173193933664b2891b6159f24Mark Andrewsbadresp:1,adberr:0,findfail:0,valfail:0]
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews The first part before the colon shows that a recursive
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews resolution for AAAA records of www.example.com completed
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews in 30.000183 seconds and the final result that led to the
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews SERVFAIL was determined at line 2970 of source file
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews The following part shows the detected final result and the
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews latest result of DNSSEC validation.
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews The latter is always success when no validation attempt
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews In this example, this query resulted in SERVFAIL probably
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews because all name servers are down or unreachable, leading
3040b455151b1e1173193933664b2891b6159f24Mark Andrews to a timeout in 30 seconds.
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews DNSSEC validation was probably not attempted.
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews The last part enclosed in square brackets shows statistics
3040b455151b1e1173193933664b2891b6159f24Mark Andrews information collected for this particular resolution
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews The <code class="varname">domain</code> field shows the deepest zone
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews that the resolver reached;
4ba21f60009e18c5950d18546a127e70be537effMark Andrews it is the zone where the error was finally detected.
4ba21f60009e18c5950d18546a127e70be537effMark Andrews The meaning of the other fields is summarized in the
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews following table.
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews The number of referrals the resolver received
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews throughout the resolution process.
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews In the above example this is 2, which are most
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews likely com and example.com.
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews The number of cycles that the resolver tried
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater remote servers at the <code class="varname">domain</code>
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater In each cycle the resolver sends one query
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews (possibly resending it, depending on the response)
3040b455151b1e1173193933664b2891b6159f24Mark Andrews to each known name server of
b577ce9ed2153db6539fb975b4a7aa16d9b3baeeTinderbox User The number of queries the resolver sent at the
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater <p><code class="varname">timeout</code></p>
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater The number of timeouts since the resolver
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater received the last response.
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater The number of lame servers the resolver detected
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater at the <code class="varname">domain</code> zone.
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater A server is detected to be lame either by an
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User invalid response or as a result of lookup in
3040b455151b1e1173193933664b2891b6159f24Mark Andrews BIND9's address database (ADB), where lame
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater servers are cached.
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews The number of erroneous results that the
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User resolver encountered in sending queries
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User at the <code class="varname">domain</code> zone.
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User One common case is the remote server is
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User unreachable and the resolver receives an ICMP
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User unreachable error message.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The number of unexpected responses (other than
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <code class="varname">lame</code>) to queries sent by the
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater resolver at the <code class="varname">domain</code> zone.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Failures in finding remote server addresses
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater of the <code class="varname">domain</code> zone in the ADB.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater One common case of this is that the remote
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater server's name does not have any address records.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews Failures of resolving remote server addresses.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews This is a total number of failures throughout
95de440e8d2b07bb130505b4146059e5734e2eeaTinderbox User the resolution process.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews Failures of DNSSEC validation.
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews Validation failures are counted throughout
ec7751119a08c6a7250f3187beed69a8b836d349Tinderbox User the resolution process (not limited to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the <code class="varname">domain</code> zone), but should
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User only happen in <code class="varname">domain</code>.
8f536463f9fdfa7da6a8310e4f4895373beb2961Mark Andrews At the debug levels of 3 or higher, the same messages
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User as those at the debug 1 level are logged for other errors
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater than SERVFAIL.
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt Note that negative responses such as NXDOMAIN are not
3040b455151b1e1173193933664b2891b6159f24Mark Andrews regarded as errors here.
dcd42a39d311b44877161ffd1e27fa62700c0171Mark Andrews At the debug levels of 4 or higher, the same messages
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater as those at the debug 2 level are logged for other errors
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater than SERVFAIL.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Unlike the above case of level 3, messages are logged for
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater negative responses.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This is because any unexpected results can be difficult to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater debug in the recursion case.
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User<div class="titlepage"><div><div><h3 class="title">
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User<a name="id2577401"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews This is the grammar of the <span><strong class="command">lwres</strong></span>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews statement in the <code class="filename">named.conf</code> file:
c5f7f6aa6c51d35353a9485b32abbabfe8358b4eMark Andrews<pre class="programlisting"><span><strong class="command">lwres</strong></span> {
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> listen-on { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> view <em class="replaceable"><code>view_name</code></em>; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> search { <em class="replaceable"><code>domain_name</code></em> ; [<span class="optional"> <em class="replaceable"><code>domain_name</code></em> ; ... </span>] }; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> ndots <em class="replaceable"><code>number</code></em>; </span>]
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User<div class="titlepage"><div><div><h3 class="title">
63654fea53d6a58a65112234bc8d0c322e0c81b5Automatic Updater<a name="id2577475"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div>
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User The <span><strong class="command">lwres</strong></span> statement configures the
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews server to also act as a lightweight resolver server. (See
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be multiple
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">lwres</strong></span> statements configuring
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater lightweight resolver servers with different properties.
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater The <span><strong class="command">listen-on</strong></span> statement specifies a
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User addresses (and ports) that this instance of a lightweight resolver
3040b455151b1e1173193933664b2891b6159f24Mark Andrews should accept requests on. If no port is specified, port 921 is
3040b455151b1e1173193933664b2891b6159f24Mark Andrews If this statement is omitted, requests will be accepted on
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">view</strong></span> statement binds this
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User lightweight resolver daemon to a view in the DNS namespace, so that
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater response will be constructed in the same manner as a normal DNS
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User matching this view. If this statement is omitted, the default view
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User used, and if there is no default view, an error is triggered.
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User The <span><strong class="command">search</strong></span> statement is equivalent to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">search</strong></span> statement in
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <code class="filename">/etc/resolv.conf</code>. It provides a
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User list of domains
80f05de86cd3cd8e4a4215c4501643891b942dafTinderbox User which are appended to relative names in queries.
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User The <span><strong class="command">ndots</strong></span> statement is equivalent to
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews <span><strong class="command">ndots</strong></span> statement in
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews <code class="filename">/etc/resolv.conf</code>. It indicates the
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User number of dots in a relative domain name that should result in an
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User exact match lookup before search path elements are appended.
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews<div class="titlepage"><div><div><h3 class="title">
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews<a name="id2577539"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div>
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews<span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> |
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] };
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<div class="titlepage"><div><div><h3 class="title">
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews<a name="id2577582"></a><span><strong class="command">masters</strong></span> Statement Definition and
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater<p><span><strong class="command">masters</strong></span>
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater lists allow for a common set of masters to be easily used by
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater multiple stub and slave zones.
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User<div class="titlepage"><div><div><h3 class="title">
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User<a name="id2577597"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This is the grammar of the <span><strong class="command">options</strong></span>
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User statement in the <code class="filename">named.conf</code> file:
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User<pre class="programlisting"><span><strong class="command">options</strong></span> {
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [<span class="optional"> attach-cache <em class="replaceable"><code>cache_name</code></em>; </span>]
183b6c7fca54001820078f324d102fc33e64bbc6Automatic Updater [<span class="optional"> version <em class="replaceable"><code>version_string</code></em>; </span>]
9563f388c8ca1bb9ebb04db54e122815b0008c8aTinderbox User [<span class="optional"> hostname <em class="replaceable"><code>hostname_string</code></em>; </span>]
9563f388c8ca1bb9ebb04db54e122815b0008c8aTinderbox User [<span class="optional"> server-id <em class="replaceable"><code>server_id_string</code></em>; </span>]
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews [<span class="optional"> directory <em class="replaceable"><code>path_name</code></em>; </span>]
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User [<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User [<span class="optional"> named-xfer <em class="replaceable"><code>path_name</code></em>; </span>]
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews [<span class="optional"> tkey-gssapi-credential <em class="replaceable"><code>principal</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> tkey-domain <em class="replaceable"><code>domainname</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> tkey-dhkey <em class="replaceable"><code>key_name</code></em> <em class="replaceable"><code>key_tag</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> cache-file <em class="replaceable"><code>path_name</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> dump-file <em class="replaceable"><code>path_name</code></em>; </span>]
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater [<span class="optional"> bindkeys-file <em class="replaceable"><code>path_name</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> memstatistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> memstatistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> pid-file <em class="replaceable"><code>path_name</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> recursing-file <em class="replaceable"><code>path_name</code></em>; </span>]
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews [<span class="optional"> statistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> auth-nxdomain <em class="replaceable"><code>yes_or_no</code></em>; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> deallocate-on-exit <em class="replaceable"><code>yes_or_no</code></em>; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em>; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> fake-iquery <em class="replaceable"><code>yes_or_no</code></em>; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> fetch-glue <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User [<span class="optional"> flush-zones-on-shutdown <em class="replaceable"><code>yes_or_no</code></em>; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> has-old-clients <em class="replaceable"><code>yes_or_no</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> host-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> host-statistics-max <em class="replaceable"><code>number</code></em>; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> minimal-responses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> multiple-cnames <em class="replaceable"><code>yes_or_no</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> recursion <em class="replaceable"><code>yes_or_no</code></em>; </span>]
64f2afc2c63a59461d11b581a208efdbeec124adTinderbox User [<span class="optional"> rfc2308-type1 <em class="replaceable"><code>yes_or_no</code></em>; </span>]
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [<span class="optional"> use-id-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em>; </span>]
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt [<span class="optional"> ixfr-from-differences (<em class="replaceable"><code>yes_or_no</code></em> | <code class="constant">master</code> | <code class="constant">slave</code>); </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> dnssec-enable <em class="replaceable"><code>yes_or_no</code></em>; </span>]
64f2afc2c63a59461d11b581a208efdbeec124adTinderbox User [<span class="optional"> dnssec-validation <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> dnssec-lookaside ( <em class="replaceable"><code>auto</code></em> |
859148b72a22e4221c3e918d15c7fdd5e78b6d8dTinderbox User <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em> ); </span>]
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews [<span class="optional"> dnssec-must-be-secure <em class="replaceable"><code>domain yes_or_no</code></em>; </span>]
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User [<span class="optional"> dnssec-accept-expired <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> forward ( <em class="replaceable"><code>only</code></em> | <em class="replaceable"><code>first</code></em> ); </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> dual-stack-servers [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] {
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews ( <em class="replaceable"><code>domain_name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] |
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ) ;
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews ... }; </span>]
859148b72a22e4221c3e918d15c7fdd5e78b6d8dTinderbox User [<span class="optional"> check-names ( <em class="replaceable"><code>master</code></em> | <em class="replaceable"><code>slave</code></em> | <em class="replaceable"><code>response</code></em> )
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> check-mx ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> check-mx-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> check-srv-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> check-sibling <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
17198e77b87667f796e910d31a4f47a80e256d09Mark Andrews [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> allow-query-cache { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> allow-query-cache-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> allow-recursion { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> allow-recursion-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> allow-v6-synthesis { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> blackhole { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> use-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> avoid-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> use-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> avoid-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> listen-on [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> listen-on-v6 [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
de73ef7ecdb9e009155993a6fa8dee5cd1bde319Mark Andrews [<span class="optional"> query-source ( ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> )
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> address ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> query-source-v6 ( ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> )
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> address ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> queryport-pool-interval <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> tcp-clients <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> reserved-sockets <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> recursive-clients <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> serial-query-rate <em class="replaceable"><code>number</code></em>; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> serial-queries <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> tcp-listen-queue <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfers-in <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfers-out <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfers-per-ns <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> coresize <em class="replaceable"><code>size_spec</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> datasize <em class="replaceable"><code>size_spec</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> files <em class="replaceable"><code>size_spec</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> stacksize <em class="replaceable"><code>size_spec</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> heartbeat-interval <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> interface-interval <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> statistics-interval <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> topology { <em class="replaceable"><code>address_match_list</code></em> }</span>];
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> sortlist { <em class="replaceable"><code>address_match_list</code></em> }</span>];
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> rrset-order { <em class="replaceable"><code>order_spec</code></em> ; [<span class="optional"> <em class="replaceable"><code>order_spec</code></em> ; ... </span>] </span>] };
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> lame-ttl <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-ncache-ttl <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-cache-ttl <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> min-roots <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> use-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> treat-cr-as-space <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> min-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em>; </span>]
757ff043760e4743dda1a10e7d58349275934902Tinderbox User [<span class="optional"> additional-from-auth <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User [<span class="optional"> additional-from-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews [<span class="optional"> random-device <em class="replaceable"><code>path_name</code></em> ; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> max-cache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
0df8ead472f207020f8da22a185fe4b945248ab8Automatic Updater [<span class="optional"> match-mapped-addresses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User [<span class="optional"> preferred-glue ( <em class="replaceable"><code>A</code></em> | <em class="replaceable"><code>AAAA</code></em> | <em class="replaceable"><code>NONE</code></em> ); </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> edns-udp-size <em class="replaceable"><code>number</code></em>; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> max-udp-size <em class="replaceable"><code>number</code></em>; </span>]
0accdb26ead1fe520a9820b52efbea64bdf564e3Tinderbox User [<span class="optional"> root-delegation-only [<span class="optional"> exclude { <em class="replaceable"><code>namelist</code></em> } </span>] ; </span>]
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User [<span class="optional"> querylog <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> disable-algorithms <em class="replaceable"><code>domain</code></em> { <em class="replaceable"><code>algorithm</code></em>;
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> <em class="replaceable"><code>algorithm</code></em>; </span>] }; </span>]
e213b38b48486b3a6349329655d9169085001fa0Tinderbox User [<span class="optional"> acache-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User [<span class="optional"> acache-cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> max-acache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
71ba75c604df3604673232828a68bb28c420e698Mark Andrews [<span class="optional"> max-clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User [<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> empty-server <em class="replaceable"><code>name</code></em> ; </span>]
c5a97a549c89d562e999d4f906b882c5a2a474e1Tinderbox User [<span class="optional"> empty-contact <em class="replaceable"><code>name</code></em> ; </span>]
e7d35dad55e8deae14f29aabfb20d540b4b6ab3dMark Andrews [<span class="optional"> empty-zones-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User [<span class="optional"> disable-empty-zone <em class="replaceable"><code>zone_name</code></em> ; </span>]
c5a97a549c89d562e999d4f906b882c5a2a474e1Tinderbox User [<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> zero-no-soa-ttl-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater<div class="titlepage"><div><div><h3 class="title">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<a name="options"></a><span><strong class="command">options</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The <span><strong class="command">options</strong></span> statement sets up global
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater to be used by <acronym class="acronym">BIND</acronym>. This statement
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews may appear only
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews once in a configuration file. If there is no <span><strong class="command">options</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews statement, an options block with each option set to its default will
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<dt><span class="term"><span><strong class="command">attach-cache</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Allows multiple views to share a single cache
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater Each view has its own cache database by default, but
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews if multiple views have the same operational policy
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews for name resolution and caching, those views can
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews share a single cache to save memory and possibly
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews improve resolution efficiency by using this option.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User The <span><strong class="command">attach-cache</strong></span> option
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews may also be specified in <span><strong class="command">view</strong></span>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User statements, in which case it overrides the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews global <span><strong class="command">attach-cache</strong></span> option.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The <em class="replaceable"><code>cache_name</code></em> specifies
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the cache to be shared.
347333bc39e9e2df63cc4e7309cef5354d52b1fbTinderbox User When the <span><strong class="command">named</strong></span> server configures
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews views which are supposed to share a cache, it
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews creates a cache with the specified name for the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater first view of these sharing views.
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater The rest of the views will simply refer to the
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews already created cache.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews One common configuration to share a cache would be to
4fe0411487e8e4401477684c0a2bac041ca7c2d5Tinderbox User allow all views to share a single cache.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews This can be done by specifying
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews the <span><strong class="command">attach-cache</strong></span> as a global
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews option with an arbitrary name.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Another possible operation is to allow a subset of
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater all views to share a cache while the others to
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson retain their own caches.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews For example, if there are three views A, B, and C,
7932a7637170550bc53b38c35db9a0187dcb3d3bAutomatic Updater and only A and B should share a cache, specify the
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson <span><strong class="command">attach-cache</strong></span> option as a view A (or
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson B)'s option, referring to the other view name:
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews // this view has its own cache
8bc3d252395842452a6d2c775cf8445f6349e331Tinderbox User // this view refers to A's cache
de7b9a1dac0c293b39994c91d4376883da25554fTinderbox User attach-cache "A";
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater // this view has its own cache
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User Views that share a cache must have the same policy
467a823e57af687ebd486dfd73ea32f9d2a145beTinderbox User on configurable parameters that may affect caching.
467a823e57af687ebd486dfd73ea32f9d2a145beTinderbox User The current implementation requires the following
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User configurable options be consistent among these
7d704e522860496310bb29c28e76064868401a9cMark Andrews <span><strong class="command">check-names</strong></span>,
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews <span><strong class="command">cleaning-interval</strong></span>,
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User <span><strong class="command">dnssec-accept-expired</strong></span>,
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span><strong class="command">dnssec-validation</strong></span>,
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews <span><strong class="command">max-cache-ttl</strong></span>,
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews <span><strong class="command">max-ncache-ttl</strong></span>,
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater <span><strong class="command">max-cache-size</strong></span>, and
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater <span><strong class="command">zero-no-soa-ttl</strong></span>.
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User Note that there may be other parameters that may
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User cause confusion if they are inconsistent for
402eda3e7d4254ffac1543bf2917c71248a09e4cTinderbox User different views that share a single cache.
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews For example, if these views define different sets of
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews forwarders that can return different answers for the
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews same question, sharing the answer does not make
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater sense or could even be harmful.
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews It is administrator's responsibility to ensure
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews configuration differences in different views do
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews not cause disruption with a shared cache.
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews<dt><span class="term"><span><strong class="command">directory</strong></span></span></dt>
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews The working directory of the server.
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater Any non-absolute pathnames in the configuration file will be
f751b1576ee6fef4023bf7101d10167e4fe520f3Tinderbox User as relative to this directory. The default location for most
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User output files (e.g. <code class="filename">named.run</code>)
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User is this directory.
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater If a directory is not specified, the working directory
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater defaults to `<code class="filename">.</code>', the directory from
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater which the server
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User was started. The directory specified should be an absolute
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User<dt><span class="term"><span><strong class="command">key-directory</strong></span></span></dt>
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User When performing dynamic update of secure zones, the
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User directory where the public and private key files should be
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User if different than the current working directory. The
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User directory specified
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User must be an absolute path.
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User<dt><span class="term"><span><strong class="command">named-xfer</strong></span></span></dt>
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User <span class="emphasis"><em>This option is obsolete.</em></span> It
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User was used in <acronym class="acronym">BIND</acronym> 8 to specify
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User the pathname to the <span><strong class="command">named-xfer</strong></span>
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User program. In <acronym class="acronym">BIND</acronym> 9, no separate
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User <span><strong class="command">named-xfer</strong></span> program is needed;
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User its functionality is built into the name server.
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User<dt><span class="term"><span><strong class="command">tkey-gssapi-credential</strong></span></span></dt>
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User The security credential with which the server should
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User authenticate keys requested by the GSS-TSIG protocol.
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User Currently only Kerberos 5 authentication is available
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User and the credential is a Kerberos principal which
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User the server can acquire through the default system
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User key file, normally <code class="filename">/etc/krb5.keytab</code>.
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User Normally this principal is of the form
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User "<strong class="userinput"><code>dns/</code></strong><code class="varname">server.domain</code>".
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User To use GSS-TSIG, <span><strong class="command">tkey-domain</strong></span>
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User must also be set.
b8cc0c5d896c361525708a2be2e5af7df76c96d7Tinderbox User<dt><span class="term"><span><strong class="command">tkey-domain</strong></span></span></dt>
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User The domain appended to the names of all shared keys
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User generated with <span><strong class="command">TKEY</strong></span>. When a
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User client requests a <span><strong class="command">TKEY</strong></span> exchange,
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User it may or may not specify the desired name for the
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User key. If present, the name of the shared key will
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User be <code class="varname">client specified part</code> +
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User <code class="varname">tkey-domain</code>. Otherwise, the
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User name of the shared key will be <code class="varname">random hex
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User digits</code> + <code class="varname">tkey-domain</code>.
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User In most cases, the <span><strong class="command">domainname</strong></span>
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User should be the server's domain name, or an otherwise
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User non-existent subdomain like
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User "_tkey.<code class="varname">domainname</code>". If you are
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User using GSS-TSIG, this variable must be defined.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User<dt><span class="term"><span><strong class="command">tkey-dhkey</strong></span></span></dt>
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User The Diffie-Hellman key used by the server
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews to generate shared keys with clients using the Diffie-Hellman
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews of <span><strong class="command">TKEY</strong></span>. The server must be
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews able to load the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews public and private keys from files in the working directory.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews most cases, the keyname should be the server's host name.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">cache-file</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews This is for testing only. Do not use.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">dump-file</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The pathname of the file the server dumps
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the database to when instructed to do so with
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">rndc dumpdb</strong></span>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If not specified, the default is <code class="filename">named_dump.db</code>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">memstatistics-file</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The pathname of the file the server writes memory
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews usage statistics to on exit. If not specified,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the default is <code class="filename">named.memstats</code>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">pid-file</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The pathname of the file the server writes its process ID
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews in. If not specified, the default is
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="filename">/var/run/named/named.pid</code>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The PID file is used by programs that want to send signals to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews name server. Specifying <span><strong class="command">pid-file none</strong></span> disables the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews use of a PID file — no file will be written and any
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews existing one will be removed. Note that <span><strong class="command">none</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews is a keyword, not a filename, and therefore is not enclosed
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews double quotes.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">recursing-file</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The pathname of the file the server dumps
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the queries that are currently recursing when instructed
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews to do so with <span><strong class="command">rndc recursing</strong></span>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If not specified, the default is <code class="filename">named.recursing</code>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">statistics-file</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The pathname of the file the server appends statistics
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews to when instructed to do so using <span><strong class="command">rndc stats</strong></span>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If not specified, the default is <code class="filename">named.stats</code> in the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews server's current directory. The format of the file is
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews in <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">bindkeys-file</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The pathname of a file to override the built-in trusted
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews keys provided by named. See the discussion of
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">dnssec-lookaside</strong></span> for details.
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews If not specified, the default is
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">port</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews receiving and sending DNS protocol traffic.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The default is 53. This option is mainly intended for server
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews a server using a port other than 53 will not be able to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews communicate with
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the global DNS.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">random-device</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The source of entropy to be used by the server. Entropy is
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews primarily needed
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews for DNSSEC operations, such as TKEY transactions and dynamic
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews update of signed
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews zones. This options specifies the device (or file) from which
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews entropy. If this is a file, operations requiring entropy will
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews fail when the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews file has been exhausted. If not specified, the default value
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews (or equivalent) when present, and none otherwise. The
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">random-device</strong></span> option takes
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews effect during
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the initial configuration load at server startup time and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews is ignored on subsequent reloads.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">preferred-glue</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If specified, the listed type (A or AAAA) will be emitted
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews before other glue
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews in the additional section of a query response.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The default is not to prefer any type (NONE).
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">root-delegation-only</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Turn on enforcement of delegation-only in TLDs (top level domains) and root zones
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews with an optional
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews exclude list.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Note some TLDs are not delegation only (e.g. "DE", "LV", "US"
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews and "MUSEUM").
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">disable-algorithms</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Disable the specified DNSSEC algorithms at and below the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews specified name.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Multiple <span><strong class="command">disable-algorithms</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews statements are allowed.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Only the most specific will be applied.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">dnssec-lookaside</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews When set, <span><strong class="command">dnssec-lookaside</strong></span> provides the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews validator with an alternate method to validate DNSKEY
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews records at the top of a zone. When a DNSKEY is at or
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews below a domain specified by the deepest
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">dnssec-lookaside</strong></span>, and the normal dnssec
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews validation has left the key untrusted, the trust-anchor
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews will be append to the key name and a DLV record will be
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews looked up to see if it can validate the key. If the DLV
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews record validates a DNSKEY (similarly to the way a DS record
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews does) the DNSKEY RRset is deemed to be trusted.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If <span><strong class="command">dnssec-lookaside</strong></span> is set to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews "auto", then built-in default values for
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the domain and trust anchor will be used, along
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews with a built-in key for validation.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater NOTE: Since the built-in key may expire, it can be
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews overridden without recompiling named by placing a new key
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews in the file <code class="filename">bind.keys</code>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">dnssec-must-be-secure</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Specify hierarchies which must be or may not be secure
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews (signed and validated). If <strong class="userinput"><code>yes</code></strong>,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews then <span><strong class="command">named</strong></span> will only accept answers if
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews they are secure. If <strong class="userinput"><code>no</code></strong>, then normal
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews DNSSEC validation applies allowing for insecure answers to
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User be accepted. The specified domain must be under a
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">trusted-key</strong></span> or
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">dnssec-lookaside</strong></span> must be active.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<div class="titlepage"><div><div><h4 class="title">
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<a name="boolean_options"></a>Boolean Options</h4></div></div></div>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">auth-nxdomain</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If <strong class="userinput"><code>yes</code></strong>, then the <span><strong class="command">AA</strong></span> bit
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews is always set on NXDOMAIN responses, even if the server is
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews not actually
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews authoritative. The default is <strong class="userinput"><code>no</code></strong>;
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews a change from <acronym class="acronym">BIND</acronym> 8. If you
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews are using very old DNS software, you
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews may need to set it to <strong class="userinput"><code>yes</code></strong>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">deallocate-on-exit</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews This option was used in <acronym class="acronym">BIND</acronym>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews 8 to enable checking
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews for memory leaks on exit. <acronym class="acronym">BIND</acronym> 9 ignores the option and always performs
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">memstatistics</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Write memory statistics to the file specified by
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">memstatistics-file</strong></span> at exit.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The default is <strong class="userinput"><code>no</code></strong> unless
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews '-m record' is specified on the command line in
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews which case it is <strong class="userinput"><code>yes</code></strong>.
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt<dt><span class="term"><span><strong class="command">dialup</strong></span></span></dt>
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt If <strong class="userinput"><code>yes</code></strong>, then the
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt server treats all zones as if they are doing zone transfers
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt a dial-on-demand dialup link, which can be brought up by
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt originating from this server. This has different effects
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt to zone type and concentrates the zone maintenance so that
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt happens in a short interval, once every <span><strong class="command">heartbeat-interval</strong></span> and
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt hopefully during the one call. It also suppresses some of
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt zone maintenance traffic. The default is <strong class="userinput"><code>no</code></strong>.
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt The <span><strong class="command">dialup</strong></span> option
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User may also be specified in the <span><strong class="command">view</strong></span> and
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User <span><strong class="command">zone</strong></span> statements,
ab272d2204a075b5ed0798d04733a9028782b8daEvan Hunt in which case it overrides the global <span><strong class="command">dialup</strong></span>
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater If the zone is a master zone, then the server will send out a
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater request to all the slaves (default). This should trigger the
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater number check in the slave (providing it supports NOTIFY)
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater allowing the slave
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater to verify the zone while the connection is active.
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater The set of servers to which NOTIFY is sent can be controlled
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater <span><strong class="command">notify</strong></span> and <span><strong class="command">also-notify</strong></span>.
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater zone is a slave or stub zone, then the server will suppress
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater "zone up to date" (refresh) queries and only perform them
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews <span><strong class="command">heartbeat-interval</strong></span> expires in
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson addition to sending
309b912841e8b97bf0b0df0d96c3eaf16990c080Automatic Updater NOTIFY requests.
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson Finer control can be achieved by using
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson <strong class="userinput"><code>notify</code></strong> which only sends NOTIFY
754ebd37e782356aedbb2987e3c1a8ab4f29574eMark Andrews <strong class="userinput"><code>notify-passive</code></strong> which sends NOTIFY
754ebd37e782356aedbb2987e3c1a8ab4f29574eMark Andrews messages and
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews suppresses the normal refresh queries, <strong class="userinput"><code>refresh</code></strong>
94df856897945fe58f130ba78765c57308bc5400Automatic Updater which suppresses normal refresh processing and sends refresh
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User when the <span><strong class="command">heartbeat-interval</strong></span>
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User <strong class="userinput"><code>passive</code></strong> which just disables normal
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User normal refresh
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater heart-beat refresh
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User heart-beat notify
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <p><span><strong class="command">no</strong></span> (default)</p>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <p><span><strong class="command">yes</strong></span></p>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <p><span><strong class="command">notify</strong></span></p>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <p><span><strong class="command">refresh</strong></span></p>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <p><span><strong class="command">passive</strong></span></p>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <p><span><strong class="command">notify-passive</strong></span></p>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Note that normal NOTIFY processing is not affected by
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">dialup</strong></span>.
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User<dt><span class="term"><span><strong class="command">fake-iquery</strong></span></span></dt>
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User In <acronym class="acronym">BIND</acronym> 8, this option
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User enabled simulating the obsolete DNS query type
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User IQUERY. <acronym class="acronym">BIND</acronym> 9 never does
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User IQUERY simulation.
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User<dt><span class="term"><span><strong class="command">fetch-glue</strong></span></span></dt>
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User This option is obsolete.
6a0d2961c04b20f0114cca12157cfed64c5b126fTinderbox User In BIND 8, <strong class="userinput"><code>fetch-glue yes</code></strong>
39a3b65090ccfc86b66e416c949c6a938c7f1d4aTinderbox User caused the server to attempt to fetch glue resource records
3a26bfc09c833a8dc4d4c12b7cd271ed6d0843cbTinderbox User didn't have when constructing the additional
4ea3649f028ea6a1e42377082a7ccf8f789fb950Automatic Updater data section of a response. This is now considered a bad
644973f327e9db74779e7c0426db90909173b284Automatic Updater and BIND 9 never does it.
3a26bfc09c833a8dc4d4c12b7cd271ed6d0843cbTinderbox User<dt><span class="term"><span><strong class="command">flush-zones-on-shutdown</strong></span></span></dt>
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User When the nameserver exits due receiving SIGTERM,
95637507c3d47481fbf0a8a8c750a57f944f677fMark Andrews flush or do not flush any pending zone writes. The default
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User <span><strong class="command">flush-zones-on-shutdown</strong></span> <strong class="userinput"><code>no</code></strong>.
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User<dt><span class="term"><span><strong class="command">has-old-clients</strong></span></span></dt>
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User This option was incorrectly implemented
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User in <acronym class="acronym">BIND</acronym> 8, and is ignored by <acronym class="acronym">BIND</acronym> 9.
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User To achieve the intended effect
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User <span><strong class="command">has-old-clients</strong></span> <strong class="userinput"><code>yes</code></strong>, specify
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User the two separate options <span><strong class="command">auth-nxdomain</strong></span> <strong class="userinput"><code>yes</code></strong>
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User and <span><strong class="command">rfc2308-type1</strong></span> <strong class="userinput"><code>no</code></strong> instead.
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User<dt><span class="term"><span><strong class="command">host-statistics</strong></span></span></dt>
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User In BIND 8, this enables keeping of
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User statistics for every host that the name server interacts
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User Not implemented in BIND 9.
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User<dt><span class="term"><span><strong class="command">maintain-ixfr-base</strong></span></span></dt>
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User <span class="emphasis"><em>This option is obsolete</em></span>.
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User It was used in <acronym class="acronym">BIND</acronym> 8 to
6a3d68b02c16c3d83fed31d3d6a1d7613a71305fTinderbox User determine whether a transaction log was
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews kept for Incremental Zone Transfer. <acronym class="acronym">BIND</acronym> 9 maintains a transaction
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews log whenever possible. If you need to disable outgoing
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews incremental zone
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews transfers, use <span><strong class="command">provide-ixfr</strong></span> <strong class="userinput"><code>no</code></strong>.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<dt><span class="term"><span><strong class="command">minimal-responses</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews If <strong class="userinput"><code>yes</code></strong>, then when generating
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews responses the server will only add records to the authority
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews and additional data sections when they are required (e.g.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews delegations, negative responses). This may improve the
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews performance of the server.
90863a6f9bfb06062c7fdf269bb675e7b674fc31Mark Andrews The default is <strong class="userinput"><code>no</code></strong>.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<dt><span class="term"><span><strong class="command">multiple-cnames</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews This option was used in <acronym class="acronym">BIND</acronym> 8 to allow
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews a domain name to have multiple CNAME records in violation of
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews the DNS standards. <acronym class="acronym">BIND</acronym> 9.2 onwards
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews always strictly enforces the CNAME rules both in master
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews files and dynamic updates.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<dt><span class="term"><span><strong class="command">notify</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews If <strong class="userinput"><code>yes</code></strong> (the default),
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews DNS NOTIFY messages are sent when a zone the server is
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater authoritative for
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews changes, see <a href="Bv9ARM.ch04.html#notify" title="Notify">the section called “Notify”</a>. The messages are
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater servers listed in the zone's NS records (except the master
8de3f14f1c300c3e1ed99084cc03485b42c92bf1Tinderbox User server identified
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews in the SOA MNAME field), and to any servers listed in the
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <span><strong class="command">also-notify</strong></span> option.
45eca3a5d46ed15aee14d81f6cb6c9fb6f365344Mark Andrews If <strong class="userinput"><code>master-only</code></strong>, notifies are only
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User for master zones.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <strong class="userinput"><code>explicit</code></strong>, notifies are sent only
45eca3a5d46ed15aee14d81f6cb6c9fb6f365344Mark Andrews servers explicitly listed using <span><strong class="command">also-notify</strong></span>.
6306dd073e0eba562491222821c4d3b39f440718Evan Hunt If <strong class="userinput"><code>no</code></strong>, no notifies are sent.
6306dd073e0eba562491222821c4d3b39f440718Evan Hunt The <span><strong class="command">notify</strong></span> option may also be
6306dd073e0eba562491222821c4d3b39f440718Evan Hunt specified in the <span><strong class="command">zone</strong></span>
f4193c2021ab0aeaad33fe0b3d1d49c80db5c725Mark Andrews in which case it overrides the <span><strong class="command">options notify</strong></span> statement.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews It would only be necessary to turn off this option if it
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User caused slaves
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User<dt><span class="term"><span><strong class="command">notify-to-soa</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews If <strong class="userinput"><code>yes</code></strong> do not check the nameservers
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews in the NS RRset against the SOA MNAME. Normally a NOTIFY
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User message is not sent to the SOA MNAME (SOA ORIGIN) as it is
3e1a17d65ec6227900f388ba2f7561365f7d4f5cTinderbox User supposed to contain the name of the ultimate master.
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews Sometimes, however, a slave is listed as the SOA MNAME in
cff0e0b52cf0928123bad6f3bccf56e22bbc07f5Automatic Updater hidden master configurations and in that case you would
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews want the ultimate master to still send NOTIFY messages to
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews all the nameservers listed in the NS RRset.
616c05f95f9a9683d73c108df2eda56bf70b77ccTinderbox User<dt><span class="term"><span><strong class="command">recursion</strong></span></span></dt>
c28a1243429dfaf8dc5f6c1db0dccdc6ce386baeMark Andrews If <strong class="userinput"><code>yes</code></strong>, and a
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews DNS query requests recursion, then the server will attempt
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews all the work required to answer the query. If recursion is
5f7e0eb1cb917b788906d3e2aa01bfc4885dcae4Mark Andrews and the server does not already know the answer, it will
15ae68f3db8261770fc33b8e0f83f5d8c7021e84Mark Andrews referral response. The default is
ac4e70ff8955669341f435bc0a734a17c01af124Mark Andrews <strong class="userinput"><code>yes</code></strong>.
c5a97a549c89d562e999d4f906b882c5a2a474e1Tinderbox User Note that setting <span><strong class="command">recursion no</strong></span> does not prevent
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User clients from getting data from the server's cache; it only
c5a97a549c89d562e999d4f906b882c5a2a474e1Tinderbox User prevents new data from being cached as an effect of client
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Caching may still occur as an effect the server's internal
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews operation, such as NOTIFY address lookups.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews See also <span><strong class="command">fetch-glue</strong></span> above.
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User<dt><span class="term"><span><strong class="command">rfc2308-type1</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Setting this to <strong class="userinput"><code>yes</code></strong> will
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User cause the server to send NS records along with the SOA
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater record for negative
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater answers. The default is <strong class="userinput"><code>no</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Not yet implemented in <acronym class="acronym">BIND</acronym>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">use-id-pool</strong></span></span></dt>
436aad11e01e916f75e68a2e9cb89ac217a990d3Tinderbox User <span class="emphasis"><em>This option is obsolete</em></span>.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater <acronym class="acronym">BIND</acronym> 9 always allocates query
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews IDs from a pool.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">zone-statistics</strong></span></span></dt>
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User If <strong class="userinput"><code>yes</code></strong>, the server will collect
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews statistical data on all zones (unless specifically turned
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User on a per-zone basis by specifying <span><strong class="command">zone-statistics no</strong></span>
a01aa536188bb3535dfc1107a623e6355a8e6b7cMark Andrews in the <span><strong class="command">zone</strong></span> statement).
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User These statistics may be accessed
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User using <span><strong class="command">rndc stats</strong></span>, which will
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater dump them to the file listed
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews in the <span><strong class="command">statistics-file</strong></span>. See
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater also <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">use-ixfr</strong></span></span></dt>
8d0e57cdac5e28964ebe7c0d925d158f17b401a6Tinderbox User <span class="emphasis"><em>This option is obsolete</em></span>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User If you need to disable IXFR to a particular server or
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews the information on the <span><strong class="command">provide-ixfr</strong></span> option
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews in <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Usage”</a>.
e10d61d84e0b735f1e8eca18644cfdb1b06cad33Tinderbox User <a href="Bv9ARM.ch04.html#incremental_zone_transfers" title="Incremental Zone Transfers (IXFR)">the section called “Incremental Zone Transfers (IXFR)”</a>.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<dt><span class="term"><span><strong class="command">provide-ixfr</strong></span></span></dt>
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User See the description of
757ff043760e4743dda1a10e7d58349275934902Tinderbox User <span><strong class="command">provide-ixfr</strong></span> in
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User Usage”</a>.
90cde4c188ac5bdea4f402b241c387c9cc9d4cc4Tinderbox User<dt><span class="term"><span><strong class="command">request-ixfr</strong></span></span></dt>
f4193c2021ab0aeaad33fe0b3d1d49c80db5c725Mark Andrews See the description of
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">request-ixfr</strong></span> in
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
4c9f230f7ca5b2b08ea8fd7a6944135801dbe152Tinderbox User Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews Usage”</a>.
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews<dt><span class="term"><span><strong class="command">treat-cr-as-space</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This option was used in <acronym class="acronym">BIND</acronym>
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews the server treat carriage return ("<span><strong class="command">\r</strong></span>") characters the same way
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews as a space or tab character,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to facilitate loading of zone files on a UNIX system that
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User were generated
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User on an NT or DOS machine. In <acronym class="acronym">BIND</acronym> 9, both UNIX "<span><strong class="command">\n</strong></span>"
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater and NT/DOS "<span><strong class="command">\r\n</strong></span>" newlines
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User are always accepted,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater and the option is ignored.
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews<span class="term"><span><strong class="command">additional-from-auth</strong></span>, </span><span class="term"><span><strong class="command">additional-from-cache</strong></span></span>
ad1d4c904f8e8dcb4db68ae1ac2f83ac53ea380dTinderbox User These options control the behavior of an authoritative
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User answering queries which have additional data, or when
02b3e44a996e9753d86306b6a1b6b579a73787fcTinderbox User following CNAME
2c1632c71e2f4d8afa35efce3080b31602a6608cTinderbox User and DNAME chains.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews When both of these options are set to <strong class="userinput"><code>yes</code></strong>
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews (the default) and a
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews query is being answered from authoritative data (a zone
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews configured into the server), the additional data section of
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater reply will be filled in using data from other authoritative
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User and from the cache. In some situations this is undesirable,
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User as when there is concern over the correctness of the cache,
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews in servers where slave zones may be added and modified by
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User untrusted third parties. Also, avoiding
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User the search for this additional data will speed up server
e20309353e6246485c521278131d3fced73d7957Tinderbox User at the possible expense of additional queries to resolve
c74518d655c1c563060f49569dce71e4a00f5f4eTinderbox User otherwise be provided in the additional section.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater For example, if a query asks for an MX record for host <code class="literal">foo.example.com</code>,
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews and the record found is "<code class="literal">MX 10 mail.example.net</code>", normally the address
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater records (A and AAAA) for <code class="literal">mail.example.net</code> will be provided as well,
53b97c9873a923f504893d1e2ab62000dfac221fTinderbox User if known, even though they are not in the example.com zone.
e8c42d50cdaf3a3b841074d8bf72b40ffbae2a4bTinderbox User Setting these options to <span><strong class="command">no</strong></span>
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater disables this behavior and makes
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews the server only search for additional data in the zone it
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater These options are intended for use in authoritative-only
713a5e3080f112b3efde9235e9c92035056ff966Automatic Updater servers, or in authoritative-only views. Attempts to set
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater them to <span><strong class="command">no</strong></span> without also
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User <span><strong class="command">recursion no</strong></span> will cause the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater ignore the options and log a warning message.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews Specifying <span><strong class="command">additional-from-cache no</strong></span> actually
be46cb4bee9253ee4832340c719920642e00c41aTinderbox User disables the use of the cache not only for additional data
c243d779731a410f8dc2d2feeed20c15f299b6e3Automatic Updater but also when looking up the answer. This is usually the
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater behavior in an authoritative-only server where the
099b86fb8136a7dff81df85cf395978c16eb254cAutomatic Updater correctness of
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews the cached data is an issue.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater When a name server is non-recursively queried for a name
02b3e44a996e9753d86306b6a1b6b579a73787fcTinderbox User below the apex of any served zone, it normally answers with
c2abd6efeb9affa70aabb63da2acb23e135cf7f2Mark Andrews "upwards referral" to the root servers or the servers of
f22980c16f244b7d7f33b5248f2d38bd4885f108Automatic Updater known parent of the query name. Since the data in an
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User upwards referral
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews comes from the cache, the server will not be able to provide
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews referrals when <span><strong class="command">additional-from-cache no</strong></span>
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews has been specified. Instead, it will respond to such
d630ef2ff74445949a482660938e9fa9da52ca14Automatic Updater with REFUSED. This should not cause any problems since
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User upwards referrals are not required for the resolution
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User<dt><span class="term"><span><strong class="command">match-mapped-addresses</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User If <strong class="userinput"><code>yes</code></strong>, then an
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater IPv4-mapped IPv6 address will match any address match
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User list entries that match the corresponding IPv4 address.
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User Enabling this option is sometimes useful on IPv6-enabled
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User systems, to work around a kernel quirk that causes IPv4
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User TCP connections such as zone transfers to be accepted
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews on an IPv6 socket using mapped addresses, causing
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews address match lists designed for IPv4 to fail to match.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User The use of this option for any other purpose is discouraged.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User When <strong class="userinput"><code>yes</code></strong> and the server loads a new version of a master
a98018050a8dfb234c22664f673e50bc3066aa9eTinderbox User zone from its zone file or receives a new version of a slave
757ff043760e4743dda1a10e7d58349275934902Tinderbox User file by a non-incremental zone transfer, it will compare
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews the new version to the previous one and calculate a set
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews of differences. The differences are then logged in the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User zone's journal file such that the changes can be transmitted
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User to downstream slaves as an incremental zone transfer.
90b25b84f037ec923efaee84d2c0dc599293d04eTinderbox User By allowing incremental zone transfers to be used for
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews non-dynamic zones, this option saves bandwidth at the
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews expense of increased CPU and memory consumption at the
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews In particular, if the new version of a zone is completely
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews different from the previous one, the set of differences
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews will be of a size comparable to the combined size of the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User old and new zone version, and the server will need to
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User temporarily allocate memory to hold this complete
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User difference set.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<p><span><strong class="command">ixfr-from-differences</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater also accepts <span><strong class="command">master</strong></span> and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">slave</strong></span> at the view and options
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User levels which causes
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">ixfr-from-differences</strong></span> to be enabled for
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User all <span><strong class="command">master</strong></span> or
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">slave</strong></span> zones respectively.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User It is off by default.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">multi-master</strong></span></span></dt>
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User This should be set when you have multiple masters for a zone
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User addresses refer to different machines. If <strong class="userinput"><code>yes</code></strong>, <span><strong class="command">named</strong></span> will
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User when the serial number on the master is less than what <span><strong class="command">named</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater has. The default is <strong class="userinput"><code>no</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">dnssec-enable</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Enable DNSSEC support in <span><strong class="command">named</strong></span>. Unless set to <strong class="userinput"><code>yes</code></strong>,
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater <span><strong class="command">named</strong></span> behaves as if it does not support DNSSEC.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <strong class="userinput"><code>yes</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">dnssec-validation</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Enable DNSSEC validation in <span><strong class="command">named</strong></span>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
a61158fed2e0281a40e3e97e0b7c3f9789a07b4eTinderbox User set to <strong class="userinput"><code>yes</code></strong> to be effective.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User The default is <strong class="userinput"><code>yes</code></strong>.
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User<dt><span class="term"><span><strong class="command">dnssec-accept-expired</strong></span></span></dt>
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User Accept expired signatures when verifying DNSSEC signatures.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <strong class="userinput"><code>no</code></strong>.
a48cf7debd16396cd764139772b0226eec05347fTinderbox User Setting this option to "yes" leaves <span><strong class="command">named</strong></span> vulnerable to replay attacks.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">querylog</strong></span></span></dt>
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User Specify whether query logging should be started when <span><strong class="command">named</strong></span>
c7f4dfc8decb44451cff27ef160d539d4954dc31Tinderbox User If <span><strong class="command">querylog</strong></span> is not specified,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater then the query logging
f34958b7669dfca333cc0cd20113b1f55a89e1deTinderbox User is determined by the presence of the logging category <span><strong class="command">queries</strong></span>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">check-names</strong></span></span></dt>
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews This option is used to restrict the character set and syntax
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater certain domain names in master files and/or DNS responses
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews from the network. The default varies according to usage
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater For <span><strong class="command">slave</strong></span> zones the default
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is <span><strong class="command">warn</strong></span>.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater For answers received from the network (<span><strong class="command">response</strong></span>)
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the default is <span><strong class="command">ignore</strong></span>.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater The rules for legal hostnames and mail domains are derived
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater from RFC 952 and RFC 821 as modified by RFC 1123.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<p><span><strong class="command">check-names</strong></span>
c762a0e4141c8eb9d7567c614cf6dde994f6a76dTinderbox User applies to the owner names of A, AAAA and MX records.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater It also applies to the domain names in the RDATA of NS, SOA,
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User MX, and SRV records.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User It also applies to the RDATA of PTR records where the owner
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User name indicated that it is a reverse lookup of a hostname
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT).
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User<dt><span class="term"><span><strong class="command">check-mx</strong></span></span></dt>
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater Check whether the MX record appears to refer to a IP address.
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater The default is to <span><strong class="command">warn</strong></span>. Other possible
3f616e6f846be57b1717c6beaba0f74de9d5a7c6Automatic Updater values are <span><strong class="command">fail</strong></span> and
1b670d35282f1b9352692ad212be3c0aa97b0689Automatic Updater <span><strong class="command">ignore</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">check-wildcard</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This option is used to check for non-terminal wildcards.
316cd2460aa66e157f72890974ca5c21d65e70e6Tinderbox User The use of non-terminal wildcards is almost always as a
316cd2460aa66e157f72890974ca5c21d65e70e6Tinderbox User result of a failure
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User to understand the wildcard matching algorithm (RFC 1034).
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater affects master zones. The default (<span><strong class="command">yes</strong></span>) is to check
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater for non-terminal wildcards and issue a warning.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">check-integrity</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Perform post load zone integrity checks on master
1f4c645185bd8fc70048e0a69eee46193a284e5cTinderbox User zones. This checks that MX and SRV records refer
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to address (A or AAAA) records and that glue
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User address records exist for delegated zones. For
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater MX and SRV records only in-zone hostnames are
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User checked (for out-of-zone hostnames use
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">named-checkzone</strong></span>).
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User For NS records only names below top of zone are
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater checked (for out-of-zone names and glue consistency
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User checks use <span><strong class="command">named-checkzone</strong></span>).
6ee455a915d0e5cab50865da23152efe59ea1decTinderbox User The default is <span><strong class="command">yes</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">check-mx-cname</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <span><strong class="command">check-integrity</strong></span> is set then
79b627f399ce925988bb326315e6742d5316cb6bTinderbox User fail, warn or ignore MX records that refer
79b627f399ce925988bb326315e6742d5316cb6bTinderbox User to CNAMES. The default is to <span><strong class="command">warn</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">check-srv-cname</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <span><strong class="command">check-integrity</strong></span> is set then
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User fail, warn or ignore SRV records that refer
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User to CNAMES. The default is to <span><strong class="command">warn</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">check-sibling</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater When performing integrity checks, also check that
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User sibling glue exists. The default is <span><strong class="command">yes</strong></span>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">zero-no-soa-ttl</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User When returning authoritative negative responses to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater SOA queries set the TTL of the SOA record returned in
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User the authority section to zero.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <span><strong class="command">yes</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">zero-no-soa-ttl-cache</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater When caching a negative response to a SOA query
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater set the TTL to zero.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <span><strong class="command">no</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">update-check-ksk</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater When regenerating the RRSIGs following a UPDATE
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater request to a secure zone, check the KSK flag on
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the DNSKEY RR to determine if this key should be
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User used to generate the RRSIG. This flag is ignored
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater if there are not DNSKEY RRs both with and without
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <span><strong class="command">yes</strong></span>.
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater<dt><span class="term"><span><strong class="command">try-tcp-refresh</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Try to refresh the zone using TCP if UDP queries fail.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User For BIND 8 compatibility, the default is
402eda3e7d4254ffac1543bf2917c71248a09e4cTinderbox User <span><strong class="command">yes</strong></span>.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<div class="titlepage"><div><div><h4 class="title">
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<a name="id2581964"></a>Forwarding</h4></div></div></div>
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User The forwarding facility can be used to create a large site-wide
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater cache on a few servers, reducing traffic over links to external
0d3490f93bb980fde704055e74c1b508987a5fe4Mark Andrews name servers. It can also be used to allow queries by servers that
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User do not have direct access to the Internet, but wish to look up
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews names anyway. Forwarding occurs only on those queries for which
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the server is not authoritative and does not have the answer in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">forward</strong></span></span></dt>
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews This option is only meaningful if the
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews forwarders list is not empty. A value of <code class="varname">first</code>,
49ab13eefc8841ea42865ae09d5a2f760577089eTinderbox User the default, causes the server to query the forwarders
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User first — and
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User if that doesn't answer the question, the server will then
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews the answer itself. If <code class="varname">only</code> is
757ff043760e4743dda1a10e7d58349275934902Tinderbox User specified, the
757ff043760e4743dda1a10e7d58349275934902Tinderbox User server will only query the forwarders.
7ca715ad1587a68a531ea1cdea07515d7232567eTinderbox User<dt><span class="term"><span><strong class="command">forwarders</strong></span></span></dt>
a98018050a8dfb234c22664f673e50bc3066aa9eTinderbox User Specifies the IP addresses to be used
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User for forwarding. The default is the empty list (no
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Forwarding can also be configured on a per-domain basis, allowing
536da846f6cc03ad8abbb8bb9d5d8a6f607b8c33Mark Andrews for the global forwarding options to be overridden in a variety
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User of ways. You can set particular domains to use different
19ad308d84cbf446a144e5a91f2032389a9d65c1Tinderbox User or have a different <span><strong class="command">forward only/first</strong></span> behavior,
114f7780384371121918624ae2c80ecfce545683Tinderbox User or not forward at all, see <a href="Bv9ARM.ch06.html#zone_statement_grammar" title="zone
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Statement Grammar">the section called “<span><strong class="command">zone</strong></span>
42c81cf2de732ec6d00e73fc755a399ca037e543Mark Andrews Statement Grammar”</a>.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<div class="titlepage"><div><div><h4 class="title">
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater<a name="id2582091"></a>Dual-stack Servers</h4></div></div></div>
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater Dual-stack servers are used as servers of last resort to work
71fc4775d04aea66809e3eb5b5159c55413bdc5cMark Andrews problems in reachability due the lack of support for either IPv4
7d704e522860496310bb29c28e76064868401a9cMark Andrews on the host machine.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater<dt><span class="term"><span><strong class="command">dual-stack-servers</strong></span></span></dt>
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater Specifies host names or addresses of machines with access to
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater both IPv4 and IPv6 transports. If a hostname is used, the
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater server must be able
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater to resolve the name using only the transport it has. If the
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater machine is dual
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater stacked, then the <span><strong class="command">dual-stack-servers</strong></span> have no effect unless
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater access to a transport has been disabled on the command line
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater (e.g. <span><strong class="command">named -4</strong></span>).
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<div class="titlepage"><div><div><h4 class="title">
b7fcdb0bee7680fe9536bec3b204aea094bc514eTinderbox User<a name="access_control"></a>Access Control</h4></div></div></div>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Access to the server can be restricted based on the IP address
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User of the requesting system. See <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a> for
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater details on how to specify IP address lists.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt>
b7fcdb0bee7680fe9536bec3b204aea094bc514eTinderbox User Specifies which hosts are allowed to
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User notify this server, a slave, of zone changes in addition
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews to the zone masters.
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User <span><strong class="command">allow-notify</strong></span> may also be
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater specified in the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">zone</strong></span> statement, in which case
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson it overrides the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">options allow-notify</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews statement. It is only meaningful
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews for a slave zone. If not specified, the default is to
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews process notify messages
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews only from a zone's master.
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson<dt><span class="term"><span><strong class="command">allow-query</strong></span></span></dt>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Specifies which hosts are allowed to ask ordinary
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews DNS questions. <span><strong class="command">allow-query</strong></span> may
8bc3d252395842452a6d2c775cf8445f6349e331Tinderbox User also be specified in the <span><strong class="command">zone</strong></span>
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User statement, in which case it overrides the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">options allow-query</strong></span> statement.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If not specified, the default is to allow queries
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User from all hosts.
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User <span><strong class="command">allow-query-cache</strong></span> is now
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User used to specify access to the cache.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater<dt><span class="term"><span><strong class="command">allow-query-on</strong></span></span></dt>
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater Specifies which local addresses can accept ordinary
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews DNS questions. This makes it possible, for instance,
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater to allow queries on internal-facing interfaces but
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater disallow them on external-facing ones, without
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User necessarily knowing the internal network's addresses.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt <span><strong class="command">allow-query-on</strong></span> may
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt also be specified in the <span><strong class="command">zone</strong></span>
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User statement, in which case it overrides the
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt <span><strong class="command">options allow-query-on</strong></span> statement.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt If not specified, the default is to allow queries
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt on all addresses.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt <span><strong class="command">allow-query-cache</strong></span> is
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt used to specify access to the cache.
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews<dt><span class="term"><span><strong class="command">allow-query-cache</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Specifies which hosts are allowed to get answers
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User from the cache. If <span><strong class="command">allow-query-cache</strong></span>
603cf17f33da24d460616389ec40d6f2a6e110a0Automatic Updater is not set then <span><strong class="command">allow-recursion</strong></span>
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User is used if set, otherwise <span><strong class="command">allow-query</strong></span>
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User is used if set unless <span><strong class="command">recursion no;</strong></span> is
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater set in which case <span><strong class="command">none;</strong></span> is used,
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater otherwise the default (<span><strong class="command">localnets;</strong></span>
757ff043760e4743dda1a10e7d58349275934902Tinderbox User <span><strong class="command">localhost;</strong></span>) is used.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">allow-query-cache-on</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Specifies which local addresses can give answers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater from the cache. If not specified, the default is
7711228a135a2fe85765ba13a67b8e397ed73489Mark Andrews to allow cache queries on any address,
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User <span><strong class="command">localnets</strong></span> and
9692d283bb43c9eab49a7fadfc1b74a6e20e6151Tinderbox User <span><strong class="command">localhost</strong></span>.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<dt><span class="term"><span><strong class="command">allow-recursion</strong></span></span></dt>
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User Specifies which hosts are allowed to make recursive
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater queries through this server. If
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">allow-recursion</strong></span> is not set
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User then <span><strong class="command">allow-query-cache</strong></span> is
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User used if set, otherwise <span><strong class="command">allow-query</strong></span>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User is used if set, otherwise the default
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User (<span><strong class="command">localnets;</strong></span>
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews <span><strong class="command">localhost;</strong></span>) is used.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">allow-recursion-on</strong></span></span></dt>
365bb6f27eace1836cb5bc6b5f9ed8c88fe22e4aTinderbox User Specifies which local addresses can accept recursive
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User queries. If not specified, the default is to allow
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews recursive queries on all addresses.
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User<dt><span class="term"><span><strong class="command">allow-update</strong></span></span></dt>
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater Specifies which hosts are allowed to
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User submit Dynamic DNS updates for master zones. The default is
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews updates from all hosts. Note that allowing updates based
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater on the requestor's IP address is insecure; see
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a> for details.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater Specifies which hosts are allowed to
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater submit Dynamic DNS updates to slave zones to be forwarded to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater master. The default is <strong class="userinput"><code>{ none; }</code></strong>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater means that no update forwarding will be performed. To
536da846f6cc03ad8abbb8bb9d5d8a6f607b8c33Mark Andrews update forwarding, specify
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews <strong class="userinput"><code>allow-update-forwarding { any; };</code></strong>.
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater Specifying values other than <strong class="userinput"><code>{ none; }</code></strong> or
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <strong class="userinput"><code>{ any; }</code></strong> is usually
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews counterproductive, since
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews the responsibility for update access control should rest
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater master server, not the slaves.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Note that enabling the update forwarding feature on a slave
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater may expose master servers relying on insecure IP address
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User access control to attacks; see <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a>
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User for more details.
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User<dt><span class="term"><span><strong class="command">allow-v6-synthesis</strong></span></span></dt>
098097efb95046a4a5285b6dae95dea3e3b70853Automatic Updater This option was introduced for the smooth transition from
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater to A6 and from "nibble labels" to binary labels.
78bc8fdc2488c92d7228e8de19827e2c114c56caAutomatic Updater However, since both A6 and binary labels were then
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater this option was also deprecated.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater It is now ignored with some warning messages.
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User<dt><span class="term"><span><strong class="command">allow-transfer</strong></span></span></dt>
904890e38b74005395451501400718d759bfc064Tinderbox User Specifies which hosts are allowed to
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User receive zone transfers from the server. <span><strong class="command">allow-transfer</strong></span> may
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater also be specified in the <span><strong class="command">zone</strong></span>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User statement, in which
1fff4d36fb18ccdca15acb0bae20c2aa8e833ceeTinderbox User case it overrides the <span><strong class="command">options allow-transfer</strong></span> statement.
11b6b0d74bb8dd6bd1ce0b60ba7f9b66323f06d4Tinderbox User If not specified, the default is to allow transfers to all
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews<dt><span class="term"><span><strong class="command">blackhole</strong></span></span></dt>
64f2afc2c63a59461d11b581a208efdbeec124adTinderbox User Specifies a list of addresses that the
a8677ecad546c955406b341eb8344ed06768b11eTinderbox User server will not accept queries from or use to resolve a
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater query. Queries
d3ba57ed92b7095fdeabc444af5dd18ac4781064Tinderbox User from these addresses will not be responded to. The default
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater is <strong class="userinput"><code>none</code></strong>.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<div class="titlepage"><div><div><h4 class="title">
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox User<a name="id2582733"></a>Interfaces</h4></div></div></div>
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews The interfaces and ports that the server will answer queries
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User an optional port and an <code class="varname">address_match_list</code>.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User The server will listen on all interfaces allowed by the address
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User match list. If a port is not specified, port 53 will be used.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Multiple <span><strong class="command">listen-on</strong></span> statements are
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt<pre class="programlisting">listen-on { 5.6.7.8; };
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt will enable the name server on port 53 for the IP address
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt 5.6.7.8, and on port 1234 of an address on the machine in net
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt 1.2 that is not 1.2.3.4.
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater If no <span><strong class="command">listen-on</strong></span> is specified, the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User server will listen on port 53 on all IPv4 interfaces.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">listen-on-v6</strong></span> option is used to
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User specify the interfaces and the ports on which the server will
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User for incoming queries sent using IPv6.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User as the <code class="varname">address_match_list</code> for the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">listen-on-v6</strong></span> option,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the server does not bind a separate socket to each IPv6 interface
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater address as it does for IPv4 if the operating system has enough API
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User support for IPv6 (specifically if it conforms to RFC 3493 and RFC
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Instead, it listens on the IPv6 wildcard address.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If the system only has incomplete API support for IPv6, however,
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User the behavior is the same as that for IPv4.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User A list of particular IPv6 addresses can also be specified, in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the server listens on a separate socket for each specified
4cde88fbf4c5e78a785d40f364cdcf60f3575f0cTinderbox User regardless of whether the desired API is supported by the system.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Multiple <span><strong class="command">listen-on-v6</strong></span> options can
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt For example,
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User<pre class="programlisting">listen-on-v6 { any; };
681beefc668253b3e469a1de282fbc33a3752422Automatic Updaterlisten-on-v6 port 1234 { !2001:db8::/32; any; };
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User will enable the name server on port 53 for any IPv6 addresses
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User (with a single wildcard socket),
904890e38b74005395451501400718d759bfc064Tinderbox User and on port 1234 of IPv6 addresses that is not in the prefix
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User 2001:db8::/32 (with separate sockets for each matched address.)
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User To make the server not listen on any IPv6 address, use
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<pre class="programlisting">listen-on-v6 { none; };
5b56652059e2c22185a0b2bb1f5e58eb89a44426Tinderbox User If no <span><strong class="command">listen-on-v6</strong></span> option is
83e281baf1b4149dc637d24dd41141129ae712c6Tinderbox User specified, the server will not listen on any IPv6 address
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater unless <span><strong class="command">-6</strong></span> is specified when <span><strong class="command">named</strong></span> is
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User invoked. If <span><strong class="command">-6</strong></span> is specified then
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User <span><strong class="command">named</strong></span> will listen on port 53 on all IPv6 interfaces by default.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h4 class="title">
64f2afc2c63a59461d11b581a208efdbeec124adTinderbox User<a name="query_address"></a>Query Address</h4></div></div></div>
d3ba57ed92b7095fdeabc444af5dd18ac4781064Tinderbox User If the server doesn't know the answer to a question, it will
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater query other name servers. <span><strong class="command">query-source</strong></span> specifies
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User the address and port used for such queries. For queries sent over
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User IPv6, there is a separate <span><strong class="command">query-source-v6</strong></span> option.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User If <span><strong class="command">address</strong></span> is <span><strong class="command">*</strong></span> (asterisk) or is omitted,
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User a wildcard IP address (<span><strong class="command">INADDR_ANY</strong></span>)
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User will be used.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews If <span><strong class="command">port</strong></span> is <span><strong class="command">*</strong></span> or is omitted,
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User a random port number from a pre-configured
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User range is picked up and will be used for each query.
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User The port range(s) is that specified in
ca5ba35827e475a824ec79d489dbcdb3341a35ccTinderbox User the <span><strong class="command">use-v4-udp-ports</strong></span> (for IPv4)
757ff043760e4743dda1a10e7d58349275934902Tinderbox User and <span><strong class="command">use-v6-udp-ports</strong></span> (for IPv6)
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews options, excluding the ranges specified in
ca5ba35827e475a824ec79d489dbcdb3341a35ccTinderbox User the <span><strong class="command">avoid-v4-udp-ports</strong></span>
1fdd58445074579ee3b65c871137a7a1740eb542Mark Andrews and <span><strong class="command">avoid-v6-udp-ports</strong></span> options, respectively.
b779e1efb14f9616a35befd2b1cfc2578f1a4d70Tinderbox User The defaults of the <span><strong class="command">query-source</strong></span> and
9692d283bb43c9eab49a7fadfc1b74a6e20e6151Tinderbox User <span><strong class="command">query-source-v6</strong></span> options
757ff043760e4743dda1a10e7d58349275934902Tinderbox User<pre class="programlisting">query-source address * port *;
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox Userquery-source-v6 address * port *;
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User If <span><strong class="command">use-v4-udp-ports</strong></span> or
904890e38b74005395451501400718d759bfc064Tinderbox User <span><strong class="command">use-v6-udp-ports</strong></span> is unspecified,
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span><strong class="command">named</strong></span> will check if the operating
316cd2460aa66e157f72890974ca5c21d65e70e6Tinderbox User system provides a programming interface to retrieve the
1fff4d36fb18ccdca15acb0bae20c2aa8e833ceeTinderbox User system's default range for ephemeral ports.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews If such an interface is available,
d3ba57ed92b7095fdeabc444af5dd18ac4781064Tinderbox User <span><strong class="command">named</strong></span> will use the corresponding system
6c910bd5e4a85a56e3a61fdf7b237a45bb2553eeTinderbox User default range; otherwise, it will use its own defaults:
049728912c39135db248f9b48f8f26675f456e9dTinderbox User<pre class="programlisting">use-v4-udp-ports { range 1024 65535; };
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox Useruse-v6-udp-ports { range 1024 65535; };
fd0f3e7cd8bc0e7fd08cc81ceb6ced861b706c97Mark Andrews Note: make sure the ranges be sufficiently large for
757ff043760e4743dda1a10e7d58349275934902Tinderbox User security. A desirable size depends on various parameters,
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater but we generally recommend it contain at least 16384 ports
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews (14 bits of entropy).
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User Note also that the system's default range when used may be
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User too small for this purpose, and that the range may even be
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User changed while <span><strong class="command">named</strong></span> is running; the new
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User range will automatically be applied when <span><strong class="command">named</strong></span>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User It is encouraged to
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User configure <span><strong class="command">use-v4-udp-ports</strong></span> and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">use-v6-udp-ports</strong></span> explicitly so that the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User ranges are sufficiently large and are reasonably
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User independent from the ranges used by other applications.
c288e47fb7d4baa1ed887156b1c5e5db394d4f52Tinderbox User Note: the operational configuration
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater where <span><strong class="command">named</strong></span> runs may prohibit the use
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater of some ports. For example, UNIX systems will not allow
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">named</strong></span> running without a root privilege
fae2925c4d1b45056302be96e5e334f3ad5809c5Tinderbox User to use ports less than 1024.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If such ports are included in the specified (or detected)
90ff38a0d8deaf5f9c2aa5916d99b2e572d28738Automatic Updater set of query ports, the corresponding query attempts will
c288e47fb7d4baa1ed887156b1c5e5db394d4f52Tinderbox User fail, resulting in resolution failures or delay.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User It is therefore important to configure the set of ports
90ff38a0d8deaf5f9c2aa5916d99b2e572d28738Automatic Updater that can be safely used in the expected operational environment.
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt The defaults of the <span><strong class="command">avoid-v4-udp-ports</strong></span> and
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt <span><strong class="command">avoid-v6-udp-ports</strong></span> options
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<pre class="programlisting">avoid-v4-udp-ports {};
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox Useravoid-v6-udp-ports {};
ce0fd07045292942bfa3e755d9ce596941528a63Automatic Updater Note: BIND 9.5.0 introduced
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User the <span><strong class="command">use-queryport-pool</strong></span>
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater option to support a pool of such random ports, but this
6ee455a915d0e5cab50865da23152efe59ea1decTinderbox User option is now obsolete because reusing the same ports in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the pool may not be sufficiently secure.
96713299d08c0735c18ebe8772dd2cc1ecd4356aAutomatic Updater For the same reason, it is generally strongly discouraged to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater specify a particular port for the
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews <span><strong class="command">query-source</strong></span> or
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">query-source-v6</strong></span> options;
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater it implicitly disables the use of randomized port numbers.
c6517a807173827b8f638d31303805ee4c1d8054Automatic Updater<dt><span class="term"><span><strong class="command">use-queryport-pool</strong></span></span></dt>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews This option is obsolete.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">queryport-pool-ports</strong></span></span></dt>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews This option is obsolete.
ad1d4c904f8e8dcb4db68ae1ac2f83ac53ea380dTinderbox User<dt><span class="term"><span><strong class="command">queryport-pool-updateinterval</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This option is obsolete.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The address specified in the <span><strong class="command">query-source</strong></span> option
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater is used for both UDP and TCP queries, but the port applies only
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews to UDP queries. TCP queries always use a random
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater unprivileged port.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
0ead2ac0a4b59c3e4a731027f0f66fbe602b1289Tinderbox User Solaris 2.5.1 and earlier does not support setting the source
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User address for TCP sockets.
d98b4b724343547314bde32a54966c8f124a5f03Mark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt See also <span><strong class="command">transfer-source</strong></span> and
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt <span><strong class="command">notify-source</strong></span>.
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews<div class="titlepage"><div><div><h4 class="title">
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<a name="zone_transfers"></a>Zone Transfers</h4></div></div></div>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <acronym class="acronym">BIND</acronym> has mechanisms in place to
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews facilitate zone transfers
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews and set limits on the amount of load that transfers place on the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews system. The following options apply to zone transfers.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews<dt><span class="term"><span><strong class="command">also-notify</strong></span></span></dt>
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater Defines a global list of IP addresses of name servers
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews that are also sent NOTIFY messages whenever a fresh copy of
e705db6d5d886dc14f4a75a2046a075c0750e7eeAutomatic Updater zone is loaded, in addition to the servers listed in the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User zone's NS records.
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox User This helps to ensure that copies of the zones will
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews quickly converge on stealth servers.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Optionally, a port may be specified with each
757ff043760e4743dda1a10e7d58349275934902Tinderbox User <span><strong class="command">also-notify</strong></span> address to send
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the notify messages to a port other than the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater default of 53.
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews If an <span><strong class="command">also-notify</strong></span> list
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater is given in a <span><strong class="command">zone</strong></span> statement,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater it will override
616c05f95f9a9683d73c108df2eda56bf70b77ccTinderbox User the <span><strong class="command">options also-notify</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User statement. When a <span><strong class="command">zone notify</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User is set to <span><strong class="command">no</strong></span>, the IP
40696c4c389a780082fb77840c173b201ce696d6Automatic Updater addresses in the global <span><strong class="command">also-notify</strong></span> list will
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User not be sent NOTIFY messages for that zone. The default is
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User list (no global notification list).
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User Inbound zone transfers running longer than
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews this many minutes will be terminated. The default is 120
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater (2 hours). The maximum value is 28 days (40320 minutes).
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Inbound zone transfers making no progress
b779e1efb14f9616a35befd2b1cfc2578f1a4d70Tinderbox User in this many minutes will be terminated. The default is 60
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater (1 hour). The maximum value is 28 days (40320 minutes).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Outbound zone transfers running longer than
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater this many minutes will be terminated. The default is 120
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User (2 hours). The maximum value is 28 days (40320 minutes).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Outbound zone transfers making no progress
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in this many minutes will be terminated. The default is 60
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater hour). The maximum value is 28 days (40320 minutes).
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<dt><span class="term"><span><strong class="command">serial-query-rate</strong></span></span></dt>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Slave servers will periodically query master servers
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews to find out if zone serial numbers have changed. Each such
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews a minute amount of the slave server's network bandwidth. To
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews amount of bandwidth used, BIND 9 limits the rate at which
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User sent. The value of the <span><strong class="command">serial-query-rate</strong></span> option,
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater an integer, is the maximum number of queries sent per
c288e47fb7d4baa1ed887156b1c5e5db394d4f52Tinderbox User The default is 20.
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews<dt><span class="term"><span><strong class="command">serial-queries</strong></span></span></dt>
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews In BIND 8, the <span><strong class="command">serial-queries</strong></span>
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews set the maximum number of concurrent serial number queries
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater allowed to be outstanding at any given time.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater BIND 9 does not limit the number of outstanding
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User serial queries and ignores the <span><strong class="command">serial-queries</strong></span> option.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Instead, it limits the rate at which the queries are sent
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater as defined using the <span><strong class="command">serial-query-rate</strong></span> option.
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews<dt><span class="term"><span><strong class="command">transfer-format</strong></span></span></dt>
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson Zone transfers can be sent using two different formats,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span><strong class="command">one-answer</strong></span> and
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User <span><strong class="command">many-answers</strong></span>.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The <span><strong class="command">transfer-format</strong></span> option is used
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews on the master server to determine which format it sends.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">one-answer</strong></span> uses one DNS message per
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews resource record transferred.
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews <span><strong class="command">many-answers</strong></span> packs as many resource
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User records as possible into a message.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span><strong class="command">many-answers</strong></span> is more efficient, but is
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews only supported by relatively new slave servers,
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User such as <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
a900e4f99ff134b567b6df5ac2c841c7d0c551d3Automatic Updater 8.x and <acronym class="acronym">BIND</acronym> 4.9.5 onwards.
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User The <span><strong class="command">many-answers</strong></span> format is also supported by
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User recent Microsoft Windows nameservers.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User The default is <span><strong class="command">many-answers</strong></span>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">transfer-format</strong></span> may be overridden on a
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews per-server basis by using the <span><strong class="command">server</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">transfers-in</strong></span></span></dt>
a900e4f99ff134b567b6df5ac2c841c7d0c551d3Automatic Updater The maximum number of inbound zone transfers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that can be running concurrently. The default value is <code class="literal">10</code>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Increasing <span><strong class="command">transfers-in</strong></span> may
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater speed up the convergence
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater of slave zones, but it also may increase the load on the
4fda24d843edac463c98785ec0c850d912592dc1Tinderbox User<dt><span class="term"><span><strong class="command">transfers-out</strong></span></span></dt>
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews The maximum number of outbound zone transfers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that can be running concurrently. Zone transfer requests in
9563f388c8ca1bb9ebb04db54e122815b0008c8aTinderbox User of the limit will be refused. The default value is <code class="literal">10</code>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">transfers-per-ns</strong></span></span></dt>
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User The maximum number of inbound zone transfers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that can be concurrently transferring from a given remote
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default value is <code class="literal">2</code>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Increasing <span><strong class="command">transfers-per-ns</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews speed up the convergence of slave zones, but it also may
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User the load on the remote name server. <span><strong class="command">transfers-per-ns</strong></span> may
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User be overridden on a per-server basis by using the <span><strong class="command">transfers</strong></span> phrase
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews of the <span><strong class="command">server</strong></span> statement.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><span><strong class="command">transfer-source</strong></span></span></dt>
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User<p><span><strong class="command">transfer-source</strong></span>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews determines which local address will be bound to IPv4
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews TCP connections used to fetch zones transferred
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User inbound by the server. It also determines the
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews source IPv4 address, and optionally the UDP port,
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews used for the refresh queries and forwarded dynamic
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User updates. If not set, it defaults to a system
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews controlled value which will usually be the address
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews of the interface "closest to" the remote end. This
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User address must appear in the remote end's
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">allow-transfer</strong></span> option for the
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews zone being transferred, if one is specified. This
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User statement sets the
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">transfer-source</strong></span> for all zones,
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews but can be overridden on a per-view or per-zone
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User basis by including a
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">transfer-source</strong></span> statement within
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews the <span><strong class="command">view</strong></span> or
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User <span><strong class="command">zone</strong></span> block in the configuration
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User Solaris 2.5.1 and earlier does not support setting the
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews source address for TCP sockets.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><span><strong class="command">transfer-source-v6</strong></span></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews The same as <span><strong class="command">transfer-source</strong></span>,
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews except zone transfers are performed using IPv6.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews An alternate transfer source if the one listed in
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">transfer-source</strong></span> fails and
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User <span><strong class="command">use-alt-transfer-source</strong></span> is
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews If you do not wish the alternate transfer source
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User to be used, you should set
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">use-alt-transfer-source</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater appropriately and you should not depend upon
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews getting an answer back to the first refresh
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User An alternate transfer source if the one listed in
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">transfer-source-v6</strong></span> fails and
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">use-alt-transfer-source</strong></span> is
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Use the alternate transfer sources or not. If views are
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User specified this defaults to <span><strong class="command">no</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User otherwise it defaults to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">yes</strong></span> (for BIND 8
cd6e9010079a4e58f7e30063df3dec0ff154ad59Tinderbox User compatibility).
f33f2b8afe60de897c53cdcb17911f10b552699fTinderbox User<dt><span class="term"><span><strong class="command">notify-source</strong></span></span></dt>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<p><span><strong class="command">notify-source</strong></span>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson determines which local source address, and
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews optionally UDP port, will be used to send NOTIFY
f33f2b8afe60de897c53cdcb17911f10b552699fTinderbox User messages. This address must appear in the slave
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews server's <span><strong class="command">masters</strong></span> zone clause or
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews in an <span><strong class="command">allow-notify</strong></span> clause. This
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews statement sets the <span><strong class="command">notify-source</strong></span>
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater for all zones, but can be overridden on a per-zone or
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater per-view basis by including a
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User <span><strong class="command">notify-source</strong></span> statement within
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews the <span><strong class="command">zone</strong></span> or
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span><strong class="command">view</strong></span> block in the configuration
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Solaris 2.5.1 and earlier does not support setting the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User source address for TCP sockets.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt<dt><span class="term"><span><strong class="command">notify-source-v6</strong></span></span></dt>
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt Like <span><strong class="command">notify-source</strong></span>,
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt but applies to notify messages sent to IPv6 addresses.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt<div class="titlepage"><div><div><h4 class="title">
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt<a name="id2583868"></a>UDP Port Lists</h4></div></div></div>
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt <span><strong class="command">use-v4-udp-ports</strong></span>,
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt <span><strong class="command">avoid-v4-udp-ports</strong></span>,
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt <span><strong class="command">use-v6-udp-ports</strong></span>, and
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt <span><strong class="command">avoid-v6-udp-ports</strong></span>
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt specify a list of IPv4 and IPv6 UDP ports that will be
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt used or not used as source ports for UDP messages.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt See <a href="Bv9ARM.ch06.html#query_address" title="Query Address">the section called “Query Address”</a> about how the
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt available ports are determined.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt For example, with the following configuration
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Huntuse-v6-udp-ports { range 32768 65535; };
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Huntavoid-v6-udp-ports { 40000; range 50000 60000; };
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt UDP ports of IPv6 messages sent
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt from <span><strong class="command">named</strong></span> will be in one
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt of the following ranges: 32768 to 39999, 40001 to 49999,
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt and 60001 to 65535.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt <span><strong class="command">avoid-v4-udp-ports</strong></span> and
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">avoid-v6-udp-ports</strong></span> can be used
713c3d5b18463f2479973e4d14f73248e60a5df7Mark Andrews to prevent <span><strong class="command">named</strong></span> from choosing as its random source port a
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User port that is blocked by your firewall or a port that is
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User used by other applications;
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User if a query went out with a source port blocked by a
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User firewall, the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews answer would not get by the firewall and the name server would
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews have to query again.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Note: the desired range can also be represented only with
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">use-v4-udp-ports</strong></span> and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">use-v6-udp-ports</strong></span>, and the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">avoid-</strong></span> options are redundant in that
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews sense; they are provided for backward compatibility and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews to possibly simplify the port specification.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<div class="titlepage"><div><div><h4 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2583928"></a>Operating System Resource Limits</h4></div></div></div>
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User The server's usage of many system resources can be limited.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Scaled values are allowed when specifying resource limits. For
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews example, <span><strong class="command">1G</strong></span> can be used instead of
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews <span><strong class="command">1073741824</strong></span> to specify a limit of
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews gigabyte. <span><strong class="command">unlimited</strong></span> requests
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews unlimited use, or the
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews maximum available amount. <span><strong class="command">default</strong></span>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User uses the limit
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User that was in force when the server was started. See the description
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews of <span><strong class="command">size_spec</strong></span> in <a href="Bv9ARM.ch06.html#configuration_file_elements" title="Configuration File Elements">the section called “Configuration File Elements”</a>.
922e6a3c2ac4ef900dd9dc99f0cc137f18372583Andreas Gustafsson The following options set operating system resource limits for
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User the name server process. Some operating systems don't support
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User any of the limits. On such systems, a warning will be issued if
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User unsupported limit is used.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">coresize</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The maximum size of a core dump. The default
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">datasize</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The maximum amount of data memory the server
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User may use. The default is <code class="literal">default</code>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User This is a hard limit on server memory usage.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If the server attempts to allocate memory in excess of this
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User limit, the allocation will fail, which may in turn leave
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the server unable to perform DNS service. Therefore,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User this option is rarely useful as a way of limiting the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User amount of memory used by the server, but it can be used
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews to raise an operating system data size limit that is
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews too small by default. If you wish to limit the amount
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of memory used by the server, use the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">max-cache-size</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">recursive-clients</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User options instead.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<dt><span class="term"><span><strong class="command">files</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The maximum number of files the server
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User may have open concurrently. The default is <code class="literal">unlimited</code>.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<dt><span class="term"><span><strong class="command">stacksize</strong></span></span></dt>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews The maximum amount of stack memory the server
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews may use. The default is <code class="literal">default</code>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="server_resource_limits"></a>Server Resource Limits</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The following options set limits on the server's
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User resource consumption that are enforced internally by the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User server rather than the operating system.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">max-ixfr-log-size</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User This option is obsolete; it is accepted
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User and ignored for BIND 8 compatibility. The option
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">max-journal-size</strong></span> performs a
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User similar function in BIND 9.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">max-journal-size</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Sets a maximum size for each journal file
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (see <a href="Bv9ARM.ch04.html#journal" title="The journal file">the section called “The journal file”</a>). When the journal file
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the specified size, some of the oldest transactions in the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User will be automatically removed. The default is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User This may also be set on a per-zone basis.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">host-statistics-max</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User In BIND 8, specifies the maximum number of host statistics
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User entries to be kept.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater Not implemented in BIND 9.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">recursive-clients</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The maximum number of simultaneous recursive lookups
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the server will perform on behalf of clients. The default
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <code class="literal">1000</code>. Because each recursing
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater client uses a fair
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User bit of memory, on the order of 20 kilobytes, the value of
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">recursive-clients</strong></span> option may
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User have to be decreased
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on hosts with limited memory.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">tcp-clients</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The maximum number of simultaneous client TCP
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User connections that the server will accept.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default is <code class="literal">100</code>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">reserved-sockets</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The number of file descriptors reserved for TCP, stdio,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User etc. This needs to be big enough to cover the number of
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interfaces <span><strong class="command">named</strong></span> listens on, <span><strong class="command">tcp-clients</strong></span> as well as
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews to provide room for outgoing TCP queries and incoming zone
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User transfers. The default is <code class="literal">512</code>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The minimum value is <code class="literal">128</code> and the
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews maximum value is <code class="literal">128</code> less than
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews maxsockets (-S). This option may be removed in the future.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User This option has little effect on Windows.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<dt><span class="term"><span><strong class="command">max-cache-size</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The maximum amount of memory to use for the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User server's cache, in bytes.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User When the amount of data in the cache
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User reaches this limit, the server will cause records to expire
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User prematurely based on an LRU based strategy so that
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the limit is not exceeded.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User A value of 0 is special, meaning that
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User records are purged from the cache only when their
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews TTLs expire.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Another special keyword <strong class="userinput"><code>unlimited</code></strong>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User means the maximum value of 32-bit unsigned integers
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (0xffffffff), which may not have the same effect as
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User 0 on machines that support more than 32 bits of
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User memory space.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Any positive values less than 2MB will be ignored reset
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User In a server with multiple views, the limit applies
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User separately to the cache of each view.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default is 0.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">tcp-listen-queue</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The listen queue depth. The default and minimum is 3.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews If the kernel supports the accept filter "dataready" this
d3be47a4a841ca6fc07e8f18004cf72174e2d117Tinderbox User also controls how
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User many TCP connections that will be queued in kernel space
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User some data before being passed to accept. Values less than 3
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User silently raised.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="id2584350"></a>Periodic Task Intervals</h4></div></div></div>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<dt><span class="term"><span><strong class="command">cleaning-interval</strong></span></span></dt>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews This interval is effectively obsolete. Previously,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the server would remove expired resource records
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User from the cache every <span><strong class="command">cleaning-interval</strong></span> minutes.
3d2e052eb879189e6d853097f8b568d887323bebTinderbox User <acronym class="acronym">BIND</acronym> 9 now manages cache
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User memory in a more sophisticated manner and does not
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User rely on the periodic cleaning any more.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specifying this option therefore has no effect on
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the server's behavior.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">heartbeat-interval</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The server will perform zone maintenance tasks
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User for all zones marked as <span><strong class="command">dialup</strong></span> whenever this
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interval expires. The default is 60 minutes. Reasonable
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User values are up
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews to 1 day (1440 minutes). The maximum value is 28 days
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (40320 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If set to 0, no zone maintenance for these zones will occur.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">interface-interval</strong></span></span></dt>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews The server will scan the network interface list
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User every <span><strong class="command">interface-interval</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User minutes. The default
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is 60 minutes. The maximum value is 28 days (40320 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If set to 0, interface scanning will only occur when
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the configuration file is loaded. After the scan, the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User begin listening for queries on any newly discovered
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interfaces (provided they are allowed by the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">listen-on</strong></span> configuration), and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User stop listening on interfaces that have gone away.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">statistics-interval</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Name server statistics will be logged
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User every <span><strong class="command">statistics-interval</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User minutes. The default is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User 60. The maximum value is 28 days (40320 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If set to 0, no statistics will be logged.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Not yet implemented in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="topology"></a>Topology</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User All other things being equal, when the server chooses a name
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews to query from a list of name servers, it prefers the one that is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User topologically closest to itself. The <span><strong class="command">topology</strong></span> statement
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater takes an <span><strong class="command">address_match_list</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in a special way. Each top-level list element is assigned a
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Non-negated elements get a distance based on their position in the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User list, where the closer the match is to the start of the list, the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User shorter the distance is between it and the server. A negated match
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User will be assigned the maximum distance from the server. If there
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews is no match, the address will get a distance which is further than
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User any non-negated list element, and closer than any negated element.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User will prefer servers on network 10 the most, followed by hosts
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on network 1.2.0.0 (netmask 255.255.0.0) and network 3, with the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User exception of hosts on network 1.2.3 (netmask 255.255.255.0), which
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews is preferred least of all.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews The default topology is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<pre class="programlisting"> topology { localhost; localnets; };
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The <span><strong class="command">topology</strong></span> option
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is not implemented in <acronym class="acronym">BIND</acronym> 9.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="the_sortlist_statement"></a>The <span><strong class="command">sortlist</strong></span> Statement</h4></div></div></div>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews The response to a DNS query may consist of multiple resource
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User records (RRs) forming a resource records set (RRset).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The name server will normally return the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User RRs within the RRset in an indeterminate order
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (but see the <span><strong class="command">rrset-order</strong></span>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews statement in <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The client resolver code should rearrange the RRs as appropriate,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User that is, using any addresses on the local net in preference to
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews other addresses.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews However, not all resolvers can do this or are correctly
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User When a client is using a local server, the sorting can be performed
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in the server, based on the client's address. This only requires
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User configuring the name servers, not all the clients.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The <span><strong class="command">sortlist</strong></span> statement (see below)
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User an <span><strong class="command">address_match_list</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interprets it even
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User more specifically than the <span><strong class="command">topology</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User does (<a href="Bv9ARM.ch06.html#topology" title="Topology">the section called “Topology”</a>).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Each top level statement in the <span><strong class="command">sortlist</strong></span> must
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User itself be an explicit <span><strong class="command">address_match_list</strong></span> with
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User one or two elements. The first element (which may be an IP
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User an IP prefix, an ACL name or a nested <span><strong class="command">address_match_list</strong></span>)
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of each top level list is checked against the source address of
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the query until a match is found.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Once the source address of the query has been matched, if
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews the top level statement contains only one element, the actual
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews element that matched the source address is used to select the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in the response to move to the beginning of the response. If the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User statement is a list of two elements, then the second element is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User treated the same as the <span><strong class="command">address_match_list</strong></span> in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User a <span><strong class="command">topology</strong></span> statement. Each top
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User level element
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is assigned a distance and the address in the response with the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User distance is moved to the beginning of the response.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User In the following example, any queries received from any of
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews the addresses of the host itself will get responses preferring
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on any of the locally connected networks. Next most preferred are
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on the 192.168.1/24 network, and after that either the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User 192.168.3/24 network with no preference shown between these two
017d755d7a606dfb1e02a9d6e2b29e49e39fde16Tinderbox User networks. Queries received from a host on the 192.168.1/24 network
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater will prefer other addresses on that network to the 192.168.2/24
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater 192.168.3/24 networks. Queries received from a host on the
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater or the 192.168.5/24 network will only prefer other addresses on
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater their directly connected networks.
081a44bd3019b18aec03c5c0746538fdc901da48Evan Hunt // IF the local host
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User // THEN first fit on the following nets
200a9e7da827b67d99193bf793aea9f3e3fa1b43Tinderbox User // IF on class C 192.168.1 THEN use .1, or .2 or .3
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User // IF on class C 192.168.2 THEN use .2, or .1 or .3
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater // IF on class C 192.168.3 THEN use .3, or .1 or .2
af9dbf1ccdd53933aaae9300d13ce0965d39b067Evan Hunt // IF .4 or .5 THEN prefer that net
f536382c59dd492a14667b753816d920f9981f1cTinderbox User The following example will give reasonable behavior for the
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User local host and hosts on directly connected networks. It is similar
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User to the behavior of the address sort in <acronym class="acronym">BIND</acronym> 4.9.x. Responses sent
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews to queries from the local host will favor any of the directly
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews networks. Responses sent to queries from any other hosts on a
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User connected network will prefer addresses on that same network.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews to other queries will not be sorted.
4fe0411487e8e4401477684c0a2bac041ca7c2d5Tinderbox User { localhost; localnets; };
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User { localnets; };
<a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a>.
If no name is specified, the default is "<span><strong class="command">*</strong></span>" (asterisk).
class IN type A name "host.example.com" order random;
<span><strong class="command">max-ncache-ttl</strong></span> is <code class="literal">10800</code> seconds (3 hours).
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
result of dynamic updates (<a href="Bv9ARM.ch04.html#dynamic_update" title="Dynamic Update">the section called “Dynamic Update”</a>) will expire. There
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
<a href="Bv9ARM.ch06.html#zonefile_format" title="Additional File Formats">the section called “Additional File Formats”</a>).
<a name="clients-per-query"></a><span class="term"><span><strong class="command">clients-per-query</strong></span>, </span><span class="term"><span><strong class="command">max-clients-per-query</strong></span></span>
before dropping additional clients. <span><strong class="command">named</strong></span> will attempt to
If the number of queries exceed this value, <span><strong class="command">named</strong></span> will
built-in view (see <a href="Bv9ARM.ch06.html#view_statement_grammar" title="view Statement Grammar">the section called “<span><strong class="command">view</strong></span> Statement Grammar”</a>) of
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
<span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
Specifying <span><strong class="command">server-id hostname;</strong></span> will cause <span><strong class="command">named</strong></span> to
The default <span><strong class="command">server-id</strong></span> is <span><strong class="command">none</strong></span>.
<dt><span class="term"><span><strong class="command">acache-cleaning-interval</strong></span></span></dt>
<a name="server_statement_grammar"></a><span><strong class="command">server</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">server</strong></span> <em class="replaceable"><code>ip_addr[/prefixlen]</code></em> {
[<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em> ; ]</span>]
[<span class="optional"> keys <em class="replaceable"><code>{ string ; [<span class="optional"> string ; [<span class="optional">...</span>]</span>] }</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> query-source [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
[<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
[<span class="optional"> query-source-v6 [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
[<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
[<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> queryport-pool-interval <em class="replaceable"><code>number</code></em>; </span>]
<a name="server_statement_definition_and_usage"></a><span><strong class="command">server</strong></span> Statement Definition and
value of <span><strong class="command">bogus</strong></span> is <span><strong class="command">no</strong></span>.
that is advertised by <span><strong class="command">named</strong></span> when querying the remote server.
The server supports two zone transfer methods. The first, <span><strong class="command">one-answer</strong></span>,
uses one DNS message per resource record transferred. <span><strong class="command">many-answers</strong></span> packs
as many resource records as possible into a message. <span><strong class="command">many-answers</strong></span> is
more efficient, but is only known to be understood by <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
<span><strong class="command">key_id</strong></span> defined by the <span><strong class="command">key</strong></span> statement,
to be used for transaction security (TSIG, <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
<a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<a name="statschannels"></a><span><strong class="command">statistics-channels</strong></span> Statement Grammar</h3></div></div></div>
<a name="id2587051"></a><span><strong class="command">statistics-channels</strong></span> Statement Definition and
address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
<a name="id2587206"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div>
<em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
[<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
<a name="id2587257"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition
DNSSEC security roots. DNSSEC is described in <a href="Bv9ARM.ch04.html#DNSSEC" title="DNSSEC">the section called “DNSSEC”</a>. A security root is defined when the
named will also load a built-in trusted key for dlv.isc.org.
<a name="view_statement_grammar"></a><span><strong class="command">view</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">view</strong></span> <em class="replaceable"><code>view_name</code></em>
<a name="id2587362"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
// Provide a complete view of the example.com
zone "example.com" {
file "example-internal.db";
// Provide a restricted view of the example.com
zone "example.com" {
file "example-external.db";
<pre class="programlisting"><span><strong class="command">zone</strong></span> <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-policy { <em class="replaceable"><code>update_policy_rule</code></em> [<span class="optional">...</span>] }; </span>]
[<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
[<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-mx (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
[<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>] // Not Implemented.
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
<a name="id2588899"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div>
status of infrastructure zones (e.g. COM, NET, ORG).
a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>),
in the mid-1970s. Zone data for it can be specified with the <code class="literal">CHAOS</code> class.
<span><strong class="command">allow-notify</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query-on</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>.
<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
network. The default varies according to zone type. For <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>. For <span><strong class="command">slave</strong></span>
<span><strong class="command">check-mx</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-wildcard</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-integrity</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-sibling</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">zero-no-soa-ttl</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">update-check-ksk</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">try-tcp-refresh</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">dialup</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
after trying the forwarders and getting no answer, while <span><strong class="command">first</strong></span> would
This is applicable to <span><strong class="command">master</strong></span> and <span><strong class="command">slave</strong></span> zones.
<span><strong class="command">max-journal-size</strong></span> in <a href="Bv9ARM.ch06.html#server_resource_limits" title="Server Resource Limits">the section called “Server Resource Limits”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
<span><strong class="command">max-transfer-time-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
<span><strong class="command">max-transfer-time-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">notify-delay</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
zones when they are loaded from disk. <acronym class="acronym">BIND</acronym> 9 does not verify signatures
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
<span><strong class="command">sig-validity-interval</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-nodes</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span><strong class="command">sig-signing-signatures</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-type</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
<span><strong class="command">alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
<span><strong class="command">alt-transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
<span><strong class="command">use-alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
See the description in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
<span><strong class="command">ixfr-from-differences</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">key-directory</strong></span> in <a href="Bv9ARM.ch06.html#options" title="options Statement Definition and
Usage">the section called “<span><strong class="command">options</strong></span> Statement Definition and
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
( <span><strong class="command">grant</strong></span> | <span><strong class="command">deny</strong></span> ) <em class="replaceable"><code>identity</code></em> <em class="replaceable"><code>nametype</code></em> <em class="replaceable"><code>name</code></em> [<span class="optional"> <em class="replaceable"><code>types</code></em> </span>]
<a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div>
that a particular nearby server be tried first. See <a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a> and <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>.
built-in server information zones, e.g.,
any order), and if neither of those succeed, delivery to <code class="literal">mail.backup.org</code> will
and PTR records. Entries in the in-addr.arpa domain are made in
in-addr.arpa name of
3.2.1.10.in-addr.arpa. This name should have a PTR resource record
Master File Directives include <span><strong class="command">$ORIGIN</strong></span>, <span><strong class="command">$INCLUDE</strong></span>,
<a name="id2594424"></a>The <span><strong class="command">@</strong></span> (at-sign)</h4></div></div></div>
<a name="id2594440"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div>
$ORIGIN example.com.
<a name="id2594637"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div>
if it were included into the file at this point. If <span><strong class="command">origin</strong></span> is
revert to the values they had prior to the <span><strong class="command">$INCLUDE</strong></span> once
<a name="id2594707"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div>
<a name="id2594743"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div>
Classless IN-ADDR.ARPA delegation.
HOST-1.EXAMPLE. MX 0 .
HOST-2.EXAMPLE. A 1.2.3.2
HOST-2.EXAMPLE. MX 0 .
HOST-3.EXAMPLE. A 1.2.3.3
HOST-3.EXAMPLE. MX 0 .
HOST-127.EXAMPLE. A 1.2.3.127
HOST-127.EXAMPLE. MX 0 .
(<span><strong class="command">n</strong></span> or <span><strong class="command">N</strong></span>\
The <span><strong class="command">$GENERATE</strong></span> directive is a <acronym class="acronym">BIND</acronym> extension
(see <a href="Bv9ARM.ch06.html#statschannels" title="statistics-channels Statement Grammar">the section called “<span><strong class="command">statistics-channels</strong></span> Statement Grammar”</a>.)
<a href="Bv9ARM.ch06.html#clients-per-query"><span><strong class="command">clients-per-query</strong></span></a>.)
<a name="id2599016"></a>Compatibility with <span class="emphasis"><em>BIND</em></span> 8 Counters</h4></div></div></div>
<td width="40%" align="left" valign="top">Chapter�5.�The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver�</td>