Bv9ARM.ch06.html revision b05106c7e68077d805893fbae006fae125494fd6
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
c7ef13f6c9ef4436bc804b150e0a93307b11fa27Tinderbox User - Copyright (C) 2000-2003 Internet Software Consortium.
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews - Permission to use, copy, modify, and/or distribute this software for any
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User - purpose with or without fee is hereby granted, provided that the above
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User - copyright notice and this permission notice appear in all copies.
5e047890ac9b745db060d95f7d1b4f876511240dTinderbox User - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
02b47c5d62e1e827743684c28a08e871da454a2dMark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User - PERFORMANCE OF THIS SOFTWARE.
e20309353e6246485c521278131d3fced73d7957Tinderbox User<!-- $Id: Bv9ARM.ch06.html,v 1.234 2009/10/09 01:14:47 tbox Exp $ -->
3cc98b8ecedcbc8465f1cf2740b966b315662430Automatic Updater<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<title>Chapter�6.�BIND 9 Configuration Reference</title>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
e20309353e6246485c521278131d3fced73d7957Tinderbox User<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
e20309353e6246485c521278131d3fced73d7957Tinderbox User<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="prev" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
df4ebd8217d02dafc12145b55c4d93d0255d1ec7Tinderbox User<link rel="next" href="Bv9ARM.ch07.html" title="Chapter�7.�BIND 9 Security Considerations">
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<table width="100%" summary="Navigation header">
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<tr><th colspan="3" align="center">Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</th></tr>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<a accesskey="p" href="Bv9ARM.ch05.html">Prev</a>�</td>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch07.html">Next</a>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<div class="titlepage"><div><div><h2 class="title">
24934f08b9ff81c2be711e566e8002d145573031Tinderbox User<a name="Bv9ARM.ch06"></a>Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</h2></div></div></div>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt>
cdfc81e048bd34c1d628380247bda6b80a89e20eAutomatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573733">Comment Syntax</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574387"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574577"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and
e20309353e6246485c521278131d3fced73d7957Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575073"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575090"><span><strong class="command">include</strong></span> Statement Definition and
e20309353e6246485c521278131d3fced73d7957Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575113"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575137"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
7feccf248d2a20a2ae48b290f58ded5abc853e9aTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575227"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575353"><span><strong class="command">logging</strong></span> Statement Definition and
80faf1588895fd26490f82f95a7a1b771df1c324Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577420"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577494"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
ec7751119a08c6a7250f3187beed69a8b836d349Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577558"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577602"><span><strong class="command">masters</strong></span> Statement Definition and
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577617"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt>
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#statschannels"><span><strong class="command">statistics-channels</strong></span> Statement Grammar</a></span></dt>
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587582"><span><strong class="command">statistics-channels</strong></span> Statement Definition and
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587737"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587857"><span><strong class="command">trusted-keys</strong></span> Statement Definition
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587904"><span><strong class="command">managed-keys</strong></span> Statement Grammar</a></span></dt>
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587955"><span><strong class="command">managed-keys</strong></span> Statement Definition
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt>
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2588172"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span>
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2589860"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2592584">Zone File</a></span></dt>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt>
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2594746">Discussion of MX Records</a></span></dt>
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt>
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2595362">Inverse Mapping in IPv4</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2595489">Other Zone File Directives</a></span></dt>
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2595693"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt>
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch06.html#statistics">BIND9 Statistics</a></span></dt>
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch06.html#statistics_counters">Statistics Counters</a></span></dt></dl></dd>
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User <acronym class="acronym">BIND</acronym> 9 configuration is broadly similar
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater to <acronym class="acronym">BIND</acronym> 8; however, there are a few new
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews of configuration, such as views. <acronym class="acronym">BIND</acronym>
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User 8 configuration files should work with few alterations in <acronym class="acronym">BIND</acronym>
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews 9, although more complex configurations should be reviewed to check
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews if they can be more efficiently implemented using the new features
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews found in <acronym class="acronym">BIND</acronym> 9.
01a5c5503482fb3ba52088bf0178a7213273bf96Mark Andrews <acronym class="acronym">BIND</acronym> 4 configuration files can be
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User converted to the new format
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews using the shell script
df4ebd8217d02dafc12145b55c4d93d0255d1ec7Tinderbox User <code class="filename">contrib/named-bootconf/named-bootconf.sh</code>.
fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater<div class="titlepage"><div><div><h2 class="title" style="clear: both">
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<a name="configuration_file_elements"></a>Configuration File Elements</h2></div></div></div>
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User Following is a list of elements used throughout the <acronym class="acronym">BIND</acronym> configuration
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User file documentation:
fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater<div class="informaltable"><table border="1">
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson The name of an <code class="varname">address_match_list</code> as
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater defined by the <span><strong class="command">acl</strong></span> statement.
c7ef13f6c9ef4436bc804b150e0a93307b11fa27Tinderbox User <code class="varname">address_match_list</code>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews A list of one or more
5f33078b538b3d317917deb962bd057b2a888db1Tinderbox User <code class="varname">ip_prefix</code>, <code class="varname">key_id</code>,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User or <code class="varname">acl_name</code> elements, see
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater A named list of one or more <code class="varname">ip_addr</code>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater with optional <code class="varname">key_id</code> and/or
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater A <code class="varname">masters_list</code> may include other
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <code class="varname">masters_lists</code>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater A quoted string which will be used as
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater a DNS name, for example "<code class="literal">my.test.domain</code>".
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews A list of one or more <code class="varname">domain_name</code>
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User One to four integers valued 0 through
f751b1576ee6fef4023bf7101d10167e4fe520f3Tinderbox User 255 separated by dots (`.'), such as <span><strong class="command">123</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">45.67</strong></span> or <span><strong class="command">89.123.45.67</strong></span>.
c3fd32ed29e9e419bb56583f4272a506773b1ea0Automatic Updater An IPv4 address with exactly four elements
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson in <code class="varname">dotted_decimal</code> notation.
9174e44c14b1cb91a651fa1dc29470438c246ab9Automatic Updater An IPv6 address, such as <span><strong class="command">2001:db8::1234</strong></span>.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson IPv6 scoped addresses that have ambiguity on their
e2caa7536302de34de6cc04025abcd53dc3a499aAutomatic Updater scope zones must be disambiguated by an appropriate
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User zone ID with the percent character (`%') as
8292deab031e7599cd7622aa7675fbe139ca6095Mark Andrews delimiter. It is strongly recommended to use
0b57424d28c9a67018107133f9fbc0a7dcf057e2Mark Andrews string zone names rather than numeric identifiers,
0b57424d28c9a67018107133f9fbc0a7dcf057e2Mark Andrews in order to be robust against system configuration
0b57424d28c9a67018107133f9fbc0a7dcf057e2Mark Andrews changes. However, since there is no standard
e31cfd80616deb9781902306b34a69aa7309b6cbTinderbox User mapping for such names and identifier values,
e31cfd80616deb9781902306b34a69aa7309b6cbTinderbox User currently only interface names as link identifiers
e31cfd80616deb9781902306b34a69aa7309b6cbTinderbox User are supported, assuming one-to-one mapping between
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews interfaces and links. For example, a link-local
b109432c3a939bff66a463be86c371bd88efe3aaAutomatic Updater address <span><strong class="command">fe80::1</strong></span> on the link
7d12a6b412fe47e6d6582923fd6954ab8cd0baebAutomatic Updater attached to the interface <span><strong class="command">ne0</strong></span>
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews can be specified as <span><strong class="command">fe80::1%ne0</strong></span>.
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews Note that on most systems link-local addresses
3351ccbd5c1961404044f8273d54dad405f53960Mark Andrews always have the ambiguity, and need to be
7d12a6b412fe47e6d6582923fd6954ab8cd0baebAutomatic Updater disambiguated.
e8fc8c884b44371784805e1e0d3100da403dd3f1Automatic Updater An <code class="varname">ip4_addr</code> or <code class="varname">ip6_addr</code>.
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User An IP port <code class="varname">number</code>.
dc435f1033bcba88b748074987db6cfd34c057a4Tinderbox User The <code class="varname">number</code> is limited to 0
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews through 65535, with values
dc435f1033bcba88b748074987db6cfd34c057a4Tinderbox User below 1024 typically restricted to use by processes running
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User In some cases, an asterisk (`*') character can be used as a
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User placeholder to
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater select a random high-numbered port.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson An IP network specified as an <code class="varname">ip_addr</code>,
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater followed by a slash (`/') and then the number of bits in the
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews Trailing zeros in a <code class="varname">ip_addr</code>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington For example, <span><strong class="command">127/8</strong></span> is the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington network <span><strong class="command">127.0.0.0</strong></span> with
e20309353e6246485c521278131d3fced73d7957Tinderbox User netmask <span><strong class="command">255.0.0.0</strong></span> and <span><strong class="command">1.2.3.0/28</strong></span> is
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews network <span><strong class="command">1.2.3.0</strong></span> with netmask <span><strong class="command">255.255.255.240</strong></span>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User When specifying a prefix involving a IPv6 scoped address
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the scope may be omitted. In that case the prefix will
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater match packets from any scope.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington A <code class="varname">domain_name</code> representing
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the name of a shared key, to be used for transaction
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington A list of one or more
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington separated by semicolons and ending with a semicolon.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington A non-negative 32-bit integer
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington (i.e., a number between 0 and 4294967295, inclusive).
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Its acceptable value might further
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington be limited by the context in which it is used.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington A quoted string which will be used as
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington a pathname, such as <code class="filename">zones/master/my.test.domain</code>.
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater A list of an <code class="varname">ip_port</code> or a port
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater A port range is specified in the form of
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater <strong class="userinput"><code>range</code></strong> followed by
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater two <code class="varname">ip_port</code>s,
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater <code class="varname">port_high</code>, which represents
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater port numbers from <code class="varname">port_low</code> through
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater <code class="varname">port_high</code>, inclusive.
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater <code class="varname">port_low</code> must not be larger than
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <strong class="userinput"><code>range 1024 65535</code></strong> represents
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User ports from 1024 through 65535.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User In either case an asterisk (`*') character is not
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User allowed as a valid <code class="varname">ip_port</code>.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User A number, the word <strong class="userinput"><code>unlimited</code></strong>,
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User or the word <strong class="userinput"><code>default</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater An <code class="varname">unlimited</code> <code class="varname">size_spec</code> requests unlimited
febbdb34a7f7759922e239655e7429d78d3a8d26Tinderbox User use, or the maximum available amount. A <code class="varname">default size_spec</code> uses
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the limit that was in force when the server was started.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User A <code class="varname">number</code> can optionally be
e01f44b37ba11c9d34f4a8394f950efae5c07f33Automatic Updater followed by a scaling factor:
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <strong class="userinput"><code>K</code></strong> or <strong class="userinput"><code>k</code></strong>
c01dec514a81ecf8c17ca3ef8c3ba95e437295ebAutomatic Updater for kilobytes,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <strong class="userinput"><code>M</code></strong> or <strong class="userinput"><code>m</code></strong>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater for megabytes, and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <strong class="userinput"><code>G</code></strong> or <strong class="userinput"><code>g</code></strong> for gigabytes,
3de6db3208d51de1e138b63b9670430c03f99694Automatic Updater which scale by 1024, 1024*1024, and 1024*1024*1024
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The value must be representable as a 64-bit unsigned integer
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington (0 to 18446744073709551615, inclusive).
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Using <code class="varname">unlimited</code> is the best
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington to safely set a really large number.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Either <strong class="userinput"><code>yes</code></strong> or <strong class="userinput"><code>no</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The words <strong class="userinput"><code>true</code></strong> and <strong class="userinput"><code>false</code></strong> are
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington also accepted, as are the numbers <strong class="userinput"><code>1</code></strong>
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews and <strong class="userinput"><code>0</code></strong>.
a26b22914b7bf25f065afb8cdef983766dcd672bAutomatic Updater <code class="varname">dialup_option</code>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington One of <strong class="userinput"><code>yes</code></strong>,
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews <strong class="userinput"><code>no</code></strong>, <strong class="userinput"><code>notify</code></strong>,
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews <strong class="userinput"><code>notify-passive</code></strong>, <strong class="userinput"><code>refresh</code></strong> or
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>passive</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington When used in a zone, <strong class="userinput"><code>notify-passive</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>refresh</code></strong>, and <strong class="userinput"><code>passive</code></strong>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington are restricted to slave and stub zones.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h3 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="address_match_lists"></a>Address Match Lists</h3></div></div></div>
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573568"></a>Syntax</h4></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ;
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews [<span class="optional"> address_match_list_element; ... </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] |
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington key key_id | acl_name | { address_match_list } )
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573595"></a>Definition and Usage</h4></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Address match lists are primarily used to determine access
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington control for various server operations. They are also used in
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the <span><strong class="command">listen-on</strong></span> and <span><strong class="command">sortlist</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington statements. The elements which constitute an address match
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington list can be any of the following:
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater a key ID, as defined by the <span><strong class="command">key</strong></span>
56effd2e3f579fd77b1fb37d47871d1bf1286bc4Automatic Updater<li>the name of an address match list defined with
42bee07ebb8152a6ec2f87f4790d87368c24704cAutomatic Updater the <span><strong class="command">acl</strong></span> statement
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<li>a nested address match list enclosed in braces</li>
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews Elements can be negated with a leading exclamation mark (`!'),
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington and the match list names "any", "none", "localhost", and
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews "localnets" are predefined. More information on those names
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington can be found in the description of the acl statement.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews The addition of the key clause made the name of this syntactic
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews element something of a misnomer, since security keys can be used
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews to validate access without regard to a host or network address.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Nonetheless, the term "address match list" is still used
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington throughout the documentation.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington When a given IP address or prefix is compared to an address
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington match list, the comparison takes place in approximately O(1)
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington time. However, key comparisons require that the list of keys
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington be traversed until a matching key is found, and therefore may
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington be somewhat slower.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The interpretation of a match depends on whether the list is being
409ba95e573b40cf36acf97dd62ee7e9c7775851Tinderbox User used for access control, defining <span><strong class="command">listen-on</strong></span> ports, or in a
89623368b8f662d458d9964b923050f33c5f75b0Tinderbox User <span><strong class="command">sortlist</strong></span>, and whether the element was negated.
febbdb34a7f7759922e239655e7429d78d3a8d26Tinderbox User When used as an access control list, a non-negated match
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User allows access and a negated match denies access. If
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User there is no match, access is denied. The clauses
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <span><strong class="command">allow-notify</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-recursion</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-recursion-on</strong></span>,
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User <span><strong class="command">allow-query</strong></span>,
da59e63e7af147a8bcef985b98b04443e04c3a0eTinderbox User <span><strong class="command">allow-query-on</strong></span>,
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User <span><strong class="command">allow-query-cache</strong></span>,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">allow-query-cache-on</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-transfer</strong></span>,
1fdd58445074579ee3b65c871137a7a1740eb542Mark Andrews <span><strong class="command">allow-update</strong></span>,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">allow-update-forwarding</strong></span>, and
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">blackhole</strong></span> all use address match
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User lists. Similarly, the <span><strong class="command">listen-on</strong></span> option will cause the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User server to refuse queries on any of the machine's
cc5a9ce75af9870f2cb9e2bf00548c2f7e6398d6Automatic Updater addresses which do not match the list.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews Order of insertion is significant. If more than one element
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews in an ACL is found to match a given IP address or prefix,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User preference will be given to the one that came
532d27b39244fadfcf8d8b4593f4c65434c9c664Automatic Updater <span class="emphasis"><em>first</em></span> in the ACL definition.
532d27b39244fadfcf8d8b4593f4c65434c9c664Automatic Updater Because of this first-match behavior, an element that
532d27b39244fadfcf8d8b4593f4c65434c9c664Automatic Updater defines a subset of another element in the list should
532d27b39244fadfcf8d8b4593f4c65434c9c664Automatic Updater come before the broader element, regardless of whether
91faa748a27dee38f6caea461d3e87f15b93abeaTinderbox User either is negated. For example, in
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">1.2.3/24; ! 1.2.3.13;</strong></span>
91faa748a27dee38f6caea461d3e87f15b93abeaTinderbox User the 1.2.3.13 element is completely useless because the
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews algorithm will match any lookup for 1.2.3.13 to the 1.2.3/24
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews element. Using <span><strong class="command">! 1.2.3.13; 1.2.3/24</strong></span> fixes
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews that problem by having 1.2.3.13 blocked by the negation, but
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews all other 1.2.3.* hosts fall through.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews<div class="titlepage"><div><div><h3 class="title">
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews<a name="id2573733"></a>Comment Syntax</h3></div></div></div>
93089a352d6903b0d7845a039de4ec2df9a0e35aTinderbox User The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for
93089a352d6903b0d7845a039de4ec2df9a0e35aTinderbox User comments to appear
93089a352d6903b0d7845a039de4ec2df9a0e35aTinderbox User anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration
861836e5f5df62bfaea9ad8923a05278d5ab2f3dTinderbox User file. To appeal to programmers of all kinds, they can be written
9c446b72069d0ab9f710502f4d7048e50875fccbAutomatic Updater<div class="titlepage"><div><div><h4 class="title">
665ba746c0585088d0c314dcfc4671aa2c7b2dc1Automatic Updater<a name="id2573748"></a>Syntax</h4></div></div></div>
93089a352d6903b0d7845a039de4ec2df9a0e35aTinderbox User<pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater<pre class="programlisting">// This is a <acronym class="acronym">BIND</acronym> comment as in C++</pre>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater<pre class="programlisting"># This is a <acronym class="acronym">BIND</acronym> comment as in common UNIX shells
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater# and perl</pre>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater<div class="titlepage"><div><div><h4 class="title">
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater<a name="id2573778"></a>Definition and Usage</h4></div></div></div>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater Comments may appear anywhere that whitespace may appear in
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater a <acronym class="acronym">BIND</acronym> configuration file.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater C-style comments start with the two characters /* (slash,
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater star) and end with */ (star, slash). Because they are completely
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater delimited with these characters, they can be used to comment only
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater a portion of a line or to span multiple lines.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater C-style comments cannot be nested. For example, the following
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater is not valid because the entire comment ends with the first */:
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater<pre class="programlisting">/* This is the start of a comment.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater This is still part of the comment.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater/* This is an incorrect attempt at nesting a comment. */
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater This is no longer in any comment. */
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater C++-style comments start with the two characters // (slash,
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater slash) and continue to the end of the physical line. They cannot
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater be continued across multiple physical lines; to have one logical
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User comment span multiple lines, each line must use the // pair.
fe84edc17e0d582cf7b4270f8df9d4742a107b1cAutomatic Updater<pre class="programlisting">// This is the start of a comment. The next line
3a988722ad9e209ba4064604d482dc4efe0e19ebTinderbox User// is a new comment, even though it is logically
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User// part of the previous comment.
bf8c3776f1bf1a1270e5e0443ae5a8df022632a8Mark Andrews Shell-style (or perl-style, if you prefer) comments start
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater with the character <code class="literal">#</code> (number sign)
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater and continue to the end of the
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater physical line, as in C++ comments.
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater<pre class="programlisting"># This is the start of a comment. The next line
ec8755f605d7dcb2de1076040e77bc2d7ec33b4aTinderbox User# is a new comment, even though it is logically
4ea3649f028ea6a1e42377082a7ccf8f789fb950Automatic Updater# part of the previous comment.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater You cannot use the semicolon (`;') character
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater to start a comment such as you would in a zone file. The
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater semicolon indicates the end of a configuration
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater<div class="titlepage"><div><div><h2 class="title" style="clear: both">
19dbf2e20df03f2b81ed1f347e27718084374059Automatic Updater<a name="Configuration_File_Grammar"></a>Configuration File Grammar</h2></div></div></div>
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater A <acronym class="acronym">BIND</acronym> 9 configuration consists of
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater statements and comments.
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater Statements end with a semicolon. Statements and comments are the
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater only elements that can appear without enclosing braces. Many
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater statements contain a block of sub-statements, which are also
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater terminated with a semicolon.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The following statements are supported:
3e5b24a74c03d5b52f32d138e64e427bd2cbc8f3Automatic Updater <p><span><strong class="command">acl</strong></span></p>
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User defines a named IP address
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User matching list, for access control and other uses.
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User <p><span><strong class="command">controls</strong></span></p>
789875a1bd6d50c00d3bd883cad17ead1d3c21cdMark Andrews declares control channels to be used
789875a1bd6d50c00d3bd883cad17ead1d3c21cdMark Andrews by the <span><strong class="command">rndc</strong></span> utility.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <p><span><strong class="command">include</strong></span></p>
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt includes a file.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt <p><span><strong class="command">key</strong></span></p>
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt specifies key information for use in
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt authentication and authorization using TSIG.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span><strong class="command">logging</strong></span></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater specifies what the server logs, and where
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater the log messages are sent.
e20309353e6246485c521278131d3fced73d7957Tinderbox User <p><span><strong class="command">lwres</strong></span></p>
9a5217f827ac0e006016745e5305b31dc0c7767fTinderbox User configures <span><strong class="command">named</strong></span> to
e20309353e6246485c521278131d3fced73d7957Tinderbox User also act as a light-weight resolver daemon (<span><strong class="command">lwresd</strong></span>).
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <p><span><strong class="command">masters</strong></span></p>
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews defines a named masters list for
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews inclusion in stub and slave zone masters clauses.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews <p><span><strong class="command">options</strong></span></p>
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews controls global server configuration
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews options and sets defaults for other statements.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">server</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User sets certain configuration options on
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater a per-server basis.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span><strong class="command">statistics-channels</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User declares communication channels to get access to
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater <span><strong class="command">named</strong></span> statistics.
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater <p><span><strong class="command">trusted-keys</strong></span></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater defines trusted DNSSEC keys.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span><strong class="command">managed-keys</strong></span></p>
48b36fa08b2b5bc0d552dc2a4425b3f7007b3d59Automatic Updater lists DNSSEC keys to be kept up to date
9fa39c73fc1d8bc44fdbbb79a1d26b837e7dd555Mark Andrews using RFC 5011 trust anchor maintenance.
1959fd489a8832e4e3d311670f64ae18e5d08156Automatic Updater <p><span><strong class="command">view</strong></span></p>
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User defines a view.
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews <p><span><strong class="command">zone</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User defines a zone.
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User The <span><strong class="command">logging</strong></span> and
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <span><strong class="command">options</strong></span> statements may only occur once
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User configuration.
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews<div class="titlepage"><div><div><h3 class="title">
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews<a name="id2574387"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div>
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews<pre class="programlisting"><span><strong class="command">acl</strong></span> acl-name {
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews address_match_list
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<div class="titlepage"><div><div><h3 class="title">
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont<a name="acl"></a><span><strong class="command">acl</strong></span> Statement Definition and
4dca64bb8991502db368028aeeba2f832d3b971dAutomatic Updater The <span><strong class="command">acl</strong></span> statement assigns a symbolic
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont name to an address match list. It gets its name from a primary
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User use of address match lists: Access Control Lists (ACLs).
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater Note that an address match list's name must be defined
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater with <span><strong class="command">acl</strong></span> before it can be used
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater elsewhere; no forward references are allowed.
7169f76a893666eb20fc7750782e7f411db742d6Tinderbox User The following ACLs are built-in:
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater <p><span><strong class="command">any</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Matches all hosts.
e20309353e6246485c521278131d3fced73d7957Tinderbox User <p><span><strong class="command">none</strong></span></p>
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater Matches no hosts.
da82e232161d67b77df2d67898bdac693f647be1Automatic Updater <p><span><strong class="command">localhost</strong></span></p>
e171a4137c6ba348957e61b7c4c3541493c0da02Automatic Updater Matches the IPv4 and IPv6 addresses of all network
c53a6f37deaa396660adb6a4ca600c4a58adfd3fAutomatic Updater interfaces on the system.
b3386fba31414344f38f0c30849c056dceb22dceTinderbox User <p><span><strong class="command">localnets</strong></span></p>
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater Matches any host on an IPv4 or IPv6 network
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater for which the system has an interface.
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater Some systems do not provide a way to determine the prefix
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater local IPv6 addresses.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User In such a case, <span><strong class="command">localnets</strong></span>
6671e343b8c7e44ac10a7900fde59555fbc71571Automatic Updater only matches the local
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater IPv6 addresses, just like <span><strong class="command">localhost</strong></span>.
99c231a3bd27893583204cd0a3e3103dc78dbc28Tinderbox User<div class="titlepage"><div><div><h3 class="title">
4104e236f71eb5108fcfda6711878a97f6f4a8e7Automatic Updater<a name="id2574577"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div>
4104e236f71eb5108fcfda6711878a97f6f4a8e7Automatic Updater<pre class="programlisting"><span><strong class="command">controls</strong></span> {
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater [ inet ( ip_addr | * ) [ port ip_port ]
409ba95e573b40cf36acf97dd62ee7e9c7775851Tinderbox User allow { <em class="replaceable"><code> address_match_list </code></em> }
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater keys { <em class="replaceable"><code>key_list</code></em> }; ]
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews [ unix <em class="replaceable"><code>path</code></em> perm <em class="replaceable"><code>number</code></em> owner <em class="replaceable"><code>number</code></em> group <em class="replaceable"><code>number</code></em>
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews keys { <em class="replaceable"><code>key_list</code></em> }; ]
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews [ unix ...; ]
c53a6f37deaa396660adb6a4ca600c4a58adfd3fAutomatic Updater<div class="titlepage"><div><div><h3 class="title">
af9cf290cea6ada6ce27b51c724ab77ad5d73fa0Tinderbox User<a name="controls_statement_definition_and_usage"></a><span><strong class="command">controls</strong></span> Statement Definition and
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User The <span><strong class="command">controls</strong></span> statement declares control
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater channels to be used by system administrators to control the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater operation of the name server. These control channels are
e20309353e6246485c521278131d3fced73d7957Tinderbox User used by the <span><strong class="command">rndc</strong></span> utility to send
e20309353e6246485c521278131d3fced73d7957Tinderbox User commands to and retrieve non-DNS results from a name server.
e628576d3b3d91c8954679077f4c208f1e43b433Automatic Updater An <span><strong class="command">inet</strong></span> control channel is a TCP socket
f8a9a38ee40c139a8d145ac76ecbff3a0f986453Mark Andrews listening at the specified <span><strong class="command">ip_port</strong></span> on the
e628576d3b3d91c8954679077f4c208f1e43b433Automatic Updater specified <span><strong class="command">ip_addr</strong></span>, which can be an IPv4 or IPv6
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews interpreted as the IPv4 wildcard address; connections will be
9d80d23172c30fd63e5046a7e69b8445e564ff31Automatic Updater accepted on any of the system's IPv4 addresses.
e20309353e6246485c521278131d3fced73d7957Tinderbox User To listen on the IPv6 wildcard address,
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews use an <span><strong class="command">ip_addr</strong></span> of <code class="literal">::</code>.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews If you will only use <span><strong class="command">rndc</strong></span> on the local host,
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews using the loopback address (<code class="literal">127.0.0.1</code>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews or <code class="literal">::1</code>) is recommended for maximum security.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews If no port is specified, port 953 is used. The asterisk
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews "<code class="literal">*</code>" cannot be used for <span><strong class="command">ip_port</strong></span>.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews The ability to issue commands over the control channel is
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews restricted by the <span><strong class="command">allow</strong></span> and
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <span><strong class="command">keys</strong></span> clauses.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews Connections to the control channel are permitted based on the
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <span><strong class="command">address_match_list</strong></span>. This is for simple
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews IP address based filtering only; any <span><strong class="command">key_id</strong></span>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews elements of the <span><strong class="command">address_match_list</strong></span>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews are ignored.
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User A <span><strong class="command">unix</strong></span> control channel is a UNIX domain
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User socket listening at the specified path in the file system.
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User Access to the socket is specified by the <span><strong class="command">perm</strong></span>,
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User <span><strong class="command">owner</strong></span> and <span><strong class="command">group</strong></span> clauses.
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User Note on some platforms (SunOS and Solaris) the permissions
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User (<span><strong class="command">perm</strong></span>) are applied to the parent directory
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User as the permissions on the socket itself are ignored.
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User The primary authorization mechanism of the command
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User channel is the <span><strong class="command">key_list</strong></span>, which
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User contains a list of <span><strong class="command">key_id</strong></span>s.
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User Each <span><strong class="command">key_id</strong></span> in the <span><strong class="command">key_list</strong></span>
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User is authorized to execute commands over the control channel.
3a988722ad9e209ba4064604d482dc4efe0e19ebTinderbox User See <a href="Bv9ARM.ch03.html#rndc">Remote Name Daemon Control application</a> in <a href="Bv9ARM.ch03.html#admin_tools" title="Administrative Tools">the section called “Administrative Tools”</a>)
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User for information about configuring keys in <span><strong class="command">rndc</strong></span>.
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User If no <span><strong class="command">controls</strong></span> statement is present,
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User <span><strong class="command">named</strong></span> will set up a default
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User control channel listening on the loopback address 127.0.0.1
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User and its IPv6 counterpart ::1.
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User In this case, and also when the <span><strong class="command">controls</strong></span> statement
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User is present but does not have a <span><strong class="command">keys</strong></span> clause,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">named</strong></span> will attempt to load the command channel key
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User from the file <code class="filename">rndc.key</code> in
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews <code class="filename">/etc</code> (or whatever <code class="varname">sysconfdir</code>
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews was specified as when <acronym class="acronym">BIND</acronym> was built).
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews To create a <code class="filename">rndc.key</code> file, run
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews <strong class="userinput"><code>rndc-confgen -a</code></strong>.
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews The <code class="filename">rndc.key</code> feature was created to
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews ease the transition of systems from <acronym class="acronym">BIND</acronym> 8,
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews which did not have digital signatures on its command channel
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews messages and thus did not have a <span><strong class="command">keys</strong></span> clause.
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews It makes it possible to use an existing <acronym class="acronym">BIND</acronym> 8
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews configuration file in <acronym class="acronym">BIND</acronym> 9 unchanged,
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews and still have <span><strong class="command">rndc</strong></span> work the same way
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User <span><strong class="command">ndc</strong></span> worked in BIND 8, simply by executing the
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User command <strong class="userinput"><code>rndc-confgen -a</code></strong> after BIND 9 is
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater Since the <code class="filename">rndc.key</code> feature
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater is only intended to allow the backward-compatible usage of
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews <acronym class="acronym">BIND</acronym> 8 configuration files, this
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User feature does not
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User have a high degree of configurability. You cannot easily change
8c9c79e5fea0cb698026a74821695907c8312a46Mark Andrews the key name or the size of the secret, so you should make a
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <code class="filename">rndc.conf</code> with your own key if you
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User wish to change
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User those things. The <code class="filename">rndc.key</code> file
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater permissions set such that only the owner of the file (the user that
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">named</strong></span> is running as) can access it.
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater desire greater flexibility in allowing other users to access
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">rndc</strong></span> commands, then you need to create
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater <code class="filename">rndc.conf</code> file and make it group
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews readable by a group
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews that contains the users who should have access.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews To disable the command channel, use an empty
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews <span><strong class="command">controls</strong></span> statement:
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews <span><strong class="command">controls { };</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2575073"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting"><span><strong class="command">include</strong></span> <em class="replaceable"><code>filename</code></em>;</pre>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2575090"></a><span><strong class="command">include</strong></span> Statement Definition and
e007e3e5b0316c6c05698a71101885743aca22bdAutomatic Updater The <span><strong class="command">include</strong></span> statement inserts the
e007e3e5b0316c6c05698a71101885743aca22bdAutomatic Updater specified file at the point where the <span><strong class="command">include</strong></span>
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews statement is encountered. The <span><strong class="command">include</strong></span>
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews statement facilitates the administration of configuration
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews by permitting the reading or writing of some things but not
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews others. For example, the statement could include private keys
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews that are readable only by the name server.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews<div class="titlepage"><div><div><h3 class="title">
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews<a name="id2575113"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div>
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews<pre class="programlisting"><span><strong class="command">key</strong></span> <em class="replaceable"><code>key_id</code></em> {
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews algorithm <em class="replaceable"><code>string</code></em>;
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews secret <em class="replaceable"><code>string</code></em>;
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews<div class="titlepage"><div><div><h3 class="title">
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews<a name="id2575137"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div>
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews The <span><strong class="command">key</strong></span> statement defines a shared
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews secret key for use with TSIG (see <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews or the command channel
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews Usage”</a>).
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews The <span><strong class="command">key</strong></span> statement can occur at the
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews of the configuration file or inside a <span><strong class="command">view</strong></span>
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews statement. Keys defined in top-level <span><strong class="command">key</strong></span>
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews statements can be used in all views. Keys intended for use in
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews a <span><strong class="command">controls</strong></span> statement
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews Usage”</a>)
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews must be defined at the top level.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews The <em class="replaceable"><code>key_id</code></em>, also known as the
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews key name, is a domain name uniquely identifying the key. It can
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews be used in a <span><strong class="command">server</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User statement to cause requests sent to that
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington server to be signed with this key, or in address match lists to
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington verify that incoming requests have been signed with a key
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater matching this name, algorithm, and secret.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <em class="replaceable"><code>algorithm_id</code></em> is a string
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that specifies a security/authentication algorithm. Named
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater supports <code class="literal">hmac-md5</code>,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington and <code class="literal">hmac-sha512</code> TSIG authentication.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews Truncated hashes are supported by appending the minimum
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User number of required bits preceded by a dash, e.g.
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User <code class="literal">hmac-sha1-80</code>. The
95cfad51a3f71246d263af79a7861a6821f7a0beAutomatic Updater <em class="replaceable"><code>secret_string</code></em> is the secret
95cfad51a3f71246d263af79a7861a6821f7a0beAutomatic Updater to be used by the algorithm, and is treated as a base-64
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User encoded string.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<div class="titlepage"><div><div><h3 class="title">
e135e3c4b1f4f986f00997f5ad5866effb203139Tinderbox User<a name="id2575227"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div>
6fd5f289d8455283fad33d1051e6fbaa3bec43d5Tinderbox User<pre class="programlisting"><span><strong class="command">logging</strong></span> {
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater [ <span><strong class="command">channel</strong></span> <em class="replaceable"><code>channel_name</code></em> {
99c231a3bd27893583204cd0a3e3103dc78dbc28Tinderbox User ( <span><strong class="command">file</strong></span> <em class="replaceable"><code>path_name</code></em>
5e1503eb9464c2284bb782228d4c315087a2415fAutomatic Updater [ <span><strong class="command">versions</strong></span> ( <em class="replaceable"><code>number</code></em> | <span><strong class="command">unlimited</strong></span> ) ]
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater [ <span><strong class="command">size</strong></span> <em class="replaceable"><code>size spec</code></em> ]
6fd5f289d8455283fad33d1051e6fbaa3bec43d5Tinderbox User | <span><strong class="command">syslog</strong></span> <em class="replaceable"><code>syslog_facility</code></em>
08d53af7d51409036462fa80fb1bde7a8c2ac123Automatic Updater | <span><strong class="command">stderr</strong></span>
08d53af7d51409036462fa80fb1bde7a8c2ac123Automatic Updater | <span><strong class="command">null</strong></span> );
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater [ <span><strong class="command">severity</strong></span> (<code class="option">critical</code> | <code class="option">error</code> | <code class="option">warning</code> | <code class="option">notice</code> |
ec7751119a08c6a7250f3187beed69a8b836d349Tinderbox User <code class="option">info</code> | <code class="option">debug</code> [ <em class="replaceable"><code>level</code></em> ] | <code class="option">dynamic</code> ); ]
6fd5f289d8455283fad33d1051e6fbaa3bec43d5Tinderbox User [ <span><strong class="command">print-category</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
6fd5f289d8455283fad33d1051e6fbaa3bec43d5Tinderbox User [ <span><strong class="command">print-severity</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater [ <span><strong class="command">print-time</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
07d9d0dbcc0c79deb3c34f4a8af05ac68a6800e4Mark Andrews [ <span><strong class="command">category</strong></span> <em class="replaceable"><code>category_name</code></em> {
07d9d0dbcc0c79deb3c34f4a8af05ac68a6800e4Mark Andrews <em class="replaceable"><code>channel_name</code></em> ; [ <em class="replaceable"><code>channel_name</code></em> ; ... ]
e135e3c4b1f4f986f00997f5ad5866effb203139Tinderbox User<div class="titlepage"><div><div><h3 class="title">
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User<a name="id2575353"></a><span><strong class="command">logging</strong></span> Statement Definition and
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater The <span><strong class="command">logging</strong></span> statement configures a
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater variety of logging options for the name server. Its <span><strong class="command">channel</strong></span> phrase
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater associates output methods, format options and severity levels with
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User a name that can then be used with the <span><strong class="command">category</strong></span> phrase
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User to select how various classes of messages are logged.
e2e3f655d133f08056c9035412d4c013aab234e7Automatic Updater Only one <span><strong class="command">logging</strong></span> statement is used to
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington as many channels and categories as are wanted. If there is no <span><strong class="command">logging</strong></span> statement,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the logging configuration will be:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington category default { default_syslog; default_debug; };
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater category unmatched { null; };
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User In <acronym class="acronym">BIND</acronym> 9, the logging configuration
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User is only established when
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User the entire configuration file has been parsed. In <acronym class="acronym">BIND</acronym> 8, it was
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User established as soon as the <span><strong class="command">logging</strong></span>
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User was parsed. When the server is starting up, all logging messages
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater regarding syntax errors in the configuration file go to the default
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User channels, or to standard error if the "<code class="option">-g</code>" option
6a9d2121152c94cb9e35832126c3f2e4d18d81edTinderbox User was specified.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h4 class="title">
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<a name="id2575405"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater All log output goes to one or more <span class="emphasis"><em>channels</em></span>;
e062b72f783cdb436a1a57a630bdff471dbb3038Mark Andrews you can make as many of them as you want.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Every channel definition must include a destination clause that
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater says whether messages selected for the channel go to a file, to a
d145b64cacc8d9cda51f9924ec70cd4661c3e2cfAutomatic Updater particular syslog facility, to the standard error stream, or are
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater discarded. It can optionally also limit the message severity level
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User that will be accepted by the channel (the default is
85b52a5959291f5014442814488ccb267cdea369Tinderbox User <span><strong class="command">info</strong></span>), and whether to include a
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">named</strong></span>-generated time stamp, the
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews category name
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews and/or severity level (the default is not to include any).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">null</strong></span> destination clause
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater causes all messages sent to the channel to be discarded;
2cdbfcdad94eba75f3f8e77343a0eefabf553b8eAutomatic Updater in that case, other options for the channel are meaningless.
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews The <span><strong class="command">file</strong></span> destination clause directs
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to a disk file. It can include limitations
52cfbde0bd391cfb37e3c1a1b460c16ba6bf1a73Automatic Updater both on how large the file is allowed to become, and how many
5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User of the file will be saved each time the file is opened.
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews If you use the <span><strong class="command">versions</strong></span> log file
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews <span><strong class="command">named</strong></span> will retain that many backup
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater versions of the file by
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User renaming them when opening. For example, if you choose to keep
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater three old versions
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User of the file <code class="filename">lamers.log</code>, then just
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User before it is opened
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User <code class="filename">lamers.log.1</code> is renamed to
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <code class="filename">lamers.log.2</code>, <code class="filename">lamers.log.0</code> is renamed
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to <code class="filename">lamers.log.1</code>, and <code class="filename">lamers.log</code> is
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater renamed to <code class="filename">lamers.log.0</code>.
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater You can say <span><strong class="command">versions unlimited</strong></span> to
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater the number of versions.
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater If a <span><strong class="command">size</strong></span> option is associated with
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater then renaming is only done when the file being opened exceeds the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User indicated size. No backup versions are kept by default; any
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User log file is simply appended.
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews The <span><strong class="command">size</strong></span> option for files is used
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater growth. If the file ever exceeds the size, then <span><strong class="command">named</strong></span> will
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User stop writing to the file unless it has a <span><strong class="command">versions</strong></span> option
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews associated with it. If backup versions are kept, the files are
cd839f5cf5f84cf163f55ff05cb88ce37efd24d1Automatic Updater described above and a new one begun. If there is no
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <span><strong class="command">versions</strong></span> option, no more data will
cd839f5cf5f84cf163f55ff05cb88ce37efd24d1Automatic Updater be written to the log
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User until some out-of-band mechanism removes or truncates the log to
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User less than the
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User maximum size. The default behavior is not to limit the size of
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Example usage of the <span><strong class="command">size</strong></span> and
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">versions</strong></span> options:
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater<pre class="programlisting">channel an_example_channel {
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User file "example.log" versions 3 size 20m;
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater print-time yes;
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater print-category yes;
c95f536d78842fbc8ebcef653d88e1f2270054f8Automatic Updater The <span><strong class="command">syslog</strong></span> destination clause
c95f536d78842fbc8ebcef653d88e1f2270054f8Automatic Updater channel to the system log. Its argument is a
c95f536d78842fbc8ebcef653d88e1f2270054f8Automatic Updater syslog facility as described in the <span><strong class="command">syslog</strong></span> man
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User page. Known facilities are <span><strong class="command">kern</strong></span>, <span><strong class="command">user</strong></span>,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">mail</strong></span>, <span><strong class="command">daemon</strong></span>, <span><strong class="command">auth</strong></span>,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">syslog</strong></span>, <span><strong class="command">lpr</strong></span>, <span><strong class="command">news</strong></span>,
ec8755f605d7dcb2de1076040e77bc2d7ec33b4aTinderbox User <span><strong class="command">uucp</strong></span>, <span><strong class="command">cron</strong></span>, <span><strong class="command">authpriv</strong></span>,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">ftp</strong></span>, <span><strong class="command">local0</strong></span>, <span><strong class="command">local1</strong></span>,
45c349c278fd83acd4dcb91eec3482401a623e47Automatic Updater <span><strong class="command">local2</strong></span>, <span><strong class="command">local3</strong></span>, <span><strong class="command">local4</strong></span>,
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <span><strong class="command">local5</strong></span>, <span><strong class="command">local6</strong></span> and
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">local7</strong></span>, however not all facilities
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User are supported on
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User all operating systems.
bf8c3776f1bf1a1270e5e0443ae5a8df022632a8Mark Andrews How <span><strong class="command">syslog</strong></span> will handle messages
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater this facility is described in the <span><strong class="command">syslog.conf</strong></span> man
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater page. If you have a system which uses a very old version of <span><strong class="command">syslog</strong></span> that
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater only uses two arguments to the <span><strong class="command">openlog()</strong></span> function,
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater then this clause is silently ignored.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater The <span><strong class="command">severity</strong></span> clause works like <span><strong class="command">syslog</strong></span>'s
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater "priorities", except that they can also be used if you are writing
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater straight to a file rather than using <span><strong class="command">syslog</strong></span>.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater Messages which are not at least of the severity level given will
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater not be selected for the channel; messages of higher severity
560d6da48f066000541dd43f5d407644dee12bebTinderbox User will be accepted.
560d6da48f066000541dd43f5d407644dee12bebTinderbox User If you are using <span><strong class="command">syslog</strong></span>, then the <span><strong class="command">syslog.conf</strong></span> priorities
560d6da48f066000541dd43f5d407644dee12bebTinderbox User will also determine what eventually passes through. For example,
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews defining a channel facility and severity as <span><strong class="command">daemon</strong></span> and <span><strong class="command">debug</strong></span> but
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User only logging <span><strong class="command">daemon.warning</strong></span> via <span><strong class="command">syslog.conf</strong></span> will
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater cause messages of severity <span><strong class="command">info</strong></span> and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">notice</strong></span> to
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater be dropped. If the situation were reversed, with <span><strong class="command">named</strong></span> writing
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater messages of only <span><strong class="command">warning</strong></span> or higher,
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater then <span><strong class="command">syslogd</strong></span> would
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater print all messages it received from the channel.
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater The <span><strong class="command">stderr</strong></span> destination clause
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User channel to the server's standard error stream. This is intended
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User use when the server is running as a foreground process, for
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews when debugging a configuration.
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater The server can supply extensive debugging information when
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater it is in debugging mode. If the server's global debug level is
a6e1f63f50af688610ebd2521ba7f028767b51f3Mark Andrews than zero, then debugging mode will be active. The global debug
2cdbfcdad94eba75f3f8e77343a0eefabf553b8eAutomatic Updater level is set either by starting the <span><strong class="command">named</strong></span> server
4d813066e967a36c407ee641155ada0c614d4dc6Automatic Updater with the <code class="option">-d</code> flag followed by a positive integer,
4d813066e967a36c407ee641155ada0c614d4dc6Automatic Updater or by running <span><strong class="command">rndc trace</strong></span>.
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater The global debug level
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater can be set to zero, and debugging mode turned off, by running <span><strong class="command">rndc
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrewsnotrace</strong></span>. All debugging messages in the server have a debug
2cdbfcdad94eba75f3f8e77343a0eefabf553b8eAutomatic Updater level, and higher debug levels give more detailed output. Channels
e0bf4fc289705375be65c05a8fb085d514a98c97Tinderbox User that specify a specific debug severity, for example:
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<pre class="programlisting">channel specific_debug_level {
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews severity debug 3;
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews will get debugging output of level 3 or less any time the
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater server is in debugging mode, regardless of the global debugging
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater level. Channels with <span><strong class="command">dynamic</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User severity use the
4d813066e967a36c407ee641155ada0c614d4dc6Automatic Updater server's global debug level to determine what messages to print.
d98b4b724343547314bde32a54966c8f124a5f03Mark Andrews If <span><strong class="command">print-time</strong></span> has been turned on,
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User the date and time will be logged. <span><strong class="command">print-time</strong></span> may
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User be specified for a <span><strong class="command">syslog</strong></span> channel,
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User but is usually
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User pointless since <span><strong class="command">syslog</strong></span> also logs
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User time. If <span><strong class="command">print-category</strong></span> is
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews requested, then the
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews category of the message will be logged as well. Finally, if <span><strong class="command">print-severity</strong></span> is
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews on, then the severity level of the message will be logged. The <span><strong class="command">print-</strong></span> options may
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews be used in any combination, and will always be printed in the
e8e87ede5c36b95806c77bcd34894ad9c4b39a78Tinderbox User order: time, category, severity. Here is an example where all
e8e87ede5c36b95806c77bcd34894ad9c4b39a78Tinderbox User three <span><strong class="command">print-</strong></span> options
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <code class="computeroutput">28-Feb-2000 15:05:32.863 general: notice: running</code>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews There are four predefined channels that are used for
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <span><strong class="command">named</strong></span>'s default logging as follows.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews How they are
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews used is described in <a href="Bv9ARM.ch06.html#the_category_phrase" title="The category Phrase">the section called “The <span><strong class="command">category</strong></span> Phrase”</a>.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews<pre class="programlisting">channel default_syslog {
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews // send to syslog's daemon facility
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews syslog daemon;
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews // only send priority info and higher
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews severity info;
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrewschannel default_debug {
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews // write to named.run in the working directory
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews // Note: stderr is used instead of "named.run" if
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews // the server is started with the '-f' option.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews // log at the server's current debug level
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews severity dynamic;
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrewschannel default_stderr {
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews // writes to stderr
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews // only send priority info and higher
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews severity info;
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrewschannel null {
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews // toss anything sent to this channel
ec8755f605d7dcb2de1076040e77bc2d7ec33b4aTinderbox User The <span><strong class="command">default_debug</strong></span> channel has the
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews property that it only produces output when the server's debug
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews nonzero. It normally writes to a file called <code class="filename">named.run</code>
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews in the server's working directory.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews For security reasons, when the "<code class="option">-u</code>"
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews command line option is used, the <code class="filename">named.run</code> file
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews is created only after <span><strong class="command">named</strong></span> has
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews changed to the
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews new UID, and any debug output generated while <span><strong class="command">named</strong></span> is
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews starting up and still running as root is discarded. If you need
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews to capture this output, you must run the server with the "<code class="option">-g</code>"
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews option and redirect standard error to a file.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews Once a channel is defined, it cannot be redefined. Thus you
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews cannot alter the built-in channels directly, but you can modify
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews the default logging by pointing categories at channels you have
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews<div class="titlepage"><div><div><h4 class="title">
bbd726b86a5b0f97a192b6027958dc7b763dc48bTinderbox User<a name="the_category_phrase"></a>The <span><strong class="command">category</strong></span> Phrase</h4></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater There are many categories, so you can send the logs you want
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater to see wherever you want, without seeing logs you don't want. If
7a2a1b8b14fc804ac80612d7b98064095e445be5Automatic Updater you don't specify a list of channels for a category, then log
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews in that category will be sent to the <span><strong class="command">default</strong></span> category
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews instead. If you don't specify a default category, the following
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews "default default" is used:
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews<pre class="programlisting">category default { default_syslog; default_debug; };
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews As an example, let's say you want to log security events to
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews a file, but you also want keep the default logging behavior. You'd
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews specify the following:
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews<pre class="programlisting">channel my_security_channel {
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews file "my_security_file";
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews severity info;
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrewscategory security {
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews my_security_channel;
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews default_syslog;
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews default_debug;
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews To discard all messages in a category, specify the <span><strong class="command">null</strong></span> channel:
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews<pre class="programlisting">category xfer-out { null; };
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrewscategory notify { null; };
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Following are the available categories and brief descriptions
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User of the types of log information they contain. More
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater categories may be added in future <acronym class="acronym">BIND</acronym> releases.
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater<div class="informaltable"><table border="1">
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">default</strong></span></p>
9a5217f827ac0e006016745e5305b31dc0c7767fTinderbox User The default category defines the logging
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews options for those categories where no specific
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User configuration has been
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater <p><span><strong class="command">general</strong></span></p>
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater The catch-all. Many things still aren't
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater classified into categories, and they all end up here.
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews <p><span><strong class="command">database</strong></span></p>
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater Messages relating to the databases used
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater internally by the name server to store zone and cache
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">security</strong></span></p>
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User Approval and denial of requests.
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User <p><span><strong class="command">config</strong></span></p>
059cd1994d4ac5c1b967ce777d2c7409dc829a42Tinderbox User Configuration file parsing and processing.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span><strong class="command">resolver</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User DNS resolution, such as the recursive
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User lookups performed on behalf of clients by a caching name
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span><strong class="command">xfer-in</strong></span></p>
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews Zone transfers the server is receiving.
3e5340279d8875d136a4dd815cccad0044aa2644Automatic Updater <p><span><strong class="command">xfer-out</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Zone transfers the server is sending.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">notify</strong></span></p>
879391501ee0ffba072433120bf1baa4087f8899Automatic Updater The NOTIFY protocol.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">client</strong></span></p>
dcd42a39d311b44877161ffd1e27fa62700c0171Mark Andrews Processing of client requests.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span><strong class="command">unmatched</strong></span></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Messages that <span><strong class="command">named</strong></span> was unable to determine the
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User class of or for which there was no matching <span><strong class="command">view</strong></span>.
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User A one line summary is also logged to the <span><strong class="command">client</strong></span> category.
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User This category is best sent to a file or stderr, by
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User default it is sent to
c5f7f6aa6c51d35353a9485b32abbabfe8358b4eMark Andrews the <span><strong class="command">null</strong></span> channel.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <p><span><strong class="command">network</strong></span></p>
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater Network operations.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">update</strong></span></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Dynamic updates.
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews <p><span><strong class="command">update-security</strong></span></p>
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews Approval and denial of update requests.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span><strong class="command">queries</strong></span></p>
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User Specify where queries should be logged to.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User At startup, specifying the category <span><strong class="command">queries</strong></span> will also
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User enable query logging unless <span><strong class="command">querylog</strong></span> option has been
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User The query log entry reports the client's IP
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User address and port number, and the query name,
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User class and type. Next it reports whether the
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User Recursion Desired flag was set (+ if set, -
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User if not set), if the query was signed (S),
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews EDNS was in use (E), if DO (DNSSEC Ok) was
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews set (D), or if CD (Checking Disabled) was set
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews (C). After this the destination address the
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews query was sent to is reported.
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews <code class="computeroutput">client 127.0.0.1#62536: query: www.example.com IN AAAA +SE</code>
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater <code class="computeroutput">client ::1#62537: query: www.example.net IN AAAA -SE</code>
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User <p><span><strong class="command">query-errors</strong></span></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Information about queries that resulted in some
e130ab53e992670e2a2ecf043976ac09f21358d1Automatic Updater <p><span><strong class="command">dispatch</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Dispatching of incoming packets to the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater server modules where they are to be processed.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">dnssec</strong></span></p>
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User DNSSEC and TSIG protocol processing.
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User <p><span><strong class="command">lame-servers</strong></span></p>
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater Lame servers. These are misconfigurations
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in remote servers, discovered by BIND 9 when trying to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater query those servers during resolution.
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater <p><span><strong class="command">delegation-only</strong></span></p>
e130ab53e992670e2a2ecf043976ac09f21358d1Automatic Updater Delegation only. Logs queries that have been
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User forced to NXDOMAIN as the result of a
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User delegation-only zone or a
e130ab53e992670e2a2ecf043976ac09f21358d1Automatic Updater <span><strong class="command">delegation-only</strong></span> in a hint
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User or stub zone declaration.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">edns-disabled</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Log queries that have been forced to use plain
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater DNS due to timeouts. This is often due to
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater the remote servers not being RFC 1034 compliant
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater (not always returning FORMERR or similar to
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User EDNS queries and other extensions to the DNS
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User when they are not understood). In other words, this is
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User targeted at servers that fail to respond to
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User DNS queries that they don't understand.
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater Note: the log message can also be due to
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater packet loss. Before reporting servers for
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User non-RFC 1034 compliance they should be re-tested
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User to determine the nature of the non-compliance.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User This testing should prevent or reduce the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User number of false-positive reports.
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater Note: eventually <span><strong class="command">named</strong></span> will have to stop
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater treating such timeouts as due to RFC 1034 non
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User compliance and start treating it as plain
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User packet loss. Falsely classifying packet
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User loss as due to RFC 1034 non compliance impacts
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User on DNSSEC validation which requires EDNS for
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the DNSSEC records to be returned.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2576901"></a>The <span><strong class="command">query-errors</strong></span> Category</h4></div></div></div>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User The <span><strong class="command">query-errors</strong></span> category is
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User specifically intended for debugging purposes: To identify
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews why and how specific queries result in responses which
0df8ead472f207020f8da22a185fe4b945248ab8Automatic Updater indicate an error.
0df8ead472f207020f8da22a185fe4b945248ab8Automatic Updater Messages of this category are therefore only logged
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews with <span><strong class="command">debug</strong></span> levels.
6fab60452ed15c1039aee974a32d692d07eda4d2Automatic Updater At the debug levels of 1 or higher, each response with the
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews rcode of SERVFAIL is logged as follows:
b4846627b60aff904d523a433b44482b3b1825a7Tinderbox User <code class="computeroutput">client 127.0.0.1#61502: query failed (SERVFAIL) for www.example.com/IN/AAAA at query.c:3880</code>
71ba75c604df3604673232828a68bb28c420e698Mark Andrews This means an error resulting in SERVFAIL was
71ba75c604df3604673232828a68bb28c420e698Mark Andrews detected at line 3880 of source file
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews Log messages of this level will particularly
dfd613f037c1385db661f17e086d34ea57fea9b0Automatic Updater help identify the cause of SERVFAIL for an
6c6a121295b30772cbf3dd75a51fb9d883051a0eAutomatic Updater authoritative server.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater At the debug levels of 2 or higher, detailed context
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater information of recursive resolutions that resulted in
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater SERVFAIL is logged.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater The log message will look like as follows:
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updaterfetch completed at resolver.c:2970 for www.example.com/A
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updaterin 30.000183: timed out/success [domain:example.com,
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updaterreferral:2,restart:7,qrysent:8,timeout:5,lame:0,neterr:0,
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updaterbadresp:1,adberr:0,findfail:0,valfail:0]
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater The first part before the colon shows that a recursive
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson resolution for AAAA records of www.example.com completed
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in 30.000183 seconds and the final result that led to the
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater SERVFAIL was determined at line 2970 of source file
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The following part shows the detected final result and the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater latest result of DNSSEC validation.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson The latter is always success when no validation attempt
7932a7637170550bc53b38c35db9a0187dcb3d3bAutomatic Updater In this example, this query resulted in SERVFAIL probably
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson because all name servers are down or unreachable, leading
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson to a timeout in 30 seconds.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson DNSSEC validation was probably not attempted.
8bc3d252395842452a6d2c775cf8445f6349e331Tinderbox User The last part enclosed in square brackets shows statistics
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews information collected for this particular resolution
8bc3d252395842452a6d2c775cf8445f6349e331Tinderbox User The <code class="varname">domain</code> field shows the deepest zone
de7b9a1dac0c293b39994c91d4376883da25554fTinderbox User that the resolver reached;
c7ef13f6c9ef4436bc804b150e0a93307b11fa27Tinderbox User it is the zone where the error was finally detected.
c7ef13f6c9ef4436bc804b150e0a93307b11fa27Tinderbox User The meaning of the other fields is summarized in the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater following table.
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews The number of referrals the resolver received
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews throughout the resolution process.
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater In the above example this is 2, which are most
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews The number of cycles that the resolver tried
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews remote servers at the <code class="varname">domain</code>
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews In each cycle the resolver sends one query
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews (possibly resending it, depending on the response)
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews to each known name server of
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater The number of queries the resolver sent at the
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User The number of timeouts since the resolver
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User received the last response.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User The number of lame servers the resolver detected
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User at the <code class="varname">domain</code> zone.
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User A server is detected to be lame either by an
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User invalid response or as a result of lookup in
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User BIND9's address database (ADB), where lame
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User servers are cached.
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User The number of erroneous results that the
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User resolver encountered in sending queries
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User at the <code class="varname">domain</code> zone.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User One common case is the remote server is
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User unreachable and the resolver receives an ICMP
2ec4ab21838e218863d052ebfa3e106e04f50820Evan Hunt unreachable error message.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The number of unexpected responses (other than
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="varname">lame</code>) to queries sent by the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews resolver at the <code class="varname">domain</code> zone.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Failures in finding remote server addresses
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews of the <code class="varname">domain</code> zone in the ADB.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews One common case of this is that the remote
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews server's name does not have any address records.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Failures of resolving remote server addresses.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews This is a total number of failures throughout
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the resolution process.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Failures of DNSSEC validation.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Validation failures are counted throughout
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the resolution process (not limited to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the <code class="varname">domain</code> zone), but should
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews only happen in <code class="varname">domain</code>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews At the debug levels of 3 or higher, the same messages
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews as those at the debug 1 level are logged for other errors
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews than SERVFAIL.
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews Note that negative responses such as NXDOMAIN are not
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews regarded as errors here.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews At the debug levels of 4 or higher, the same messages
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews as those at the debug 2 level are logged for other errors
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews than SERVFAIL.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Unlike the above case of level 3, messages are logged for
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews negative responses.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews This is because any unexpected results can be difficult to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews debug in the recursion case.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<div class="titlepage"><div><div><h3 class="title">
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<a name="id2577420"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews This is the grammar of the <span><strong class="command">lwres</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews statement in the <code class="filename">named.conf</code> file:
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<pre class="programlisting"><span><strong class="command">lwres</strong></span> {
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> listen-on { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> view <em class="replaceable"><code>view_name</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> search { <em class="replaceable"><code>domain_name</code></em> ; [<span class="optional"> <em class="replaceable"><code>domain_name</code></em> ; ... </span>] }; </span>]
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews [<span class="optional"> ndots <em class="replaceable"><code>number</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<div class="titlepage"><div><div><h3 class="title">
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<a name="id2577494"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The <span><strong class="command">lwres</strong></span> statement configures the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews server to also act as a lightweight resolver server. (See
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be multiple
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">lwres</strong></span> statements configuring
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews lightweight resolver servers with different properties.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The <span><strong class="command">listen-on</strong></span> statement specifies a
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews addresses (and ports) that this instance of a lightweight resolver
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews should accept requests on. If no port is specified, port 921 is
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If this statement is omitted, requests will be accepted on
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The <span><strong class="command">view</strong></span> statement binds this
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews instance of a
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews lightweight resolver daemon to a view in the DNS namespace, so that
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews response will be constructed in the same manner as a normal DNS
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews matching this view. If this statement is omitted, the default view
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews used, and if there is no default view, an error is triggered.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The <span><strong class="command">search</strong></span> statement is equivalent to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">search</strong></span> statement in
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="filename">/etc/resolv.conf</code>. It provides a
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews list of domains
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews which are appended to relative names in queries.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The <span><strong class="command">ndots</strong></span> statement is equivalent to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">ndots</strong></span> statement in
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="filename">/etc/resolv.conf</code>. It indicates the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews number of dots in a relative domain name that should result in an
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews exact match lookup before search path elements are appended.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<div class="titlepage"><div><div><h3 class="title">
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<a name="id2577558"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div>
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater<span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> |
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] };
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<div class="titlepage"><div><div><h3 class="title">
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<a name="id2577602"></a><span><strong class="command">masters</strong></span> Statement Definition and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<p><span><strong class="command">masters</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews lists allow for a common set of masters to be easily used by
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews multiple stub and slave zones.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<div class="titlepage"><div><div><h3 class="title">
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<a name="id2577617"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews This is the grammar of the <span><strong class="command">options</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews statement in the <code class="filename">named.conf</code> file:
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<pre class="programlisting"><span><strong class="command">options</strong></span> {
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> attach-cache <em class="replaceable"><code>cache_name</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> version <em class="replaceable"><code>version_string</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> hostname <em class="replaceable"><code>hostname_string</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> server-id <em class="replaceable"><code>server_id_string</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> directory <em class="replaceable"><code>path_name</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> named-xfer <em class="replaceable"><code>path_name</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> tkey-gssapi-credential <em class="replaceable"><code>principal</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> tkey-domain <em class="replaceable"><code>domainname</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> tkey-dhkey <em class="replaceable"><code>key_name</code></em> <em class="replaceable"><code>key_tag</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> cache-file <em class="replaceable"><code>path_name</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> dump-file <em class="replaceable"><code>path_name</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> bindkeys-file <em class="replaceable"><code>path_name</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> memstatistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> memstatistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> pid-file <em class="replaceable"><code>path_name</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> recursing-file <em class="replaceable"><code>path_name</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> statistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> auth-nxdomain <em class="replaceable"><code>yes_or_no</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> deallocate-on-exit <em class="replaceable"><code>yes_or_no</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> fake-iquery <em class="replaceable"><code>yes_or_no</code></em>; </span>]
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews [<span class="optional"> fetch-glue <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> flush-zones-on-shutdown <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> has-old-clients <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> host-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> host-statistics-max <em class="replaceable"><code>number</code></em>; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> minimal-responses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> multiple-cnames <em class="replaceable"><code>yes_or_no</code></em>; </span>]
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews [<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em>; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> recursion <em class="replaceable"><code>yes_or_no</code></em>; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> rfc2308-type1 <em class="replaceable"><code>yes_or_no</code></em>; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> use-id-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em>; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> ixfr-from-differences (<em class="replaceable"><code>yes_or_no</code></em> | <code class="constant">master</code> | <code class="constant">slave</code>); </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> dnssec-enable <em class="replaceable"><code>yes_or_no</code></em>; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> dnssec-validation <em class="replaceable"><code>yes_or_no</code></em>; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> dnssec-lookaside ( <em class="replaceable"><code>auto</code></em> |
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em> ); </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> dnssec-must-be-secure <em class="replaceable"><code>domain yes_or_no</code></em>; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> dnssec-accept-expired <em class="replaceable"><code>yes_or_no</code></em>; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> forward ( <em class="replaceable"><code>only</code></em> | <em class="replaceable"><code>first</code></em> ); </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> dual-stack-servers [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] {
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews ( <em class="replaceable"><code>domain_name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] |
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ) ;
35bc7055d1b9b816e68a4180d46a49963e45c233Automatic Updater ... }; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> check-names ( <em class="replaceable"><code>master</code></em> | <em class="replaceable"><code>slave</code></em> | <em class="replaceable"><code>response</code></em> )
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> check-mx ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
78cb74fab4665da2e2641ba909c6f59f74cc4193Automatic Updater [<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em>; </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> check-mx-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> check-srv-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> check-sibling <em class="replaceable"><code>yes_or_no</code></em>; </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> allow-query-cache { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> allow-query-cache-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
c57668a2fbbe558c1bd21652813616f2f517c469Tinderbox User [<span class="optional"> allow-recursion { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> allow-recursion-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater [<span class="optional"> secure-to-insecure <em class="replaceable"><code>yes_or_no</code></em> ;</span>]
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews [<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson [<span class="optional"> allow-v6-synthesis { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
309b912841e8b97bf0b0df0d96c3eaf16990c080Automatic Updater [<span class="optional"> blackhole { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
66d24a46538c7c2d29fdb5611ab1173e83685b1dTinderbox User [<span class="optional"> use-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
66d24a46538c7c2d29fdb5611ab1173e83685b1dTinderbox User [<span class="optional"> avoid-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson [<span class="optional"> use-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson [<span class="optional"> avoid-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
754ebd37e782356aedbb2987e3c1a8ab4f29574eMark Andrews [<span class="optional"> listen-on [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
754ebd37e782356aedbb2987e3c1a8ab4f29574eMark Andrews [<span class="optional"> listen-on-v6 [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
754ebd37e782356aedbb2987e3c1a8ab4f29574eMark Andrews [<span class="optional"> query-source ( ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> )
93089a352d6903b0d7845a039de4ec2df9a0e35aTinderbox User [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
94df856897945fe58f130ba78765c57308bc5400Automatic Updater [<span class="optional"> address ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
5c679dbb66df92766f6a7e7bb93c18d61275d1feMark Andrews [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
1d4f4d2db2d69e48fec2dde5c1535853677d22a7Automatic Updater [<span class="optional"> query-source-v6 ( ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> )
5c679dbb66df92766f6a7e7bb93c18d61275d1feMark Andrews [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater [<span class="optional"> address ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
1d4f4d2db2d69e48fec2dde5c1535853677d22a7Automatic Updater [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews [<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews [<span class="optional"> queryport-pool-interval <em class="replaceable"><code>number</code></em>; </span>]
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews [<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em>; </span>]
1d4f4d2db2d69e48fec2dde5c1535853677d22a7Automatic Updater [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em>; </span>]
da93950363b307b718d156514b95b9df93a63776Mark Andrews [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em>; </span>]
da93950363b307b718d156514b95b9df93a63776Mark Andrews [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em>; </span>]
35bc7055d1b9b816e68a4180d46a49963e45c233Automatic Updater [<span class="optional"> tcp-clients <em class="replaceable"><code>number</code></em>; </span>]
1d4f4d2db2d69e48fec2dde5c1535853677d22a7Automatic Updater [<span class="optional"> reserved-sockets <em class="replaceable"><code>number</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> recursive-clients <em class="replaceable"><code>number</code></em>; </span>]
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater [<span class="optional"> serial-query-rate <em class="replaceable"><code>number</code></em>; </span>]
f6056ad06781c95198505ae3a361e6dd98df4b91Automatic Updater [<span class="optional"> serial-queries <em class="replaceable"><code>number</code></em>; </span>]
1d4f4d2db2d69e48fec2dde5c1535853677d22a7Automatic Updater [<span class="optional"> tcp-listen-queue <em class="replaceable"><code>number</code></em>; </span>]
f6056ad06781c95198505ae3a361e6dd98df4b91Automatic Updater [<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em>; </span>]
fbcaee30a27f47fe337152c27e7d90489dc8fd63Tinderbox User [<span class="optional"> transfers-in <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> transfers-out <em class="replaceable"><code>number</code></em>; </span>]
1d4f4d2db2d69e48fec2dde5c1535853677d22a7Automatic Updater [<span class="optional"> transfers-per-ns <em class="replaceable"><code>number</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
1d4f4d2db2d69e48fec2dde5c1535853677d22a7Automatic Updater [<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
f8e61212a1b83e60f521577cc522e8bc1509c8cfAutomatic Updater [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em>; </span>]
f8e61212a1b83e60f521577cc522e8bc1509c8cfAutomatic Updater [<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
c57668a2fbbe558c1bd21652813616f2f517c469Tinderbox User [<span class="optional"> coresize <em class="replaceable"><code>size_spec</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> datasize <em class="replaceable"><code>size_spec</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> files <em class="replaceable"><code>size_spec</code></em> ; </span>]
78d7186253dfed549ec0ce2d7c2b08a7978ede9cAutomatic Updater [<span class="optional"> stacksize <em class="replaceable"><code>size_spec</code></em> ; </span>]
78d7186253dfed549ec0ce2d7c2b08a7978ede9cAutomatic Updater [<span class="optional"> cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> heartbeat-interval <em class="replaceable"><code>number</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> interface-interval <em class="replaceable"><code>number</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> statistics-interval <em class="replaceable"><code>number</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> topology { <em class="replaceable"><code>address_match_list</code></em> }</span>];
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> sortlist { <em class="replaceable"><code>address_match_list</code></em> }</span>];
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> rrset-order { <em class="replaceable"><code>order_spec</code></em> ; [<span class="optional"> <em class="replaceable"><code>order_spec</code></em> ; ... </span>] </span>] };
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> lame-ttl <em class="replaceable"><code>number</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> max-ncache-ttl <em class="replaceable"><code>number</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> max-cache-ttl <em class="replaceable"><code>number</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> min-roots <em class="replaceable"><code>number</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> use-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> treat-cr-as-space <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> min-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> additional-from-auth <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> additional-from-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> random-device <em class="replaceable"><code>path_name</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> max-cache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> match-mapped-addresses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> preferred-glue ( <em class="replaceable"><code>A</code></em> | <em class="replaceable"><code>AAAA</code></em> | <em class="replaceable"><code>NONE</code></em> ); </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> edns-udp-size <em class="replaceable"><code>number</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> max-udp-size <em class="replaceable"><code>number</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> root-delegation-only [<span class="optional"> exclude { <em class="replaceable"><code>namelist</code></em> } </span>] ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> querylog <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> disable-algorithms <em class="replaceable"><code>domain</code></em> { <em class="replaceable"><code>algorithm</code></em>;
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> <em class="replaceable"><code>algorithm</code></em>; </span>] }; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> acache-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> acache-cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> max-acache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> max-clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> empty-server <em class="replaceable"><code>name</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> empty-contact <em class="replaceable"><code>name</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> empty-zones-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0b580e05aec89f501a9c20cc00ceb42d043d3928Automatic Updater [<span class="optional"> disable-empty-zone <em class="replaceable"><code>zone_name</code></em> ; </span>]
78d7186253dfed549ec0ce2d7c2b08a7978ede9cAutomatic Updater [<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> zero-no-soa-ttl-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> deny-answer-addresses { <em class="replaceable"><code>address_match_list</code></em> } [<span class="optional"> except-from { <em class="replaceable"><code>namelist</code></em> } </span>];</span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater [<span class="optional"> deny-answer-aliases { <em class="replaceable"><code>namelist</code></em> } [<span class="optional"> except-from { <em class="replaceable"><code>namelist</code></em> } </span>];</span>]
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater<div class="titlepage"><div><div><h3 class="title">
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater<a name="options"></a><span><strong class="command">options</strong></span> Statement Definition and
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater The <span><strong class="command">options</strong></span> statement sets up global
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater to be used by <acronym class="acronym">BIND</acronym>. This statement
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater may appear only
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater once in a configuration file. If there is no <span><strong class="command">options</strong></span>
78d7186253dfed549ec0ce2d7c2b08a7978ede9cAutomatic Updater statement, an options block with each option set to its default will
0b580e05aec89f501a9c20cc00ceb42d043d3928Automatic Updater<dt><span class="term"><span><strong class="command">attach-cache</strong></span></span></dt>
0b580e05aec89f501a9c20cc00ceb42d043d3928Automatic Updater Allows multiple views to share a single cache
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater Each view has its own cache database by default, but
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater if multiple views have the same operational policy
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater for name resolution and caching, those views can
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater share a single cache to save memory and possibly
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater improve resolution efficiency by using this option.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater The <span><strong class="command">attach-cache</strong></span> option
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater may also be specified in <span><strong class="command">view</strong></span>
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater statements, in which case it overrides the
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater global <span><strong class="command">attach-cache</strong></span> option.
f8e61212a1b83e60f521577cc522e8bc1509c8cfAutomatic Updater The <em class="replaceable"><code>cache_name</code></em> specifies
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater the cache to be shared.
f8e61212a1b83e60f521577cc522e8bc1509c8cfAutomatic Updater When the <span><strong class="command">named</strong></span> server configures
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User views which are supposed to share a cache, it
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User creates a cache with the specified name for the
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User first view of these sharing views.
6a9d2121152c94cb9e35832126c3f2e4d18d81edTinderbox User The rest of the views will simply refer to the
6a9d2121152c94cb9e35832126c3f2e4d18d81edTinderbox User already created cache.
6a9d2121152c94cb9e35832126c3f2e4d18d81edTinderbox User One common configuration to share a cache would be to
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User allow all views to share a single cache.
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User This can be done by specifying
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User the <span><strong class="command">attach-cache</strong></span> as a global
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User option with an arbitrary name.
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews Another possible operation is to allow a subset of
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User all views to share a cache while the others to
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews retain their own caches.
c7ef13f6c9ef4436bc804b150e0a93307b11fa27Tinderbox User For example, if there are three views A, B, and C,
4ea3649f028ea6a1e42377082a7ccf8f789fb950Automatic Updater and only A and B should share a cache, specify the
644973f327e9db74779e7c0426db90909173b284Automatic Updater <span><strong class="command">attach-cache</strong></span> option as a view A (or
644973f327e9db74779e7c0426db90909173b284Automatic Updater B)'s option, referring to the other view name:
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User // this view has its own cache
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User // this view refers to A's cache
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User attach-cache "A";
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User // this view has its own cache
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User Views that share a cache must have the same policy
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User on configurable parameters that may affect caching.
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User The current implementation requires the following
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User configurable options be consistent among these
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User <span><strong class="command">check-names</strong></span>,
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User <span><strong class="command">cleaning-interval</strong></span>,
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User <span><strong class="command">dnssec-accept-expired</strong></span>,
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User <span><strong class="command">dnssec-validation</strong></span>,
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User <span><strong class="command">max-cache-ttl</strong></span>,
418cc932318b1d67f88a36904d88d8a5a0a2ba09Automatic Updater <span><strong class="command">max-ncache-ttl</strong></span>,
e31cfd80616deb9781902306b34a69aa7309b6cbTinderbox User <span><strong class="command">max-cache-size</strong></span>, and
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <span><strong class="command">zero-no-soa-ttl</strong></span>.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Note that there may be other parameters that may
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews cause confusion if they are inconsistent for
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews different views that share a single cache.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews For example, if these views define different sets of
90863a6f9bfb06062c7fdf269bb675e7b674fc31Mark Andrews forwarders that can return different answers for the
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews same question, sharing the answer does not make
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews sense or could even be harmful.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews It is administrator's responsibility to ensure
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews configuration differences in different views do
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews not cause disruption with a shared cache.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<dt><span class="term"><span><strong class="command">directory</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews The working directory of the server.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Any non-absolute pathnames in the configuration file will be
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews as relative to this directory. The default location for most
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater output files (e.g. <code class="filename">named.run</code>)
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews is this directory.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews If a directory is not specified, the working directory
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater defaults to `<code class="filename">.</code>', the directory from
68e1b398b5b1b417723e90b5e52b9148f8f93294Automatic Updater which the server
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews was started. The directory specified should be an absolute
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">key-directory</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User When performing dynamic update of secure zones, the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User directory where the public and private DNSSEC key files
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater should be found, if different than the current working
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater directory. The directory specified must be an absolute
45eca3a5d46ed15aee14d81f6cb6c9fb6f365344Mark Andrews path. (Note that this option has no effect on the paths
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User for files containing non-DNSSEC keys such as
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<dt><span class="term"><span><strong class="command">named-xfer</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <span class="emphasis"><em>This option is obsolete.</em></span> It
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews was used in <acronym class="acronym">BIND</acronym> 8 to specify
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews the pathname to the <span><strong class="command">named-xfer</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User program. In <acronym class="acronym">BIND</acronym> 9, no separate
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span><strong class="command">named-xfer</strong></span> program is needed;
7a2a1b8b14fc804ac80612d7b98064095e445be5Automatic Updater its functionality is built into the name server.
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews<dt><span class="term"><span><strong class="command">tkey-gssapi-credential</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews The security credential with which the server should
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington authenticate keys requested by the GSS-TSIG protocol.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Currently only Kerberos 5 authentication is available
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington and the credential is a Kerberos principal which
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the server can acquire through the default system
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington key file, normally <code class="filename">/etc/krb5.keytab</code>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Normally this principal is of the form
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington "<strong class="userinput"><code>dns/</code></strong><code class="varname">server.domain</code>".
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington To use GSS-TSIG, <span><strong class="command">tkey-domain</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington must also be set.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">tkey-domain</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The domain appended to the names of all shared keys
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater generated with <span><strong class="command">TKEY</strong></span>. When a
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater client requests a <span><strong class="command">TKEY</strong></span> exchange,
644973f327e9db74779e7c0426db90909173b284Automatic Updater it may or may not specify the desired name for the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater key. If present, the name of the shared key will
c28a1243429dfaf8dc5f6c1db0dccdc6ce386baeMark Andrews be <code class="varname">client specified part</code> +
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <code class="varname">tkey-domain</code>. Otherwise, the
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews name of the shared key will be <code class="varname">random hex
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews digits</code> + <code class="varname">tkey-domain</code>.
5f7e0eb1cb917b788906d3e2aa01bfc4885dcae4Mark Andrews In most cases, the <span><strong class="command">domainname</strong></span>
bf1263835e8e35421960f65088c043f42aacef13Mark Andrews should be the server's domain name, or an otherwise
15ae68f3db8261770fc33b8e0f83f5d8c7021e84Mark Andrews non-existent subdomain like
ac4e70ff8955669341f435bc0a734a17c01af124Mark Andrews "_tkey.<code class="varname">domainname</code>". If you are
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User using GSS-TSIG, this variable must be defined.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">tkey-dhkey</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User The Diffie-Hellman key used by the server
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater to generate shared keys with clients using the Diffie-Hellman
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User of <span><strong class="command">TKEY</strong></span>. The server must be
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews able to load the
d642d3857129678797a01adee14fbd70335b05a9Mark Andrews public and private keys from files in the working directory.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User most cases, the keyname should be the server's host name.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">cache-file</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This is for testing only. Do not use.
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater<dt><span class="term"><span><strong class="command">dump-file</strong></span></span></dt>
02973ab41430678c285ef7ae6d1183003469a3bcAutomatic Updater The pathname of the file the server dumps
10640b2e3efc7bc8034108136d7487f7407fbf37Andreas Gustafsson the database to when instructed to do so with
02973ab41430678c285ef7ae6d1183003469a3bcAutomatic Updater <span><strong class="command">rndc dumpdb</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If not specified, the default is <code class="filename">named_dump.db</code>.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater<dt><span class="term"><span><strong class="command">memstatistics-file</strong></span></span></dt>
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews The pathname of the file the server writes memory
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User usage statistics to on exit. If not specified,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews the default is <code class="filename">named.memstats</code>.
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User<dt><span class="term"><span><strong class="command">pid-file</strong></span></span></dt>
a01aa536188bb3535dfc1107a623e6355a8e6b7cMark Andrews The pathname of the file the server writes its process ID
0a50626faa2f8941f55bf435d3965d490bb5d026Tinderbox User in. If not specified, the default is
1d4f4d2db2d69e48fec2dde5c1535853677d22a7Automatic Updater <code class="filename">/var/run/named/named.pid</code>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The PID file is used by programs that want to send signals to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater name server. Specifying <span><strong class="command">pid-file none</strong></span> disables the
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User use of a PID file — no file will be written and any
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User existing one will be removed. Note that <span><strong class="command">none</strong></span>
f751b1576ee6fef4023bf7101d10167e4fe520f3Tinderbox User is a keyword, not a filename, and therefore is not enclosed
e130ab53e992670e2a2ecf043976ac09f21358d1Automatic Updater double quotes.
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User<dt><span class="term"><span><strong class="command">recursing-file</strong></span></span></dt>
99c231a3bd27893583204cd0a3e3103dc78dbc28Tinderbox User The pathname of the file the server dumps
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the queries that are currently recursing when instructed
e10d61d84e0b735f1e8eca18644cfdb1b06cad33Tinderbox User to do so with <span><strong class="command">rndc recursing</strong></span>.
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews If not specified, the default is <code class="filename">named.recursing</code>.
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews<dt><span class="term"><span><strong class="command">statistics-file</strong></span></span></dt>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews The pathname of the file the server appends statistics
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater to when instructed to do so using <span><strong class="command">rndc stats</strong></span>.
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater If not specified, the default is <code class="filename">named.stats</code> in the
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User server's current directory. The format of the file is
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews in <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
d3ba57ed92b7095fdeabc444af5dd18ac4781064Tinderbox User<dt><span class="term"><span><strong class="command">bindkeys-file</strong></span></span></dt>
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews The pathname of a file to override the built-in trusted
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews keys provided by named. See the discussion of
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <span><strong class="command">dnssec-lookaside</strong></span> for details.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews If not specified, the default is
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <code class="filename">/etc/bind.keys</code>.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews<dt><span class="term"><span><strong class="command">session-keyfile</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The pathname of the file into which to write a TSIG
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater session key generated by <span><strong class="command">named</strong></span> for use by
1d4f4d2db2d69e48fec2dde5c1535853677d22a7Automatic Updater <span><strong class="command">nsupdate -l</strong></span>. If not specified, the
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater default is <code class="filename">/var/run/named/session.key</code>.
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews (See <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>, and in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater particular the discussion of the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">update-policy</strong></span> statement's
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews <strong class="userinput"><code>local</code></strong> option for more
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews information about this feature.)
dc5552b4df5e3821783821c8d4e734c1608c446eTinderbox User<dt><span class="term"><span><strong class="command">session-keyname</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User The key name to use for the TSIG session key.
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User If not specified, the default is "local-ddns".
02b3e44a996e9753d86306b6a1b6b579a73787fcTinderbox User<dt><span class="term"><span><strong class="command">session-keyalg</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The algorithm to use for the TSIG session key.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews Valid values are hmac-sha1, hmac-sha224, hmac-sha256,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews hmac-sha384, hmac-sha512 and hmac-md5. If not
53b97c9873a923f504893d1e2ab62000dfac221fTinderbox User specified, the default is hmac-sha256.
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater<dt><span class="term"><span><strong class="command">session-keyfile</strong></span></span></dt>
8c6328ab5890aa79d84b86ed672e185dc111bb68Automatic Updater The pathname of the file into which to write a session TSIG
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User key for use by <span><strong class="command">nsupdate -l</strong></span>. (See the
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater discussion of the <span><strong class="command">update-policy</strong></span>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews statement's <strong class="userinput"><code>local</code></strong> option for more
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater details on this feature.)
f89eb76a7516649f8717c6397fc496ca906ddb57Tinderbox User<dt><span class="term"><span><strong class="command">port</strong></span></span></dt>
e20309353e6246485c521278131d3fced73d7957Tinderbox User receiving and sending DNS protocol traffic.
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews The default is 53. This option is mainly intended for server
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater a server using a port other than 53 will not be able to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater communicate with
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews the global DNS.
53b97c9873a923f504893d1e2ab62000dfac221fTinderbox User<dt><span class="term"><span><strong class="command">random-device</strong></span></span></dt>
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater The source of entropy to be used by the server. Entropy is
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews primarily needed
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater for DNSSEC operations, such as TKEY transactions and dynamic
ca904804e43f663f08eb1ac9d6d617930b9a3cd3Automatic Updater update of signed
19ad308d84cbf446a144e5a91f2032389a9d65c1Tinderbox User zones. This options specifies the device (or file) from which
713a5e3080f112b3efde9235e9c92035056ff966Automatic Updater entropy. If this is a file, operations requiring entropy will
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews file has been exhausted. If not specified, the default value
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater (or equivalent) when present, and none otherwise. The
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <span><strong class="command">random-device</strong></span> option takes
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews the initial configuration load at server startup time and
be46cb4bee9253ee4832340c719920642e00c41aTinderbox User is ignored on subsequent reloads.
c243d779731a410f8dc2d2feeed20c15f299b6e3Automatic Updater<dt><span class="term"><span><strong class="command">preferred-glue</strong></span></span></dt>
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater If specified, the listed type (A or AAAA) will be emitted
099b86fb8136a7dff81df85cf395978c16eb254cAutomatic Updater before other glue
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User in the additional section of a query response.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is not to prefer any type (NONE).
572cb2c1c931f6bc6a4a019c103ae88239b0eb96Automatic Updater<a name="root_delegation_only"></a><span class="term"><span><strong class="command">root-delegation-only</strong></span></span>
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews Turn on enforcement of delegation-only in TLDs
f22980c16f244b7d7f33b5248f2d38bd4885f108Automatic Updater (top level domains) and root zones with an optional
e20309353e6246485c521278131d3fced73d7957Tinderbox User exclude list.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews DS queries are expected to be made to and be answered by
f751b1576ee6fef4023bf7101d10167e4fe520f3Tinderbox User delegation only zones. Such queries and responses are
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater treated as an exception to delegation-only processing
d630ef2ff74445949a482660938e9fa9da52ca14Automatic Updater and are not converted to NXDOMAIN responses provided
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User a CNAME is not discovered at the query name.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If a delegation only zone server also serves a child
e10d61d84e0b735f1e8eca18644cfdb1b06cad33Tinderbox User zone it is not always possible to determine whether
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User an answer comes from the delegation only zone or the
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User child zone. SOA NS and DNSKEY records are apex
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater only records and a matching response that contains
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater these records or DS is treated as coming from a
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User child zone. RRSIG records are also examined to see
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews if they are signed by a child zone or not. The
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews authority section is also examined to see if there
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User is evidence that the answer is from the child zone.
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews Answers that are determined to be from a child zone
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User are not converted to NXDOMAIN responses. Despite
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews all these checks there is still a possibility of
93089a352d6903b0d7845a039de4ec2df9a0e35aTinderbox User false negatives when a child zone is being served.
e20309353e6246485c521278131d3fced73d7957Tinderbox User Similarly false positives can arise from empty nodes
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews (no records at the name) in the delegation only zone
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User when the query type is not ANY.
ca5ba35827e475a824ec79d489dbcdb3341a35ccTinderbox User Note some TLDs are not delegation only (e.g. "DE", "LV",
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews "US" and "MUSEUM"). This list is not exhaustive.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">disable-algorithms</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Disable the specified DNSSEC algorithms at and below the
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User specified name.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews Multiple <span><strong class="command">disable-algorithms</strong></span>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User statements are allowed.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Only the most specific will be applied.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">dnssec-lookaside</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User When set, <span><strong class="command">dnssec-lookaside</strong></span> provides the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater validator with an alternate method to validate DNSKEY
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater records at the top of a zone. When a DNSKEY is at or
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater below a domain specified by the deepest
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews <span><strong class="command">dnssec-lookaside</strong></span>, and the normal dnssec
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater validation has left the key untrusted, the trust-anchor
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater will be append to the key name and a DLV record will be
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater looked up to see if it can validate the key. If the DLV
f89eb76a7516649f8717c6397fc496ca906ddb57Tinderbox User record validates a DNSKEY (similarly to the way a DS record
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater does) the DNSKEY RRset is deemed to be trusted.
a61158fed2e0281a40e3e97e0b7c3f9789a07b4eTinderbox User If <span><strong class="command">dnssec-lookaside</strong></span> is set to
a61158fed2e0281a40e3e97e0b7c3f9789a07b4eTinderbox User "auto", then built-in default values for
a61158fed2e0281a40e3e97e0b7c3f9789a07b4eTinderbox User the domain and trust anchor will be used, along
a61158fed2e0281a40e3e97e0b7c3f9789a07b4eTinderbox User with a built-in key for validation.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater NOTE: Since the built-in key may expire, it can be
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater overridden without recompiling named by placing a new key
3f616e6f846be57b1717c6beaba0f74de9d5a7c6Automatic Updater in the file <code class="filename">bind.keys</code>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">dnssec-must-be-secure</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Specify hierarchies which must be or may not be secure
c7f4dfc8decb44451cff27ef160d539d4954dc31Tinderbox User (signed and validated). If <strong class="userinput"><code>yes</code></strong>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater then <span><strong class="command">named</strong></span> will only accept answers if
f34958b7669dfca333cc0cd20113b1f55a89e1deTinderbox User they are secure. If <strong class="userinput"><code>no</code></strong>, then normal
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater DNSSEC validation applies allowing for insecure answers to
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews be accepted. The specified domain must be under a
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews <span><strong class="command">trusted-keys</strong></span> or
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews <span><strong class="command">managed-keys</strong></span> statement, or
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews <span><strong class="command">dnssec-lookaside</strong></span> must be active.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews<div class="titlepage"><div><div><h4 class="title">
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater<a name="boolean_options"></a>Boolean Options</h4></div></div></div>
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater<dt><span class="term"><span><strong class="command">auth-nxdomain</strong></span></span></dt>
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater If <strong class="userinput"><code>yes</code></strong>, then the <span><strong class="command">AA</strong></span> bit
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is always set on NXDOMAIN responses, even if the server is
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater authoritative. The default is <strong class="userinput"><code>no</code></strong>;
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater a change from <acronym class="acronym">BIND</acronym> 8. If you
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater are using very old DNS software, you
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater may need to set it to <strong class="userinput"><code>yes</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">deallocate-on-exit</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User This option was used in <acronym class="acronym">BIND</acronym>
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews 8 to enable checking
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews for memory leaks on exit. <acronym class="acronym">BIND</acronym> 9 ignores the option and always performs
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">memstatistics</strong></span></span></dt>
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater Write memory statistics to the file specified by
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater <span><strong class="command">memstatistics-file</strong></span> at exit.
3f616e6f846be57b1717c6beaba0f74de9d5a7c6Automatic Updater The default is <strong class="userinput"><code>no</code></strong> unless
1b670d35282f1b9352692ad212be3c0aa97b0689Automatic Updater '-m record' is specified on the command line in
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User which case it is <strong class="userinput"><code>yes</code></strong>.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater<dt><span class="term"><span><strong class="command">dialup</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <strong class="userinput"><code>yes</code></strong>, then the
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater server treats all zones as if they are doing zone transfers
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater a dial-on-demand dialup link, which can be brought up by
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater originating from this server. This has different effects
f89eb76a7516649f8717c6397fc496ca906ddb57Tinderbox User to zone type and concentrates the zone maintenance so that
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater happens in a short interval, once every <span><strong class="command">heartbeat-interval</strong></span> and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater hopefully during the one call. It also suppresses some of
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater zone maintenance traffic. The default is <strong class="userinput"><code>no</code></strong>.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater The <span><strong class="command">dialup</strong></span> option
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater may also be specified in the <span><strong class="command">view</strong></span> and
324a8797b46d646fe8d3b2eef6785e0b2b3ac956Tinderbox User <span><strong class="command">zone</strong></span> statements,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in which case it overrides the global <span><strong class="command">dialup</strong></span>
7169f76a893666eb20fc7750782e7f411db742d6Tinderbox User If the zone is a master zone, then the server will send out a
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater request to all the slaves (default). This should trigger the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater number check in the slave (providing it supports NOTIFY)
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User allowing the slave
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User to verify the zone while the connection is active.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater The set of servers to which NOTIFY is sent can be controlled
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater <span><strong class="command">notify</strong></span> and <span><strong class="command">also-notify</strong></span>.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater zone is a slave or stub zone, then the server will suppress
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater "zone up to date" (refresh) queries and only perform them
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater <span><strong class="command">heartbeat-interval</strong></span> expires in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater addition to sending
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User NOTIFY requests.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Finer control can be achieved by using
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater <strong class="userinput"><code>notify</code></strong> which only sends NOTIFY
324a8797b46d646fe8d3b2eef6785e0b2b3ac956Tinderbox User <strong class="userinput"><code>notify-passive</code></strong> which sends NOTIFY
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater suppresses the normal refresh queries, <strong class="userinput"><code>refresh</code></strong>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater which suppresses normal refresh processing and sends refresh
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater when the <span><strong class="command">heartbeat-interval</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <strong class="userinput"><code>passive</code></strong> which just disables normal
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater<div class="informaltable"><table border="1">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater normal refresh
114f7780384371121918624ae2c80ecfce545683Tinderbox User heart-beat refresh
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User heart-beat notify
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User <p><span><strong class="command">no</strong></span> (default)</p>
7d704e522860496310bb29c28e76064868401a9cMark Andrews <p><span><strong class="command">yes</strong></span></p>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <p><span><strong class="command">notify</strong></span></p>
ca5ba35827e475a824ec79d489dbcdb3341a35ccTinderbox User <p><span><strong class="command">refresh</strong></span></p>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <p><span><strong class="command">passive</strong></span></p>
b5423cbff7175727ed9046c8c670d8a7bb4d01eaTinderbox User <p><span><strong class="command">notify-passive</strong></span></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Note that normal NOTIFY processing is not affected by
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews <span><strong class="command">dialup</strong></span>.
da59e63e7af147a8bcef985b98b04443e04c3a0eTinderbox User<dt><span class="term"><span><strong class="command">fake-iquery</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater In <acronym class="acronym">BIND</acronym> 8, this option
b5423cbff7175727ed9046c8c670d8a7bb4d01eaTinderbox User enabled simulating the obsolete DNS query type
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater IQUERY. <acronym class="acronym">BIND</acronym> 9 never does
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater IQUERY simulation.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">fetch-glue</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This option is obsolete.
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater In BIND 8, <strong class="userinput"><code>fetch-glue yes</code></strong>
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater caused the server to attempt to fetch glue resource records
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater didn't have when constructing the additional
b4cebdb6ccde66a8f3e397a1b90b0cf788519d69Automatic Updater data section of a response. This is now considered a bad
19b3dc94bce93fa76bd7e066f9298630dbc9dcb4Automatic Updater and BIND 9 never does it.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">flush-zones-on-shutdown</strong></span></span></dt>
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User When the nameserver exits due receiving SIGTERM,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater flush or do not flush any pending zone writes. The default
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">flush-zones-on-shutdown</strong></span> <strong class="userinput"><code>no</code></strong>.
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User<dt><span class="term"><span><strong class="command">has-old-clients</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This option was incorrectly implemented
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater in <acronym class="acronym">BIND</acronym> 8, and is ignored by <acronym class="acronym">BIND</acronym> 9.
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User To achieve the intended effect
098097efb95046a4a5285b6dae95dea3e3b70853Automatic Updater <span><strong class="command">has-old-clients</strong></span> <strong class="userinput"><code>yes</code></strong>, specify
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the two separate options <span><strong class="command">auth-nxdomain</strong></span> <strong class="userinput"><code>yes</code></strong>
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater and <span><strong class="command">rfc2308-type1</strong></span> <strong class="userinput"><code>no</code></strong> instead.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">host-statistics</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater In BIND 8, this enables keeping of
9d80d23172c30fd63e5046a7e69b8445e564ff31Automatic Updater statistics for every host that the name server interacts
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater Not implemented in BIND 9.
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User<dt><span class="term"><span><strong class="command">maintain-ixfr-base</strong></span></span></dt>
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User <span class="emphasis"><em>This option is obsolete</em></span>.
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater It was used in <acronym class="acronym">BIND</acronym> 8 to
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater determine whether a transaction log was
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater kept for Incremental Zone Transfer. <acronym class="acronym">BIND</acronym> 9 maintains a transaction
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews log whenever possible. If you need to disable outgoing
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews incremental zone
e705db6d5d886dc14f4a75a2046a075c0750e7eeAutomatic Updater transfers, use <span><strong class="command">provide-ixfr</strong></span> <strong class="userinput"><code>no</code></strong>.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater<dt><span class="term"><span><strong class="command">minimal-responses</strong></span></span></dt>
d3ba57ed92b7095fdeabc444af5dd18ac4781064Tinderbox User If <strong class="userinput"><code>yes</code></strong>, then when generating
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater responses the server will only add records to the authority
b4cebdb6ccde66a8f3e397a1b90b0cf788519d69Automatic Updater and additional data sections when they are required (e.g.
b4cebdb6ccde66a8f3e397a1b90b0cf788519d69Automatic Updater delegations, negative responses). This may improve the
6c910bd5e4a85a56e3a61fdf7b237a45bb2553eeTinderbox User performance of the server.
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User The default is <strong class="userinput"><code>no</code></strong>.
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox User<dt><span class="term"><span><strong class="command">multiple-cnames</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This option was used in <acronym class="acronym">BIND</acronym> 8 to allow
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User a domain name to have multiple CNAME records in violation of
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User the DNS standards. <acronym class="acronym">BIND</acronym> 9.2 onwards
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User always strictly enforces the CNAME rules both in master
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews files and dynamic updates.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">notify</strong></span></span></dt>
6c910bd5e4a85a56e3a61fdf7b237a45bb2553eeTinderbox User If <strong class="userinput"><code>yes</code></strong> (the default),
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater DNS NOTIFY messages are sent when a zone the server is
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater authoritative for
2bb3422dc683c013db7042f5736240de6b86f182Automatic Updater changes, see <a href="Bv9ARM.ch04.html#notify" title="Notify">the section called “Notify”</a>. The messages are
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater servers listed in the zone's NS records (except the master
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews server identified
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User in the SOA MNAME field), and to any servers listed in the
b4cebdb6ccde66a8f3e397a1b90b0cf788519d69Automatic Updater <span><strong class="command">also-notify</strong></span> option.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User If <strong class="userinput"><code>master-only</code></strong>, notifies are only
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater for master zones.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User If <strong class="userinput"><code>explicit</code></strong>, notifies are sent only
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater servers explicitly listed using <span><strong class="command">also-notify</strong></span>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User If <strong class="userinput"><code>no</code></strong>, no notifies are sent.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The <span><strong class="command">notify</strong></span> option may also be
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User specified in the <span><strong class="command">zone</strong></span>
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User in which case it overrides the <span><strong class="command">options notify</strong></span> statement.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater It would only be necessary to turn off this option if it
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User caused slaves
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">notify-to-soa</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <strong class="userinput"><code>yes</code></strong> do not check the nameservers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in the NS RRset against the SOA MNAME. Normally a NOTIFY
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater message is not sent to the SOA MNAME (SOA ORIGIN) as it is
1ac49378a458420bc685293d12e567d7222d17b6Tinderbox User supposed to contain the name of the ultimate master.
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User Sometimes, however, a slave is listed as the SOA MNAME in
681beefc668253b3e469a1de282fbc33a3752422Automatic Updater hidden master configurations and in that case you would
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User want the ultimate master to still send NOTIFY messages to
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User all the nameservers listed in the NS RRset.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">recursion</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User If <strong class="userinput"><code>yes</code></strong>, and a
b3386fba31414344f38f0c30849c056dceb22dceTinderbox User DNS query requests recursion, then the server will attempt
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User all the work required to answer the query. If recursion is
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater and the server does not already know the answer, it will
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater referral response. The default is
71bfd0968456cc0c69fd400d2dafd02977c649d2Tinderbox User <strong class="userinput"><code>yes</code></strong>.
83e281baf1b4149dc637d24dd41141129ae712c6Tinderbox User Note that setting <span><strong class="command">recursion no</strong></span> does not prevent
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater clients from getting data from the server's cache; it only
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User prevents new data from being cached as an effect of client
6c910bd5e4a85a56e3a61fdf7b237a45bb2553eeTinderbox User Caching may still occur as an effect the server's internal
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater operation, such as NOTIFY address lookups.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews See also <span><strong class="command">fetch-glue</strong></span> above.
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater<dt><span class="term"><span><strong class="command">rfc2308-type1</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Setting this to <strong class="userinput"><code>yes</code></strong> will
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User cause the server to send NS records along with the SOA
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User record for negative
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User answers. The default is <strong class="userinput"><code>no</code></strong>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews Not yet implemented in <acronym class="acronym">BIND</acronym>
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User<dt><span class="term"><span><strong class="command">use-id-pool</strong></span></span></dt>
ca5ba35827e475a824ec79d489dbcdb3341a35ccTinderbox User <span class="emphasis"><em>This option is obsolete</em></span>.
1fdd58445074579ee3b65c871137a7a1740eb542Mark Andrews <acronym class="acronym">BIND</acronym> 9 always allocates query
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User IDs from a pool.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews<dt><span class="term"><span><strong class="command">zone-statistics</strong></span></span></dt>
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User If <strong class="userinput"><code>yes</code></strong>, the server will collect
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User statistical data on all zones (unless specifically turned
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews on a per-zone basis by specifying <span><strong class="command">zone-statistics no</strong></span>
d3ba57ed92b7095fdeabc444af5dd18ac4781064Tinderbox User in the <span><strong class="command">zone</strong></span> statement).
6c910bd5e4a85a56e3a61fdf7b237a45bb2553eeTinderbox User The default is <strong class="userinput"><code>no</code></strong>.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews These statistics may be accessed
049728912c39135db248f9b48f8f26675f456e9dTinderbox User using <span><strong class="command">rndc stats</strong></span>, which will
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User dump them to the file listed
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User in the <span><strong class="command">statistics-file</strong></span>. See
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews also <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">use-ixfr</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span class="emphasis"><em>This option is obsolete</em></span>.
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User If you need to disable IXFR to a particular server or
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User the information on the <span><strong class="command">provide-ixfr</strong></span> option
be5e43393922d459eae5c8c467c0320d4a018666Tinderbox User in <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
78d7186253dfed549ec0ce2d7c2b08a7978ede9cAutomatic Updater Usage”</a>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <a href="Bv9ARM.ch04.html#incremental_zone_transfers" title="Incremental Zone Transfers (IXFR)">the section called “Incremental Zone Transfers (IXFR)”</a>.
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User<dt><span class="term"><span><strong class="command">provide-ixfr</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater See the description of
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">provide-ixfr</strong></span> in
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
90ff38a0d8deaf5f9c2aa5916d99b2e572d28738Automatic Updater Usage”</a>.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">request-ixfr</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater See the description of
c904ec617fe9e711c6743660a66b7dee1e213756Tinderbox User <span><strong class="command">request-ixfr</strong></span> in
c01dec514a81ecf8c17ca3ef8c3ba95e437295ebAutomatic Updater <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Usage”</a>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">treat-cr-as-space</strong></span></span></dt>
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User This option was used in <acronym class="acronym">BIND</acronym>
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox User the server treat carriage return ("<span><strong class="command">\r</strong></span>") characters the same way
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater as a space or tab character,
96713299d08c0735c18ebe8772dd2cc1ecd4356aAutomatic Updater to facilitate loading of zone files on a UNIX system that
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater were generated
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User on an NT or DOS machine. In <acronym class="acronym">BIND</acronym> 9, both UNIX "<span><strong class="command">\n</strong></span>"
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater and NT/DOS "<span><strong class="command">\r\n</strong></span>" newlines
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater are always accepted,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User and the option is ignored.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews<span class="term"><span><strong class="command">additional-from-auth</strong></span>, </span><span class="term"><span><strong class="command">additional-from-cache</strong></span></span>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews These options control the behavior of an authoritative
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User answering queries which have additional data, or when
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User following CNAME
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater and DNAME chains.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater When both of these options are set to <strong class="userinput"><code>yes</code></strong>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater (the default) and a
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User query is being answered from authoritative data (a zone
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater configured into the server), the additional data section of
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews reply will be filled in using data from other authoritative
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater and from the cache. In some situations this is undesirable,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater as when there is concern over the correctness of the cache,
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater in servers where slave zones may be added and modified by
0ead2ac0a4b59c3e4a731027f0f66fbe602b1289Tinderbox User untrusted third parties. Also, avoiding
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User the search for this additional data will speed up server
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater at the possible expense of additional queries to resolve
c904ec617fe9e711c6743660a66b7dee1e213756Tinderbox User otherwise be provided in the additional section.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater For example, if a query asks for an MX record for host <code class="literal">foo.example.com</code>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater and the record found is "<code class="literal">MX 10 mail.example.net</code>", normally the address
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater records (A and AAAA) for <code class="literal">mail.example.net</code> will be provided as well,
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User if known, even though they are not in the example.com zone.
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User Setting these options to <span><strong class="command">no</strong></span>
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson disables this behavior and makes
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User the server only search for additional data in the zone it
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews answers from.
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater These options are intended for use in authoritative-only
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater servers, or in authoritative-only views. Attempts to set
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews them to <span><strong class="command">no</strong></span> without also
c57668a2fbbe558c1bd21652813616f2f517c469Tinderbox User <span><strong class="command">recursion no</strong></span> will cause the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater ignore the options and log a warning message.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Specifying <span><strong class="command">additional-from-cache no</strong></span> actually
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater disables the use of the cache not only for additional data
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater but also when looking up the answer. This is usually the
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews behavior in an authoritative-only server where the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User correctness of
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the cached data is an issue.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User When a name server is non-recursively queried for a name
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User below the apex of any served zone, it normally answers with
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User "upwards referral" to the root servers or the servers of
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews known parent of the query name. Since the data in an
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater upwards referral
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User comes from the cache, the server will not be able to provide
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User referrals when <span><strong class="command">additional-from-cache no</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User has been specified. Instead, it will respond to such
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater with REFUSED. This should not cause any problems since
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User upwards referrals are not required for the resolution
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">match-mapped-addresses</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <strong class="userinput"><code>yes</code></strong>, then an
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater IPv4-mapped IPv6 address will match any address match
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater list entries that match the corresponding IPv4 address.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This option was introduced to work around a kernel quirk
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in some operating systems that causes IPv4 TCP
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater connections, such as zone transfers, to be accepted on an
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater IPv6 socket using mapped addresses. This caused address
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater match lists designed for IPv4 to fail to match. However,
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson <span><strong class="command">named</strong></span> now solves this problem
02973ab41430678c285ef7ae6d1183003469a3bcAutomatic Updater internally. The use of this option is discouraged.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews When <strong class="userinput"><code>yes</code></strong> and the server loads a new version of a master
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater zone from its zone file or receives a new version of a slave
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User file by a non-incremental zone transfer, it will compare
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the new version to the previous one and calculate a set
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews of differences. The differences are then logged in the
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User zone's journal file such that the changes can be transmitted
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater to downstream slaves as an incremental zone transfer.
e5fe07a7ebff18f7ed4ac434b37daff6c8ee5d5bAutomatic Updater By allowing incremental zone transfers to be used for
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater non-dynamic zones, this option saves bandwidth at the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater expense of increased CPU and memory consumption at the
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User In particular, if the new version of a zone is completely
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater different from the previous one, the set of differences
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater will be of a size comparable to the combined size of the
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews old and new zone version, and the server will need to
02973ab41430678c285ef7ae6d1183003469a3bcAutomatic Updater temporarily allocate memory to hold this complete
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson difference set.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<p><span><strong class="command">ixfr-from-differences</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User also accepts <span><strong class="command">master</strong></span> and
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews <span><strong class="command">slave</strong></span> at the view and options
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User levels which causes
6c910bd5e4a85a56e3a61fdf7b237a45bb2553eeTinderbox User <span><strong class="command">ixfr-from-differences</strong></span> to be enabled for
a900e4f99ff134b567b6df5ac2c841c7d0c551d3Automatic Updater all <span><strong class="command">master</strong></span> or
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">slave</strong></span> zones respectively.
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews It is off by default.
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews<dt><span class="term"><span><strong class="command">multi-master</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User This should be set when you have multiple masters for a zone
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User addresses refer to different machines. If <strong class="userinput"><code>yes</code></strong>, <span><strong class="command">named</strong></span> will
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater when the serial number on the master is less than what <span><strong class="command">named</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater has. The default is <strong class="userinput"><code>no</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">dnssec-enable</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Enable DNSSEC support in <span><strong class="command">named</strong></span>. Unless set to <strong class="userinput"><code>yes</code></strong>,
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater <span><strong class="command">named</strong></span> behaves as if it does not support DNSSEC.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <strong class="userinput"><code>yes</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">dnssec-validation</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Enable DNSSEC validation in <span><strong class="command">named</strong></span>.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
6c910bd5e4a85a56e3a61fdf7b237a45bb2553eeTinderbox User set to <strong class="userinput"><code>yes</code></strong> to be effective.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <strong class="userinput"><code>yes</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">dnssec-accept-expired</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Accept expired signatures when verifying DNSSEC signatures.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <strong class="userinput"><code>no</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Setting this option to "yes" leaves <span><strong class="command">named</strong></span> vulnerable to replay attacks.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">querylog</strong></span></span></dt>
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews Specify whether query logging should be started when <span><strong class="command">named</strong></span>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews If <span><strong class="command">querylog</strong></span> is not specified,
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews then the query logging
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews is determined by the presence of the logging category <span><strong class="command">queries</strong></span>.
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews<dt><span class="term"><span><strong class="command">check-names</strong></span></span></dt>
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews This option is used to restrict the character set and syntax
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews certain domain names in master files and/or DNS responses
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews from the network. The default varies according to usage
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews For <span><strong class="command">slave</strong></span> zones the default
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews is <span><strong class="command">warn</strong></span>.
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews For answers received from the network (<span><strong class="command">response</strong></span>)
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews the default is <span><strong class="command">ignore</strong></span>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews The rules for legal hostnames and mail domains are derived
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews from RFC 952 and RFC 821 as modified by RFC 1123.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<p><span><strong class="command">check-names</strong></span>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews applies to the owner names of A, AAAA and MX records.
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews It also applies to the domain names in the RDATA of NS, SOA,
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews MX, and SRV records.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews It also applies to the RDATA of PTR records where the owner
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews name indicated that it is a reverse lookup of a hostname
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT).
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><span><strong class="command">check-mx</strong></span></span></dt>
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews Check whether the MX record appears to refer to a IP address.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews The default is to <span><strong class="command">warn</strong></span>. Other possible
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews values are <span><strong class="command">fail</strong></span> and
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews <span><strong class="command">ignore</strong></span>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><span><strong class="command">check-wildcard</strong></span></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews This option is used to check for non-terminal wildcards.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews The use of non-terminal wildcards is almost always as a
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews result of a failure
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews to understand the wildcard matching algorithm (RFC 1034).
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews affects master zones. The default (<span><strong class="command">yes</strong></span>) is to check
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews for non-terminal wildcards and issue a warning.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">check-integrity</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Perform post load zone integrity checks on master
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User zones. This checks that MX and SRV records refer
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User to address (A or AAAA) records and that glue
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User address records exist for delegated zones. For
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater MX and SRV records only in-zone hostnames are
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater checked (for out-of-zone hostnames use
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater <span><strong class="command">named-checkzone</strong></span>).
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User For NS records only names below top of zone are
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User checked (for out-of-zone names and glue consistency
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User checks use <span><strong class="command">named-checkzone</strong></span>).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <span><strong class="command">yes</strong></span>.
cd6e9010079a4e58f7e30063df3dec0ff154ad59Tinderbox User<dt><span class="term"><span><strong class="command">check-mx-cname</strong></span></span></dt>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson If <span><strong class="command">check-integrity</strong></span> is set then
02973ab41430678c285ef7ae6d1183003469a3bcAutomatic Updater fail, warn or ignore MX records that refer
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson to CNAMES. The default is to <span><strong class="command">warn</strong></span>.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews<dt><span class="term"><span><strong class="command">check-srv-cname</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <span><strong class="command">check-integrity</strong></span> is set then
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User fail, warn or ignore SRV records that refer
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User to CNAMES. The default is to <span><strong class="command">warn</strong></span>.
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User<dt><span class="term"><span><strong class="command">check-sibling</strong></span></span></dt>
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User When performing integrity checks, also check that
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User sibling glue exists. The default is <span><strong class="command">yes</strong></span>.
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User<dt><span class="term"><span><strong class="command">zero-no-soa-ttl</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User When returning authoritative negative responses to
713c3d5b18463f2479973e4d14f73248e60a5df7Mark Andrews SOA queries set the TTL of the SOA record returned in
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the authority section to zero.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The default is <span><strong class="command">yes</strong></span>.
0a50626faa2f8941f55bf435d3965d490bb5d026Tinderbox User<dt><span class="term"><span><strong class="command">zero-no-soa-ttl-cache</strong></span></span></dt>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson When caching a negative response to a SOA query
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson set the TTL to zero.
992616aaf75643a0c9f84826f0a1ed5a27e84328Mark Andrews The default is <span><strong class="command">no</strong></span>.
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews<dt><span class="term"><span><strong class="command">update-check-ksk</strong></span></span></dt>
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews When regenerating the RRSIGs following a UPDATE
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews request to a secure zone, check the KSK flag on
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews the DNSKEY RR to determine if this key should be
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews used to generate the RRSIG. This flag is ignored
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User if there are not DNSKEY RRs both with and without
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The default is <span><strong class="command">yes</strong></span>.
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews<dt><span class="term"><span><strong class="command">try-tcp-refresh</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Try to refresh the zone using TCP if UDP queries fail.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User For BIND 8 compatibility, the default is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">yes</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">secure-to-insecure</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Allow a zone to transition from secure to insecure by
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User deleting all DNSKEY records. The default is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">no</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="id2582228"></a>Forwarding</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The forwarding facility can be used to create a large site-wide
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User cache on a few servers, reducing traffic over links to external
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User name servers. It can also be used to allow queries by servers that
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User do not have direct access to the Internet, but wish to look up
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User names anyway. Forwarding occurs only on those queries for which
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the server is not authoritative and does not have the answer in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">forward</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User This option is only meaningful if the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User forwarders list is not empty. A value of <code class="varname">first</code>,
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews the default, causes the server to query the forwarders
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User first — and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User if that doesn't answer the question, the server will then
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the answer itself. If <code class="varname">only</code> is
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews specified, the
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews server will only query the forwarders.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<dt><span class="term"><span><strong class="command">forwarders</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specifies the IP addresses to be used
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User for forwarding. The default is the empty list (no
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Forwarding can also be configured on a per-domain basis, allowing
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User for the global forwarding options to be overridden in a variety
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of ways. You can set particular domains to use different
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User or have a different <span><strong class="command">forward only/first</strong></span> behavior,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User or not forward at all, see <a href="Bv9ARM.ch06.html#zone_statement_grammar" title="zone
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Statement Grammar">the section called “<span><strong class="command">zone</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Statement Grammar”</a>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="id2582286"></a>Dual-stack Servers</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Dual-stack servers are used as servers of last resort to work
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User problems in reachability due the lack of support for either IPv4
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on the host machine.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">dual-stack-servers</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specifies host names or addresses of machines with access to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User both IPv4 and IPv6 transports. If a hostname is used, the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User server must be able
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to resolve the name using only the transport it has. If the
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater machine is dual
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User stacked, then the <span><strong class="command">dual-stack-servers</strong></span> have no effect unless
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User access to a transport has been disabled on the command line
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (e.g. <span><strong class="command">named -4</strong></span>).
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="access_control"></a>Access Control</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Access to the server can be restricted based on the IP address
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of the requesting system. See <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a> for
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User details on how to specify IP address lists.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specifies which hosts are allowed to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User notify this server, a slave, of zone changes in addition
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to the zone masters.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">allow-notify</strong></span> may also be
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User specified in the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">zone</strong></span> statement, in which case
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User it overrides the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">options allow-notify</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User statement. It is only meaningful
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews for a slave zone. If not specified, the default is to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User process notify messages
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User only from a zone's master.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<dt><span class="term"><span><strong class="command">allow-query</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specifies which hosts are allowed to ask ordinary
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User DNS questions. <span><strong class="command">allow-query</strong></span> may
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User also be specified in the <span><strong class="command">zone</strong></span>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews statement, in which case it overrides the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">options allow-query</strong></span> statement.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If not specified, the default is to allow queries
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User from all hosts.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">allow-query-cache</strong></span> is now
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User used to specify access to the cache.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">allow-query-on</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specifies which local addresses can accept ordinary
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User DNS questions. This makes it possible, for instance,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to allow queries on internal-facing interfaces but
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User disallow them on external-facing ones, without
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User necessarily knowing the internal network's addresses.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">allow-query-on</strong></span> may
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User also be specified in the <span><strong class="command">zone</strong></span>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews statement, in which case it overrides the
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews <span><strong class="command">options allow-query-on</strong></span> statement.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If not specified, the default is to allow queries
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater on all addresses.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">allow-query-cache</strong></span> is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User used to specify access to the cache.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<dt><span class="term"><span><strong class="command">allow-query-cache</strong></span></span></dt>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Specifies which hosts are allowed to get answers
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User from the cache. If <span><strong class="command">allow-query-cache</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is not set then <span><strong class="command">allow-recursion</strong></span>
3d2e052eb879189e6d853097f8b568d887323bebTinderbox User is used if set, otherwise <span><strong class="command">allow-query</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is used if set unless <span><strong class="command">recursion no;</strong></span> is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User set in which case <span><strong class="command">none;</strong></span> is used,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User otherwise the default (<span><strong class="command">localnets;</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">localhost;</strong></span>) is used.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">allow-query-cache-on</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specifies which local addresses can give answers
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User from the cache. If not specified, the default is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to allow cache queries on any address,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">localnets</strong></span> and
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews <span><strong class="command">localhost</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">allow-recursion</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specifies which hosts are allowed to make recursive
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User queries through this server. If
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews <span><strong class="command">allow-recursion</strong></span> is not set
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User then <span><strong class="command">allow-query-cache</strong></span> is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User used if set, otherwise <span><strong class="command">allow-query</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is used if set, otherwise the default
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (<span><strong class="command">localnets;</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">localhost;</strong></span>) is used.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">allow-recursion-on</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specifies which local addresses can accept recursive
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User queries. If not specified, the default is to allow
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User recursive queries on all addresses.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">allow-update</strong></span></span></dt>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Specifies which hosts are allowed to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User submit Dynamic DNS updates for master zones. The default is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User updates from all hosts. Note that allowing updates based
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on the requestor's IP address is insecure; see
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a> for details.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Specifies which hosts are allowed to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User submit Dynamic DNS updates to slave zones to be forwarded to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User master. The default is <strong class="userinput"><code>{ none; }</code></strong>,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User means that no update forwarding will be performed. To
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User update forwarding, specify
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <strong class="userinput"><code>allow-update-forwarding { any; };</code></strong>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specifying values other than <strong class="userinput"><code>{ none; }</code></strong> or
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <strong class="userinput"><code>{ any; }</code></strong> is usually
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User counterproductive, since
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the responsibility for update access control should rest
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User master server, not the slaves.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Note that enabling the update forwarding feature on a slave
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User may expose master servers relying on insecure IP address
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User access control to attacks; see <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User for more details.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">allow-v6-synthesis</strong></span></span></dt>
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews This option was introduced for the smooth transition from
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to A6 and from "nibble labels" to binary labels.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User However, since both A6 and binary labels were then
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User this option was also deprecated.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User It is now ignored with some warning messages.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews<dt><span class="term"><span><strong class="command">allow-transfer</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specifies which hosts are allowed to
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews receive zone transfers from the server. <span><strong class="command">allow-transfer</strong></span> may
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User also be specified in the <span><strong class="command">zone</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User statement, in which
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User case it overrides the <span><strong class="command">options allow-transfer</strong></span> statement.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If not specified, the default is to allow transfers to all
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">blackhole</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specifies a list of addresses that the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User server will not accept queries from or use to resolve a
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User query. Queries
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User from these addresses will not be responded to. The default
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is <strong class="userinput"><code>none</code></strong>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="id2582929"></a>Interfaces</h4></div></div></div>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews The interfaces and ports that the server will answer queries
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User an optional port and an <code class="varname">address_match_list</code>.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews The server will listen on all interfaces allowed by the address
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews match list. If a port is not specified, port 53 will be used.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Multiple <span><strong class="command">listen-on</strong></span> statements are
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<pre class="programlisting">listen-on { 5.6.7.8; };
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User will enable the name server on port 53 for the IP address
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User 5.6.7.8, and on port 1234 of an address on the machine in net
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User 1.2 that is not 1.2.3.4.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If no <span><strong class="command">listen-on</strong></span> is specified, the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User server will listen on port 53 on all IPv4 interfaces.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The <span><strong class="command">listen-on-v6</strong></span> option is used to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User specify the interfaces and the ports on which the server will
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews for incoming queries sent using IPv6.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User as the <code class="varname">address_match_list</code> for the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">listen-on-v6</strong></span> option,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the server does not bind a separate socket to each IPv6 interface
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User address as it does for IPv4 if the operating system has enough API
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews support for IPv6 (specifically if it conforms to RFC 3493 and RFC
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Instead, it listens on the IPv6 wildcard address.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If the system only has incomplete API support for IPv6, however,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the behavior is the same as that for IPv4.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User A list of particular IPv6 addresses can also be specified, in
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater the server listens on a separate socket for each specified
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User regardless of whether the desired API is supported by the system.
017d755d7a606dfb1e02a9d6e2b29e49e39fde16Tinderbox User Multiple <span><strong class="command">listen-on-v6</strong></span> options can
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews For example,
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater<pre class="programlisting">listen-on-v6 { any; };
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updaterlisten-on-v6 port 1234 { !2001:db8::/32; any; };
081a44bd3019b18aec03c5c0746538fdc901da48Evan Hunt will enable the name server on port 53 for any IPv6 addresses
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User (with a single wildcard socket),
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User and on port 1234 of IPv6 addresses that is not in the prefix
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User 2001:db8::/32 (with separate sockets for each matched address.)
200a9e7da827b67d99193bf793aea9f3e3fa1b43Tinderbox User To make the server not listen on any IPv6 address, use
af9dbf1ccdd53933aaae9300d13ce0965d39b067Evan Hunt<pre class="programlisting">listen-on-v6 { none; };
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User If no <span><strong class="command">listen-on-v6</strong></span> option is
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User specified, the server will not listen on any IPv6 address
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User unless <span><strong class="command">-6</strong></span> is specified when <span><strong class="command">named</strong></span> is
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater invoked. If <span><strong class="command">-6</strong></span> is specified then
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span><strong class="command">named</strong></span> will listen on port 53 on all IPv6 interfaces by default.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<div class="titlepage"><div><div><h4 class="title">
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<a name="query_address"></a>Query Address</h4></div></div></div>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User If the server doesn't know the answer to a question, it will
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User query other name servers. <span><strong class="command">query-source</strong></span> specifies
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User the address and port used for such queries. For queries sent over
b87da030df926d03cf53f299cc73b046cfd5e9fbTinderbox User IPv6, there is a separate <span><strong class="command">query-source-v6</strong></span> option.
5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User If <span><strong class="command">address</strong></span> is <span><strong class="command">*</strong></span> (asterisk) or is omitted,
5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User a wildcard IP address (<span><strong class="command">INADDR_ANY</strong></span>)
63d98873e29dee9608c27f40613cb69d130a56e7Mark Andrews will be used.
ca9a8f6d0b0f2a400a96f868193471510364336fMark Andrews If <span><strong class="command">port</strong></span> is <span><strong class="command">*</strong></span> or is omitted,
5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User a random port number from a pre-configured
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User range is picked up and will be used for each query.
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews The port range(s) is that specified in
5f33078b538b3d317917deb962bd057b2a888db1Tinderbox User the <span><strong class="command">use-v4-udp-ports</strong></span> (for IPv4)
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User and <span><strong class="command">use-v6-udp-ports</strong></span> (for IPv6)
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews options, excluding the ranges specified in
b8cc0c5d896c361525708a2be2e5af7df76c96d7Tinderbox User the <span><strong class="command">avoid-v4-udp-ports</strong></span>
5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User and <span><strong class="command">avoid-v6-udp-ports</strong></span> options, respectively.
<dt><span class="term"><span><strong class="command">queryport-pool-ports</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">queryport-pool-updateinterval</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
the load on the remote name server. <span><strong class="command">transfers-per-ns</strong></span> may
be overridden on a per-server basis by using the <span><strong class="command">transfers</strong></span> phrase
<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
See <a href="Bv9ARM.ch06.html#query_address" title="Query Address">the section called “Query Address”</a> about how the
to prevent <span><strong class="command">named</strong></span> from choosing as its random source port a
of <span><strong class="command">size_spec</strong></span> in <a href="Bv9ARM.ch06.html#configuration_file_elements" title="Configuration File Elements">the section called “Configuration File Elements”</a>.
(see <a href="Bv9ARM.ch04.html#journal" title="The journal file">the section called “The journal file”</a>). When the journal file
<dt><span class="term"><span><strong class="command">host-statistics-max</strong></span></span></dt>
interfaces <span><strong class="command">named</strong></span> listens on, <span><strong class="command">tcp-clients</strong></span> as well as
<dt><span class="term"><span><strong class="command">statistics-interval</strong></span></span></dt>
topologically closest to itself. The <span><strong class="command">topology</strong></span> statement
<a name="the_sortlist_statement"></a>The <span><strong class="command">sortlist</strong></span> Statement</h4></div></div></div>
statement in <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>).
does (<a href="Bv9ARM.ch06.html#topology" title="Topology">the section called “Topology”</a>).
an IP prefix, an ACL name or a nested <span><strong class="command">address_match_list</strong></span>)
to the behavior of the address sort in <acronym class="acronym">BIND</acronym> 4.9.x. Responses sent
<a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a>.
If no name is specified, the default is "<span><strong class="command">*</strong></span>" (asterisk).
class IN type A name "host.example.com" order random;
<span><strong class="command">max-ncache-ttl</strong></span> is <code class="literal">10800</code> seconds (3 hours).
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
result of dynamic updates (<a href="Bv9ARM.ch04.html#dynamic_update" title="Dynamic Update">the section called “Dynamic Update”</a>) will expire. There
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
<a href="Bv9ARM.ch06.html#zonefile_format" title="Additional File Formats">the section called “Additional File Formats”</a>).
<a name="clients-per-query"></a><span class="term"><span><strong class="command">clients-per-query</strong></span>, </span><span class="term"><span><strong class="command">max-clients-per-query</strong></span></span>
before dropping additional clients. <span><strong class="command">named</strong></span> will attempt to
If the number of queries exceed this value, <span><strong class="command">named</strong></span> will
built-in view (see <a href="Bv9ARM.ch06.html#view_statement_grammar" title="view Statement Grammar">the section called “<span><strong class="command">view</strong></span> Statement Grammar”</a>) of
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
<span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
Specifying <span><strong class="command">server-id hostname;</strong></span> will cause <span><strong class="command">named</strong></span> to
The default <span><strong class="command">server-id</strong></span> is <span><strong class="command">none</strong></span>.
<dt><span class="term"><span><strong class="command">acache-cleaning-interval</strong></span></span></dt>
name (i.e., the CNAME alias or the substituted query name
for example, even if "example.com" is specified for
returned by an "example.com" server will be accepted.
For example, if you own a domain named "example.net" and
deny-answer-aliases { "example.net"; };
network look up an IPv4 address of "attacker.example.com",
internal web server "www.example.net" and the
it will be accepted since the owner name "www.example.net"
"example.net".
<a name="server_statement_grammar"></a><span><strong class="command">server</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">server</strong></span> <em class="replaceable"><code>ip_addr[/prefixlen]</code></em> {
[<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em> ; ]</span>]
[<span class="optional"> keys <em class="replaceable"><code>{ string ; [<span class="optional"> string ; [<span class="optional">...</span>]</span>] }</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> query-source [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
[<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
[<span class="optional"> query-source-v6 [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
[<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
[<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> queryport-pool-interval <em class="replaceable"><code>number</code></em>; </span>]
<a name="server_statement_definition_and_usage"></a><span><strong class="command">server</strong></span> Statement Definition and
value of <span><strong class="command">bogus</strong></span> is <span><strong class="command">no</strong></span>.
that is advertised by <span><strong class="command">named</strong></span> when querying the remote server.
The server supports two zone transfer methods. The first, <span><strong class="command">one-answer</strong></span>,
uses one DNS message per resource record transferred. <span><strong class="command">many-answers</strong></span> packs
as many resource records as possible into a message. <span><strong class="command">many-answers</strong></span> is
more efficient, but is only known to be understood by <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
<span><strong class="command">key_id</strong></span> defined by the <span><strong class="command">key</strong></span> statement,
to be used for transaction security (TSIG, <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
<a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<a name="statschannels"></a><span><strong class="command">statistics-channels</strong></span> Statement Grammar</h3></div></div></div>
<a name="id2587582"></a><span><strong class="command">statistics-channels</strong></span> Statement Definition and
address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
<a name="id2587737"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div>
<em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
[<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
<a name="id2587857"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition
DNSSEC security roots. DNSSEC is described in <a href="Bv9ARM.ch04.html#DNSSEC" title="DNSSEC">the section called “DNSSEC”</a>. A security root is defined when the
<a name="id2587904"></a><span><strong class="command">managed-keys</strong></span> Statement Grammar</h3></div></div></div>
<em class="replaceable"><code>string</code></em> initial-key <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
[<span class="optional"> <em class="replaceable"><code>string</code></em> initial-key <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
<a name="id2587955"></a><span><strong class="command">managed-keys</strong></span> Statement Definition
<a name="view_statement_grammar"></a><span><strong class="command">view</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">view</strong></span> <em class="replaceable"><code>view_name</code></em>
<a name="id2588172"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
// Provide a complete view of the example.com
zone "example.com" {
file "example-internal.db";
// Provide a restricted view of the example.com
zone "example.com" {
file "example-external.db";
<pre class="programlisting"><span><strong class="command">zone</strong></span> <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-policy <em class="replaceable"><code>local</code></em> | { <em class="replaceable"><code>update_policy_rule</code></em> [<span class="optional">...</span>] }; </span>]
[<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
[<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-mx (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
[<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> secure-to-insecure <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
[<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>] // Not Implemented.
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
<a name="id2589860"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div>
status of infrastructure zones (e.g. COM,
See caveats in <a href="Bv9ARM.ch06.html#root_delegation_only"><span><strong class="command">root-delegation-only</strong></span></a>.
a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>),
in the mid-1970s. Zone data for it can be specified with the <code class="literal">CHAOS</code> class.
<span><strong class="command">allow-notify</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query-on</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>.
<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
network. The default varies according to zone type. For <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>. For <span><strong class="command">slave</strong></span>
<span><strong class="command">check-mx</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-wildcard</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-integrity</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-sibling</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">zero-no-soa-ttl</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">update-check-ksk</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">try-tcp-refresh</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">dialup</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
See caveats in <a href="Bv9ARM.ch06.html#root_delegation_only"><span><strong class="command">root-delegation-only</strong></span></a>.
after trying the forwarders and getting no answer, while <span><strong class="command">first</strong></span> would
This is applicable to <span><strong class="command">master</strong></span> and <span><strong class="command">slave</strong></span> zones.
<span><strong class="command">max-journal-size</strong></span> in <a href="Bv9ARM.ch06.html#server_resource_limits" title="Server Resource Limits">the section called “Server Resource Limits”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
<span><strong class="command">max-transfer-time-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
<span><strong class="command">max-transfer-time-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">notify-delay</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
zones when they are loaded from disk. <acronym class="acronym">BIND</acronym> 9 does not verify signatures
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
<span><strong class="command">sig-validity-interval</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-nodes</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span><strong class="command">sig-signing-signatures</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-type</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
<span><strong class="command">alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
<span><strong class="command">alt-transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
<span><strong class="command">use-alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
See the description in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
<span><strong class="command">ixfr-from-differences</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">key-directory</strong></span> in <a href="Bv9ARM.ch06.html#options" title="options Statement Definition and
Usage">the section called “<span><strong class="command">options</strong></span> Statement Definition and
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">secure-to-insecure</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
( <span><strong class="command">grant</strong></span> | <span><strong class="command">deny</strong></span> ) <em class="replaceable"><code>identity</code></em> <em class="replaceable"><code>nametype</code></em> [<span class="optional"> <em class="replaceable"><code>name</code></em> </span>] [<span class="optional"> <em class="replaceable"><code>types</code></em> </span>]
<a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div>
that a particular nearby server be tried first. See <a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a> and <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>.
built-in server information zones, e.g.,
any order), and if neither of those succeed, delivery to <code class="literal">mail.backup.org</code> will
and PTR records. Entries in the in-addr.arpa domain are made in
in-addr.arpa name of
3.2.1.10.in-addr.arpa. This name should have a PTR resource record
Master File Directives include <span><strong class="command">$ORIGIN</strong></span>, <span><strong class="command">$INCLUDE</strong></span>,
<a name="id2595511"></a>The <span><strong class="command">@</strong></span> (at-sign)</h4></div></div></div>
<a name="id2595527"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div>
$ORIGIN example.com.
<a name="id2595588"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div>
if it were included into the file at this point. If <span><strong class="command">origin</strong></span> is
revert to the values they had prior to the <span><strong class="command">$INCLUDE</strong></span> once
<a name="id2595657"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div>
<a name="id2595693"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div>
Classless IN-ADDR.ARPA delegation.
HOST-1.EXAMPLE. MX 0 .
HOST-2.EXAMPLE. A 1.2.3.2
HOST-2.EXAMPLE. MX 0 .
HOST-3.EXAMPLE. A 1.2.3.3
HOST-3.EXAMPLE. MX 0 .
HOST-127.EXAMPLE. A 1.2.3.127
HOST-127.EXAMPLE. MX 0 .
(<span><strong class="command">n</strong></span> or <span><strong class="command">N</strong></span>\
The <span><strong class="command">$GENERATE</strong></span> directive is a <acronym class="acronym">BIND</acronym> extension
(see <a href="Bv9ARM.ch06.html#statschannels" title="statistics-channels Statement Grammar">the section called “<span><strong class="command">statistics-channels</strong></span> Statement Grammar”</a>.)
<a href="Bv9ARM.ch06.html#clients-per-query"><span><strong class="command">clients-per-query</strong></span></a>.)
<a name="id2600240"></a>Compatibility with <span class="emphasis"><em>BIND</em></span> 8 Counters</h4></div></div></div>
<td width="40%" align="left" valign="top">Chapter�5.�The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver�</td>