Bv9ARM.ch06.html revision e2e4d321999340802f77adaacd19c797d04b4b95
59602f2a7c4e4809941583bed3e94cd26e628f1aTinderbox User - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater - Copyright (C) 2000-2003 Internet Software Consortium.
19558a04decde0e7261d489d92d04ad88104217bTinderbox User - Permission to use, copy, modify, and/or distribute this software for any
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews - purpose with or without fee is hereby granted, provided that the above
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews - copyright notice and this permission notice appear in all copies.
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
f4ee48be3994797a8332b86c101db4d7b54799ceTinderbox User - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
8de3f14f1c300c3e1ed99084cc03485b42c92bf1Tinderbox User - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User - PERFORMANCE OF THIS SOFTWARE.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<!-- $Id: Bv9ARM.ch06.html,v 1.249 2009/12/04 22:22:26 tbox Exp $ -->
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
d5637bdbb931ff79fced3d4858d83212ea58ed15Tinderbox User<title>Chapter�6.�BIND 9 Configuration Reference</title>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
d5637bdbb931ff79fced3d4858d83212ea58ed15Tinderbox User<link rel="prev" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="next" href="Bv9ARM.ch07.html" title="Chapter�7.�BIND 9 Security Considerations">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<table width="100%" summary="Navigation header">
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt<tr><th colspan="3" align="center">Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</th></tr>
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews<a accesskey="p" href="Bv9ARM.ch05.html">Prev</a>�</td>
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch07.html">Next</a>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<div class="titlepage"><div><div><h2 class="title">
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User<a name="Bv9ARM.ch06"></a>Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</h2></div></div></div>
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573997">Comment Syntax</a></span></dt>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt>
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574515"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574773"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575132"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
cdfc81e048bd34c1d628380247bda6b80a89e20eAutomatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575149"><span><strong class="command">include</strong></span> Statement Definition and
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575173"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575196"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575287"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575413"><span><strong class="command">logging</strong></span> Statement Definition and
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577480"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577554"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577686"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577730"><span><strong class="command">masters</strong></span> Statement Definition and
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577745"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#statschannels"><span><strong class="command">statistics-channels</strong></span> Statement Grammar</a></span></dt>
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2588103"><span><strong class="command">statistics-channels</strong></span> Statement Definition and
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2588326"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2588377"><span><strong class="command">trusted-keys</strong></span> Statement Definition
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2588424"><span><strong class="command">managed-keys</strong></span> Statement Grammar</a></span></dt>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2588475"><span><strong class="command">managed-keys</strong></span> Statement Definition
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2588848"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
7cc0a5d21ef046bfd630c4769943d896a7d7472cTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590421"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2593225">Zone File</a></span></dt>
549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2595387">Discussion of MX Records</a></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt>
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2596003">Inverse Mapping in IPv4</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2596130">Other Zone File Directives</a></span></dt>
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2596403"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt>
aef6cf0f147a5014d4891c9689b9f463399e16e7Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch06.html#statistics">BIND9 Statistics</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch06.html#statistics_counters">Statistics Counters</a></span></dt></dl></dd>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <acronym class="acronym">BIND</acronym> 9 configuration is broadly similar
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt to <acronym class="acronym">BIND</acronym> 8; however, there are a few new
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User of configuration, such as views. <acronym class="acronym">BIND</acronym>
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews 8 configuration files should work with few alterations in <acronym class="acronym">BIND</acronym>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews 9, although more complex configurations should be reviewed to check
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt if they can be more efficiently implemented using the new features
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews found in <acronym class="acronym">BIND</acronym> 9.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <acronym class="acronym">BIND</acronym> 4 configuration files can be
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews converted to the new format
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt using the shell script
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <code class="filename">contrib/named-bootconf/named-bootconf.sh</code>.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<a name="configuration_file_elements"></a>Configuration File Elements</h2></div></div></div>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Following is a list of elements used throughout the <acronym class="acronym">BIND</acronym> configuration
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews file documentation:
5747235bf35e7398984fd6b4632743396895ea7aTinderbox User The name of an <code class="varname">address_match_list</code> as
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews defined by the <span><strong class="command">acl</strong></span> statement.
5747235bf35e7398984fd6b4632743396895ea7aTinderbox User <code class="varname">address_match_list</code>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews A list of one or more
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User <code class="varname">ip_prefix</code>, <code class="varname">key_id</code>,
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews or <code class="varname">acl_name</code> elements, see
01a5c5503482fb3ba52088bf0178a7213273bf96Mark Andrews <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a>.
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt A named list of one or more <code class="varname">ip_addr</code>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews with optional <code class="varname">key_id</code> and/or
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User A <code class="varname">masters_list</code> may include other
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User A quoted string which will be used as
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews a DNS name, for example "<code class="literal">my.test.domain</code>".
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews A list of one or more <code class="varname">domain_name</code>
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt One to four integers valued 0 through
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews 255 separated by dots (`.'), such as <span><strong class="command">123</strong></span>,
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User <span><strong class="command">45.67</strong></span> or <span><strong class="command">89.123.45.67</strong></span>.
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater An IPv4 address with exactly four elements
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in <code class="varname">dotted_decimal</code> notation.
b02be031b9ff37b042adc8e68e36b8bbc1f672b7Tinderbox User An IPv6 address, such as <span><strong class="command">2001:db8::1234</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater IPv6 scoped addresses that have ambiguity on their
ba8b771c371967dd1254c7fa82ebe4158ee04b24Tinderbox User scope zones must be disambiguated by an appropriate
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater zone ID with the percent character (`%') as
3ec8f7777ea2b04fc1ebb63077f0916f63b1011aTinderbox User delimiter. It is strongly recommended to use
c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User string zone names rather than numeric identifiers,
b02be031b9ff37b042adc8e68e36b8bbc1f672b7Tinderbox User in order to be robust against system configuration
933799f3641f4f78445d015008bad0038900a82aTinderbox User changes. However, since there is no standard
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater mapping for such names and identifier values,
19b3dc94bce93fa76bd7e066f9298630dbc9dcb4Automatic Updater currently only interface names as link identifiers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater are supported, assuming one-to-one mapping between
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater interfaces and links. For example, a link-local
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews address <span><strong class="command">fe80::1</strong></span> on the link
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater attached to the interface <span><strong class="command">ne0</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater can be specified as <span><strong class="command">fe80::1%ne0</strong></span>.
bac4435d473c9a0281507524f084480c34aa942aTinderbox User Note that on most systems link-local addresses
39ae0eafed076ef769fef5c18b22a8051df5c93aTinderbox User always have the ambiguity, and need to be
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews disambiguated.
c26604a73c4ce907ef6392f38b3fac838b1873a9Tinderbox User An <code class="varname">ip4_addr</code> or <code class="varname">ip6_addr</code>.
7f9e2fff07b9c17e0d7a0ea7abc9304ce9d01b61Tinderbox User An IP port <code class="varname">number</code>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <code class="varname">number</code> is limited to 0
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User through 65535, with values
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews below 1024 typically restricted to use by processes running
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User In some cases, an asterisk (`*') character can be used as a
757ff043760e4743dda1a10e7d58349275934902Tinderbox User placeholder to
a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User select a random high-numbered port.
ba8b771c371967dd1254c7fa82ebe4158ee04b24Tinderbox User An IP network specified as an <code class="varname">ip_addr</code>,
a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User followed by a slash (`/') and then the number of bits in the
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User Trailing zeros in a <code class="varname">ip_addr</code>
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User For example, <span><strong class="command">127/8</strong></span> is the
3857cb6fcabeb79d85de4b3e3e4ab99912b701f8Mark Andrews network <span><strong class="command">127.0.0.0</strong></span> with
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User netmask <span><strong class="command">255.0.0.0</strong></span> and <span><strong class="command">1.2.3.0/28</strong></span> is
e64202536ea72d8f371dd0df9fc763f8d70bf886Tinderbox User network <span><strong class="command">1.2.3.0</strong></span> with netmask <span><strong class="command">255.255.255.240</strong></span>.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson When specifying a prefix involving a IPv6 scoped address
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User the scope may be omitted. In that case the prefix will
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews match packets from any scope.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews A <code class="varname">domain_name</code> representing
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews the name of a shared key, to be used for transaction
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews A list of one or more
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews separated by semicolons and ending with a semicolon.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews A non-negative 32-bit integer
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews (i.e., a number between 0 and 4294967295, inclusive).
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt Its acceptable value might further
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews be limited by the context in which it is used.
168cf0ede1cf13a095e48af6749d88fbc432f096Evan Hunt A quoted string which will be used as
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews a pathname, such as <code class="filename">zones/master/my.test.domain</code>.
168cf0ede1cf13a095e48af6749d88fbc432f096Evan Hunt A list of an <code class="varname">ip_port</code> or a port
168cf0ede1cf13a095e48af6749d88fbc432f096Evan Hunt A port range is specified in the form of
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <strong class="userinput"><code>range</code></strong> followed by
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <code class="varname">port_high</code>, which represents
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews port numbers from <code class="varname">port_low</code> through
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <code class="varname">port_high</code>, inclusive.
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <code class="varname">port_low</code> must not be larger than
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews For example,
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <strong class="userinput"><code>range 1024 65535</code></strong> represents
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews ports from 1024 through 65535.
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews In either case an asterisk (`*') character is not
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews allowed as a valid <code class="varname">ip_port</code>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews A number, the word <strong class="userinput"><code>unlimited</code></strong>,
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont or the word <strong class="userinput"><code>default</code></strong>.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson An <code class="varname">unlimited</code> <code class="varname">size_spec</code> requests unlimited
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews use, or the maximum available amount. A <code class="varname">default size_spec</code> uses
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews the limit that was in force when the server was started.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews A <code class="varname">number</code> can optionally be
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews followed by a scaling factor:
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <strong class="userinput"><code>K</code></strong> or <strong class="userinput"><code>k</code></strong>
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt for kilobytes,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <strong class="userinput"><code>M</code></strong> or <strong class="userinput"><code>m</code></strong>
3a988722ad9e209ba4064604d482dc4efe0e19ebTinderbox User for megabytes, and
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>G</code></strong> or <strong class="userinput"><code>g</code></strong> for gigabytes,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington which scale by 1024, 1024*1024, and 1024*1024*1024
a3ffa9ab0644ae2b52f2e13a00b5e85b879f612fTinderbox User respectively.
1bf507ca635310b340aea42d6c3e567819974a99Tinderbox User The value must be representable as a 64-bit unsigned integer
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews (0 to 18446744073709551615, inclusive).
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Using <code class="varname">unlimited</code> is the best
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews to safely set a really large number.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont Either <strong class="userinput"><code>yes</code></strong> or <strong class="userinput"><code>no</code></strong>.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont The words <strong class="userinput"><code>true</code></strong> and <strong class="userinput"><code>false</code></strong> are
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews also accepted, as are the numbers <strong class="userinput"><code>1</code></strong>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington and <strong class="userinput"><code>0</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington One of <strong class="userinput"><code>yes</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>no</code></strong>, <strong class="userinput"><code>notify</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>notify-passive</code></strong>, <strong class="userinput"><code>refresh</code></strong> or
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>passive</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington When used in a zone, <strong class="userinput"><code>notify-passive</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>refresh</code></strong>, and <strong class="userinput"><code>passive</code></strong>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington are restricted to slave and stub zones.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h3 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="address_match_lists"></a>Address Match Lists</h3></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573627"></a>Syntax</h4></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ;
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> address_match_list_element; ... </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] |
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington key key_id | acl_name | { address_match_list } )
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573655"></a>Definition and Usage</h4></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Address match lists are primarily used to determine access
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington control for various server operations. They are also used in
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the <span><strong class="command">listen-on</strong></span> and <span><strong class="command">sortlist</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington statements. The elements which constitute an address match
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington list can be any of the following:
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews a key ID, as defined by the <span><strong class="command">key</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<li>the name of an address match list defined with
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews the <span><strong class="command">acl</strong></span> statement
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<li>a nested address match list enclosed in braces</li>
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater Elements can be negated with a leading exclamation mark (`!'),
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater and the match list names "any", "none", "localhost", and
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater "localnets" are predefined. More information on those names
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater can be found in the description of the acl statement.
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater The addition of the key clause made the name of this syntactic
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater element something of a misnomer, since security keys can be used
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater to validate access without regard to a host or network address.
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater Nonetheless, the term "address match list" is still used
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater throughout the documentation.
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater When a given IP address or prefix is compared to an address
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews match list, the comparison takes place in approximately O(1)
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User time. However, key comparisons require that the list of keys
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User be traversed until a matching key is found, and therefore may
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User be somewhat slower.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User The interpretation of a match depends on whether the list is being
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User used for access control, defining <span><strong class="command">listen-on</strong></span> ports, or in a
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <span><strong class="command">sortlist</strong></span>, and whether the element was negated.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews When used as an access control list, a non-negated match
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User allows access and a negated match denies access. If
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont there is no match, access is denied. The clauses
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews <span><strong class="command">allow-notify</strong></span>,
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <span><strong class="command">allow-recursion</strong></span>,
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <span><strong class="command">allow-recursion-on</strong></span>,
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <span><strong class="command">allow-query</strong></span>,
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <span><strong class="command">allow-query-on</strong></span>,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span><strong class="command">allow-query-cache</strong></span>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">allow-query-cache-on</strong></span>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">allow-transfer</strong></span>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">allow-update</strong></span>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">allow-update-forwarding</strong></span>, and
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <span><strong class="command">blackhole</strong></span> all use address match
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt lists. Similarly, the <span><strong class="command">listen-on</strong></span> option will cause the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews server to refuse queries on any of the machine's
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont addresses which do not match the list.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont Order of insertion is significant. If more than one element
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont in an ACL is found to match a given IP address or prefix,
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont preference will be given to the one that came
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont <span class="emphasis"><em>first</em></span> in the ACL definition.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Because of this first-match behavior, an element that
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews defines a subset of another element in the list should
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews come before the broader element, regardless of whether
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews either is negated. For example, in
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">1.2.3/24; ! 1.2.3.13;</strong></span>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews the 1.2.3.13 element is completely useless because the
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt algorithm will match any lookup for 1.2.3.13 to the 1.2.3/24
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews element. Using <span><strong class="command">! 1.2.3.13; 1.2.3/24</strong></span> fixes
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User that problem by having 1.2.3.13 blocked by the negation, but
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont all other 1.2.3.* hosts fall through.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<div class="titlepage"><div><div><h3 class="title">
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<a name="id2573997"></a>Comment Syntax</h3></div></div></div>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington comments to appear
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington file. To appeal to programmers of all kinds, they can be written
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2574012"></a>Syntax</h4></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting">// This is a <acronym class="acronym">BIND</acronym> comment as in C++</pre>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting"># This is a <acronym class="acronym">BIND</acronym> comment as in common UNIX shells
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington# and perl</pre>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<div class="titlepage"><div><div><h4 class="title">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<a name="id2574042"></a>Definition and Usage</h4></div></div></div>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Comments may appear anywhere that whitespace may appear in
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews a <acronym class="acronym">BIND</acronym> configuration file.
33d1cff1dd63494ffa00fac695a793f00c4ebf0bTinderbox User C-style comments start with the two characters /* (slash,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews star) and end with */ (star, slash). Because they are completely
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews delimited with these characters, they can be used to comment only
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews a portion of a line or to span multiple lines.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews C-style comments cannot be nested. For example, the following
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt is not valid because the entire comment ends with the first */:
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<pre class="programlisting">/* This is the start of a comment.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington This is still part of the comment.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews/* This is an incorrect attempt at nesting a comment. */
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews This is no longer in any comment. */
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington C++-style comments start with the two characters // (slash,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington slash) and continue to the end of the physical line. They cannot
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington be continued across multiple physical lines; to have one logical
b7aab05edae933e169d5f83c653935b17c7f0a8bMark Andrews comment span multiple lines, each line must use the // pair.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting">// This is the start of a comment. The next line
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington// is a new comment, even though it is logically
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews// part of the previous comment.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Shell-style (or perl-style, if you prefer) comments start
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews with the character <code class="literal">#</code> (number sign)
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews and continue to the end of the
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt physical line, as in C++ comments.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews For example:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting"># This is the start of a comment. The next line
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington# is a new comment, even though it is logically
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington# part of the previous comment.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont You cannot use the semicolon (`;') character
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to start a comment such as you would in a zone file. The
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater semicolon indicates the end of a configuration
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<div class="titlepage"><div><div><h2 class="title" style="clear: both">
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<a name="Configuration_File_Grammar"></a>Configuration File Grammar</h2></div></div></div>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews A <acronym class="acronym">BIND</acronym> 9 configuration consists of
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont statements and comments.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont Statements end with a semicolon. Statements and comments are the
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont only elements that can appear without enclosing braces. Many
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont statements contain a block of sub-statements, which are also
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont terminated with a semicolon.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont The following statements are supported:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="informaltable"><table border="1">
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews <p><span><strong class="command">acl</strong></span></p>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington defines a named IP address
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington matching list, for access control and other uses.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <p><span><strong class="command">controls</strong></span></p>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews declares control channels to be used
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews by the <span><strong class="command">rndc</strong></span> utility.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <p><span><strong class="command">include</strong></span></p>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews includes a file.
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt <p><span><strong class="command">key</strong></span></p>
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User specifies key information for use in
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont authentication and authorization using TSIG.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <p><span><strong class="command">logging</strong></span></p>
1fdd58445074579ee3b65c871137a7a1740eb542Mark Andrews specifies what the server logs, and where
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the log messages are sent.
ec8755f605d7dcb2de1076040e77bc2d7ec33b4aTinderbox User <p><span><strong class="command">lwres</strong></span></p>
532d27b39244fadfcf8d8b4593f4c65434c9c664Automatic Updater configures <span><strong class="command">named</strong></span> to
532d27b39244fadfcf8d8b4593f4c65434c9c664Automatic Updater also act as a light-weight resolver daemon (<span><strong class="command">lwresd</strong></span>).
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User <p><span><strong class="command">masters</strong></span></p>
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews defines a named masters list for
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews inclusion in stub and slave zone masters clauses.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews <p><span><strong class="command">options</strong></span></p>
93089a352d6903b0d7845a039de4ec2df9a0e35aTinderbox User controls global server configuration
861836e5f5df62bfaea9ad8923a05278d5ab2f3dTinderbox User options and sets defaults for other statements.
665ba746c0585088d0c314dcfc4671aa2c7b2dc1Automatic Updater <p><span><strong class="command">server</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater sets certain configuration options on
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater a per-server basis.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">statistics-channels</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater declares communication channels to get access to
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <span><strong class="command">named</strong></span> statistics.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">trusted-keys</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater defines trusted DNSSEC keys.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">managed-keys</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater lists DNSSEC keys to be kept up to date
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater using RFC 5011 trust anchor maintenance.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">view</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater defines a view.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <p><span><strong class="command">zone</strong></span></p>
bf8c3776f1bf1a1270e5e0443ae5a8df022632a8Mark Andrews defines a zone.
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater The <span><strong class="command">logging</strong></span> and
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater <span><strong class="command">options</strong></span> statements may only occur once
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User configuration.
4ea3649f028ea6a1e42377082a7ccf8f789fb950Automatic Updater<div class="titlepage"><div><div><h3 class="title">
40072ce70bc4125329addb4aaa56d18a1230bc17Automatic Updater<a name="id2574515"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div>
60d5d17479b47c03b9c7c86f54269718103750b8Automatic Updater<pre class="programlisting"><span><strong class="command">acl</strong></span> acl-name {
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater address_match_list
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater<div class="titlepage"><div><div><h3 class="title">
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater<a name="acl"></a><span><strong class="command">acl</strong></span> Statement Definition and
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater The <span><strong class="command">acl</strong></span> statement assigns a symbolic
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater name to an address match list. It gets its name from a primary
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater use of address match lists: Access Control Lists (ACLs).
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater Note that an address match list's name must be defined
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater with <span><strong class="command">acl</strong></span> before it can be used
19dbf2e20df03f2b81ed1f347e27718084374059Automatic Updater elsewhere; no forward references are allowed.
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater The following ACLs are built-in:
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater<div class="informaltable"><table border="1">
7f9e2fff07b9c17e0d7a0ea7abc9304ce9d01b61Tinderbox User <p><span><strong class="command">any</strong></span></p>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont Matches all hosts.
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington <p><span><strong class="command">none</strong></span></p>
01f91b9cd440833f66e7476e43659655cb52ad10Automatic Updater Matches no hosts.
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews <p><span><strong class="command">localhost</strong></span></p>
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews Matches the IPv4 and IPv6 addresses of all network
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews interfaces on the system.
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User <p><span><strong class="command">localnets</strong></span></p>
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews Matches any host on an IPv4 or IPv6 network
bac4435d473c9a0281507524f084480c34aa942aTinderbox User for which the system has an interface.
54890cfd30f01bdd33b7fb997f9b89fb084c3438Tinderbox User Some systems do not provide a way to determine the prefix
a8677ecad546c955406b341eb8344ed06768b11eTinderbox User local IPv6 addresses.
11b6b0d74bb8dd6bd1ce0b60ba7f9b66323f06d4Tinderbox User In such a case, <span><strong class="command">localnets</strong></span>
11b6b0d74bb8dd6bd1ce0b60ba7f9b66323f06d4Tinderbox User only matches the local
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews IPv6 addresses, just like <span><strong class="command">localhost</strong></span>.
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews<div class="titlepage"><div><div><h3 class="title">
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews<a name="id2574773"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div>
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews<pre class="programlisting"><span><strong class="command">controls</strong></span> {
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews [ inet ( ip_addr | * ) [ port ip_port ]
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews allow { <em class="replaceable"><code> address_match_list </code></em> }
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews keys { <em class="replaceable"><code>key_list</code></em> }; ]
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User [ inet ...; ]
789875a1bd6d50c00d3bd883cad17ead1d3c21cdMark Andrews [ unix <em class="replaceable"><code>path</code></em> perm <em class="replaceable"><code>number</code></em> owner <em class="replaceable"><code>number</code></em> group <em class="replaceable"><code>number</code></em>
789875a1bd6d50c00d3bd883cad17ead1d3c21cdMark Andrews keys { <em class="replaceable"><code>key_list</code></em> }; ]
789875a1bd6d50c00d3bd883cad17ead1d3c21cdMark Andrews [ unix ...; ]
08a1e53c738c425390557196a2ba5039e5afd364Mark Andrews<div class="titlepage"><div><div><h3 class="title">
1efe84be7849c5327001ad7dbad93d92c66c1389Mark Andrews<a name="controls_statement_definition_and_usage"></a><span><strong class="command">controls</strong></span> Statement Definition and
7e8129652903780873ba91f379f9ffca1f59773cMark Andrews The <span><strong class="command">controls</strong></span> statement declares control
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews channels to be used by system administrators to control the
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews operation of the name server. These control channels are
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews used by the <span><strong class="command">rndc</strong></span> utility to send
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews commands to and retrieve non-DNS results from a name server.
1efe84be7849c5327001ad7dbad93d92c66c1389Mark Andrews An <span><strong class="command">inet</strong></span> control channel is a TCP socket
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews listening at the specified <span><strong class="command">ip_port</strong></span> on the
1efe84be7849c5327001ad7dbad93d92c66c1389Mark Andrews specified <span><strong class="command">ip_addr</strong></span>, which can be an IPv4 or IPv6
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews interpreted as the IPv4 wildcard address; connections will be
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews accepted on any of the system's IPv4 addresses.
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews To listen on the IPv6 wildcard address,
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews use an <span><strong class="command">ip_addr</strong></span> of <code class="literal">::</code>.
f6ba5791728d244650c1887d8dd8ed771fd50a1dMark Andrews If you will only use <span><strong class="command">rndc</strong></span> on the local host,
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews using the loopback address (<code class="literal">127.0.0.1</code>
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews or <code class="literal">::1</code>) is recommended for maximum security.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt If no port is specified, port 953 is used. The asterisk
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt "<code class="literal">*</code>" cannot be used for <span><strong class="command">ip_port</strong></span>.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt The ability to issue commands over the control channel is
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt restricted by the <span><strong class="command">allow</strong></span> and
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt <span><strong class="command">keys</strong></span> clauses.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt Connections to the control channel are permitted based on the
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User <span><strong class="command">address_match_list</strong></span>. This is for simple
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User IP address based filtering only; any <span><strong class="command">key_id</strong></span>
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt elements of the <span><strong class="command">address_match_list</strong></span>
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt are ignored.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater A <span><strong class="command">unix</strong></span> control channel is a UNIX domain
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater socket listening at the specified path in the file system.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Access to the socket is specified by the <span><strong class="command">perm</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">owner</strong></span> and <span><strong class="command">group</strong></span> clauses.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Note on some platforms (SunOS and Solaris) the permissions
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater (<span><strong class="command">perm</strong></span>) are applied to the parent directory
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater as the permissions on the socket itself are ignored.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The primary authorization mechanism of the command
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater channel is the <span><strong class="command">key_list</strong></span>, which
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater contains a list of <span><strong class="command">key_id</strong></span>s.
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews Each <span><strong class="command">key_id</strong></span> in the <span><strong class="command">key_list</strong></span>
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews is authorized to execute commands over the control channel.
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews See <a href="Bv9ARM.ch03.html#rndc">Remote Name Daemon Control application</a> in <a href="Bv9ARM.ch03.html#admin_tools" title="Administrative Tools">the section called “Administrative Tools”</a>)
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews for information about configuring keys in <span><strong class="command">rndc</strong></span>.
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews If no <span><strong class="command">controls</strong></span> statement is present,
9f8051ea406dc3d98bb205df82cfc4d668a25d6eTinderbox User <span><strong class="command">named</strong></span> will set up a default
8f3657636521817d2971ae29aa3fb66e33709753Mark Andrews control channel listening on the loopback address 127.0.0.1
8f3657636521817d2971ae29aa3fb66e33709753Mark Andrews and its IPv6 counterpart ::1.
66458d12f373fb75e8543d36fd76864a7567057bTinderbox User In this case, and also when the <span><strong class="command">controls</strong></span> statement
c19bf21885cdf78b52eee017dc1189a300657995Tinderbox User is present but does not have a <span><strong class="command">keys</strong></span> clause,
f525041ae26958385b697cf82a30f108577024b6Tinderbox User <span><strong class="command">named</strong></span> will attempt to load the command channel key
f525041ae26958385b697cf82a30f108577024b6Tinderbox User from the file <code class="filename">rndc.key</code> in
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User <code class="filename">/etc</code> (or whatever <code class="varname">sysconfdir</code>
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User was specified as when <acronym class="acronym">BIND</acronym> was built).
f525041ae26958385b697cf82a30f108577024b6Tinderbox User To create a <code class="filename">rndc.key</code> file, run
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <strong class="userinput"><code>rndc-confgen -a</code></strong>.
c78c39caab4cf8b5daefc9c65878f7f5ed3eb7a0Tinderbox User The <code class="filename">rndc.key</code> feature was created to
8e86e8a779f37378fdb85a92c4ba77e394013729Tinderbox User ease the transition of systems from <acronym class="acronym">BIND</acronym> 8,
c19bf21885cdf78b52eee017dc1189a300657995Tinderbox User which did not have digital signatures on its command channel
9f8051ea406dc3d98bb205df82cfc4d668a25d6eTinderbox User messages and thus did not have a <span><strong class="command">keys</strong></span> clause.
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User It makes it possible to use an existing <acronym class="acronym">BIND</acronym> 8
ff62ab3c2e6274f19190ded15548c723d38bbbe3Automatic Updater configuration file in <acronym class="acronym">BIND</acronym> 9 unchanged,
ee23b913b6acccad68cf5af480b9e289a3d00510Tinderbox User and still have <span><strong class="command">rndc</strong></span> work the same way
ee23b913b6acccad68cf5af480b9e289a3d00510Tinderbox User <span><strong class="command">ndc</strong></span> worked in BIND 8, simply by executing the
9a5217f827ac0e006016745e5305b31dc0c7767fTinderbox User command <strong class="userinput"><code>rndc-confgen -a</code></strong> after BIND 9 is
ee23b913b6acccad68cf5af480b9e289a3d00510Tinderbox User Since the <code class="filename">rndc.key</code> feature
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User is only intended to allow the backward-compatible usage of
9e8ee4ffd77aa2974cecbdbb2b122156b8d3a27aTinderbox User <acronym class="acronym">BIND</acronym> 8 configuration files, this
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews feature does not
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User have a high degree of configurability. You cannot easily change
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User the key name or the size of the secret, so you should make a
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <code class="filename">rndc.conf</code> with your own key if you
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater wish to change
9dde9ce5558696850b6b9850a8475ae518409518Tinderbox User those things. The <code class="filename">rndc.key</code> file
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews also has its
21b353c36cb484d022a0df8cb39c602649a46ae6Tinderbox User permissions set such that only the owner of the file (the user that
21b353c36cb484d022a0df8cb39c602649a46ae6Tinderbox User <span><strong class="command">named</strong></span> is running as) can access it.
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews desire greater flexibility in allowing other users to access
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews <span><strong class="command">rndc</strong></span> commands, then you need to create
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews <code class="filename">rndc.conf</code> file and make it group
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews readable by a group
c0cc232ba92b92c1c5a48d49449ef56f7ca05b56Tinderbox User that contains the users who should have access.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews To disable the command channel, use an empty
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews <span><strong class="command">controls</strong></span> statement:
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews <span><strong class="command">controls { };</strong></span>.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews<div class="titlepage"><div><div><h3 class="title">
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews<a name="id2575132"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div>
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews<pre class="programlisting"><span><strong class="command">include</strong></span> <em class="replaceable"><code>filename</code></em>;</pre>
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews<div class="titlepage"><div><div><h3 class="title">
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews<a name="id2575149"></a><span><strong class="command">include</strong></span> Statement Definition and
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews The <span><strong class="command">include</strong></span> statement inserts the
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews specified file at the point where the <span><strong class="command">include</strong></span>
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews statement is encountered. The <span><strong class="command">include</strong></span>
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews statement facilitates the administration of configuration
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews by permitting the reading or writing of some things but not
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews others. For example, the statement could include private keys
3040b455151b1e1173193933664b2891b6159f24Mark Andrews that are readable only by the name server.
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews<div class="titlepage"><div><div><h3 class="title">
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User<a name="id2575173"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div>
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User<pre class="programlisting"><span><strong class="command">key</strong></span> <em class="replaceable"><code>key_id</code></em> {
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User algorithm <em class="replaceable"><code>string</code></em>;
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User secret <em class="replaceable"><code>string</code></em>;
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2575196"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The <span><strong class="command">key</strong></span> statement defines a shared
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User secret key for use with TSIG (see <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User or the command channel
fca737c98d2be3ef944cc96320c040fdb5f160e3Tinderbox User (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
fca737c98d2be3ef944cc96320c040fdb5f160e3Tinderbox User Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
fca737c98d2be3ef944cc96320c040fdb5f160e3Tinderbox User Usage”</a>).
fca737c98d2be3ef944cc96320c040fdb5f160e3Tinderbox User The <span><strong class="command">key</strong></span> statement can occur at the
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User of the configuration file or inside a <span><strong class="command">view</strong></span>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews statement. Keys defined in top-level <span><strong class="command">key</strong></span>
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater statements can be used in all views. Keys intended for use in
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater a <span><strong class="command">controls</strong></span> statement
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
3040b455151b1e1173193933664b2891b6159f24Mark Andrews Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
88d58d79c5bc7ce3c20a42461a5070116c736836Automatic Updater Usage”</a>)
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater must be defined at the top level.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <em class="replaceable"><code>key_id</code></em>, also known as the
48b36fa08b2b5bc0d552dc2a4425b3f7007b3d59Automatic Updater key name, is a domain name uniquely identifying the key. It can
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater be used in a <span><strong class="command">server</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater statement to cause requests sent to that
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater server to be signed with this key, or in address match lists to
3040b455151b1e1173193933664b2891b6159f24Mark Andrews verify that incoming requests have been signed with a key
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater matching this name, algorithm, and secret.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <em class="replaceable"><code>algorithm_id</code></em> is a string
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User that specifies a security/authentication algorithm. Named
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User supports <code class="literal">hmac-md5</code>,
48b36fa08b2b5bc0d552dc2a4425b3f7007b3d59Automatic Updater <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
9fa39c73fc1d8bc44fdbbb79a1d26b837e7dd555Mark Andrews <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater and <code class="literal">hmac-sha512</code> TSIG authentication.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews Truncated hashes are supported by appending the minimum
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt number of required bits preceded by a dash, e.g.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <em class="replaceable"><code>secret_string</code></em> is the secret
3040b455151b1e1173193933664b2891b6159f24Mark Andrews to be used by the algorithm, and is treated as a base-64
1959fd489a8832e4e3d311670f64ae18e5d08156Automatic Updater encoded string.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User<div class="titlepage"><div><div><h3 class="title">
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt<a name="id2575287"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<pre class="programlisting"><span><strong class="command">logging</strong></span> {
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User [ <span><strong class="command">channel</strong></span> <em class="replaceable"><code>channel_name</code></em> {
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User ( <span><strong class="command">file</strong></span> <em class="replaceable"><code>path_name</code></em>
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews [ <span><strong class="command">versions</strong></span> ( <em class="replaceable"><code>number</code></em> | <span><strong class="command">unlimited</strong></span> ) ]
d2247b4740cc5f740bf7d89ef9ce67fef015c95cMark Andrews [ <span><strong class="command">size</strong></span> <em class="replaceable"><code>size spec</code></em> ]
d2247b4740cc5f740bf7d89ef9ce67fef015c95cMark Andrews | <span><strong class="command">syslog</strong></span> <em class="replaceable"><code>syslog_facility</code></em>
d2247b4740cc5f740bf7d89ef9ce67fef015c95cMark Andrews | <span><strong class="command">stderr</strong></span>
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews | <span><strong class="command">null</strong></span> );
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews [ <span><strong class="command">severity</strong></span> (<code class="option">critical</code> | <code class="option">error</code> | <code class="option">warning</code> | <code class="option">notice</code> |
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews <code class="option">info</code> | <code class="option">debug</code> [ <em class="replaceable"><code>level</code></em> ] | <code class="option">dynamic</code> ); ]
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews [ <span><strong class="command">print-category</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews [ <span><strong class="command">print-severity</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [ <span><strong class="command">print-time</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User [ <span><strong class="command">category</strong></span> <em class="replaceable"><code>category_name</code></em> {
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User <em class="replaceable"><code>channel_name</code></em> ; [ <em class="replaceable"><code>channel_name</code></em> ; ... ]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<div class="titlepage"><div><div><h3 class="title">
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<a name="id2575413"></a><span><strong class="command">logging</strong></span> Statement Definition and
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont The <span><strong class="command">logging</strong></span> statement configures a
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont variety of logging options for the name server. Its <span><strong class="command">channel</strong></span> phrase
4dca64bb8991502db368028aeeba2f832d3b971dAutomatic Updater associates output methods, format options and severity levels with
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont a name that can then be used with the <span><strong class="command">category</strong></span> phrase
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User to select how various classes of messages are logged.
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater Only one <span><strong class="command">logging</strong></span> statement is used to
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater as many channels and categories as are wanted. If there is no <span><strong class="command">logging</strong></span> statement,
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater the logging configuration will be:
7169f76a893666eb20fc7750782e7f411db742d6Tinderbox User category default { default_syslog; default_debug; };
7169f76a893666eb20fc7750782e7f411db742d6Tinderbox User category unmatched { null; };
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater In <acronym class="acronym">BIND</acronym> 9, the logging configuration
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater is only established when
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User the entire configuration file has been parsed. In <acronym class="acronym">BIND</acronym> 8, it was
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater established as soon as the <span><strong class="command">logging</strong></span>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews was parsed. When the server is starting up, all logging messages
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User regarding syntax errors in the configuration file go to the default
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User channels, or to standard error if the "<code class="option">-g</code>" option
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt was specified.
229ea4644b3a7d9c7fdaa43888e7f55ba01e2ee3Automatic Updater<div class="titlepage"><div><div><h4 class="title">
549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User<a name="id2575465"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater All log output goes to one or more <span class="emphasis"><em>channels</em></span>;
8eb631bc4a219650906a6dc6ca51af3034b6ba54Tinderbox User you can make as many of them as you want.
665ba746c0585088d0c314dcfc4671aa2c7b2dc1Automatic Updater Every channel definition must include a destination clause that
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews says whether messages selected for the channel go to a file, to a
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews particular syslog facility, to the standard error stream, or are
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews discarded. It can optionally also limit the message severity level
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews that will be accepted by the channel (the default is
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews <span><strong class="command">info</strong></span>), and whether to include a
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews <span><strong class="command">named</strong></span>-generated time stamp, the
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater and/or severity level (the default is not to include any).
e1a389f7478d094ffbe592df28328a10d484cb38Tinderbox User The <span><strong class="command">null</strong></span> destination clause
8eb631bc4a219650906a6dc6ca51af3034b6ba54Tinderbox User causes all messages sent to the channel to be discarded;
50fa300826799727204b93cbe63bebc341c5eadeTinderbox User in that case, other options for the channel are meaningless.
2da2220fe7af2c45724b50b0187523b1fab0cf08Rob Austein The <span><strong class="command">file</strong></span> destination clause directs
e171a4137c6ba348957e61b7c4c3541493c0da02Automatic Updater to a disk file. It can include limitations
c53a6f37deaa396660adb6a4ca600c4a58adfd3fAutomatic Updater both on how large the file is allowed to become, and how many
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User of the file will be saved each time the file is opened.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If you use the <span><strong class="command">versions</strong></span> log file
19ad308d84cbf446a144e5a91f2032389a9d65c1Tinderbox User <span><strong class="command">named</strong></span> will retain that many backup
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User versions of the file by
4bc4740495aca028379fecd2afac26b1d53a4e25Tinderbox User renaming them when opening. For example, if you choose to keep
b3386fba31414344f38f0c30849c056dceb22dceTinderbox User three old versions
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater of the file <code class="filename">lamers.log</code>, then just
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater before it is opened
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater <code class="filename">lamers.log.1</code> is renamed to
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater <code class="filename">lamers.log.2</code>, <code class="filename">lamers.log.0</code> is renamed
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater to <code class="filename">lamers.log.1</code>, and <code class="filename">lamers.log</code> is
af9cf290cea6ada6ce27b51c724ab77ad5d73fa0Tinderbox User renamed to <code class="filename">lamers.log.0</code>.
e1a389f7478d094ffbe592df28328a10d484cb38Tinderbox User You can say <span><strong class="command">versions unlimited</strong></span> to
e1a389f7478d094ffbe592df28328a10d484cb38Tinderbox User the number of versions.
6671e343b8c7e44ac10a7900fde59555fbc71571Automatic Updater If a <span><strong class="command">size</strong></span> option is associated with
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater then renaming is only done when the file being opened exceeds the
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater indicated size. No backup versions are kept by default; any
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater log file is simply appended.
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater The <span><strong class="command">size</strong></span> option for files is used
4104e236f71eb5108fcfda6711878a97f6f4a8e7Automatic Updater growth. If the file ever exceeds the size, then <span><strong class="command">named</strong></span> will
4104e236f71eb5108fcfda6711878a97f6f4a8e7Automatic Updater stop writing to the file unless it has a <span><strong class="command">versions</strong></span> option
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater associated with it. If backup versions are kept, the files are
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater described above and a new one begun. If there is no
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater <span><strong class="command">versions</strong></span> option, no more data will
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews be written to the log
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews until some out-of-band mechanism removes or truncates the log to
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews less than the
e1a389f7478d094ffbe592df28328a10d484cb38Tinderbox User maximum size. The default behavior is not to limit the size of
af9cf290cea6ada6ce27b51c724ab77ad5d73fa0Tinderbox User Example usage of the <span><strong class="command">size</strong></span> and
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User <span><strong class="command">versions</strong></span> options:
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User<pre class="programlisting">channel an_example_channel {
50fa300826799727204b93cbe63bebc341c5eadeTinderbox User file "example.log" versions 3 size 20m;
82b96702f09ed6bc5cd0f1aa5e54198c04cc192bTinderbox User print-time yes;
e97ad980e88f16c50e8fcd571a4f51121672e477Tinderbox User print-category yes;
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews The <span><strong class="command">syslog</strong></span> destination clause
e20309353e6246485c521278131d3fced73d7957Tinderbox User channel to the system log. Its argument is a
3040b455151b1e1173193933664b2891b6159f24Mark Andrews syslog facility as described in the <span><strong class="command">syslog</strong></span> man
39cad8fb7d7ff3436bb24ce761354afcb80d295aMark Andrews page. Known facilities are <span><strong class="command">kern</strong></span>, <span><strong class="command">user</strong></span>,
f8a9a38ee40c139a8d145ac76ecbff3a0f986453Mark Andrews <span><strong class="command">mail</strong></span>, <span><strong class="command">daemon</strong></span>, <span><strong class="command">auth</strong></span>,
e628576d3b3d91c8954679077f4c208f1e43b433Automatic Updater <span><strong class="command">syslog</strong></span>, <span><strong class="command">lpr</strong></span>, <span><strong class="command">news</strong></span>,
39cad8fb7d7ff3436bb24ce761354afcb80d295aMark Andrews <span><strong class="command">uucp</strong></span>, <span><strong class="command">cron</strong></span>, <span><strong class="command">authpriv</strong></span>,
39cad8fb7d7ff3436bb24ce761354afcb80d295aMark Andrews <span><strong class="command">ftp</strong></span>, <span><strong class="command">local0</strong></span>, <span><strong class="command">local1</strong></span>,
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User <span><strong class="command">local2</strong></span>, <span><strong class="command">local3</strong></span>, <span><strong class="command">local4</strong></span>,
76fbdc591b3d46df28878a6ff844798622b85265Tinderbox User <span><strong class="command">local5</strong></span>, <span><strong class="command">local6</strong></span> and
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User <span><strong class="command">local7</strong></span>, however not all facilities
9d80d23172c30fd63e5046a7e69b8445e564ff31Automatic Updater are supported on
549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User all operating systems.
549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User How <span><strong class="command">syslog</strong></span> will handle messages
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt this facility is described in the <span><strong class="command">syslog.conf</strong></span> man
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt page. If you have a system which uses a very old version of <span><strong class="command">syslog</strong></span> that
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt only uses two arguments to the <span><strong class="command">openlog()</strong></span> function,
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt then this clause is silently ignored.
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt The <span><strong class="command">severity</strong></span> clause works like <span><strong class="command">syslog</strong></span>'s
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User "priorities", except that they can also be used if you are writing
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews straight to a file rather than using <span><strong class="command">syslog</strong></span>.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews Messages which are not at least of the severity level given will
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews not be selected for the channel; messages of higher severity
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews will be accepted.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews If you are using <span><strong class="command">syslog</strong></span>, then the <span><strong class="command">syslog.conf</strong></span> priorities
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews will also determine what eventually passes through. For example,
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews defining a channel facility and severity as <span><strong class="command">daemon</strong></span> and <span><strong class="command">debug</strong></span> but
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews only logging <span><strong class="command">daemon.warning</strong></span> via <span><strong class="command">syslog.conf</strong></span> will
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews cause messages of severity <span><strong class="command">info</strong></span> and
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <span><strong class="command">notice</strong></span> to
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews be dropped. If the situation were reversed, with <span><strong class="command">named</strong></span> writing
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews messages of only <span><strong class="command">warning</strong></span> or higher,
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews then <span><strong class="command">syslogd</strong></span> would
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews print all messages it received from the channel.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews The <span><strong class="command">stderr</strong></span> destination clause
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User channel to the server's standard error stream. This is intended
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User use when the server is running as a foreground process, for
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User when debugging a configuration.
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User The server can supply extensive debugging information when
61932ed91732417e05c8c6fd335acf1be896c778Mark Andrews it is in debugging mode. If the server's global debug level is
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User than zero, then debugging mode will be active. The global debug
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews level is set either by starting the <span><strong class="command">named</strong></span> server
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews with the <code class="option">-d</code> flag followed by a positive integer,
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews or by running <span><strong class="command">rndc trace</strong></span>.
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews The global debug level
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews can be set to zero, and debugging mode turned off, by running <span><strong class="command">rndc
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrewsnotrace</strong></span>. All debugging messages in the server have a debug
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews level, and higher debug levels give more detailed output. Channels
9dde9ce5558696850b6b9850a8475ae518409518Tinderbox User that specify a specific debug severity, for example:
9dde9ce5558696850b6b9850a8475ae518409518Tinderbox User<pre class="programlisting">channel specific_debug_level {
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews severity debug 3;
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews will get debugging output of level 3 or less any time the
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews server is in debugging mode, regardless of the global debugging
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews level. Channels with <span><strong class="command">dynamic</strong></span>
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews severity use the
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews server's global debug level to determine what messages to print.
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews If <span><strong class="command">print-time</strong></span> has been turned on,
3040b455151b1e1173193933664b2891b6159f24Mark Andrews the date and time will be logged. <span><strong class="command">print-time</strong></span> may
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User be specified for a <span><strong class="command">syslog</strong></span> channel,
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User but is usually
3040b455151b1e1173193933664b2891b6159f24Mark Andrews pointless since <span><strong class="command">syslog</strong></span> also logs
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt time. If <span><strong class="command">print-category</strong></span> is
3040b455151b1e1173193933664b2891b6159f24Mark Andrews requested, then the
0a2ff769ecd0b5a6bda54b62bc1ec5fa6fd198a0Tinderbox User category of the message will be logged as well. Finally, if <span><strong class="command">print-severity</strong></span> is
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User on, then the severity level of the message will be logged. The <span><strong class="command">print-</strong></span> options may
182bfea3ae9912f6d5e2f4fe3e13737719e06f97Tinderbox User be used in any combination, and will always be printed in the
bd89a8c38d51f0a3035f6aa411e55e34a4b6f470Tinderbox User order: time, category, severity. Here is an example where all
af60449fe472b8bea5ad04bf538c777c6b151112Tinderbox User three <span><strong class="command">print-</strong></span> options
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews <code class="computeroutput">28-Feb-2000 15:05:32.863 general: notice: running</code>
af60449fe472b8bea5ad04bf538c777c6b151112Tinderbox User There are four predefined channels that are used for
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User <span><strong class="command">named</strong></span>'s default logging as follows.
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User used is described in <a href="Bv9ARM.ch06.html#the_category_phrase" title="The category Phrase">the section called “The <span><strong class="command">category</strong></span> Phrase”</a>.
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User<pre class="programlisting">channel default_syslog {
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User // send to syslog's daemon facility
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User syslog daemon;
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User // only send priority info and higher
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User severity info;
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox Userchannel default_debug {
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User // write to named.run in the working directory
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User // Note: stderr is used instead of "named.run" if
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User // the server is started with the '-f' option.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews // log at the server's current debug level
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews severity dynamic;
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrewschannel default_stderr {
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews // writes to stderr
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews // only send priority info and higher
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews severity info;
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrewschannel null {
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews // toss anything sent to this channel
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User The <span><strong class="command">default_debug</strong></span> channel has the
3040b455151b1e1173193933664b2891b6159f24Mark Andrews property that it only produces output when the server's debug
f09f1bf18e3ad40a0e8a6cc3dabf1c11f04992cbMark Andrews nonzero. It normally writes to a file called <code class="filename">named.run</code>
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater in the server's working directory.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User For security reasons, when the "<code class="option">-u</code>"
8c9c79e5fea0cb698026a74821695907c8312a46Mark Andrews command line option is used, the <code class="filename">named.run</code> file
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User is created only after <span><strong class="command">named</strong></span> has
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User changed to the
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User new UID, and any debug output generated while <span><strong class="command">named</strong></span> is
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User starting up and still running as root is discarded. If you need
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater to capture this output, you must run the server with the "<code class="option">-g</code>"
3040b455151b1e1173193933664b2891b6159f24Mark Andrews option and redirect standard error to a file.
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater Once a channel is defined, it cannot be redefined. Thus you
3040b455151b1e1173193933664b2891b6159f24Mark Andrews cannot alter the built-in channels directly, but you can modify
3040b455151b1e1173193933664b2891b6159f24Mark Andrews the default logging by pointing categories at channels you have
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews<div class="titlepage"><div><div><h4 class="title">
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews<a name="the_category_phrase"></a>The <span><strong class="command">category</strong></span> Phrase</h4></div></div></div>
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews There are many categories, so you can send the logs you want
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews to see wherever you want, without seeing logs you don't want. If
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User you don't specify a list of channels for a category, then log
7cc0a5d21ef046bfd630c4769943d896a7d7472cTinderbox User in that category will be sent to the <span><strong class="command">default</strong></span> category
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater instead. If you don't specify a default category, the following
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington "default default" is used:
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<pre class="programlisting">category default { default_syslog; default_debug; };
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews As an example, let's say you want to log security events to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater a file, but you also want keep the default logging behavior. You'd
e007e3e5b0316c6c05698a71101885743aca22bdAutomatic Updater specify the following:
93ca5ee4c4c77aca8d3bcffd70216f30ef398387Mark Andrews<pre class="programlisting">channel my_security_channel {
93ca5ee4c4c77aca8d3bcffd70216f30ef398387Mark Andrews file "my_security_file";
93ca5ee4c4c77aca8d3bcffd70216f30ef398387Mark Andrews severity info;
93ca5ee4c4c77aca8d3bcffd70216f30ef398387Mark Andrewscategory security {
34348322c7016b6b5d1bceee5b1cf42e2d2216b4Tinderbox User my_security_channel;
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews default_syslog;
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User default_debug;
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews To discard all messages in a category, specify the <span><strong class="command">null</strong></span> channel:
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews<pre class="programlisting">category xfer-out { null; };
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrewscategory notify { null; };
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews Following are the available categories and brief descriptions
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews of the types of log information they contain. More
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews categories may be added in future <acronym class="acronym">BIND</acronym> releases.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <p><span><strong class="command">default</strong></span></p>
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews The default category defines the logging
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews options for those categories where no specific
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews configuration has been
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <p><span><strong class="command">general</strong></span></p>
2a3eef7f65270e3f9a954573d866b368b7857584Tinderbox User The catch-all. Many things still aren't
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews classified into categories, and they all end up here.
267e57d39b06f65eecb8f92e476dcf0c8cd90fabTinderbox User <p><span><strong class="command">database</strong></span></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Messages relating to the databases used
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater internally by the name server to store zone and cache
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <p><span><strong class="command">security</strong></span></p>
95cfad51a3f71246d263af79a7861a6821f7a0beAutomatic Updater Approval and denial of requests.
e135e3c4b1f4f986f00997f5ad5866effb203139Tinderbox User <p><span><strong class="command">config</strong></span></p>
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater Configuration file parsing and processing.
08d53af7d51409036462fa80fb1bde7a8c2ac123Automatic Updater <p><span><strong class="command">resolver</strong></span></p>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews DNS resolution, such as the recursive
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater lookups performed on behalf of clients by a caching name
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <p><span><strong class="command">xfer-in</strong></span></p>
e135e3c4b1f4f986f00997f5ad5866effb203139Tinderbox User Zone transfers the server is receiving.
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater <p><span><strong class="command">xfer-out</strong></span></p>
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User Zone transfers the server is sending.
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <p><span><strong class="command">notify</strong></span></p>
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews The NOTIFY protocol.
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <p><span><strong class="command">client</strong></span></p>
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews Processing of client requests.
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <p><span><strong class="command">unmatched</strong></span></p>
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews Messages that <span><strong class="command">named</strong></span> was unable to determine the
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews class of or for which there was no matching <span><strong class="command">view</strong></span>.
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews A one line summary is also logged to the <span><strong class="command">client</strong></span> category.
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews This category is best sent to a file or stderr, by
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews default it is sent to
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews the <span><strong class="command">null</strong></span> channel.
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <p><span><strong class="command">network</strong></span></p>
f0877b0237674d0519006ca7f8436e5f92250d30Mark Andrews Network operations.
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User <p><span><strong class="command">update</strong></span></p>
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User Dynamic updates.
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User <p><span><strong class="command">update-security</strong></span></p>
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User Approval and denial of update requests.
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User <p><span><strong class="command">queries</strong></span></p>
287a6a8f9040dc43560cd69cddf83bfc0f53b76fTinderbox User Specify where queries should be logged to.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington At startup, specifying the category <span><strong class="command">queries</strong></span> will also
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington enable query logging unless <span><strong class="command">querylog</strong></span> option has been
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The query log entry reports the client's IP
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User address and port number, and the query name,
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User class and type. Next it reports whether the
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User Recursion Desired flag was set (+ if set, -
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User if not set), if the query was signed (S),
e21f41f6504b3381be86cbe7f457f9ee1fff947bTinderbox User EDNS was in use (E), if TCP was used (T), if
c2abd6efeb9affa70aabb63da2acb23e135cf7f2Mark Andrews DO (DNSSEC Ok) was set (D), or if CD (Checking
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User Disabled) was set (C). After this the
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User destination address the query was sent to is
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User <code class="computeroutput">client 127.0.0.1#62536: query: www.example.com IN AAAA +SE</code>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont <code class="computeroutput">client ::1#62537: query: www.example.net IN AAAA -SE</code>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span><strong class="command">query-errors</strong></span></p>
4ba21f60009e18c5950d18546a127e70be537effMark Andrews Information about queries that resulted in some
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span><strong class="command">dispatch</strong></span></p>
c855e7170a7ddb5d4ebab69a771f35dc93e95e43Mark Andrews Dispatching of incoming packets to the
c855e7170a7ddb5d4ebab69a771f35dc93e95e43Mark Andrews server modules where they are to be processed.
4fda24d843edac463c98785ec0c850d912592dc1Tinderbox User <p><span><strong class="command">dnssec</strong></span></p>
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews DNSSEC and TSIG protocol processing.
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater <p><span><strong class="command">lame-servers</strong></span></p>
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User Lame servers. These are misconfigurations
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User in remote servers, discovered by BIND 9 when trying to
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User query those servers during resolution.
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User <p><span><strong class="command">delegation-only</strong></span></p>
0c9af52e8ff870126d837c52f1d30d8ad0608733Tinderbox User Delegation only. Logs queries that have been
1404d301dd9e7e487a247b803f63909cd10cdf72Tinderbox User forced to NXDOMAIN as the result of a
1404d301dd9e7e487a247b803f63909cd10cdf72Tinderbox User delegation-only zone or a
1404d301dd9e7e487a247b803f63909cd10cdf72Tinderbox User <span><strong class="command">delegation-only</strong></span> in a hint
1404d301dd9e7e487a247b803f63909cd10cdf72Tinderbox User or stub zone declaration.
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater <p><span><strong class="command">edns-disabled</strong></span></p>
11b6b0d74bb8dd6bd1ce0b60ba7f9b66323f06d4Tinderbox User Log queries that have been forced to use plain
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater DNS due to timeouts. This is often due to
b577ce9ed2153db6539fb975b4a7aa16d9b3baeeTinderbox User the remote servers not being RFC 1034 compliant
b577ce9ed2153db6539fb975b4a7aa16d9b3baeeTinderbox User (not always returning FORMERR or similar to
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User EDNS queries and other extensions to the DNS
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User when they are not understood). In other words, this is
b577ce9ed2153db6539fb975b4a7aa16d9b3baeeTinderbox User targeted at servers that fail to respond to
bd89a8c38d51f0a3035f6aa411e55e34a4b6f470Tinderbox User DNS queries that they don't understand.
ac2ad7b4e4e41e7e788dbe103c581f1605209d3bTinderbox User Note: the log message can also be due to
ac2ad7b4e4e41e7e788dbe103c581f1605209d3bTinderbox User packet loss. Before reporting servers for
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User non-RFC 1034 compliance they should be re-tested
12ee3c02ab36d7e7430bd705cc289db1a69a5733Mark Andrews to determine the nature of the non-compliance.
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater This testing should prevent or reduce the
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews number of false-positive reports.
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews Note: eventually <span><strong class="command">named</strong></span> will have to stop
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews treating such timeouts as due to RFC 1034 non
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews compliance and start treating it as plain
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews packet loss. Falsely classifying packet
8ccd7da886e93cd490fcb6f4c4e98a6514f35820Automatic Updater loss as due to RFC 1034 non compliance impacts
cd839f5cf5f84cf163f55ff05cb88ce37efd24d1Automatic Updater on DNSSEC validation which requires EDNS for
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews the DNSSEC records to be returned.
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews<div class="titlepage"><div><div><h4 class="title">
fd8fb4df8499e292daeac765f599ac7c507d9ca3Mark Andrews<a name="id2576961"></a>The <span><strong class="command">query-errors</strong></span> Category</h4></div></div></div>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews The <span><strong class="command">query-errors</strong></span> category is
c95f536d78842fbc8ebcef653d88e1f2270054f8Automatic Updater specifically intended for debugging purposes: To identify
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater why and how specific queries result in responses which
3040b455151b1e1173193933664b2891b6159f24Mark Andrews indicate an error.
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater Messages of this category are therefore only logged
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater with <span><strong class="command">debug</strong></span> levels.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews At the debug levels of 1 or higher, each response with the
c95f536d78842fbc8ebcef653d88e1f2270054f8Automatic Updater rcode of SERVFAIL is logged as follows:
c95f536d78842fbc8ebcef653d88e1f2270054f8Automatic Updater <code class="computeroutput">client 127.0.0.1#61502: query failed (SERVFAIL) for www.example.com/IN/AAAA at query.c:3880</code>
cb40461f8744c5aeb369b84d5f48395a13a221a0Mark Andrews This means an error resulting in SERVFAIL was
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User detected at line 3880 of source file
bac4435d473c9a0281507524f084480c34aa942aTinderbox User Log messages of this level will particularly
bac4435d473c9a0281507524f084480c34aa942aTinderbox User help identify the cause of SERVFAIL for an
bac4435d473c9a0281507524f084480c34aa942aTinderbox User authoritative server.
bac4435d473c9a0281507524f084480c34aa942aTinderbox User At the debug levels of 2 or higher, detailed context
bac4435d473c9a0281507524f084480c34aa942aTinderbox User information of recursive resolutions that resulted in
bac4435d473c9a0281507524f084480c34aa942aTinderbox User SERVFAIL is logged.
bac4435d473c9a0281507524f084480c34aa942aTinderbox User The log message will look like as follows:
bac4435d473c9a0281507524f084480c34aa942aTinderbox Userfetch completed at resolver.c:2970 for www.example.com/A
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox Userin 30.000183: timed out/success [domain:example.com,
ec8755f605d7dcb2de1076040e77bc2d7ec33b4aTinderbox Userreferral:2,restart:7,qrysent:8,timeout:5,lame:0,neterr:0,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrewsbadresp:1,adberr:0,findfail:0,valfail:0]
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The first part before the colon shows that a recursive
bf8c3776f1bf1a1270e5e0443ae5a8df022632a8Mark Andrews resolution for AAAA records of www.example.com completed
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews in 30.000183 seconds and the final result that led to the
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews SERVFAIL was determined at line 2970 of source file
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The following part shows the detected final result and the
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews latest result of DNSSEC validation.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The latter is always success when no validation attempt
28e0061dbcc2ae45d34541267a00d8b4de5b4a41Tinderbox User In this example, this query resulted in SERVFAIL probably
9692d283bb43c9eab49a7fadfc1b74a6e20e6151Tinderbox User because all name servers are down or unreachable, leading
9692d283bb43c9eab49a7fadfc1b74a6e20e6151Tinderbox User to a timeout in 30 seconds.
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User DNSSEC validation was probably not attempted.
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User The last part enclosed in square brackets shows statistics
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User information collected for this particular resolution
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User The <code class="varname">domain</code> field shows the deepest zone
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User that the resolver reached;
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User it is the zone where the error was finally detected.
3a28155fe228cd6d59b15f1ca0b568be6620a9d2Tinderbox User The meaning of the other fields is summarized in the
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User following table.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater <p><code class="varname">referral</code></p>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews The number of referrals the resolver received
560d6da48f066000541dd43f5d407644dee12bebTinderbox User throughout the resolution process.
560d6da48f066000541dd43f5d407644dee12bebTinderbox User In the above example this is 2, which are most
c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User The number of cycles that the resolver tried
c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User remote servers at the <code class="varname">domain</code>
1f471f3b06fae27f4b42ee4f0d6dac0cc7e5bc81Tinderbox User In each cycle the resolver sends one query
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User (possibly resending it, depending on the response)
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User to each known name server of
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User the <code class="varname">domain</code> zone.
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater <p><code class="varname">qrysent</code></p>
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User The number of queries the resolver sent at the
3a28155fe228cd6d59b15f1ca0b568be6620a9d2Tinderbox User The number of timeouts since the resolver
2c1632c71e2f4d8afa35efce3080b31602a6608cTinderbox User received the last response.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews The number of lame servers the resolver detected
3040b455151b1e1173193933664b2891b6159f24Mark Andrews at the <code class="varname">domain</code> zone.
1dbe80aade5bed39893d903cf9d7318a5265813aTinderbox User A server is detected to be lame either by an
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User invalid response or as a result of lookup in
850cfa4e86da9f63c1b97ec8c743c091ffd3546bFrancis Dupont BIND9's address database (ADB), where lame
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User servers are cached.
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User The number of erroneous results that the
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User resolver encountered in sending queries
3040b455151b1e1173193933664b2891b6159f24Mark Andrews at the <code class="varname">domain</code> zone.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews One common case is the remote server is
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews unreachable and the resolver receives an ICMP
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews unreachable error message.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews The number of unexpected responses (other than
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <code class="varname">lame</code>) to queries sent by the
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews resolver at the <code class="varname">domain</code> zone.
ac5ed748602c890d596bed07b0b23b8b5f42b2f6Mark Andrews Failures in finding remote server addresses
ac5ed748602c890d596bed07b0b23b8b5f42b2f6Mark Andrews of the <code class="varname">domain</code> zone in the ADB.
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt One common case of this is that the remote
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews server's name does not have any address records.
2706fce75f04398595d9648122c6b67164e94fccTinderbox User Failures of resolving remote server addresses.
d56349eff4a1ebb8f4370df5a8a507f1a8ecd0dfMark Andrews This is a total number of failures throughout
d56349eff4a1ebb8f4370df5a8a507f1a8ecd0dfMark Andrews the resolution process.
0d13a9584b9f97693ab22d54322f1c484d578701Mark Andrews Failures of DNSSEC validation.
0d13a9584b9f97693ab22d54322f1c484d578701Mark Andrews Validation failures are counted throughout
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews the resolution process (not limited to
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews the <code class="varname">domain</code> zone), but should
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews only happen in <code class="varname">domain</code>.
cb40461f8744c5aeb369b84d5f48395a13a221a0Mark Andrews At the debug levels of 3 or higher, the same messages
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews as those at the debug 1 level are logged for other errors
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews than SERVFAIL.
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews Note that negative responses such as NXDOMAIN are not
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews regarded as errors here.
d56349eff4a1ebb8f4370df5a8a507f1a8ecd0dfMark Andrews At the debug levels of 4 or higher, the same messages
d56349eff4a1ebb8f4370df5a8a507f1a8ecd0dfMark Andrews as those at the debug 2 level are logged for other errors
0c9af52e8ff870126d837c52f1d30d8ad0608733Tinderbox User than SERVFAIL.
015f044f7f916eb18d053f2e5dcbee481425bc66Mark Andrews Unlike the above case of level 3, messages are logged for
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews negative responses.
015f044f7f916eb18d053f2e5dcbee481425bc66Mark Andrews This is because any unexpected results can be difficult to
6284b9b877d2205240dce1cf7f88d4dca888e44aTinderbox User debug in the recursion case.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews<div class="titlepage"><div><div><h3 class="title">
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews<a name="id2577480"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews This is the grammar of the <span><strong class="command">lwres</strong></span>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews statement in the <code class="filename">named.conf</code> file:
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt<pre class="programlisting"><span><strong class="command">lwres</strong></span> {
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews [<span class="optional"> listen-on { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt [<span class="optional"> view <em class="replaceable"><code>view_name</code></em>; </span>]
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt [<span class="optional"> search { <em class="replaceable"><code>domain_name</code></em> ; [<span class="optional"> <em class="replaceable"><code>domain_name</code></em> ; ... </span>] }; </span>]
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews [<span class="optional"> ndots <em class="replaceable"><code>number</code></em>; </span>]
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews<div class="titlepage"><div><div><h3 class="title">
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews<a name="id2577554"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div>
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews The <span><strong class="command">lwres</strong></span> statement configures the
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews server to also act as a lightweight resolver server. (See
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews <a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be multiple
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews <span><strong class="command">lwres</strong></span> statements configuring
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews lightweight resolver servers with different properties.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews The <span><strong class="command">listen-on</strong></span> statement specifies a
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews addresses (and ports) that this instance of a lightweight resolver
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews should accept requests on. If no port is specified, port 921 is
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews If this statement is omitted, requests will be accepted on
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews The <span><strong class="command">view</strong></span> statement binds this
bbd726b86a5b0f97a192b6027958dc7b763dc48bTinderbox User instance of a
7a2a1b8b14fc804ac80612d7b98064095e445be5Automatic Updater lightweight resolver daemon to a view in the DNS namespace, so that
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater response will be constructed in the same manner as a normal DNS
213dd665a9f45c3acb5f6c5f853bbbd5fd1598a2Tinderbox User matching this view. If this statement is omitted, the default view
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews used, and if there is no default view, an error is triggered.
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews The <span><strong class="command">search</strong></span> statement is equivalent to
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews <span><strong class="command">search</strong></span> statement in
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews <code class="filename">/etc/resolv.conf</code>. It provides a
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews list of domains
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews which are appended to relative names in queries.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews The <span><strong class="command">ndots</strong></span> statement is equivalent to
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews <span><strong class="command">ndots</strong></span> statement in
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews <code class="filename">/etc/resolv.conf</code>. It indicates the
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews number of dots in a relative domain name that should result in an
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews exact match lookup before search path elements are appended.
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews<div class="titlepage"><div><div><h3 class="title">
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<a name="id2577686"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div>
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews<span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> |
31de528a5f7fae26452f6f68625702c4e4d10af9Tinderbox User <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] };
4ba21f60009e18c5950d18546a127e70be537effMark Andrews<div class="titlepage"><div><div><h3 class="title">
4ba21f60009e18c5950d18546a127e70be537effMark Andrews<a name="id2577730"></a><span><strong class="command">masters</strong></span> Statement Definition and
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews<p><span><strong class="command">masters</strong></span>
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews lists allow for a common set of masters to be easily used by
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews multiple stub and slave zones.
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User<div class="titlepage"><div><div><h3 class="title">
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews<a name="id2577745"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div>
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews This is the grammar of the <span><strong class="command">options</strong></span>
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews statement in the <code class="filename">named.conf</code> file:
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews<pre class="programlisting"><span><strong class="command">options</strong></span> {
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews [<span class="optional"> attach-cache <em class="replaceable"><code>cache_name</code></em>; </span>]
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews [<span class="optional"> version <em class="replaceable"><code>version_string</code></em>; </span>]
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews [<span class="optional"> hostname <em class="replaceable"><code>hostname_string</code></em>; </span>]
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews [<span class="optional"> server-id <em class="replaceable"><code>server_id_string</code></em>; </span>]
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews [<span class="optional"> directory <em class="replaceable"><code>path_name</code></em>; </span>]
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater [<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> named-xfer <em class="replaceable"><code>path_name</code></em>; </span>]
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater [<span class="optional"> tkey-gssapi-credential <em class="replaceable"><code>principal</code></em>; </span>]
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews [<span class="optional"> tkey-domain <em class="replaceable"><code>domainname</code></em>; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> tkey-dhkey <em class="replaceable"><code>key_name</code></em> <em class="replaceable"><code>key_tag</code></em>; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> cache-file <em class="replaceable"><code>path_name</code></em>; </span>]
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User [<span class="optional"> dump-file <em class="replaceable"><code>path_name</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> bindkeys-file <em class="replaceable"><code>path_name</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> memstatistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> memstatistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> pid-file <em class="replaceable"><code>path_name</code></em>; </span>]
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews [<span class="optional"> recursing-file <em class="replaceable"><code>path_name</code></em>; </span>]
9a5217f827ac0e006016745e5305b31dc0c7767fTinderbox User [<span class="optional"> statistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
9a5217f827ac0e006016745e5305b31dc0c7767fTinderbox User [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews [<span class="optional"> auth-nxdomain <em class="replaceable"><code>yes_or_no</code></em>; </span>]
ba8b771c371967dd1254c7fa82ebe4158ee04b24Tinderbox User [<span class="optional"> deallocate-on-exit <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em>; </span>]
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews [<span class="optional"> fake-iquery <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> fetch-glue <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> flush-zones-on-shutdown <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> has-old-clients <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> host-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> host-statistics-max <em class="replaceable"><code>number</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> minimal-responses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> multiple-cnames <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> recursion <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> rfc2308-type1 <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> use-id-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> ixfr-from-differences (<em class="replaceable"><code>yes_or_no</code></em> | <code class="constant">master</code> | <code class="constant">slave</code>); </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> dnssec-enable <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> dnssec-validation <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> dnssec-lookaside ( <em class="replaceable"><code>auto</code></em> |
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em> ); </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> dnssec-must-be-secure <em class="replaceable"><code>domain yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> dnssec-accept-expired <em class="replaceable"><code>yes_or_no</code></em>; </span>]
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews [<span class="optional"> forward ( <em class="replaceable"><code>only</code></em> | <em class="replaceable"><code>first</code></em> ); </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> dual-stack-servers [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] {
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews ( <em class="replaceable"><code>domain_name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] |
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ) ;
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews ... }; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> check-names ( <em class="replaceable"><code>master</code></em> | <em class="replaceable"><code>slave</code></em> | <em class="replaceable"><code>response</code></em> )
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> check-dup-records ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> check-mx ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater [<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em>; </span>]
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt [<span class="optional"> check-mx-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> check-srv-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews [<span class="optional"> check-sibling <em class="replaceable"><code>yes_or_no</code></em>; </span>]
59602f2a7c4e4809941583bed3e94cd26e628f1aTinderbox User [<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
4c6bae917bec70e1fc4d1b761a9765075af78441Tinderbox User [<span class="optional"> allow-query-cache { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
4c6bae917bec70e1fc4d1b761a9765075af78441Tinderbox User [<span class="optional"> allow-query-cache-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
4c6bae917bec70e1fc4d1b761a9765075af78441Tinderbox User [<span class="optional"> allow-recursion { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User [<span class="optional"> allow-recursion-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User [<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
3d015b2a0aeaa8d763fc783c23f895125ca1e0b8Tinderbox User [<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
3d015b2a0aeaa8d763fc783c23f895125ca1e0b8Tinderbox User [<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>]
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User [<span class="optional"> dnssec-secure-to-insecure <em class="replaceable"><code>yes_or_no</code></em> ;</span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
4c6bae917bec70e1fc4d1b761a9765075af78441Tinderbox User [<span class="optional"> allow-v6-synthesis { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews [<span class="optional"> blackhole { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
70d987def5a58ebeb8243017c0ec2e9b2c326cf4Evan Hunt [<span class="optional"> use-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
3d015b2a0aeaa8d763fc783c23f895125ca1e0b8Tinderbox User [<span class="optional"> avoid-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
70d987def5a58ebeb8243017c0ec2e9b2c326cf4Evan Hunt [<span class="optional"> use-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
70d987def5a58ebeb8243017c0ec2e9b2c326cf4Evan Hunt [<span class="optional"> avoid-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
70d987def5a58ebeb8243017c0ec2e9b2c326cf4Evan Hunt [<span class="optional"> listen-on [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
3d015b2a0aeaa8d763fc783c23f895125ca1e0b8Tinderbox User [<span class="optional"> listen-on-v6 [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
3d015b2a0aeaa8d763fc783c23f895125ca1e0b8Tinderbox User [<span class="optional"> query-source ( ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> )
8fabea916f73d0b7c7371998dd041b41d1ad5296Tinderbox User [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
3d015b2a0aeaa8d763fc783c23f895125ca1e0b8Tinderbox User [<span class="optional"> address ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
3d015b2a0aeaa8d763fc783c23f895125ca1e0b8Tinderbox User [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
70d987def5a58ebeb8243017c0ec2e9b2c326cf4Evan Hunt [<span class="optional"> query-source-v6 ( ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> )
70d987def5a58ebeb8243017c0ec2e9b2c326cf4Evan Hunt [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
70d987def5a58ebeb8243017c0ec2e9b2c326cf4Evan Hunt [<span class="optional"> address ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
2706fce75f04398595d9648122c6b67164e94fccTinderbox User [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
2706fce75f04398595d9648122c6b67164e94fccTinderbox User [<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> queryport-pool-updateinterval <em class="replaceable"><code>number</code></em>; </span>]
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews [<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em>; </span>]
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em>; </span>]
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater [<span class="optional"> tcp-clients <em class="replaceable"><code>number</code></em>; </span>]
3a28155fe228cd6d59b15f1ca0b568be6620a9d2Tinderbox User [<span class="optional"> reserved-sockets <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> recursive-clients <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> serial-query-rate <em class="replaceable"><code>number</code></em>; </span>]
3a28155fe228cd6d59b15f1ca0b568be6620a9d2Tinderbox User [<span class="optional"> serial-queries <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> tcp-listen-queue <em class="replaceable"><code>number</code></em>; </span>]
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User [<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em>; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> transfers-in <em class="replaceable"><code>number</code></em>; </span>]
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews [<span class="optional"> transfers-out <em class="replaceable"><code>number</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> transfers-per-ns <em class="replaceable"><code>number</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>]
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont [<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont [<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em>; </span>]
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont [<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> coresize <em class="replaceable"><code>size_spec</code></em> ; </span>]
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews [<span class="optional"> datasize <em class="replaceable"><code>size_spec</code></em> ; </span>]
95de440e8d2b07bb130505b4146059e5734e2eeaTinderbox User [<span class="optional"> files <em class="replaceable"><code>size_spec</code></em> ; </span>]
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews [<span class="optional"> stacksize <em class="replaceable"><code>size_spec</code></em> ; </span>]
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User [<span class="optional"> cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont [<span class="optional"> heartbeat-interval <em class="replaceable"><code>number</code></em>; </span>]
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont [<span class="optional"> interface-interval <em class="replaceable"><code>number</code></em>; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews [<span class="optional"> statistics-interval <em class="replaceable"><code>number</code></em>; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> topology { <em class="replaceable"><code>address_match_list</code></em> }</span>];
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> sortlist { <em class="replaceable"><code>address_match_list</code></em> }</span>];
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews [<span class="optional"> rrset-order { <em class="replaceable"><code>order_spec</code></em> ; [<span class="optional"> <em class="replaceable"><code>order_spec</code></em> ; ... </span>] </span>] };
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> lame-ttl <em class="replaceable"><code>number</code></em>; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> max-ncache-ttl <em class="replaceable"><code>number</code></em>; </span>]
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews [<span class="optional"> max-cache-ttl <em class="replaceable"><code>number</code></em>; </span>]
ec7751119a08c6a7250f3187beed69a8b836d349Tinderbox User [<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User [<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> min-roots <em class="replaceable"><code>number</code></em>; </span>]
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User [<span class="optional"> use-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
879391501ee0ffba072433120bf1baa4087f8899Automatic Updater [<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater [<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater [<span class="optional"> treat-cr-as-space <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
8f536463f9fdfa7da6a8310e4f4895373beb2961Mark Andrews [<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater [<span class="optional"> min-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em>; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> additional-from-auth <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User [<span class="optional"> additional-from-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
dcd42a39d311b44877161ffd1e27fa62700c0171Mark Andrews [<span class="optional"> random-device <em class="replaceable"><code>path_name</code></em> ; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> max-cache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> match-mapped-addresses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> filter-aaaa-on-v4 ( <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>break-dnssec</code></em> ); </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> preferred-glue ( <em class="replaceable"><code>A</code></em> | <em class="replaceable"><code>AAAA</code></em> | <em class="replaceable"><code>NONE</code></em> ); </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> edns-udp-size <em class="replaceable"><code>number</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> max-udp-size <em class="replaceable"><code>number</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> root-delegation-only [<span class="optional"> exclude { <em class="replaceable"><code>namelist</code></em> } </span>] ; </span>]
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User [<span class="optional"> querylog <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User [<span class="optional"> disable-algorithms <em class="replaceable"><code>domain</code></em> { <em class="replaceable"><code>algorithm</code></em>;
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> <em class="replaceable"><code>algorithm</code></em>; </span>] }; </span>]
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User [<span class="optional"> acache-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User [<span class="optional"> acache-cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> max-acache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> max-clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
c5f7f6aa6c51d35353a9485b32abbabfe8358b4eMark Andrews [<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
c5f7f6aa6c51d35353a9485b32abbabfe8358b4eMark Andrews [<span class="optional"> empty-server <em class="replaceable"><code>name</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> empty-contact <em class="replaceable"><code>name</code></em> ; </span>]
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User [<span class="optional"> empty-zones-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> disable-empty-zone <em class="replaceable"><code>zone_name</code></em> ; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> zero-no-soa-ttl-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> deny-answer-addresses { <em class="replaceable"><code>address_match_list</code></em> } [<span class="optional"> except-from { <em class="replaceable"><code>namelist</code></em> } </span>];</span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> deny-answer-aliases { <em class="replaceable"><code>namelist</code></em> } [<span class="optional"> except-from { <em class="replaceable"><code>namelist</code></em> } </span>];</span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<div class="titlepage"><div><div><h3 class="title">
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User<a name="options"></a><span><strong class="command">options</strong></span> Statement Definition and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">options</strong></span> statement sets up global
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to be used by <acronym class="acronym">BIND</acronym>. This statement
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater may appear only
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater once in a configuration file. If there is no <span><strong class="command">options</strong></span>
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater statement, an options block with each option set to its default will
3040b455151b1e1173193933664b2891b6159f24Mark Andrews<dt><span class="term"><span><strong class="command">attach-cache</strong></span></span></dt>
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User Allows multiple views to share a single cache
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews Each view has its own cache database by default, but
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User if multiple views have the same operational policy
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater for name resolution and caching, those views can
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater share a single cache to save memory and possibly
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User improve resolution efficiency by using this option.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">attach-cache</strong></span> option
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater may also be specified in <span><strong class="command">view</strong></span>
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User statements, in which case it overrides the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater global <span><strong class="command">attach-cache</strong></span> option.
63d024b4a80b39753d7b2976d46b1478913cc6a1Tinderbox User The <em class="replaceable"><code>cache_name</code></em> specifies
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User the cache to be shared.
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews When the <span><strong class="command">named</strong></span> server configures
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater views which are supposed to share a cache, it
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User creates a cache with the specified name for the
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User first view of these sharing views.
80f05de86cd3cd8e4a4215c4501643891b942dafTinderbox User The rest of the views will simply refer to the
80f05de86cd3cd8e4a4215c4501643891b942dafTinderbox User already created cache.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews One common configuration to share a cache would be to
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews allow all views to share a single cache.
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews This can be done by specifying
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User the <span><strong class="command">attach-cache</strong></span> as a global
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User option with an arbitrary name.
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User Another possible operation is to allow a subset of
3040b455151b1e1173193933664b2891b6159f24Mark Andrews all views to share a cache while the others to
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews retain their own caches.
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews For example, if there are three views A, B, and C,
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews and only A and B should share a cache, specify the
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews <span><strong class="command">attach-cache</strong></span> option as a view A (or
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews B)'s option, referring to the other view name:
3040b455151b1e1173193933664b2891b6159f24Mark Andrews // this view has its own cache
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater // this view refers to A's cache
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater attach-cache "A";
7f514657e26e5eb066c2be710fd64ec6bfee1475Mark Andrews // this view has its own cache
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Views that share a cache must have the same policy
7f514657e26e5eb066c2be710fd64ec6bfee1475Mark Andrews on configurable parameters that may affect caching.
7f514657e26e5eb066c2be710fd64ec6bfee1475Mark Andrews The current implementation requires the following
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User configurable options be consistent among these
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <span><strong class="command">check-names</strong></span>,
183b6c7fca54001820078f324d102fc33e64bbc6Automatic Updater <span><strong class="command">cleaning-interval</strong></span>,
9563f388c8ca1bb9ebb04db54e122815b0008c8aTinderbox User <span><strong class="command">dnssec-accept-expired</strong></span>,
9563f388c8ca1bb9ebb04db54e122815b0008c8aTinderbox User <span><strong class="command">dnssec-validation</strong></span>,
50cfe402e61ba8d816d845a9f297e3de18f4fc15Tinderbox User <span><strong class="command">max-cache-ttl</strong></span>,
50cfe402e61ba8d816d845a9f297e3de18f4fc15Tinderbox User <span><strong class="command">max-ncache-ttl</strong></span>,
50cfe402e61ba8d816d845a9f297e3de18f4fc15Tinderbox User <span><strong class="command">max-cache-size</strong></span>, and
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews <span><strong class="command">zero-no-soa-ttl</strong></span>.
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User Note that there may be other parameters that may
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater cause confusion if they are inconsistent for
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater different views that share a single cache.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater For example, if these views define different sets of
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater forwarders that can return different answers for the
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater same question, sharing the answer does not make
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater sense or could even be harmful.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User It is administrator's responsibility to ensure
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User configuration differences in different views do
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User not cause disruption with a shared cache.
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User<dt><span class="term"><span><strong class="command">directory</strong></span></span></dt>
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User The working directory of the server.
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User Any non-absolute pathnames in the configuration file will be
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User as relative to this directory. The default location for most
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater output files (e.g. <code class="filename">named.run</code>)
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is this directory.
dd53726b246db5cc63c1c87ca86dae39568eeaa3Tinderbox User If a directory is not specified, the working directory
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User defaults to `<code class="filename">.</code>', the directory from
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater which the server
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater was started. The directory specified should be an absolute
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User<dt><span class="term"><span><strong class="command">key-directory</strong></span></span></dt>
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt When performing dynamic update of secure zones, the
dd53726b246db5cc63c1c87ca86dae39568eeaa3Tinderbox User directory where the public and private DNSSEC key files
dd53726b246db5cc63c1c87ca86dae39568eeaa3Tinderbox User should be found, if different than the current working
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User directory. (Note that this option has no effect on the
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont paths for files containing non-DNSSEC keys such as
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">named-xfer</strong></span></span></dt>
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt <span class="emphasis"><em>This option is obsolete.</em></span> It
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont was used in <acronym class="acronym">BIND</acronym> 8 to specify
33d1cff1dd63494ffa00fac695a793f00c4ebf0bTinderbox User the pathname to the <span><strong class="command">named-xfer</strong></span>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews program. In <acronym class="acronym">BIND</acronym> 9, no separate
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">named-xfer</strong></span> program is needed;
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews its functionality is built into the name server.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">tkey-gssapi-credential</strong></span></span></dt>
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt The security credential with which the server should
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews authenticate keys requested by the GSS-TSIG protocol.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Currently only Kerberos 5 authentication is available
17198e77b87667f796e910d31a4f47a80e256d09Mark Andrews and the credential is a Kerberos principal which
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User the server can acquire through the default system
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater key file, normally <code class="filename">/etc/krb5.keytab</code>.
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater Normally this principal is of the form
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater "<strong class="userinput"><code>dns/</code></strong><code class="varname">server.domain</code>".
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User To use GSS-TSIG, <span><strong class="command">tkey-domain</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User must also be set.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">tkey-domain</strong></span></span></dt>
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater The domain appended to the names of all shared keys
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater generated with <span><strong class="command">TKEY</strong></span>. When a
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater client requests a <span><strong class="command">TKEY</strong></span> exchange,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User it may or may not specify the desired name for the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User key. If present, the name of the shared key will
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User be <code class="varname">client specified part</code> +
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <code class="varname">tkey-domain</code>. Otherwise, the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User name of the shared key will be <code class="varname">random hex
de73ef7ecdb9e009155993a6fa8dee5cd1bde319Mark Andrews digits</code> + <code class="varname">tkey-domain</code>.
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater In most cases, the <span><strong class="command">domainname</strong></span>
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater should be the server's domain name, or an otherwise
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User non-existent subdomain like
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User "_tkey.<code class="varname">domainname</code>". If you are
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User using GSS-TSIG, this variable must be defined.
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User<dt><span class="term"><span><strong class="command">tkey-dhkey</strong></span></span></dt>
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater The Diffie-Hellman key used by the server
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater to generate shared keys with clients using the Diffie-Hellman
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User of <span><strong class="command">TKEY</strong></span>. The server must be
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User able to load the
0e98665878103743dac92b6e8e1556d927e5bc30Tinderbox User public and private keys from files in the working directory.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User most cases, the keyname should be the server's host name.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">cache-file</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews This is for testing only. Do not use.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">dump-file</strong></span></span></dt>
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt The pathname of the file the server dumps
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the database to when instructed to do so with
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">rndc dumpdb</strong></span>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews If not specified, the default is <code class="filename">named_dump.db</code>.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<dt><span class="term"><span><strong class="command">memstatistics-file</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The pathname of the file the server writes memory
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews usage statistics to on exit. If not specified,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the default is <code class="filename">named.memstats</code>.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<dt><span class="term"><span><strong class="command">pid-file</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The pathname of the file the server writes its process ID
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews in. If not specified, the default is
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <code class="filename">/var/run/named/named.pid</code>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The PID file is used by programs that want to send signals to
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt name server. Specifying <span><strong class="command">pid-file none</strong></span> disables the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews use of a PID file — no file will be written and any
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews existing one will be removed. Note that <span><strong class="command">none</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews is a keyword, not a filename, and therefore is not enclosed
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews double quotes.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">recursing-file</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The pathname of the file the server dumps
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the queries that are currently recursing when instructed
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews to do so with <span><strong class="command">rndc recursing</strong></span>.
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt If not specified, the default is <code class="filename">named.recursing</code>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">statistics-file</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The pathname of the file the server appends statistics
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews to when instructed to do so using <span><strong class="command">rndc stats</strong></span>.
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt If not specified, the default is <code class="filename">named.stats</code> in the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews server's current directory. The format of the file is
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington in <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term"><span><strong class="command">bindkeys-file</strong></span></span></dt>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont The pathname of a file to override the built-in trusted
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User keys provided by <span><strong class="command">named</strong></span>.
e76dfff967cfbe00f4d1540434832e4499a9cd83Tinderbox User See the discussion of <span><strong class="command">dnssec-lookaside</strong></span>
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews for details. If not specified, the default is
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont <code class="filename">/etc/bind.keys</code>.
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews<dt><span class="term"><span><strong class="command">session-keyfile</strong></span></span></dt>
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt The pathname of the file into which to write a TSIG
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt session key generated by <span><strong class="command">named</strong></span> for use by
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews <span><strong class="command">nsupdate -l</strong></span>. If not specified, the
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews default is <code class="filename">/var/run/named/session.key</code>.
0accdb26ead1fe520a9820b52efbea64bdf564e3Tinderbox User (See <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>, and in
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews particular the discussion of the
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews <span><strong class="command">update-policy</strong></span> statement's
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews <strong class="userinput"><code>local</code></strong> option for more
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont information about this feature.)
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews<dt><span class="term"><span><strong class="command">session-keyname</strong></span></span></dt>
549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User The key name to use for the TSIG session key.
549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User If not specified, the default is "local-ddns".
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews<dt><span class="term"><span><strong class="command">session-keyalg</strong></span></span></dt>
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews The algorithm to use for the TSIG session key.
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews Valid values are hmac-sha1, hmac-sha224, hmac-sha256,
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews hmac-sha384, hmac-sha512 and hmac-md5. If not
3915dc3dae1955e9f96696ca932efbd18c108d1dTinderbox User specified, the default is hmac-sha256.
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews<dt><span class="term"><span><strong class="command">session-keyfile</strong></span></span></dt>
757ff043760e4743dda1a10e7d58349275934902Tinderbox User The pathname of the file into which to write a session TSIG
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews key for use by <span><strong class="command">nsupdate -l</strong></span>. (See the
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews discussion of the <span><strong class="command">update-policy</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews statement's <strong class="userinput"><code>local</code></strong> option for more
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater details on this feature.)
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<dt><span class="term"><span><strong class="command">port</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews receiving and sending DNS protocol traffic.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater The default is 53. This option is mainly intended for server
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews a server using a port other than 53 will not be able to
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt communicate with
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the global DNS.
56334ccb2d4b5a04fc12b70b5852049db5d24088Evan Hunt<dt><span class="term"><span><strong class="command">random-device</strong></span></span></dt>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews The source of entropy to be used by the server. Entropy is
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt primarily needed
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews for DNSSEC operations, such as TKEY transactions and dynamic
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews update of signed
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater zones. This options specifies the device (or file) from which
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews entropy. If this is a file, operations requiring entropy will
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt fail when the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews file has been exhausted. If not specified, the default value
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont (or equivalent) when present, and none otherwise. The
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont <span><strong class="command">random-device</strong></span> option takes
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt effect during
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont the initial configuration load at server startup time and
c7f686829f05e44169d46746cfb25cadcf078585Tinderbox User is ignored on subsequent reloads.
c7f686829f05e44169d46746cfb25cadcf078585Tinderbox User<dt><span class="term"><span><strong class="command">preferred-glue</strong></span></span></dt>
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt If specified, the listed type (A or AAAA) will be emitted
c7f686829f05e44169d46746cfb25cadcf078585Tinderbox User before other glue
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews in the additional section of a query response.
51901858be9d4632c1d0bed28cfa8f29932c1967Tinderbox User The default is not to prefer any type (NONE).
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt<a name="root_delegation_only"></a><span class="term"><span><strong class="command">root-delegation-only</strong></span></span>
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater Turn on enforcement of delegation-only in TLDs
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews (top level domains) and root zones with an optional
4fe0411487e8e4401477684c0a2bac041ca7c2d5Tinderbox User DS queries are expected to be made to and be answered by
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews delegation only zones. Such queries and responses are
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt treated as an exception to delegation-only processing
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews and are not converted to NXDOMAIN responses provided
e76dfff967cfbe00f4d1540434832e4499a9cd83Tinderbox User a CNAME is not discovered at the query name.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If a delegation only zone server also serves a child
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson zone it is not always possible to determine whether
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews an answer comes from the delegation only zone or the
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User child zone. SOA NS and DNSKEY records are apex
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson only records and a matching response that contains
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson these records or DS is treated as coming from a
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson child zone. RRSIG records are also examined to see
3a9593055ead76cbbb417aee2d2e656c2c92cf46Automatic Updater if they are signed by a child zone or not. The
229ea4644b3a7d9c7fdaa43888e7f55ba01e2ee3Automatic Updater authority section is also examined to see if there
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews is evidence that the answer is from the child zone.
8bc3d252395842452a6d2c775cf8445f6349e331Tinderbox User Answers that are determined to be from a child zone
a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User are not converted to NXDOMAIN responses. Despite
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User all these checks there is still a possibility of
8bc3d252395842452a6d2c775cf8445f6349e331Tinderbox User false negatives when a child zone is being served.
a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User Similarly false positives can arise from empty nodes
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater (no records at the name) in the delegation only zone
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater when the query type is not ANY.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Note some TLDs are not delegation only (e.g. "DE", "LV",
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User "US" and "MUSEUM"). This list is not exhaustive.
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">disable-algorithms</strong></span></span></dt>
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews Disable the specified DNSSEC algorithms at and below the
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater specified name.
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater Multiple <span><strong class="command">disable-algorithms</strong></span>
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User statements are allowed.
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User Only the most specific will be applied.
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User<dt><span class="term"><span><strong class="command">dnssec-lookaside</strong></span></span></dt>
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews When set, <span><strong class="command">dnssec-lookaside</strong></span> provides the
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews validator with an alternate method to validate DNSKEY
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater records at the top of a zone. When a DNSKEY is at or
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews below a domain specified by the deepest
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews <span><strong class="command">dnssec-lookaside</strong></span>, and the normal DNSSEC
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews validation has left the key untrusted, the trust-anchor
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews will be appended to the key name and a DLV record will be
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews looked up to see if it can validate the key. If the DLV
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews record validates a DNSKEY (similarly to the way a DS
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews record does) the DNSKEY RRset is deemed to be trusted.
409ba95e573b40cf36acf97dd62ee7e9c7775851Tinderbox User If <span><strong class="command">dnssec-lookaside</strong></span> is set to
f751b1576ee6fef4023bf7101d10167e4fe520f3Tinderbox User <strong class="userinput"><code>auto</code></strong>, then built-in default
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User values for the DLV domain and trust anchor will be
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User used, along with a built-in key for validation.
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater The default DLV key is stored in the file
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater <code class="filename">bind.keys</code>, which
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User <span><strong class="command">named</strong></span> loads at startup if
22870a9f8df95488abe2b17ab92b7cb6a9fe6f14Tinderbox User <span><strong class="command">dnssec-lookaside</strong></span> is set to
22870a9f8df95488abe2b17ab92b7cb6a9fe6f14Tinderbox User <code class="constant">auto</code>. A copy of that file is
22870a9f8df95488abe2b17ab92b7cb6a9fe6f14Tinderbox User installed along with <acronym class="acronym">BIND</acronym> 9, and is
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User current as of the release date. If the DLV key expires, a
22870a9f8df95488abe2b17ab92b7cb6a9fe6f14Tinderbox User new copy of <code class="filename">bind.keys</code> can be downloaded
22870a9f8df95488abe2b17ab92b7cb6a9fe6f14Tinderbox User from <a href="" target="_top">https://www.isc.org/solutions/dlv</a>.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User (To prevent problems if <code class="filename">bind.keys</code> is
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User not found, the current key is also compiled in to
0a2ff769ecd0b5a6bda54b62bc1ec5fa6fd198a0Tinderbox User <span><strong class="command">named</strong></span>. Relying on this is not
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User recommended, however, as it requires <span><strong class="command">named</strong></span>
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User to be recompiled with a new key when the DLV key expires.)
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User NOTE: Using <code class="filename">bind.keys</code> to store
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User locally-configured keys is possible, but not
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User recommended, as the file will be overwritten whenever
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User <acronym class="acronym">BIND</acronym> 9 is re-installed or upgraded.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User<dt><span class="term"><span><strong class="command">dnssec-must-be-secure</strong></span></span></dt>
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User Specify hierarchies which must be or may not be secure
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User (signed and validated). If <strong class="userinput"><code>yes</code></strong>,
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User then <span><strong class="command">named</strong></span> will only accept answers if
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User they are secure. If <strong class="userinput"><code>no</code></strong>, then normal
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User DNSSEC validation applies allowing for insecure answers to
6d114a4c5cddb176ae5199eee154c0273d652ba4Tinderbox User be accepted. The specified domain must be under a
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User <span><strong class="command">trusted-keys</strong></span> or
9e295ad801d5c986eb6c7745637b5dc0efb28711Tinderbox User <span><strong class="command">managed-keys</strong></span> statement, or
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User <span><strong class="command">dnssec-lookaside</strong></span> must be active.
b8cc0c5d896c361525708a2be2e5af7df76c96d7Tinderbox User<div class="titlepage"><div><div><h4 class="title">
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User<a name="boolean_options"></a>Boolean Options</h4></div></div></div>
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User<dt><span class="term"><span><strong class="command">auth-nxdomain</strong></span></span></dt>
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User If <strong class="userinput"><code>yes</code></strong>, then the <span><strong class="command">AA</strong></span> bit
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User is always set on NXDOMAIN responses, even if the server is
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User authoritative. The default is <strong class="userinput"><code>no</code></strong>;
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User a change from <acronym class="acronym">BIND</acronym> 8. If you
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User are using very old DNS software, you
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User may need to set it to <strong class="userinput"><code>yes</code></strong>.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User<dt><span class="term"><span><strong class="command">deallocate-on-exit</strong></span></span></dt>
43c88753060df6335a789cd9bef2994d724d8be5Tinderbox User This option was used in <acronym class="acronym">BIND</acronym>
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User 8 to enable checking
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User for memory leaks on exit. <acronym class="acronym">BIND</acronym> 9 ignores the option and always performs
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User<dt><span class="term"><span><strong class="command">memstatistics</strong></span></span></dt>
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User Write memory statistics to the file specified by
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User <span><strong class="command">memstatistics-file</strong></span> at exit.
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User The default is <strong class="userinput"><code>no</code></strong> unless
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User '-m record' is specified on the command line in
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User which case it is <strong class="userinput"><code>yes</code></strong>.
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User<dt><span class="term"><span><strong class="command">dialup</strong></span></span></dt>
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User If <strong class="userinput"><code>yes</code></strong>, then the
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User server treats all zones as if they are doing zone transfers
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User a dial-on-demand dialup link, which can be brought up by
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User originating from this server. This has different effects
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User to zone type and concentrates the zone maintenance so that
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User happens in a short interval, once every <span><strong class="command">heartbeat-interval</strong></span> and
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User hopefully during the one call. It also suppresses some of
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User zone maintenance traffic. The default is <strong class="userinput"><code>no</code></strong>.
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User The <span><strong class="command">dialup</strong></span> option
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User may also be specified in the <span><strong class="command">view</strong></span> and
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User <span><strong class="command">zone</strong></span> statements,
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User in which case it overrides the global <span><strong class="command">dialup</strong></span>
2ec4ab21838e218863d052ebfa3e106e04f50820Evan Hunt If the zone is a master zone, then the server will send out a
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews request to all the slaves (default). This should trigger the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews number check in the slave (providing it supports NOTIFY)
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews allowing the slave
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews to verify the zone while the connection is active.
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews The set of servers to which NOTIFY is sent can be controlled
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">notify</strong></span> and <span><strong class="command">also-notify</strong></span>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews zone is a slave or stub zone, then the server will suppress
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews "zone up to date" (refresh) queries and only perform them
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">heartbeat-interval</strong></span> expires in
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews addition to sending
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews NOTIFY requests.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Finer control can be achieved by using
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <strong class="userinput"><code>notify</code></strong> which only sends NOTIFY
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <strong class="userinput"><code>notify-passive</code></strong> which sends NOTIFY
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews messages and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews suppresses the normal refresh queries, <strong class="userinput"><code>refresh</code></strong>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews which suppresses normal refresh processing and sends refresh
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews when the <span><strong class="command">heartbeat-interval</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews expires, and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <strong class="userinput"><code>passive</code></strong> which just disables normal
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews normal refresh
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews heart-beat refresh
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews heart-beat notify
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <p><span><strong class="command">no</strong></span> (default)</p>
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews <p><span><strong class="command">yes</strong></span></p>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <p><span><strong class="command">notify</strong></span></p>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <p><span><strong class="command">refresh</strong></span></p>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <p><span><strong class="command">passive</strong></span></p>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <p><span><strong class="command">notify-passive</strong></span></p>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Note that normal NOTIFY processing is not affected by
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">dialup</strong></span>.
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews<dt><span class="term"><span><strong class="command">fake-iquery</strong></span></span></dt>
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews In <acronym class="acronym">BIND</acronym> 8, this option
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews enabled simulating the obsolete DNS query type
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User IQUERY. <acronym class="acronym">BIND</acronym> 9 never does
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt IQUERY simulation.
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt<dt><span class="term"><span><strong class="command">fetch-glue</strong></span></span></dt>
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt This option is obsolete.
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt In BIND 8, <strong class="userinput"><code>fetch-glue yes</code></strong>
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt caused the server to attempt to fetch glue resource records
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt didn't have when constructing the additional
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt data section of a response. This is now considered a bad
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt and BIND 9 never does it.
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt<dt><span class="term"><span><strong class="command">flush-zones-on-shutdown</strong></span></span></dt>
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt When the nameserver exits due receiving SIGTERM,
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt flush or do not flush any pending zone writes. The default
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt <span><strong class="command">flush-zones-on-shutdown</strong></span> <strong class="userinput"><code>no</code></strong>.
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User<dt><span class="term"><span><strong class="command">has-old-clients</strong></span></span></dt>
214af784e91553d387246fd9ce46cb1291697b9aTinderbox User This option was incorrectly implemented
ab272d2204a075b5ed0798d04733a9028782b8daEvan Hunt in <acronym class="acronym">BIND</acronym> 8, and is ignored by <acronym class="acronym">BIND</acronym> 9.
72a6417eb3792914417031300a8589be63ab1102Tinderbox User To achieve the intended effect
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater <span><strong class="command">has-old-clients</strong></span> <strong class="userinput"><code>yes</code></strong>, specify
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater the two separate options <span><strong class="command">auth-nxdomain</strong></span> <strong class="userinput"><code>yes</code></strong>
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater and <span><strong class="command">rfc2308-type1</strong></span> <strong class="userinput"><code>no</code></strong> instead.
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater<dt><span class="term"><span><strong class="command">host-statistics</strong></span></span></dt>
9e295ad801d5c986eb6c7745637b5dc0efb28711Tinderbox User In BIND 8, this enables keeping of
9e295ad801d5c986eb6c7745637b5dc0efb28711Tinderbox User statistics for every host that the name server interacts
9e295ad801d5c986eb6c7745637b5dc0efb28711Tinderbox User Not implemented in BIND 9.
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User<dt><span class="term"><span><strong class="command">maintain-ixfr-base</strong></span></span></dt>
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater <span class="emphasis"><em>This option is obsolete</em></span>.
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater It was used in <acronym class="acronym">BIND</acronym> 8 to
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User determine whether a transaction log was
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews kept for Incremental Zone Transfer. <acronym class="acronym">BIND</acronym> 9 maintains a transaction
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson log whenever possible. If you need to disable outgoing
309b912841e8b97bf0b0df0d96c3eaf16990c080Automatic Updater incremental zone
66d24a46538c7c2d29fdb5611ab1173e83685b1dTinderbox User transfers, use <span><strong class="command">provide-ixfr</strong></span> <strong class="userinput"><code>no</code></strong>.
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson<dt><span class="term"><span><strong class="command">minimal-responses</strong></span></span></dt>
754ebd37e782356aedbb2987e3c1a8ab4f29574eMark Andrews If <strong class="userinput"><code>yes</code></strong>, then when generating
754ebd37e782356aedbb2987e3c1a8ab4f29574eMark Andrews responses the server will only add records to the authority
754ebd37e782356aedbb2987e3c1a8ab4f29574eMark Andrews and additional data sections when they are required (e.g.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews delegations, negative responses). This may improve the
94df856897945fe58f130ba78765c57308bc5400Automatic Updater performance of the server.
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User The default is <strong class="userinput"><code>no</code></strong>.
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User<dt><span class="term"><span><strong class="command">multiple-cnames</strong></span></span></dt>
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User This option was used in <acronym class="acronym">BIND</acronym> 8 to allow
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User a domain name to have multiple CNAME records in violation of
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User the DNS standards. <acronym class="acronym">BIND</acronym> 9.2 onwards
5c679dbb66df92766f6a7e7bb93c18d61275d1feMark Andrews always strictly enforces the CNAME rules both in master
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User files and dynamic updates.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater<dt><span class="term"><span><strong class="command">notify</strong></span></span></dt>
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews If <strong class="userinput"><code>yes</code></strong> (the default),
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews DNS NOTIFY messages are sent when a zone the server is
9e295ad801d5c986eb6c7745637b5dc0efb28711Tinderbox User authoritative for
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User changes, see <a href="Bv9ARM.ch04.html#notify" title="Notify">the section called “Notify”</a>. The messages are
da93950363b307b718d156514b95b9df93a63776Mark Andrews servers listed in the zone's NS records (except the master
9e295ad801d5c986eb6c7745637b5dc0efb28711Tinderbox User server identified
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User in the SOA MNAME field), and to any servers listed in the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">also-notify</strong></span> option.
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User If <strong class="userinput"><code>master-only</code></strong>, notifies are only
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User for master zones.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User If <strong class="userinput"><code>explicit</code></strong>, notifies are sent only
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater servers explicitly listed using <span><strong class="command">also-notify</strong></span>.
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User If <strong class="userinput"><code>no</code></strong>, no notifies are sent.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The <span><strong class="command">notify</strong></span> option may also be
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User specified in the <span><strong class="command">zone</strong></span>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User in which case it overrides the <span><strong class="command">options notify</strong></span> statement.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User It would only be necessary to turn off this option if it
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User caused slaves
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">notify-to-soa</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User If <strong class="userinput"><code>yes</code></strong> do not check the nameservers
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User in the NS RRset against the SOA MNAME. Normally a NOTIFY
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User message is not sent to the SOA MNAME (SOA ORIGIN) as it is
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User supposed to contain the name of the ultimate master.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Sometimes, however, a slave is listed as the SOA MNAME in
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User hidden master configurations and in that case you would
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User want the ultimate master to still send NOTIFY messages to
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User all the nameservers listed in the NS RRset.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">recursion</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User If <strong class="userinput"><code>yes</code></strong>, and a
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User DNS query requests recursion, then the server will attempt
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User all the work required to answer the query. If recursion is
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User and the server does not already know the answer, it will
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User referral response. The default is
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <strong class="userinput"><code>yes</code></strong>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Note that setting <span><strong class="command">recursion no</strong></span> does not prevent
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User clients from getting data from the server's cache; it only
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User prevents new data from being cached as an effect of client
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Caching may still occur as an effect the server's internal
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User operation, such as NOTIFY address lookups.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User See also <span><strong class="command">fetch-glue</strong></span> above.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">rfc2308-type1</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Setting this to <strong class="userinput"><code>yes</code></strong> will
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User cause the server to send NS records along with the SOA
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User record for negative
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User answers. The default is <strong class="userinput"><code>no</code></strong>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Not yet implemented in <acronym class="acronym">BIND</acronym>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">use-id-pool</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <span class="emphasis"><em>This option is obsolete</em></span>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <acronym class="acronym">BIND</acronym> 9 always allocates query
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User IDs from a pool.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">zone-statistics</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User If <strong class="userinput"><code>yes</code></strong>, the server will collect
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User statistical data on all zones (unless specifically turned
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User on a per-zone basis by specifying <span><strong class="command">zone-statistics no</strong></span>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User in the <span><strong class="command">zone</strong></span> statement).
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The default is <strong class="userinput"><code>no</code></strong>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User These statistics may be accessed
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User using <span><strong class="command">rndc stats</strong></span>, which will
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User dump them to the file listed
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User in the <span><strong class="command">statistics-file</strong></span>. See
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User also <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">use-ixfr</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <span class="emphasis"><em>This option is obsolete</em></span>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User If you need to disable IXFR to a particular server or
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User the information on the <span><strong class="command">provide-ixfr</strong></span> option
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User in <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Usage”</a>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <a href="Bv9ARM.ch04.html#incremental_zone_transfers" title="Incremental Zone Transfers (IXFR)">the section called “Incremental Zone Transfers (IXFR)”</a>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">provide-ixfr</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User See the description of
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <span><strong class="command">provide-ixfr</strong></span> in
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Usage”</a>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">request-ixfr</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User See the description of
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <span><strong class="command">request-ixfr</strong></span> in
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Usage”</a>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span><strong class="command">treat-cr-as-space</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User This option was used in <acronym class="acronym">BIND</acronym>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User the server treat carriage return ("<span><strong class="command">\r</strong></span>") characters the same way
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User as a space or tab character,
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User to facilitate loading of zone files on a UNIX system that
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User were generated
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User on an NT or DOS machine. In <acronym class="acronym">BIND</acronym> 9, both UNIX "<span><strong class="command">\n</strong></span>"
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User and NT/DOS "<span><strong class="command">\r\n</strong></span>" newlines
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User are always accepted,
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User and the option is ignored.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<span class="term"><span><strong class="command">additional-from-auth</strong></span>, </span><span class="term"><span><strong class="command">additional-from-cache</strong></span></span>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User These options control the behavior of an authoritative
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User answering queries which have additional data, or when
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User following CNAME
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User and DNAME chains.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User When both of these options are set to <strong class="userinput"><code>yes</code></strong>
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews (the default) and a
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews query is being answered from authoritative data (a zone
549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User configured into the server), the additional data section of
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User reply will be filled in using data from other authoritative
631aac8c2802f14d2e8ab42255d14a3337009da7Tinderbox User and from the cache. In some situations this is undesirable,
631aac8c2802f14d2e8ab42255d14a3337009da7Tinderbox User as when there is concern over the correctness of the cache,
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User in servers where slave zones may be added and modified by
19558a04decde0e7261d489d92d04ad88104217bTinderbox User untrusted third parties. Also, avoiding
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User the search for this additional data will speed up server
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User at the possible expense of additional queries to resolve
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews otherwise be provided in the additional section.
a42655602677933f768df30059ac23cc98d71958Tinderbox User For example, if a query asks for an MX record for host <code class="literal">foo.example.com</code>,
1bf507ca635310b340aea42d6c3e567819974a99Tinderbox User and the record found is "<code class="literal">MX 10 mail.example.net</code>", normally the address
d5637bdbb931ff79fced3d4858d83212ea58ed15Tinderbox User records (A and AAAA) for <code class="literal">mail.example.net</code> will be provided as well,
5747235bf35e7398984fd6b4632743396895ea7aTinderbox User if known, even though they are not in the example.com zone.
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews Setting these options to <span><strong class="command">no</strong></span>
644973f327e9db74779e7c0426db90909173b284Automatic Updater disables this behavior and makes
644973f327e9db74779e7c0426db90909173b284Automatic Updater the server only search for additional data in the zone it
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews answers from.
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User These options are intended for use in authoritative-only
170a1a5adbb78860d29ffe322c8dadbdc8e5accbTinderbox User servers, or in authoritative-only views. Attempts to set
631aac8c2802f14d2e8ab42255d14a3337009da7Tinderbox User them to <span><strong class="command">no</strong></span> without also
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User <span><strong class="command">recursion no</strong></span> will cause the
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User ignore the options and log a warning message.
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User Specifying <span><strong class="command">additional-from-cache no</strong></span> actually
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User disables the use of the cache not only for additional data
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User but also when looking up the answer. This is usually the
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User behavior in an authoritative-only server where the
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User correctness of
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User the cached data is an issue.
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User When a name server is non-recursively queried for a name
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User below the apex of any served zone, it normally answers with
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User "upwards referral" to the root servers or the servers of
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User known parent of the query name. Since the data in an
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User upwards referral
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User comes from the cache, the server will not be able to provide
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews referrals when <span><strong class="command">additional-from-cache no</strong></span>
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User has been specified. Instead, it will respond to such
19558a04decde0e7261d489d92d04ad88104217bTinderbox User with REFUSED. This should not cause any problems since
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User upwards referrals are not required for the resolution
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User<dt><span class="term"><span><strong class="command">match-mapped-addresses</strong></span></span></dt>
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews If <strong class="userinput"><code>yes</code></strong>, then an
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews IPv4-mapped IPv6 address will match any address match
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews list entries that match the corresponding IPv4 address.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews This option was introduced to work around a kernel quirk
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews in some operating systems that causes IPv4 TCP
90863a6f9bfb06062c7fdf269bb675e7b674fc31Mark Andrews connections, such as zone transfers, to be accepted on an
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews IPv6 socket using mapped addresses. This caused address
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews match lists designed for IPv4 to fail to match. However,
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <span><strong class="command">named</strong></span> now solves this problem
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews internally. The use of this option is discouraged.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<dt><span class="term"><span><strong class="command">filter-aaaa-on-v4</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews This option is only available when
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <acronym class="acronym">BIND</acronym> 9 is compiled with the
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <strong class="userinput"><code>--enable-filter-aaaa</code></strong> option on the
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews "configure" command line. It is intended to help the
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews transition from IPv4 to IPv6 by not giving IPv6 addresses
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to DNS clients unless they have connections to the IPv6
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Internet. This is not recommended unless absolutely
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews necessary. The default is <strong class="userinput"><code>no</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">filter-aaaa-on-v4</strong></span> option
8de3f14f1c300c3e1ed99084cc03485b42c92bf1Tinderbox User may also be specified in <span><strong class="command">view</strong></span> statements
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews to override the global <span><strong class="command">filter-aaaa-on-v4</strong></span>
45eca3a5d46ed15aee14d81f6cb6c9fb6f365344Mark Andrews If <strong class="userinput"><code>yes</code></strong>,
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User the DNS client is at an IPv4 address,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User and if the response does not include DNSSEC signatures,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater then all AAAA records are deleted from the response.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This filtering applies to all responses and not only
45eca3a5d46ed15aee14d81f6cb6c9fb6f365344Mark Andrews authoritative responses.
6634faa55bb26d8e995dd5ad4755060f1bedc2f0Tinderbox User If <strong class="userinput"><code>break-dnssec</code></strong>,
6306dd073e0eba562491222821c4d3b39f440718Evan Hunt then AAAA records are deleted even when dnssec is enabled.
6306dd073e0eba562491222821c4d3b39f440718Evan Hunt As suggested by the name, this makes the response not verify,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User because the DNSSEC protocol is designed detect deletions.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User This mechanism can erroneously cause other servers to
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews not give AAAA records to their clients.
872a5b83f68b8058945298715b0fa53442aad52fAutomatic Updater A recursing server with both IPv6 and IPv4 network connections
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews that queries an authoritative server using this mechanism
bac4435d473c9a0281507524f084480c34aa942aTinderbox User via IPv4 will be denied AAAA records even if its client is
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User This mechanism is applied to authoritative as well as
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews non-authoritative records.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews A client using IPv4 that is not allowed recursion can
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews erroneously be given AAAA records because the server is not
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews allowed to check for A records.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews Some AAAA records are given to IPv4 clients in glue records.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews IPv4 clients that are servers can then erroneously
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews answer requests for AAAA records received via IPv4.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews When <strong class="userinput"><code>yes</code></strong> and the server loads a new version of a master
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews zone from its zone file or receives a new version of a slave
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews file by a non-incremental zone transfer, it will compare
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews the new version to the previous one and calculate a set
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews of differences. The differences are then logged in the
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews zone's journal file such that the changes can be transmitted
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews to downstream slaves as an incremental zone transfer.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews By allowing incremental zone transfers to be used for
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews non-dynamic zones, this option saves bandwidth at the
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews expense of increased CPU and memory consumption at the
5f7e0eb1cb917b788906d3e2aa01bfc4885dcae4Mark Andrews In particular, if the new version of a zone is completely
bf1263835e8e35421960f65088c043f42aacef13Mark Andrews different from the previous one, the set of differences
15ae68f3db8261770fc33b8e0f83f5d8c7021e84Mark Andrews will be of a size comparable to the combined size of the
ac4e70ff8955669341f435bc0a734a17c01af124Mark Andrews old and new zone version, and the server will need to
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews temporarily allocate memory to hold this complete
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews difference set.
cb40461f8744c5aeb369b84d5f48395a13a221a0Mark Andrews<p><span><strong class="command">ixfr-from-differences</strong></span>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User also accepts <span><strong class="command">master</strong></span> and
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews <span><strong class="command">slave</strong></span> at the view and options
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews levels which causes
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User <span><strong class="command">ixfr-from-differences</strong></span> to be enabled for
76fbdc591b3d46df28878a6ff844798622b85265Tinderbox User all <span><strong class="command">master</strong></span> or
93ca5ee4c4c77aca8d3bcffd70216f30ef398387Mark Andrews <span><strong class="command">slave</strong></span> zones respectively.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User It is off by default.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">multi-master</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This should be set when you have multiple masters for a zone
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater addresses refer to different machines. If <strong class="userinput"><code>yes</code></strong>, <span><strong class="command">named</strong></span> will
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User when the serial number on the master is less than what <span><strong class="command">named</strong></span>
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User has. The default is <strong class="userinput"><code>no</code></strong>.
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User<dt><span class="term"><span><strong class="command">dnssec-enable</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Enable DNSSEC support in <span><strong class="command">named</strong></span>. Unless set to <strong class="userinput"><code>yes</code></strong>,
436aad11e01e916f75e68a2e9cb89ac217a990d3Tinderbox User <span><strong class="command">named</strong></span> behaves as if it does not support DNSSEC.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater The default is <strong class="userinput"><code>yes</code></strong>.
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews<dt><span class="term"><span><strong class="command">dnssec-validation</strong></span></span></dt>
d97783f18169fc9c5220a0b91fe53653efcd6b10Tinderbox User Enable DNSSEC validation in <span><strong class="command">named</strong></span>.
76fbdc591b3d46df28878a6ff844798622b85265Tinderbox User Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
34348322c7016b6b5d1bceee5b1cf42e2d2216b4Tinderbox User set to <strong class="userinput"><code>yes</code></strong> to be effective.
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User The default is <strong class="userinput"><code>yes</code></strong>.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<dt><span class="term"><span><strong class="command">dnssec-accept-expired</strong></span></span></dt>
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User Accept expired signatures when verifying DNSSEC signatures.
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews The default is <strong class="userinput"><code>no</code></strong>.
09ee43766e232bd04066445db114c2703dd02bf8Tinderbox User Setting this option to <strong class="userinput"><code>yes</code></strong>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater leaves <span><strong class="command">named</strong></span> vulnerable to
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User replay attacks.
bac4435d473c9a0281507524f084480c34aa942aTinderbox User<dt><span class="term"><span><strong class="command">querylog</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Specify whether query logging should be started when <span><strong class="command">named</strong></span>
ebef9584efe60846358489cc9269e93690fbd8c3Tinderbox User If <span><strong class="command">querylog</strong></span> is not specified,
6715db6593ce9a271ac3131cd7a886feaa386a2eEvan Hunt then the query logging
6715db6593ce9a271ac3131cd7a886feaa386a2eEvan Hunt is determined by the presence of the logging category <span><strong class="command">queries</strong></span>.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<dt><span class="term"><span><strong class="command">check-names</strong></span></span></dt>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews This option is used to restrict the character set and syntax
0197efed438a96881ebd8d165f8479a89f1ba62fTinderbox User certain domain names in master files and/or DNS responses
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews from the network. The default varies according to usage
f0c5e918974bf778af6cd1e25309ad13e30a79a6Tinderbox User <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>.
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User For <span><strong class="command">slave</strong></span> zones the default
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews is <span><strong class="command">warn</strong></span>.
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt For answers received from the network (<span><strong class="command">response</strong></span>)
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater the default is <span><strong class="command">ignore</strong></span>.
2846972c703e9c588e88726c10caf62c7cdbefd0Tinderbox User The rules for legal hostnames and mail domains are derived
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont from RFC 952 and RFC 821 as modified by RFC 1123.
d6487e3c0a981bd8ac1e155d3a2d590c078d6c85Tinderbox User<p><span><strong class="command">check-names</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User applies to the owner names of A, AAAA and MX records.
9160e27507ba636887f6352bee5cb3729108fc76Tinderbox User It also applies to the domain names in the RDATA of NS, SOA,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews MX, and SRV records.
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User It also applies to the RDATA of PTR records where the owner
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews name indicated that it is a reverse lookup of a hostname
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT).
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews<dt><span class="term"><span><strong class="command">check-dup-records</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Check master zones for records that are treated as different
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User by DNSSEC but are semantically equal in plain DNS. The
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User default is to <span><strong class="command">warn</strong></span>. Other possible
1404d301dd9e7e487a247b803f63909cd10cdf72Tinderbox User values are <span><strong class="command">fail</strong></span> and
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews <span><strong class="command">ignore</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">check-mx</strong></span></span></dt>
bac4435d473c9a0281507524f084480c34aa942aTinderbox User Check whether the MX record appears to refer to a IP address.
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews The default is to <span><strong class="command">warn</strong></span>. Other possible
dc5552b4df5e3821783821c8d4e734c1608c446eTinderbox User values are <span><strong class="command">fail</strong></span> and
e23761df2059ed612c8fb7cc248d93bb2c4f62dbTinderbox User <span><strong class="command">ignore</strong></span>.
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt<dt><span class="term"><span><strong class="command">check-mx</strong></span></span></dt>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Check whether the MX record appears to refer to a IP address.
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User The default is to <span><strong class="command">warn</strong></span>. Other possible
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User values are <span><strong class="command">fail</strong></span> and
02b3e44a996e9753d86306b6a1b6b579a73787fcTinderbox User <span><strong class="command">ignore</strong></span>.
616c05f95f9a9683d73c108df2eda56bf70b77ccTinderbox User<dt><span class="term"><span><strong class="command">check-wildcard</strong></span></span></dt>
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt This option is used to check for non-terminal wildcards.
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews The use of non-terminal wildcards is almost always as a
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews result of a failure
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews to understand the wildcard matching algorithm (RFC 1034).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater affects master zones. The default (<span><strong class="command">yes</strong></span>) is to check
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User for non-terminal wildcards and issue a warning.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater<dt><span class="term"><span><strong class="command">check-integrity</strong></span></span></dt>
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater Perform post load zone integrity checks on master
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews zones. This checks that MX and SRV records refer
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt to address (A or AAAA) records and that glue
e1a389f7478d094ffbe592df28328a10d484cb38Tinderbox User address records exist for delegated zones. For
93ca5ee4c4c77aca8d3bcffd70216f30ef398387Mark Andrews MX and SRV records only in-zone hostnames are
e20309353e6246485c521278131d3fced73d7957Tinderbox User checked (for out-of-zone hostnames use
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews <span><strong class="command">named-checkzone</strong></span>).
c74518d655c1c563060f49569dce71e4a00f5f4eTinderbox User For NS records only names below top of zone are
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User checked (for out-of-zone names and glue consistency
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater checks use <span><strong class="command">named-checkzone</strong></span>).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <span><strong class="command">yes</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">check-mx-cname</strong></span></span></dt>
93ca5ee4c4c77aca8d3bcffd70216f30ef398387Mark Andrews If <span><strong class="command">check-integrity</strong></span> is set then
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater fail, warn or ignore MX records that refer
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews to CNAMES. The default is to <span><strong class="command">warn</strong></span>.
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews<dt><span class="term"><span><strong class="command">check-srv-cname</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <span><strong class="command">check-integrity</strong></span> is set then
713a5e3080f112b3efde9235e9c92035056ff966Automatic Updater fail, warn or ignore SRV records that refer
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews to CNAMES. The default is to <span><strong class="command">warn</strong></span>.
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User<dt><span class="term"><span><strong class="command">check-sibling</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater When performing integrity checks, also check that
cb40461f8744c5aeb369b84d5f48395a13a221a0Mark Andrews sibling glue exists. The default is <span><strong class="command">yes</strong></span>.
8add7cdaa81ec881fe17df02ed8833722dc9e690Tinderbox User<dt><span class="term"><span><strong class="command">zero-no-soa-ttl</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User When returning authoritative negative responses to
c243d779731a410f8dc2d2feeed20c15f299b6e3Automatic Updater SOA queries set the TTL of the SOA record returned in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the authority section to zero.
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater The default is <span><strong class="command">yes</strong></span>.
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews<dt><span class="term"><span><strong class="command">zero-no-soa-ttl-cache</strong></span></span></dt>
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater When caching a negative response to a SOA query
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater set the TTL to zero.
572cb2c1c931f6bc6a4a019c103ae88239b0eb96Automatic Updater The default is <span><strong class="command">no</strong></span>.
3e5340279d8875d136a4dd815cccad0044aa2644Automatic Updater<dt><span class="term"><span><strong class="command">update-check-ksk</strong></span></span></dt>
28e0061dbcc2ae45d34541267a00d8b4de5b4a41Tinderbox User When set to the default value of <code class="literal">yes</code>,
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User check the KSK bit in each key to determine how the key
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews should be used when generating RRSIGs for a secure zone.
87d570d3531d3d0eef29c4f2007cef1dbd6aed2cTinderbox User Ordinarily, zone-signing keys (that is, keys without the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater KSK bit set) are used to sign the entire zone, while
d630ef2ff74445949a482660938e9fa9da52ca14Automatic Updater key-signing keys (keys with the KSK bit set) are only
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User used to sign the DNSKEY RRset at the zone apex.
d6487e3c0a981bd8ac1e155d3a2d590c078d6c85Tinderbox User However, if this option is set to <code class="literal">no</code>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews then the KSK bit is ignored; KSKs are treated as if they
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater were ZSKs and are used to sign the entire zone. This is
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User similar to the <span><strong class="command">dnssec-signzone -z</strong></span>
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews command line option.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User When this option is set to <code class="literal">yes</code>, there
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User must be at least two active keys for every algorithm
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews represented in the DNSKEY RRset: at least one KSK and one
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User ZSK per algorithm. If there is any algorithm for which
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User this requirement is not met, this option will be ignored
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews for that algorithm.
aef6cf0f147a5014d4891c9689b9f463399e16e7Tinderbox User<dt><span class="term"><span><strong class="command">dnssec-dnskey-kskonly</strong></span></span></dt>
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews When this option and <span><strong class="command">update-check-ksk</strong></span>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User are both set to <code class="literal">yes</code>, only key-signing
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User keys (that is, keys with the KSK bit set) will be used
ace87434ed3dc7b9d8b36835fd2ce497d29d8191Tinderbox User to sign the DNSKEY RRset at the zone apex. Zone-signing
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews keys (keys without the KSK bit set) will be used to sign
0197efed438a96881ebd8d165f8479a89f1ba62fTinderbox User the remainder of the zone, but not the DNSKEY RRset.
d6487e3c0a981bd8ac1e155d3a2d590c078d6c85Tinderbox User This is similar to the
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews <span><strong class="command">dnssec-signzone -x</strong></span> command line option.
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews The default is <span><strong class="command">no</strong></span>. If
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span><strong class="command">update-check-ksk</strong></span> is set to
d6487e3c0a981bd8ac1e155d3a2d590c078d6c85Tinderbox User <code class="literal">no</code>, this option is ignored.
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews<dt><span class="term"><span><strong class="command">try-tcp-refresh</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Try to refresh the zone using TCP if UDP queries fail.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User For BIND 8 compatibility, the default is
aef6cf0f147a5014d4891c9689b9f463399e16e7Tinderbox User <span><strong class="command">yes</strong></span>.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">dnssec-secure-to-insecure</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Allow a zone to transition from secure to insecure by
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews deleting all DNSKEY records. The default is
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews <span><strong class="command">no</strong></span>.
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User<div class="titlepage"><div><div><h4 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2582885"></a>Forwarding</h4></div></div></div>
34348322c7016b6b5d1bceee5b1cf42e2d2216b4Tinderbox User The forwarding facility can be used to create a large site-wide
fc57adef42982f7a8cc4a5ad81bcebacec10b5feTinderbox User cache on a few servers, reducing traffic over links to external
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User name servers. It can also be used to allow queries by servers that
00ce5d1add91ba5664de4da3cda8c3a5017ba6a7Tinderbox User do not have direct access to the Internet, but wish to look up
00ce5d1add91ba5664de4da3cda8c3a5017ba6a7Tinderbox User names anyway. Forwarding occurs only on those queries for which
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User the server is not authoritative and does not have the answer in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">forward</strong></span></span></dt>
8f1a00cf8b3d9dc8d419a797b7ff4fb6ddba428eTinderbox User This option is only meaningful if the
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User forwarders list is not empty. A value of <code class="varname">first</code>,
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User the default, causes the server to query the forwarders
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User first — and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater if that doesn't answer the question, the server will then
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User the answer itself. If <code class="varname">only</code> is
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User specified, the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater server will only query the forwarders.
a61158fed2e0281a40e3e97e0b7c3f9789a07b4eTinderbox User<dt><span class="term"><span><strong class="command">forwarders</strong></span></span></dt>
a61158fed2e0281a40e3e97e0b7c3f9789a07b4eTinderbox User Specifies the IP addresses to be used
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User for forwarding. The default is the empty list (no
59b277af9d9aac08d16be63aed5ae60ac9eef0d5Automatic Updater Forwarding can also be configured on a per-domain basis, allowing
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User for the global forwarding options to be overridden in a variety
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater of ways. You can set particular domains to use different
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater or have a different <span><strong class="command">forward only/first</strong></span> behavior,
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User or not forward at all, see <a href="Bv9ARM.ch06.html#zone_statement_grammar" title="zone
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User Statement Grammar">the section called “<span><strong class="command">zone</strong></span>
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User Statement Grammar”</a>.
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User<div class="titlepage"><div><div><h4 class="title">
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews<a name="id2583012"></a>Dual-stack Servers</h4></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Dual-stack servers are used as servers of last resort to work
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews problems in reachability due the lack of support for either IPv4
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater on the host machine.
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User<dt><span class="term"><span><strong class="command">dual-stack-servers</strong></span></span></dt>
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User Specifies host names or addresses of machines with access to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater both IPv4 and IPv6 transports. If a hostname is used, the
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User server must be able
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to resolve the name using only the transport it has. If the
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User machine is dual
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater stacked, then the <span><strong class="command">dual-stack-servers</strong></span> have no effect unless
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User access to a transport has been disabled on the command line
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater (e.g. <span><strong class="command">named -4</strong></span>).
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User<div class="titlepage"><div><div><h4 class="title">
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User<a name="access_control"></a>Access Control</h4></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Access to the server can be restricted based on the IP address
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User of the requesting system. See <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a> for
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User details on how to specify IP address lists.
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User<dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt>
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User Specifies which hosts are allowed to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater notify this server, a slave, of zone changes in addition
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User to the zone masters.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-notify</strong></span> may also be
c0cc232ba92b92c1c5a48d49449ef56f7ca05b56Tinderbox User specified in the
316cd2460aa66e157f72890974ca5c21d65e70e6Tinderbox User <span><strong class="command">zone</strong></span> statement, in which case
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User it overrides the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">options allow-notify</strong></span>
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User statement. It is only meaningful
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater for a slave zone. If not specified, the default is to
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User process notify messages
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater only from a zone's master.
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User<dt><span class="term"><span><strong class="command">allow-query</strong></span></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User Specifies which hosts are allowed to ask ordinary
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater DNS questions. <span><strong class="command">allow-query</strong></span> may
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User also be specified in the <span><strong class="command">zone</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater statement, in which case it overrides the
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User <span><strong class="command">options allow-query</strong></span> statement.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If not specified, the default is to allow queries
6284b9b877d2205240dce1cf7f88d4dca888e44aTinderbox User from all hosts.
36c0c1405d4dd31afaf614668f4512e69637e159Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-query-cache</strong></span> is now
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User used to specify access to the cache.
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User<dt><span class="term"><span><strong class="command">allow-query-on</strong></span></span></dt>
0a2ff769ecd0b5a6bda54b62bc1ec5fa6fd198a0Tinderbox User Specifies which local addresses can accept ordinary
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User DNS questions. This makes it possible, for instance,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to allow queries on internal-facing interfaces but
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User disallow them on external-facing ones, without
79b627f399ce925988bb326315e6742d5316cb6bTinderbox User necessarily knowing the internal network's addresses.
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User <span><strong class="command">allow-query-on</strong></span> may
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater also be specified in the <span><strong class="command">zone</strong></span>
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User statement, in which case it overrides the
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span><strong class="command">options allow-query-on</strong></span> statement.
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User If not specified, the default is to allow queries
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater on all addresses.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User <span><strong class="command">allow-query-cache</strong></span> is
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater used to specify access to the cache.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">allow-query-cache</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Specifies which hosts are allowed to get answers
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User from the cache. If <span><strong class="command">allow-query-cache</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is not set then <span><strong class="command">allow-recursion</strong></span>
f525041ae26958385b697cf82a30f108577024b6Tinderbox User is used if set, otherwise <span><strong class="command">allow-query</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is used if set unless <span><strong class="command">recursion no;</strong></span> is
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User set in which case <span><strong class="command">none;</strong></span> is used,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater otherwise the default (<span><strong class="command">localnets;</strong></span>
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User <span><strong class="command">localhost;</strong></span>) is used.
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User<dt><span class="term"><span><strong class="command">allow-query-cache-on</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Specifies which local addresses can give answers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater from the cache. If not specified, the default is
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews to allow cache queries on any address,
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews <span><strong class="command">localnets</strong></span> and
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User <span><strong class="command">localhost</strong></span>.
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews<dt><span class="term"><span><strong class="command">allow-recursion</strong></span></span></dt>
aef6cf0f147a5014d4891c9689b9f463399e16e7Tinderbox User Specifies which hosts are allowed to make recursive
f0c5e918974bf778af6cd1e25309ad13e30a79a6Tinderbox User queries through this server. If
bd4b86327dc2825e7bf256c9f5fed2586c2fd61aTinderbox User <span><strong class="command">allow-recursion</strong></span> is not set
5a23eb8cb48cee59999acc9af33f643dbcd76feaTinderbox User then <span><strong class="command">allow-query-cache</strong></span> is
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews used if set, otherwise <span><strong class="command">allow-query</strong></span>
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews is used if set, otherwise the default
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews (<span><strong class="command">localnets;</strong></span>
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews <span><strong class="command">localhost;</strong></span>) is used.
0d3490f93bb980fde704055e74c1b508987a5fe4Mark Andrews<dt><span class="term"><span><strong class="command">allow-recursion-on</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Specifies which local addresses can accept recursive
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User queries. If not specified, the default is to allow
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User recursive queries on all addresses.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">allow-update</strong></span></span></dt>
33d1cff1dd63494ffa00fac695a793f00c4ebf0bTinderbox User Specifies which hosts are allowed to
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater submit Dynamic DNS updates for master zones. The default is
8f1a00cf8b3d9dc8d419a797b7ff4fb6ddba428eTinderbox User updates from all hosts. Note that allowing updates based
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User on the requestor's IP address is insecure; see
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a> for details.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt Specifies which hosts are allowed to
e64202536ea72d8f371dd0df9fc763f8d70bf886Tinderbox User submit Dynamic DNS updates to slave zones to be forwarded to
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont master. The default is <strong class="userinput"><code>{ none; }</code></strong>,
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User means that no update forwarding will be performed. To
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User update forwarding, specify
34348322c7016b6b5d1bceee5b1cf42e2d2216b4Tinderbox User <strong class="userinput"><code>allow-update-forwarding { any; };</code></strong>.
36c0c1405d4dd31afaf614668f4512e69637e159Tinderbox User Specifying values other than <strong class="userinput"><code>{ none; }</code></strong> or
904890e38b74005395451501400718d759bfc064Tinderbox User <strong class="userinput"><code>{ any; }</code></strong> is usually
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User counterproductive, since
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User the responsibility for update access control should rest
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User master server, not the slaves.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Note that enabling the update forwarding feature on a slave
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User may expose master servers relying on insecure IP address
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User access control to attacks; see <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a>
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt for more details.
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt<dt><span class="term"><span><strong class="command">allow-v6-synthesis</strong></span></span></dt>
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt This option was introduced for the smooth transition from
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater to A6 and from "nibble labels" to binary labels.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater However, since both A6 and binary labels were then
71fc4775d04aea66809e3eb5b5159c55413bdc5cMark Andrews this option was also deprecated.
71fc4775d04aea66809e3eb5b5159c55413bdc5cMark Andrews It is now ignored with some warning messages.
7d704e522860496310bb29c28e76064868401a9cMark Andrews<dt><span class="term"><span><strong class="command">allow-transfer</strong></span></span></dt>
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews Specifies which hosts are allowed to
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater receive zone transfers from the server. <span><strong class="command">allow-transfer</strong></span> may
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater also be specified in the <span><strong class="command">zone</strong></span>
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater statement, in which
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater case it overrides the <span><strong class="command">options allow-transfer</strong></span> statement.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater If not specified, the default is to allow transfers to all
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater<dt><span class="term"><span><strong class="command">blackhole</strong></span></span></dt>
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater Specifies a list of addresses that the
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater server will not accept queries from or use to resolve a
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater query. Queries
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater from these addresses will not be responded to. The default
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User is <strong class="userinput"><code>none</code></strong>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<div class="titlepage"><div><div><h4 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2583449"></a>Interfaces</h4></div></div></div>
da24e725ff982595d74da7e75e9fbd6a696367ccAutomatic Updater The interfaces and ports that the server will answer queries
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User an optional port and an <code class="varname">address_match_list</code>.
28e0061dbcc2ae45d34541267a00d8b4de5b4a41Tinderbox User The server will listen on all interfaces allowed by the address
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User match list. If a port is not specified, port 53 will be used.
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater Multiple <span><strong class="command">listen-on</strong></span> statements are
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<pre class="programlisting">listen-on { 5.6.7.8; };
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User will enable the name server on port 53 for the IP address
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson 5.6.7.8, and on port 1234 of an address on the machine in net
5e82fe9a56d17bfbd120817d00d28c5952ab4ddcTinderbox User 1.2 that is not 1.2.3.4.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews If no <span><strong class="command">listen-on</strong></span> is specified, the
8bc3d252395842452a6d2c775cf8445f6349e331Tinderbox User server will listen on port 53 on all IPv4 interfaces.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">listen-on-v6</strong></span> option is used to
7d19af23a7cff2908a35657dc3e35d1e6fbac2c1Tinderbox User specify the interfaces and the ports on which the server will
76fbdc591b3d46df28878a6ff844798622b85265Tinderbox User for incoming queries sent using IPv6.
4c9f230f7ca5b2b08ea8fd7a6944135801dbe152Tinderbox User as the <code class="varname">address_match_list</code> for the
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater <span><strong class="command">listen-on-v6</strong></span> option,
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater the server does not bind a separate socket to each IPv6 interface
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater address as it does for IPv4 if the operating system has enough API
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater support for IPv6 (specifically if it conforms to RFC 3493 and RFC
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater Instead, it listens on the IPv6 wildcard address.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater If the system only has incomplete API support for IPv6, however,
8f1a00cf8b3d9dc8d419a797b7ff4fb6ddba428eTinderbox User the behavior is the same as that for IPv4.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt A list of particular IPv6 addresses can also be specified, in
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User the server listens on a separate socket for each specified
a8677ecad546c955406b341eb8344ed06768b11eTinderbox User regardless of whether the desired API is supported by the system.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt Multiple <span><strong class="command">listen-on-v6</strong></span> options can
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt For example,
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User<pre class="programlisting">listen-on-v6 { any; };
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Huntlisten-on-v6 port 1234 { !2001:db8::/32; any; };
1fdd58445074579ee3b65c871137a7a1740eb542Mark Andrews will enable the name server on port 53 for any IPv6 addresses
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews (with a single wildcard socket),
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews and on port 1234 of IPv6 addresses that is not in the prefix
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User 2001:db8::/32 (with separate sockets for each matched address.)
603cf17f33da24d460616389ec40d6f2a6e110a0Automatic Updater To make the server not listen on any IPv6 address, use
e64202536ea72d8f371dd0df9fc763f8d70bf886Tinderbox User<pre class="programlisting">listen-on-v6 { none; };
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews If no <span><strong class="command">listen-on-v6</strong></span> option is
6d114a4c5cddb176ae5199eee154c0273d652ba4Tinderbox User specified, the server will not listen on any IPv6 address
6d114a4c5cddb176ae5199eee154c0273d652ba4Tinderbox User unless <span><strong class="command">-6</strong></span> is specified when <span><strong class="command">named</strong></span> is
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews invoked. If <span><strong class="command">-6</strong></span> is specified then
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User <span><strong class="command">named</strong></span> will listen on port 53 on all IPv6 interfaces by default.
9692d283bb43c9eab49a7fadfc1b74a6e20e6151Tinderbox User<div class="titlepage"><div><div><h4 class="title">
b5423cbff7175727ed9046c8c670d8a7bb4d01eaTinderbox User<a name="query_address"></a>Query Address</h4></div></div></div>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont If the server doesn't know the answer to a question, it will
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User query other name servers. <span><strong class="command">query-source</strong></span> specifies
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the address and port used for such queries. For queries sent over
f4ee48be3994797a8332b86c101db4d7b54799ceTinderbox User IPv6, there is a separate <span><strong class="command">query-source-v6</strong></span> option.
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews If <span><strong class="command">address</strong></span> is <span><strong class="command">*</strong></span> (asterisk) or is omitted,
6d114a4c5cddb176ae5199eee154c0273d652ba4Tinderbox User a wildcard IP address (<span><strong class="command">INADDR_ANY</strong></span>)
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews will be used.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User If <span><strong class="command">port</strong></span> is <span><strong class="command">*</strong></span> or is omitted,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User a random port number from a pre-configured
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User range is picked up and will be used for each query.
365bb6f27eace1836cb5bc6b5f9ed8c88fe22e4aTinderbox User The port range(s) is that specified in
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User the <span><strong class="command">use-v4-udp-ports</strong></span> (for IPv4)
9160e27507ba636887f6352bee5cb3729108fc76Tinderbox User and <span><strong class="command">use-v6-udp-ports</strong></span> (for IPv6)
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews options, excluding the ranges specified in
e64202536ea72d8f371dd0df9fc763f8d70bf886Tinderbox User the <span><strong class="command">avoid-v4-udp-ports</strong></span>
f4ee48be3994797a8332b86c101db4d7b54799ceTinderbox User and <span><strong class="command">avoid-v6-udp-ports</strong></span> options, respectively.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The defaults of the <span><strong class="command">query-source</strong></span> and
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews <span><strong class="command">query-source-v6</strong></span> options
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<pre class="programlisting">query-source address * port *;
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrewsquery-source-v6 address * port *;
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater If <span><strong class="command">use-v4-udp-ports</strong></span> or
f4ee48be3994797a8332b86c101db4d7b54799ceTinderbox User <span><strong class="command">use-v6-udp-ports</strong></span> is unspecified,
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User <span><strong class="command">named</strong></span> will check if the operating
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater system provides a programming interface to retrieve the
6d114a4c5cddb176ae5199eee154c0273d652ba4Tinderbox User system's default range for ephemeral ports.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If such an interface is available,
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater <span><strong class="command">named</strong></span> will use the corresponding system
9dde9ce5558696850b6b9850a8475ae518409518Tinderbox User default range; otherwise, it will use its own defaults:
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater<pre class="programlisting">use-v4-udp-ports { range 1024 65535; };
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrewsuse-v6-udp-ports { range 1024 65535; };
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Note: make sure the ranges be sufficiently large for
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater security. A desirable size depends on various parameters,
0accdb26ead1fe520a9820b52efbea64bdf564e3Tinderbox User but we generally recommend it contain at least 16384 ports
8b8e37f252b0411e00a0a2775d570562aedce439Tinderbox User (14 bits of entropy).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Note also that the system's default range when used may be
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews too small for this purpose, and that the range may even be
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater changed while <span><strong class="command">named</strong></span> is running; the new
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater range will automatically be applied when <span><strong class="command">named</strong></span>
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User It is encouraged to
f4ee48be3994797a8332b86c101db4d7b54799ceTinderbox User configure <span><strong class="command">use-v4-udp-ports</strong></span> and
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span><strong class="command">use-v6-udp-ports</strong></span> explicitly so that the
ba8b771c371967dd1254c7fa82ebe4158ee04b24Tinderbox User ranges are sufficiently large and are reasonably
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews independent from the ranges used by other applications.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Note: the operational configuration
2964b1f272bab3e7ed3fbb4a0811da5e93646d34Tinderbox User where <span><strong class="command">named</strong></span> runs may prohibit the use
78bc8fdc2488c92d7228e8de19827e2c114c56caAutomatic Updater of some ports. For example, UNIX systems will not allow
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">named</strong></span> running without a root privilege
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to use ports less than 1024.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If such ports are included in the specified (or detected)
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User set of query ports, the corresponding query attempts will
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User fail, resulting in resolution failures or delay.
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater It is therefore important to configure the set of ports
0d13a9584b9f97693ab22d54322f1c484d578701Mark Andrews that can be safely used in the expected operational environment.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User The defaults of the <span><strong class="command">avoid-v4-udp-ports</strong></span> and
1fff4d36fb18ccdca15acb0bae20c2aa8e833ceeTinderbox User <span><strong class="command">avoid-v6-udp-ports</strong></span> options
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews<pre class="programlisting">avoid-v4-udp-ports {};
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrewsavoid-v6-udp-ports {};
a8677ecad546c955406b341eb8344ed06768b11eTinderbox User Note: BIND 9.5.0 introduced
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User the <span><strong class="command">use-queryport-pool</strong></span>
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews option to support a pool of such random ports, but this
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater option is now obsolete because reusing the same ports in
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews the pool may not be sufficiently secure.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews For the same reason, it is generally strongly discouraged to
2964b1f272bab3e7ed3fbb4a0811da5e93646d34Tinderbox User specify a particular port for the
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User <span><strong class="command">query-source</strong></span> or
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span><strong class="command">query-source-v6</strong></span> options;
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox User it implicitly disables the use of randomized port numbers.
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews<dt><span class="term"><span><strong class="command">use-queryport-pool</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User This option is obsolete.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<dt><span class="term"><span><strong class="command">queryport-pool-ports</strong></span></span></dt>
f4ee48be3994797a8332b86c101db4d7b54799ceTinderbox User This option is obsolete.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">queryport-pool-updateinterval</strong></span></span></dt>
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt This option is obsolete.
a8677ecad546c955406b341eb8344ed06768b11eTinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt The address specified in the <span><strong class="command">query-source</strong></span> option
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt is used for both UDP and TCP queries, but the port applies only
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User to UDP queries. TCP queries always use a random
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater unprivileged port.
c855e7170a7ddb5d4ebab69a771f35dc93e95e43Mark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Solaris 2.5.1 and earlier does not support setting the source
a907c61823c4715248b259c4d495fc0c9d1b9889Tinderbox User address for TCP sockets.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User See also <span><strong class="command">transfer-source</strong></span> and
2964b1f272bab3e7ed3fbb4a0811da5e93646d34Tinderbox User <span><strong class="command">notify-source</strong></span>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<div class="titlepage"><div><div><h4 class="title">
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User<a name="zone_transfers"></a>Zone Transfers</h4></div></div></div>
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User <acronym class="acronym">BIND</acronym> has mechanisms in place to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater facilitate zone transfers
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User and set limits on the amount of load that transfers place on the
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User system. The following options apply to zone transfers.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">also-notify</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Defines a global list of IP addresses of name servers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that are also sent NOTIFY messages whenever a fresh copy of
1ac49378a458420bc685293d12e567d7222d17b6Tinderbox User zone is loaded, in addition to the servers listed in the
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont zone's NS records.
f0c5e918974bf778af6cd1e25309ad13e30a79a6Tinderbox User This helps to ensure that copies of the zones will
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews quickly converge on stealth servers.
681beefc668253b3e469a1de282fbc33a3752422Automatic Updater Optionally, a port may be specified with each
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">also-notify</strong></span> address to send
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the notify messages to a port other than the
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User default of 53.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User If an <span><strong class="command">also-notify</strong></span> list
0d13a9584b9f97693ab22d54322f1c484d578701Mark Andrews is given in a <span><strong class="command">zone</strong></span> statement,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User it will override
b3386fba31414344f38f0c30849c056dceb22dceTinderbox User the <span><strong class="command">options also-notify</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User statement. When a <span><strong class="command">zone notify</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is set to <span><strong class="command">no</strong></span>, the IP
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater addresses in the global <span><strong class="command">also-notify</strong></span> list will
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater not be sent NOTIFY messages for that zone. The default is
572048aa7bf7b449d60dfb2dbebf861454626f96Tinderbox User list (no global notification list).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User Inbound zone transfers running longer than
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User this many minutes will be terminated. The default is 120
33d1cff1dd63494ffa00fac695a793f00c4ebf0bTinderbox User (2 hours). The maximum value is 28 days (40320 minutes).
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews Inbound zone transfers making no progress
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in this many minutes will be terminated. The default is 60
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User (1 hour). The maximum value is 28 days (40320 minutes).
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Outbound zone transfers running longer than
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User this many minutes will be terminated. The default is 120
9e8ee4ffd77aa2974cecbdbb2b122156b8d3a27aTinderbox User (2 hours). The maximum value is 28 days (40320 minutes).
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews Outbound zone transfers making no progress
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews in this many minutes will be terminated. The default is 60
1fdd58445074579ee3b65c871137a7a1740eb542Mark Andrews hour). The maximum value is 28 days (40320 minutes).
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews<dt><span class="term"><span><strong class="command">serial-query-rate</strong></span></span></dt>
9692d283bb43c9eab49a7fadfc1b74a6e20e6151Tinderbox User Slave servers will periodically query master servers
5ee9f7f23852d92772c08ca6e4b46c549beaf660Mark Andrews to find out if zone serial numbers have changed. Each such
757ff043760e4743dda1a10e7d58349275934902Tinderbox User a minute amount of the slave server's network bandwidth. To
b6e12209e3e7df826f5f8f949ad400ec6d1f6371Tinderbox User amount of bandwidth used, BIND 9 limits the rate at which
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User sent. The value of the <span><strong class="command">serial-query-rate</strong></span> option,
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User an integer, is the maximum number of queries sent per
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User The default is 20.
646fed0d28be4387e3e32fb0f5732a1f58b572baTinderbox User<dt><span class="term"><span><strong class="command">serial-queries</strong></span></span></dt>
f0c5e918974bf778af6cd1e25309ad13e30a79a6Tinderbox User In BIND 8, the <span><strong class="command">serial-queries</strong></span>
2964b1f272bab3e7ed3fbb4a0811da5e93646d34Tinderbox User set the maximum number of concurrent serial number queries
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont allowed to be outstanding at any given time.
049728912c39135db248f9b48f8f26675f456e9dTinderbox User BIND 9 does not limit the number of outstanding
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User serial queries and ignores the <span><strong class="command">serial-queries</strong></span> option.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Instead, it limits the rate at which the queries are sent
5ee9f7f23852d92772c08ca6e4b46c549beaf660Mark Andrews as defined using the <span><strong class="command">serial-query-rate</strong></span> option.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<dt><span class="term"><span><strong class="command">transfer-format</strong></span></span></dt>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Zone transfers can be sent using two different formats,
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <span><strong class="command">one-answer</strong></span> and
af60449fe472b8bea5ad04bf538c777c6b151112Tinderbox User <span><strong class="command">many-answers</strong></span>.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User The <span><strong class="command">transfer-format</strong></span> option is used
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User on the master server to determine which format it sends.
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox User <span><strong class="command">one-answer</strong></span> uses one DNS message per
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User resource record transferred.
4f538e852f20912e629338e911e46ce26de3e965Tinderbox User <span><strong class="command">many-answers</strong></span> packs as many resource
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater records as possible into a message.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">many-answers</strong></span> is more efficient, but is
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont only supported by relatively new slave servers,
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont such as <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User 8.x and <acronym class="acronym">BIND</acronym> 4.9.5 onwards.
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User The <span><strong class="command">many-answers</strong></span> format is also supported by
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater recent Microsoft Windows nameservers.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <span><strong class="command">many-answers</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">transfer-format</strong></span> may be overridden on a
fae2925c4d1b45056302be96e5e334f3ad5809c5Tinderbox User per-server basis by using the <span><strong class="command">server</strong></span>
c288e47fb7d4baa1ed887156b1c5e5db394d4f52Tinderbox User<dt><span class="term"><span><strong class="command">transfers-in</strong></span></span></dt>
90ff38a0d8deaf5f9c2aa5916d99b2e572d28738Automatic Updater The maximum number of inbound zone transfers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that can be running concurrently. The default value is <code class="literal">10</code>.
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt Increasing <span><strong class="command">transfers-in</strong></span> may
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt speed up the convergence
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt of slave zones, but it also may increase the load on the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User local system.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">transfers-out</strong></span></span></dt>
39ae0eafed076ef769fef5c18b22a8051df5c93aTinderbox User The maximum number of outbound zone transfers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that can be running concurrently. Zone transfer requests in
ce0fd07045292942bfa3e755d9ce596941528a63Automatic Updater of the limit will be refused. The default value is <code class="literal">10</code>.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater<dt><span class="term"><span><strong class="command">transfers-per-ns</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The maximum number of inbound zone transfers
96713299d08c0735c18ebe8772dd2cc1ecd4356aAutomatic Updater that can be concurrently transferring from a given remote
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt The default value is <code class="literal">2</code>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Increasing <span><strong class="command">transfers-per-ns</strong></span>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews speed up the convergence of slave zones, but it also may
c6517a807173827b8f638d31303805ee4c1d8054Automatic Updater the load on the remote name server. <span><strong class="command">transfers-per-ns</strong></span> may
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews be overridden on a per-server basis by using the <span><strong class="command">transfers</strong></span> phrase
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews of the <span><strong class="command">server</strong></span> statement.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">transfer-source</strong></span></span></dt>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews<p><span><strong class="command">transfer-source</strong></span>
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User determines which local address will be bound to IPv4
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User TCP connections used to fetch zones transferred
1bf507ca635310b340aea42d6c3e567819974a99Tinderbox User inbound by the server. It also determines the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater source IPv4 address, and optionally the UDP port,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater used for the refresh queries and forwarded dynamic
c6517a807173827b8f638d31303805ee4c1d8054Automatic Updater updates. If not set, it defaults to a system
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater controlled value which will usually be the address
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater of the interface "closest to" the remote end. This
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User address must appear in the remote end's
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-transfer</strong></span> option for the
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater zone being transferred, if one is specified. This
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews statement sets the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">transfer-source</strong></span> for all zones,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater but can be overridden on a per-view or per-zone
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews basis by including a
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">transfer-source</strong></span> statement within
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the <span><strong class="command">view</strong></span> or
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User <span><strong class="command">zone</strong></span> block in the configuration
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt Solaris 2.5.1 and earlier does not support setting the
bac4435d473c9a0281507524f084480c34aa942aTinderbox User source address for TCP sockets.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">transfer-source-v6</strong></span></span></dt>
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater The same as <span><strong class="command">transfer-source</strong></span>,
1bcc3273a80c256f11d9098a00ba2c041939e233Mark Andrews except zone transfers are performed using IPv6.
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User An alternate transfer source if the one listed in
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User <span><strong class="command">transfer-source</strong></span> fails and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">use-alt-transfer-source</strong></span> is
cd6e9010079a4e58f7e30063df3dec0ff154ad59Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews If you do not wish the alternate transfer source
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater to be used, you should set
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <span><strong class="command">use-alt-transfer-source</strong></span>
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt appropriately and you should not depend upon
e705db6d5d886dc14f4a75a2046a075c0750e7eeAutomatic Updater getting an answer back to the first refresh
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater An alternate transfer source if the one listed in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">transfer-source-v6</strong></span> fails and
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt <span><strong class="command">use-alt-transfer-source</strong></span> is
bac4435d473c9a0281507524f084480c34aa942aTinderbox User<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Use the alternate transfer sources or not. If views are
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User specified this defaults to <span><strong class="command">no</strong></span>
1bf507ca635310b340aea42d6c3e567819974a99Tinderbox User otherwise it defaults to
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">yes</strong></span> (for BIND 8
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User compatibility).
4bc4740495aca028379fecd2afac26b1d53a4e25Tinderbox User<dt><span class="term"><span><strong class="command">notify-source</strong></span></span></dt>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<p><span><strong class="command">notify-source</strong></span>
76fbdc591b3d46df28878a6ff844798622b85265Tinderbox User determines which local source address, and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews optionally UDP port, will be used to send NOTIFY
fab54780409846f7c71f6026d665f18c77c649efTinderbox User messages. This address must appear in the slave
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater server's <span><strong class="command">masters</strong></span> zone clause or
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User in an <span><strong class="command">allow-notify</strong></span> clause. This
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User statement sets the <span><strong class="command">notify-source</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater for all zones, but can be overridden on a per-zone or
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater per-view basis by including a
b779e1efb14f9616a35befd2b1cfc2578f1a4d70Tinderbox User <span><strong class="command">notify-source</strong></span> statement within
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the <span><strong class="command">zone</strong></span> or
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">view</strong></span> block in the configuration
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Solaris 2.5.1 and earlier does not support setting the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User source address for TCP sockets.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<dt><span class="term"><span><strong class="command">notify-source-v6</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Like <span><strong class="command">notify-source</strong></span>,
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater but applies to notify messages sent to IPv6 addresses.
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User<div class="titlepage"><div><div><h4 class="title">
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User<a name="id2584652"></a>UDP Port Lists</h4></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">use-v4-udp-ports</strong></span>,
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User <span><strong class="command">avoid-v4-udp-ports</strong></span>,
7692464e78fc43578c394b8d1d30e81fec1d8523Tinderbox User <span><strong class="command">use-v6-udp-ports</strong></span>, and
76fbdc591b3d46df28878a6ff844798622b85265Tinderbox User <span><strong class="command">avoid-v6-udp-ports</strong></span>
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater specify a list of IPv4 and IPv6 UDP ports that will be
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User used or not used as source ports for UDP messages.
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User See <a href="Bv9ARM.ch06.html#query_address" title="Query Address">the section called “Query Address”</a> about how the
e213b38b48486b3a6349329655d9169085001fa0Tinderbox User available ports are determined.
933799f3641f4f78445d015008bad0038900a82aTinderbox User For example, with the following configuration
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updateruse-v6-udp-ports { range 32768 65535; };
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrewsavoid-v6-udp-ports { 40000; range 50000 60000; };
933799f3641f4f78445d015008bad0038900a82aTinderbox User UDP ports of IPv6 messages sent
3915dc3dae1955e9f96696ca932efbd18c108d1dTinderbox User from <span><strong class="command">named</strong></span> will be in one
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater of the following ranges: 32768 to 39999, 40001 to 49999,
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater and 60001 to 65535.
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson <span><strong class="command">avoid-v4-udp-ports</strong></span> and
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span><strong class="command">avoid-v6-udp-ports</strong></span> can be used
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User to prevent <span><strong class="command">named</strong></span> from choosing as its random source port a
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User port that is blocked by your firewall or a port that is
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews used by other applications;
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater if a query went out with a source port blocked by a
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews firewall, the
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User answer would not get by the firewall and the name server would
76fbdc591b3d46df28878a6ff844798622b85265Tinderbox User have to query again.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Note: the desired range can also be represented only with
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews <span><strong class="command">use-v4-udp-ports</strong></span> and
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">use-v6-udp-ports</strong></span>, and the
a900e4f99ff134b567b6df5ac2c841c7d0c551d3Automatic Updater <span><strong class="command">avoid-</strong></span> options are redundant in that
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User sense; they are provided for backward compatibility and
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User to possibly simplify the port specification.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<div class="titlepage"><div><div><h4 class="title">
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<a name="id2584780"></a>Operating System Resource Limits</h4></div></div></div>
c288e47fb7d4baa1ed887156b1c5e5db394d4f52Tinderbox User The server's usage of many system resources can be limited.
a900e4f99ff134b567b6df5ac2c841c7d0c551d3Automatic Updater Scaled values are allowed when specifying resource limits. For
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater example, <span><strong class="command">1G</strong></span> can be used instead of
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">1073741824</strong></span> to specify a limit of
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater gigabyte. <span><strong class="command">unlimited</strong></span> requests
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater unlimited use, or the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater maximum available amount. <span><strong class="command">default</strong></span>
4fda24d843edac463c98785ec0c850d912592dc1Tinderbox User uses the limit
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User that was in force when the server was started. See the description
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews of <span><strong class="command">size_spec</strong></span> in <a href="Bv9ARM.ch06.html#configuration_file_elements" title="Configuration File Elements">the section called “Configuration File Elements”</a>.
9563f388c8ca1bb9ebb04db54e122815b0008c8aTinderbox User The following options set operating system resource limits for
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the name server process. Some operating systems don't support
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User any of the limits. On such systems, a warning will be issued if
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater unsupported limit is used.
bcb68be0a8f3c3eca58d6a6a869267e5c1841de2Francis Dupont<dt><span class="term"><span><strong class="command">coresize</strong></span></span></dt>
bcb68be0a8f3c3eca58d6a6a869267e5c1841de2Francis Dupont The maximum size of a core dump. The default
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User<dt><span class="term"><span><strong class="command">datasize</strong></span></span></dt>
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews The maximum amount of data memory the server
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews may use. The default is <code class="literal">default</code>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews This is a hard limit on server memory usage.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews If the server attempts to allocate memory in excess of this
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews limit, the allocation will fail, which may in turn leave
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews the server unable to perform DNS service. Therefore,
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews this option is rarely useful as a way of limiting the
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews amount of memory used by the server, but it can be used
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews to raise an operating system data size limit that is
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews too small by default. If you wish to limit the amount
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews of memory used by the server, use the
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">max-cache-size</strong></span> and
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews <span><strong class="command">recursive-clients</strong></span>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews options instead.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews<dt><span class="term"><span><strong class="command">files</strong></span></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews The maximum number of files the server
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews may have open concurrently. The default is <code class="literal">unlimited</code>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><span><strong class="command">stacksize</strong></span></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews The maximum amount of stack memory the server
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews may use. The default is <code class="literal">default</code>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<div class="titlepage"><div><div><h4 class="title">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<a name="server_resource_limits"></a>Server Resource Limits</h4></div></div></div>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews The following options set limits on the server's
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews resource consumption that are enforced internally by the
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews server rather than the operating system.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews<dt><span class="term"><span><strong class="command">max-ixfr-log-size</strong></span></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews This option is obsolete; it is accepted
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews and ignored for BIND 8 compatibility. The option
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">max-journal-size</strong></span> performs a
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews similar function in BIND 9.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><span><strong class="command">max-journal-size</strong></span></span></dt>
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews Sets a maximum size for each journal file
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews (see <a href="Bv9ARM.ch04.html#journal" title="The journal file">the section called “The journal file”</a>). When the journal file
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews the specified size, some of the oldest transactions in the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater will be automatically removed. The default is
e23256e740b238bddb4ba41ffac5f81a01c92245Automatic Updater This may also be set on a per-zone basis.
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User<dt><span class="term"><span><strong class="command">host-statistics-max</strong></span></span></dt>
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews In BIND 8, specifies the maximum number of host statistics
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User entries to be kept.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Not implemented in BIND 9.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">recursive-clients</strong></span></span></dt>
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater The maximum number of simultaneous recursive lookups
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the server will perform on behalf of clients. The default
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User <code class="literal">1000</code>. Because each recursing
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User client uses a fair
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater bit of memory, on the order of 20 kilobytes, the value of
cd6e9010079a4e58f7e30063df3dec0ff154ad59Tinderbox User <span><strong class="command">recursive-clients</strong></span> option may
f33f2b8afe60de897c53cdcb17911f10b552699fTinderbox User have to be decreased
397c35b074ed59592cac25bafeb7e082f50f9ac1Tinderbox User on hosts with limited memory.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson<dt><span class="term"><span><strong class="command">tcp-clients</strong></span></span></dt>
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User The maximum number of simultaneous client TCP
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User connections that the server will accept.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The default is <code class="literal">100</code>.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<dt><span class="term"><span><strong class="command">reserved-sockets</strong></span></span></dt>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The number of file descriptors reserved for TCP, stdio,
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User etc. This needs to be big enough to cover the number of
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User interfaces <span><strong class="command">named</strong></span> listens on, <span><strong class="command">tcp-clients</strong></span> as well as
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont to provide room for outgoing TCP queries and incoming zone
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User transfers. The default is <code class="literal">512</code>.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont The minimum value is <code class="literal">128</code> and the
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont maximum value is <code class="literal">128</code> less than
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont maxsockets (-S). This option may be removed in the future.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt This option has little effect on Windows.
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt<dt><span class="term"><span><strong class="command">max-cache-size</strong></span></span></dt>
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt The maximum amount of memory to use for the
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt server's cache, in bytes.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt When the amount of data in the cache
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews reaches this limit, the server will cause records to expire
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt prematurely based on an LRU based strategy so that
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt the limit is not exceeded.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt A value of 0 is special, meaning that
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt records are purged from the cache only when their
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt TTLs expire.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews Another special keyword <strong class="userinput"><code>unlimited</code></strong>
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt means the maximum value of 32-bit unsigned integers
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt (0xffffffff), which may not have the same effect as
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt 0 on machines that support more than 32 bits of
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt memory space.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt Any positive values less than 2MB will be ignored reset
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt In a server with multiple views, the limit applies
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt separately to the cache of each view.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt The default is 0.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt<dt><span class="term"><span><strong class="command">tcp-listen-queue</strong></span></span></dt>
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt The listen queue depth. The default and minimum is 3.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt If the kernel supports the accept filter "dataready" this
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt also controls how
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt many TCP connections that will be queued in kernel space
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews some data before being passed to accept. Values less than 3
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt silently raised.
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User<div class="titlepage"><div><div><h4 class="title">
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User<a name="id2585134"></a>Periodic Task Intervals</h4></div></div></div>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">cleaning-interval</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews This interval is effectively obsolete. Previously,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the server would remove expired resource records
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews from the cache every <span><strong class="command">cleaning-interval</strong></span> minutes.
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt <acronym class="acronym">BIND</acronym> 9 now manages cache
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews memory in a more sophisticated manner and does not
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater rely on the periodic cleaning any more.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Specifying this option therefore has no effect on
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson the server's behavior.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">heartbeat-interval</strong></span></span></dt>
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt The server will perform zone maintenance tasks
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews for all zones marked as <span><strong class="command">dialup</strong></span> whenever this
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews interval expires. The default is 60 minutes. Reasonable
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews values are up
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews to 1 day (1440 minutes). The maximum value is 28 days
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews (40320 minutes).
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews If set to 0, no zone maintenance for these zones will occur.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">interface-interval</strong></span></span></dt>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The server will scan the network interface list
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User every <span><strong class="command">interface-interval</strong></span>
a42655602677933f768df30059ac23cc98d71958Tinderbox User minutes. The default
922e6a3c2ac4ef900dd9dc99f0cc137f18372583Andreas Gustafsson is 60 minutes. The maximum value is 28 days (40320 minutes).
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User If set to 0, interface scanning will only occur when
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User the configuration file is loaded. After the scan, the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User begin listening for queries on any newly discovered
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interfaces (provided they are allowed by the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">listen-on</strong></span> configuration), and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User stop listening on interfaces that have gone away.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">statistics-interval</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Name server statistics will be logged
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User every <span><strong class="command">statistics-interval</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User minutes. The default is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User 60. The maximum value is 28 days (40320 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If set to 0, no statistics will be logged.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Not yet implemented in
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="topology"></a>Topology</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User All other things being equal, when the server chooses a name
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews to query from a list of name servers, it prefers the one that is
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews topologically closest to itself. The <span><strong class="command">topology</strong></span> statement
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews takes an <span><strong class="command">address_match_list</strong></span> and
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews interprets it
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews in a special way. Each top-level list element is assigned a
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Non-negated elements get a distance based on their position in the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User list, where the closer the match is to the start of the list, the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User shorter the distance is between it and the server. A negated match
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User will be assigned the maximum distance from the server. If there
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is no match, the address will get a distance which is further than
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User any non-negated list element, and closer than any negated element.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User will prefer servers on network 10 the most, followed by hosts
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on network 1.2.0.0 (netmask 255.255.0.0) and network 3, with the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User exception of hosts on network 1.2.3 (netmask 255.255.255.0), which
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is preferred least of all.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default topology is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<pre class="programlisting"> topology { localhost; localnets; };
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The <span><strong class="command">topology</strong></span> option
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is not implemented in <acronym class="acronym">BIND</acronym> 9.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="the_sortlist_statement"></a>The <span><strong class="command">sortlist</strong></span> Statement</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The response to a DNS query may consist of multiple resource
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User records (RRs) forming a resource records set (RRset).
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews The name server will normally return the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User RRs within the RRset in an indeterminate order
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater (but see the <span><strong class="command">rrset-order</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User statement in <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The client resolver code should rearrange the RRs as appropriate,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User that is, using any addresses on the local net in preference to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User other addresses.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User However, not all resolvers can do this or are correctly
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User When a client is using a local server, the sorting can be performed
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in the server, based on the client's address. This only requires
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User configuring the name servers, not all the clients.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The <span><strong class="command">sortlist</strong></span> statement (see below)
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User an <span><strong class="command">address_match_list</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interprets it even
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User more specifically than the <span><strong class="command">topology</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User does (<a href="Bv9ARM.ch06.html#topology" title="Topology">the section called “Topology”</a>).
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Each top level statement in the <span><strong class="command">sortlist</strong></span> must
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User itself be an explicit <span><strong class="command">address_match_list</strong></span> with
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User one or two elements. The first element (which may be an IP
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews an IP prefix, an ACL name or a nested <span><strong class="command">address_match_list</strong></span>)
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews of each top level list is checked against the source address of
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the query until a match is found.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Once the source address of the query has been matched, if
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews the top level statement contains only one element, the actual
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User element that matched the source address is used to select the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in the response to move to the beginning of the response. If the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User statement is a list of two elements, then the second element is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User treated the same as the <span><strong class="command">address_match_list</strong></span> in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User a <span><strong class="command">topology</strong></span> statement. Each top
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User level element
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is assigned a distance and the address in the response with the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User distance is moved to the beginning of the response.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User In the following example, any queries received from any of
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the addresses of the host itself will get responses preferring
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on any of the locally connected networks. Next most preferred are
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on the 192.168.1/24 network, and after that either the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User 192.168.3/24 network with no preference shown between these two
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User networks. Queries received from a host on the 192.168.1/24 network
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User will prefer other addresses on that network to the 192.168.2/24
d3be47a4a841ca6fc07e8f18004cf72174e2d117Tinderbox User 192.168.3/24 networks. Queries received from a host on the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User or the 192.168.5/24 network will only prefer other addresses on
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User their directly connected networks.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User // IF the local host
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User // THEN first fit on the following nets
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User // IF on class C 192.168.1 THEN use .1, or .2 or .3
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User // IF on class C 192.168.2 THEN use .2, or .1 or .3
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User // IF on class C 192.168.3 THEN use .3, or .1 or .2
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User // IF .4 or .5 THEN prefer that net
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The following example will give reasonable behavior for the
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews local host and hosts on directly connected networks. It is similar
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to the behavior of the address sort in <acronym class="acronym">BIND</acronym> 4.9.x. Responses sent
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to queries from the local host will favor any of the directly
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User networks. Responses sent to queries from any other hosts on a
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews connected network will prefer addresses on that same network.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to other queries will not be sorted.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User { localhost; localnets; };
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User { localnets; };
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="rrset_ordering"></a>RRset Ordering</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User When multiple records are returned in an answer it may be
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews useful to configure the order of the records placed into the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The <span><strong class="command">rrset-order</strong></span> statement permits
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User configuration
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of the ordering of the records in a multiple record response.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User See also the <span><strong class="command">sortlist</strong></span> statement,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User An <span><strong class="command">order_spec</strong></span> is defined as
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User [<span class="optional">class <em class="replaceable"><code>class_name</code></em></span>]
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User [<span class="optional">type <em class="replaceable"><code>type_name</code></em></span>]
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User [<span class="optional">name <em class="replaceable"><code>"domain_name"</code></em></span>]
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User order <em class="replaceable"><code>ordering</code></em>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If no class is specified, the default is <span><strong class="command">ANY</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If no type is specified, the default is <span><strong class="command">ANY</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If no name is specified, the default is "<span><strong class="command">*</strong></span>" (asterisk).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The legal values for <span><strong class="command">ordering</strong></span> are:
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater<div class="informaltable"><table border="1">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <p><span><strong class="command">fixed</strong></span></p>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Records are returned in the order they
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User are defined in the zone file.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <p><span><strong class="command">random</strong></span></p>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Records are returned in some random order.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater <p><span><strong class="command">cyclic</strong></span></p>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Records are returned in a cyclic round-robin order.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If <acronym class="acronym">BIND</acronym> is configured with the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User "--enable-fixed-rrset" option at compile time, then
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the initial ordering of the RRset will match the
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews one specified in the zone file.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User class IN type A name "host.example.com" order random;
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User order cyclic;
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User will cause any responses for type A records in class IN that
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User have "<code class="literal">host.example.com</code>" as a
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User suffix, to always be returned
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in random order. All other records are returned in cyclic order.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If multiple <span><strong class="command">rrset-order</strong></span> statements
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User they are not combined — the last one applies.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User In this release of <acronym class="acronym">BIND</acronym> 9, the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">rrset-order</strong></span> statement does not support
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User "fixed" ordering by default. Fixed ordering can be enabled
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User at compile time by specifying "--enable-fixed-rrset" on
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews the "configure" command line.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="tuning"></a>Tuning</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">lame-ttl</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Sets the number of seconds to cache a
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews lame server indication. 0 disables caching. (This is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span class="bold"><strong>NOT</strong></span> recommended.)
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default is <code class="literal">600</code> (10 minutes) and the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User maximum value is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <code class="literal">1800</code> (30 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">max-ncache-ttl</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User To reduce network traffic and increase performance,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the server stores negative answers. <span><strong class="command">max-ncache-ttl</strong></span> is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User used to set a maximum retention time for these answers in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in seconds. The default
5ca309a0fb9a75162852653f881d1e6290e28c2aTinderbox User <span><strong class="command">max-ncache-ttl</strong></span> is <code class="literal">10800</code> seconds (3 hours).
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater <span><strong class="command">max-ncache-ttl</strong></span> cannot exceed
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews 7 days and will
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater be silently truncated to 7 days if set to a greater value.
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater<dt><span class="term"><span><strong class="command">max-cache-ttl</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Sets the maximum time for which the server will
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews cache ordinary (positive) answers. The default is
081a44bd3019b18aec03c5c0746538fdc901da48Evan Hunt one week (7 days).
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews A value of zero may cause all queries to return
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User SERVFAIL, because of lost caches of intermediate
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User RRsets (such as NS and glue AAAA/A records) in the
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User resolution process.
be41770245bd56746fbb61f9b5ba0aca683f318eTinderbox User<dt><span class="term"><span><strong class="command">min-roots</strong></span></span></dt>
af9dbf1ccdd53933aaae9300d13ce0965d39b067Evan Hunt The minimum number of root servers that
9160e27507ba636887f6352bee5cb3729108fc76Tinderbox User is required for a request for the root servers to be
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User accepted. The default
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User is <strong class="userinput"><code>2</code></strong>.
9dde9ce5558696850b6b9850a8475ae518409518Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Not implemented in <acronym class="acronym">BIND</acronym> 9.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Specifies the number of days into the future when
f536382c59dd492a14667b753816d920f9981f1cTinderbox User DNSSEC signatures automatically generated as a
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User result of dynamic updates (<a href="Bv9ARM.ch04.html#dynamic_update" title="Dynamic Update">the section called “Dynamic Update”</a>) will expire. There
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User is an optional second field which specifies how
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User long before expiry that the signatures will be
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews regenerated. If not specified, the signatures will
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User be regenerated at 1/4 of base interval. The second
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User field is specified in days if the base interval is
f190095cae5e5a8734e0ff16055488d471569499Tinderbox User greater than 7 days otherwise it is specified in hours.
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User The default base interval is <code class="literal">30</code> days
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User giving a re-signing interval of 7 1/2 days. The maximum
16f6050f29b6b0422cee858e609f65e474e70ef2Tinderbox User values are 10 years (3660 days).
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User The signature inception time is unconditionally
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User set to one hour before the current time to allow
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
<a href="Bv9ARM.ch06.html#zonefile_format" title="Additional File Formats">the section called “Additional File Formats”</a>).
<a name="clients-per-query"></a><span class="term"><span><strong class="command">clients-per-query</strong></span>, </span><span class="term"><span><strong class="command">max-clients-per-query</strong></span></span>
before dropping additional clients. <span><strong class="command">named</strong></span> will attempt to
If the number of queries exceed this value, <span><strong class="command">named</strong></span> will
built-in view (see <a href="Bv9ARM.ch06.html#view_statement_grammar" title="view Statement Grammar">the section called “<span><strong class="command">view</strong></span> Statement Grammar”</a>) of
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
<span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
Specifying <span><strong class="command">server-id hostname;</strong></span> will cause <span><strong class="command">named</strong></span> to
The default <span><strong class="command">server-id</strong></span> is <span><strong class="command">none</strong></span>.
<dt><span class="term"><span><strong class="command">acache-cleaning-interval</strong></span></span></dt>
name (i.e., the CNAME alias or the substituted query name
for example, even if "example.com" is specified for
returned by an "example.com" server will be accepted.
For example, if you own a domain named "example.net" and
deny-answer-aliases { "example.net"; };
network look up an IPv4 address of "attacker.example.com",
internal web server "www.example.net" and the
it will be accepted since the owner name "www.example.net"
"example.net".
<a name="server_statement_grammar"></a><span><strong class="command">server</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">server</strong></span> <em class="replaceable"><code>ip_addr[/prefixlen]</code></em> {
[<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em> ; ]</span>]
[<span class="optional"> keys <em class="replaceable"><code>{ string ; [<span class="optional"> string ; [<span class="optional">...</span>]</span>] }</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> query-source [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
[<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
[<span class="optional"> query-source-v6 [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
[<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
[<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> queryport-pool-updateinterval <em class="replaceable"><code>number</code></em>; </span>]
<a name="server_statement_definition_and_usage"></a><span><strong class="command">server</strong></span> Statement Definition and
value of <span><strong class="command">bogus</strong></span> is <span><strong class="command">no</strong></span>.
that is advertised by <span><strong class="command">named</strong></span> when querying the remote server.
The server supports two zone transfer methods. The first, <span><strong class="command">one-answer</strong></span>,
uses one DNS message per resource record transferred. <span><strong class="command">many-answers</strong></span> packs
as many resource records as possible into a message. <span><strong class="command">many-answers</strong></span> is
more efficient, but is only known to be understood by <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
<span><strong class="command">key_id</strong></span> defined by the <span><strong class="command">key</strong></span> statement,
to be used for transaction security (TSIG, <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
<a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<a name="statschannels"></a><span><strong class="command">statistics-channels</strong></span> Statement Grammar</h3></div></div></div>
<a name="id2588103"></a><span><strong class="command">statistics-channels</strong></span> Statement Definition and
address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
<a name="id2588326"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div>
<em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
[<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
<a name="id2588377"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition
DNSSEC security roots. DNSSEC is described in <a href="Bv9ARM.ch04.html#DNSSEC" title="DNSSEC">the section called “DNSSEC”</a>. A security root is defined when the
<a name="id2588424"></a><span><strong class="command">managed-keys</strong></span> Statement Grammar</h3></div></div></div>
<em class="replaceable"><code>string</code></em> initial-key <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
[<span class="optional"> <em class="replaceable"><code>string</code></em> initial-key <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
<a name="id2588475"></a><span><strong class="command">managed-keys</strong></span> Statement Definition
set to <strong class="userinput"><code>auto</code></strong>, <span><strong class="command">named</strong></span>
<a name="view_statement_grammar"></a><span><strong class="command">view</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">view</strong></span> <em class="replaceable"><code>view_name</code></em>
<a name="id2588848"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
// Provide a complete view of the example.com
zone "example.com" {
file "example-internal.db";
// Provide a restricted view of the example.com
zone "example.com" {
file "example-external.db";
<pre class="programlisting"><span><strong class="command">zone</strong></span> <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-policy <em class="replaceable"><code>local</code></em> | { <em class="replaceable"><code>update_policy_rule</code></em> [<span class="optional">...</span>] }; </span>]
[<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
[<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-mx (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
[<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> auto-dnssec <code class="constant">allow</code>|<code class="constant">maintain</code>|<code class="constant">create</code>|<code class="constant">off</code>; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> dnssec-secure-to-insecure <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
[<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>] // Not Implemented.
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
<a name="id2590421"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div>
status of infrastructure zones (e.g. COM,
See caveats in <a href="Bv9ARM.ch06.html#root_delegation_only"><span><strong class="command">root-delegation-only</strong></span></a>.
a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>),
in the mid-1970s. Zone data for it can be specified with the <code class="literal">CHAOS</code> class.
<span><strong class="command">allow-notify</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query-on</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>.
<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
network. The default varies according to zone type. For <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>. For <span><strong class="command">slave</strong></span>
<span><strong class="command">check-mx</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-wildcard</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-integrity</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-sibling</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">zero-no-soa-ttl</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">update-check-ksk</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<dt><span class="term"><span><strong class="command">dnssec-dnskey-kskonly</strong></span></span></dt>
<span><strong class="command">dnssec-dnskey-kskonly</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">try-tcp-refresh</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">dialup</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
See caveats in <a href="Bv9ARM.ch06.html#root_delegation_only"><span><strong class="command">root-delegation-only</strong></span></a>.
after trying the forwarders and getting no answer, while <span><strong class="command">first</strong></span> would
This is applicable to <span><strong class="command">master</strong></span> and <span><strong class="command">slave</strong></span> zones.
<span><strong class="command">max-journal-size</strong></span> in <a href="Bv9ARM.ch06.html#server_resource_limits" title="Server Resource Limits">the section called “Server Resource Limits”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
<span><strong class="command">max-transfer-time-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
<span><strong class="command">max-transfer-time-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">notify-delay</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
zones when they are loaded from disk. <acronym class="acronym">BIND</acronym> 9 does not verify signatures
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
<span><strong class="command">sig-validity-interval</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-nodes</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span><strong class="command">sig-signing-signatures</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-type</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
<span><strong class="command">alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
<span><strong class="command">alt-transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
<span><strong class="command">use-alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
See the description in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
<span><strong class="command">ixfr-from-differences</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">key-directory</strong></span> in <a href="Bv9ARM.ch06.html#options" title="options Statement Definition and
Usage">the section called “<span><strong class="command">options</strong></span> Statement Definition and
(see <a href="man.dnssec-keygen.html" title="dnssec-keygen"><span class="refentrytitle"><span class="application">dnssec-keygen</span></span>(8)</a> and
<a href="man.dnssec-settime.html" title="dnssec-settime"><span class="refentrytitle"><span class="application">dnssec-settime</span></span>(8)</a>).
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<dt><span class="term"><span><strong class="command">dnssec-secure-to-insecure</strong></span></span></dt>
<span><strong class="command">dnssec-secure-to-insecure</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
( <span><strong class="command">grant</strong></span> | <span><strong class="command">deny</strong></span> ) <em class="replaceable"><code>identity</code></em> <em class="replaceable"><code>nametype</code></em> [<span class="optional"> <em class="replaceable"><code>name</code></em> </span>] [<span class="optional"> <em class="replaceable"><code>types</code></em> </span>]
<a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div>
that a particular nearby server be tried first. See <a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a> and <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>.
built-in server information zones, e.g.,
any order), and if neither of those succeed, delivery to <code class="literal">mail.backup.org</code> will
and PTR records. Entries in the in-addr.arpa domain are made in
in-addr.arpa name of
3.2.1.10.in-addr.arpa. This name should have a PTR resource record
Master File Directives include <span><strong class="command">$ORIGIN</strong></span>, <span><strong class="command">$INCLUDE</strong></span>,
<a name="id2596152"></a>The <span><strong class="command">@</strong></span> (at-sign)</h4></div></div></div>
<a name="id2596168"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div>
$ORIGIN example.com.
<a name="id2596229"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div>
if it were included into the file at this point. If <span><strong class="command">origin</strong></span> is
revert to the values they had prior to the <span><strong class="command">$INCLUDE</strong></span> once
<a name="id2596298"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div>
<a name="id2596403"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div>
Classless IN-ADDR.ARPA delegation.
HOST-1.EXAMPLE. MX 0 .
HOST-2.EXAMPLE. A 1.2.3.2
HOST-2.EXAMPLE. MX 0 .
HOST-3.EXAMPLE. A 1.2.3.3
HOST-3.EXAMPLE. MX 0 .
HOST-127.EXAMPLE. A 1.2.3.127
HOST-127.EXAMPLE. MX 0 .
(<span><strong class="command">n</strong></span> or <span><strong class="command">N</strong></span>\
The <span><strong class="command">$GENERATE</strong></span> directive is a <acronym class="acronym">BIND</acronym> extension
(see <a href="Bv9ARM.ch06.html#statschannels" title="statistics-channels Statement Grammar">the section called “<span><strong class="command">statistics-channels</strong></span> Statement Grammar”</a>.)
<a href="Bv9ARM.ch06.html#clients-per-query"><span><strong class="command">clients-per-query</strong></span></a>.)
<a name="id2600881"></a>Compatibility with <span class="emphasis"><em>BIND</em></span> 8 Counters</h4></div></div></div>
<td width="40%" align="left" valign="top">Chapter�5.�The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver�</td>