Bv9ARM.ch06.html revision 369963ad26cef09c3839d76c74c2d856f91be27a
6c2a76b3e2ccd32c35814b6e0f54da00190749d7Evan Hunt - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater - Copyright (C) 2000-2003 Internet Software Consortium.
c7fd128f8ea8a527fe27c1b95ab46df7155bc8e4Tinderbox User - Permission to use, copy, modify, and/or distribute this software for any
ba9e87b35e561bc7354ce3f4b9685b747b7be507Tinderbox User - purpose with or without fee is hereby granted, provided that the above
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews - copyright notice and this permission notice appear in all copies.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
59663800d2ec04777dae2791dd92aa563faf94c8Evan Hunt - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
1ca2cf024391992fe14b2df7d3ae0f575d074452Evan Hunt - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
0726d872f6f36901ea09321df57084614e5bb6faTinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
1ca2cf024391992fe14b2df7d3ae0f575d074452Evan Hunt - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User - PERFORMANCE OF THIS SOFTWARE.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<!-- $Id$ -->
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
2b7254075b883d70852a2757210793603085a0f1Tinderbox User<title>Chapter�6.�BIND 9 Configuration Reference</title>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<link rel="prev" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="next" href="Bv9ARM.ch07.html" title="Chapter�7.�BIND 9 Security Considerations">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<table width="100%" summary="Navigation header">
415d630b6309922caee8469384a6fab75cf05032Mark Andrews<tr><th colspan="3" align="center">Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</th></tr>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<a accesskey="p" href="Bv9ARM.ch05.html">Prev</a>�</td>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch07.html">Next</a>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<div class="titlepage"><div><div><h2 class="title">
415d630b6309922caee8469384a6fab75cf05032Mark Andrews<a name="Bv9ARM.ch06"></a>Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</h2></div></div></div>
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573293">Comment Syntax</a></span></dt>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574022"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574286"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574646"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574663"><span><strong class="command">include</strong></span> Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574755"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574778"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
cdfc81e048bd34c1d628380247bda6b80a89e20eAutomatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574872"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575008"><span><strong class="command">logging</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577145"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577242"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577338"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577456"><span><strong class="command">masters</strong></span> Statement Definition and
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577477"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt>
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#statschannels"><span><strong class="command">statistics-channels</strong></span> Statement Grammar</a></span></dt>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592246"><span><strong class="command">statistics-channels</strong></span> Statement Definition and
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#trusted-keys"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
3ccf87473f7cf6d9faac156df38a935a238f96fdTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592595"><span><strong class="command">trusted-keys</strong></span> Statement Definition
b378314925e78f21853a98cec924788ce1822c6cTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592648"><span><strong class="command">managed-keys</strong></span> Statement Grammar</a></span></dt>
ebe53509ca55a141131c104b6d722236b606e0efTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#managed-keys"><span><strong class="command">managed-keys</strong></span> Statement Definition
415d630b6309922caee8469384a6fab75cf05032Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2593152"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2595031"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
7cc0a5d21ef046bfd630c4769943d896a7d7472cTinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2598793">Zone File</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2601024">Discussion of MX Records</a></span></dt>
551e6d2414c4f47d58a9bb0b37f206f915a4f5acTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2601639">Inverse Mapping in IPv4</a></span></dt>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2601766">Other Zone File Directives</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2602107"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch06.html#statistics">BIND9 Statistics</a></span></dt>
51aeb0ae19596e99b029cfa933e73b76ebec480aTinderbox User<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch06.html#statistics_counters">Statistics Counters</a></span></dt></dl></dd>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <acronym class="acronym">BIND</acronym> 9 configuration is broadly similar
415d630b6309922caee8469384a6fab75cf05032Mark Andrews to <acronym class="acronym">BIND</acronym> 8; however, there are a few new
415d630b6309922caee8469384a6fab75cf05032Mark Andrews of configuration, such as views. <acronym class="acronym">BIND</acronym>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews 8 configuration files should work with few alterations in <acronym class="acronym">BIND</acronym>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User 9, although more complex configurations should be reviewed to check
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews if they can be more efficiently implemented using the new features
415d630b6309922caee8469384a6fab75cf05032Mark Andrews found in <acronym class="acronym">BIND</acronym> 9.
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User <acronym class="acronym">BIND</acronym> 4 configuration files can be
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews converted to the new format
415d630b6309922caee8469384a6fab75cf05032Mark Andrews using the shell script
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson <code class="filename">contrib/named-bootconf/named-bootconf.sh</code>.
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<a name="configuration_file_elements"></a>Configuration File Elements</h2></div></div></div>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson Following is a list of elements used throughout the <acronym class="acronym">BIND</acronym> configuration
415d630b6309922caee8469384a6fab75cf05032Mark Andrews file documentation:
baeaed18341c015e9ad54ffa21973184c1bc432bMark Andrews The name of an <code class="varname">address_match_list</code> as
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont defined by the <span><strong class="command">acl</strong></span> statement.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <code class="varname">address_match_list</code>
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews A list of one or more
2b7254075b883d70852a2757210793603085a0f1Tinderbox User <code class="varname">ip_prefix</code>, <code class="varname">key_id</code>,
66317da170ed35b08f5847db2d48b225826327cbTinderbox User or <code class="varname">acl_name</code> elements, see
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a>.
415d630b6309922caee8469384a6fab75cf05032Mark Andrews A named list of one or more <code class="varname">ip_addr</code>
fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater with optional <code class="varname">key_id</code> and/or
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews A <code class="varname">masters_list</code> may include other
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User A quoted string which will be used as
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews a DNS name, for example "<code class="literal">my.test.domain</code>".
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews A list of one or more <code class="varname">domain_name</code>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson <code class="varname">dotted_decimal</code>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews One to four integers valued 0 through
5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User 255 separated by dots (`.'), such as <span><strong class="command">123</strong></span>,
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <span><strong class="command">45.67</strong></span> or <span><strong class="command">89.123.45.67</strong></span>.
fab54780409846f7c71f6026d665f18c77c649efTinderbox User An IPv4 address with exactly four elements
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews in <code class="varname">dotted_decimal</code> notation.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews An IPv6 address, such as <span><strong class="command">2001:db8::1234</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews IPv6 scoped addresses that have ambiguity on their
98240f34c38524fd6d0db5a42b9d47cd95ec0fa1Tinderbox User scope zones must be disambiguated by an appropriate
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews zone ID with the percent character (`%') as
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews delimiter. It is strongly recommended to use
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews string zone names rather than numeric identifiers,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews in order to be robust against system configuration
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews changes. However, since there is no standard
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User mapping for such names and identifier values,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews currently only interface names as link identifiers
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews are supported, assuming one-to-one mapping between
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews interfaces and links. For example, a link-local
c317b09bf112121245fafe61f38b95dc6e96acabTinderbox User address <span><strong class="command">fe80::1</strong></span> on the link
98240f34c38524fd6d0db5a42b9d47cd95ec0fa1Tinderbox User attached to the interface <span><strong class="command">ne0</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews can be specified as <span><strong class="command">fe80::1%ne0</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Note that on most systems link-local addresses
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews always have the ambiguity, and need to be
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews disambiguated.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews An <code class="varname">ip4_addr</code> or <code class="varname">ip6_addr</code>.
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews A <code class="varname">number</code> between 0 and 63, used
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews to select a differentiated services code point (DSCP)
e5c7ef08d1bf9f8388de8174a47da78b9eeb7e5cTinderbox User value for use with outgoing traffic on operating systems
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews that support DSCP.
98240f34c38524fd6d0db5a42b9d47cd95ec0fa1Tinderbox User An IP port <code class="varname">number</code>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <code class="varname">number</code> is limited to 0
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews through 65535, with values
076e51f1ff9497ae61a99994189ed8bf5a0d3472Tinderbox User below 1024 typically restricted to use by processes running
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson In some cases, an asterisk (`*') character can be used as a
a2c370ca12bb0360ff7e969474ead3f788c65fffTinderbox User placeholder to
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User select a random high-numbered port.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews An IP network specified as an <code class="varname">ip_addr</code>,
415d630b6309922caee8469384a6fab75cf05032Mark Andrews followed by a slash (`/') and then the number of bits in the
415d630b6309922caee8469384a6fab75cf05032Mark Andrews Trailing zeros in a <code class="varname">ip_addr</code>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews may omitted.
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User For example, <span><strong class="command">127/8</strong></span> is the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews network <span><strong class="command">127.0.0.0</strong></span> with
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User netmask <span><strong class="command">255.0.0.0</strong></span> and <span><strong class="command">1.2.3.0/28</strong></span> is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews network <span><strong class="command">1.2.3.0</strong></span> with netmask <span><strong class="command">255.255.255.240</strong></span>.
c1e2310a3725eeed45e5e7c86750c64c5a02e993Francis Dupont When specifying a prefix involving a IPv6 scoped address
4b61b671f5de767ec1d1b8e6cf7b849bddf08e98Tinderbox User the scope may be omitted. In that case the prefix will
4b61b671f5de767ec1d1b8e6cf7b849bddf08e98Tinderbox User match packets from any scope.
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews A <code class="varname">domain_name</code> representing
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews the name of a shared key, to be used for transaction
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews A list of one or more
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews separated by semicolons and ending with a semicolon.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews A non-negative 32-bit integer
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews (i.e., a number between 0 and 4294967295, inclusive).
ebe53509ca55a141131c104b6d722236b606e0efTinderbox User Its acceptable value might further
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews be limited by the context in which it is used.
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews A quoted string which will be used as
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews a pathname, such as <code class="filename">zones/master/my.test.domain</code>.
4840ef4581a577a29a18d180b6bc2e7355378ed7Mark Andrews A list of an <code class="varname">ip_port</code> or a port
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews A port range is specified in the form of
8927a982bde7e4b665966b55f0fa57c5cf21b9d8Mark Andrews <strong class="userinput"><code>range</code></strong> followed by
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <code class="varname">port_high</code>, which represents
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews port numbers from <code class="varname">port_low</code> through
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <code class="varname">port_high</code>, inclusive.
baeaed18341c015e9ad54ffa21973184c1bc432bMark Andrews <code class="varname">port_low</code> must not be larger than
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews For example,
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <strong class="userinput"><code>range 1024 65535</code></strong> represents
3bd8b5a8fb126e45c67ff53b68183c889cc27918Tinderbox User ports from 1024 through 65535.
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User In either case an asterisk (`*') character is not
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews allowed as a valid <code class="varname">ip_port</code>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews A 64-bit unsigned integer, or the keywords
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson <strong class="userinput"><code>unlimited</code></strong> or
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <strong class="userinput"><code>default</code></strong>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Integers may take values
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews 0 <= value <= 18446744073709551615, though
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews certain parameters
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews (such as <span><strong class="command">max-journal-size</strong></span>) may
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User use a more limited range within these extremes.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews In most cases, setting a value to 0 does not
3a988722ad9e209ba4064604d482dc4efe0e19ebTinderbox User literally mean zero; it means "undefined" or
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington "as big as possible", depending on the context.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington See the explanations of particular parameters
e1ebc476b08b4a498fcf3477e42c986eb1991360Tinderbox User that use <code class="varname">size_spec</code>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews for details on how they interpret its use.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Numeric values can optionally be followed by a
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews scaling factor:
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <strong class="userinput"><code>K</code></strong> or <strong class="userinput"><code>k</code></strong>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews for kilobytes,
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User <strong class="userinput"><code>M</code></strong> or <strong class="userinput"><code>m</code></strong>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews for megabytes, and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <strong class="userinput"><code>G</code></strong> or <strong class="userinput"><code>g</code></strong>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews for gigabytes, which scale by 1024, 1024*1024, and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews 1024*1024*1024 respectively.
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews <code class="varname">unlimited</code> generally means
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews "as big as possible", and is usually the best
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews way to safely set a very large number.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews uses the limit that was in force when the server was started.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Either <strong class="userinput"><code>yes</code></strong> or <strong class="userinput"><code>no</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The words <strong class="userinput"><code>true</code></strong> and <strong class="userinput"><code>false</code></strong> are
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington also accepted, as are the numbers <strong class="userinput"><code>1</code></strong>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington and <strong class="userinput"><code>0</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington One of <strong class="userinput"><code>yes</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>no</code></strong>, <strong class="userinput"><code>notify</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>notify-passive</code></strong>, <strong class="userinput"><code>refresh</code></strong> or
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>passive</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington When used in a zone, <strong class="userinput"><code>notify-passive</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>refresh</code></strong>, and <strong class="userinput"><code>passive</code></strong>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington are restricted to slave and stub zones.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h3 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="address_match_lists"></a>Address Match Lists</h3></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573128"></a>Syntax</h4></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ;
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> address_match_list_element; ... </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] |
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington key key_id | acl_name | { address_match_list } )
415d630b6309922caee8469384a6fab75cf05032Mark Andrews<div class="titlepage"><div><div><h4 class="title">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<a name="id2573156"></a>Definition and Usage</h4></div></div></div>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews Address match lists are primarily used to determine access
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User control for various server operations. They are also used in
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the <span><strong class="command">listen-on</strong></span> and <span><strong class="command">sortlist</strong></span>
2b7254075b883d70852a2757210793603085a0f1Tinderbox User statements. The elements which constitute an address match
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater list can be any of the following:
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews a key ID, as defined by the <span><strong class="command">key</strong></span>
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater<li>the name of an address match list defined with
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater the <span><strong class="command">acl</strong></span> statement
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater<li>a nested address match list enclosed in braces</li>
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews Elements can be negated with a leading exclamation mark (`!'),
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User and the match list names "any", "none", "localhost", and
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User "localnets" are predefined. More information on those names
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User can be found in the description of the acl statement.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User The addition of the key clause made the name of this syntactic
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User element something of a misnomer, since security keys can be used
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User to validate access without regard to a host or network address.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User Nonetheless, the term "address match list" is still used
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User throughout the documentation.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews When a given IP address or prefix is compared to an address
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews match list, the comparison takes place in approximately O(1)
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User time. However, key comparisons require that the list of keys
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User be traversed until a matching key is found, and therefore may
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User be somewhat slower.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The interpretation of a match depends on whether the list is being
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews used for access control, defining <span><strong class="command">listen-on</strong></span> ports, or in a
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">sortlist</strong></span>, and whether the element was negated.
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User When used as an access control list, a non-negated match
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews allows access and a negated match denies access. If
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews there is no match, access is denied. The clauses
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">allow-notify</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">allow-recursion</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">allow-recursion-on</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">allow-query</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">allow-query-on</strong></span>,
2b7254075b883d70852a2757210793603085a0f1Tinderbox User <span><strong class="command">allow-query-cache</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">allow-query-cache-on</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">allow-transfer</strong></span>,
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <span><strong class="command">allow-update</strong></span>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">allow-update-forwarding</strong></span>, and
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <span><strong class="command">blackhole</strong></span> all use address match
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews lists. Similarly, the <span><strong class="command">listen-on</strong></span> option will cause the
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User server to refuse queries on any of the machine's
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews addresses which do not match the list.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Order of insertion is significant. If more than one element
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews in an ACL is found to match a given IP address or prefix,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews preference will be given to the one that came
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span class="emphasis"><em>first</em></span> in the ACL definition.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Because of this first-match behavior, an element that
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews defines a subset of another element in the list should
51aeb0ae19596e99b029cfa933e73b76ebec480aTinderbox User come before the broader element, regardless of whether
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews either is negated. For example, in
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span><strong class="command">1.2.3/24; ! 1.2.3.13;</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the 1.2.3.13 element is completely useless because the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington algorithm will match any lookup for 1.2.3.13 to the 1.2.3/24
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington element. Using <span><strong class="command">! 1.2.3.13; 1.2.3/24</strong></span> fixes
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington that problem by having 1.2.3.13 blocked by the negation, but
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington all other 1.2.3.* hosts fall through.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h3 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573293"></a>Comment Syntax</h3></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington comments to appear
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington file. To appeal to programmers of all kinds, they can be written
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573308"></a>Syntax</h4></div></div></div>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User<pre class="programlisting">// This is a <acronym class="acronym">BIND</acronym> comment as in C++</pre>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<pre class="programlisting"># This is a <acronym class="acronym">BIND</acronym> comment as in common UNIX shells
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews# and perl</pre>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User<div class="titlepage"><div><div><h4 class="title">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<a name="id2573406"></a>Definition and Usage</h4></div></div></div>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Comments may appear anywhere that whitespace may appear in
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews a <acronym class="acronym">BIND</acronym> configuration file.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews C-style comments start with the two characters /* (slash,
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews star) and end with */ (star, slash). Because they are completely
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington delimited with these characters, they can be used to comment only
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington a portion of a line or to span multiple lines.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington C-style comments cannot be nested. For example, the following
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington is not valid because the entire comment ends with the first */:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting">/* This is the start of a comment.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington This is still part of the comment.
409ba95e573b40cf36acf97dd62ee7e9c7775851Tinderbox User/* This is an incorrect attempt at nesting a comment. */
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews This is no longer in any comment. */
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington C++-style comments start with the two characters // (slash,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews slash) and continue to the end of the physical line. They cannot
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews be continued across multiple physical lines; to have one logical
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews comment span multiple lines, each line must use the // pair.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews For example:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting">// This is the start of a comment. The next line
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington// is a new comment, even though it is logically
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington// part of the previous comment.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Shell-style (or perl-style, if you prefer) comments start
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews with the character <code class="literal">#</code> (number sign)
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews and continue to the end of the
5835beb229e17d583fb4b6fd4246bd014a68ddf6Tinderbox User physical line, as in C++ comments.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews For example:
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User<pre class="programlisting"># This is the start of a comment. The next line
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews# is a new comment, even though it is logically
77997fab4b6b2d2c36ec66ace387447e8bc5c18eMark Andrews# part of the previous comment.
872e1437295dce8162ac7374317d593320ac2dd6Tinderbox User<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
872e1437295dce8162ac7374317d593320ac2dd6Tinderbox User You cannot use the semicolon (`;') character
872e1437295dce8162ac7374317d593320ac2dd6Tinderbox User to start a comment such as you would in a zone file. The
872e1437295dce8162ac7374317d593320ac2dd6Tinderbox User semicolon indicates the end of a configuration
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews<div class="titlepage"><div><div><h2 class="title" style="clear: both">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="Configuration_File_Grammar"></a>Configuration File Grammar</h2></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington A <acronym class="acronym">BIND</acronym> 9 configuration consists of
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews statements and comments.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews Statements end with a semicolon. Statements and comments are the
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews only elements that can appear without enclosing braces. Many
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews statements contain a block of sub-statements, which are also
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews terminated with a semicolon.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The following statements are supported:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="informaltable"><table border="1">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">acl</strong></span></p>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews defines a named IP address
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User matching list, for access control and other uses.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">controls</strong></span></p>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews declares control channels to be used
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews by the <span><strong class="command">rndc</strong></span> utility.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">include</strong></span></p>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews includes a file.
1fdd58445074579ee3b65c871137a7a1740eb542Mark Andrews <p><span><strong class="command">key</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews specifies key information for use in
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews authentication and authorization using TSIG.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">logging</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews specifies what the server logs, and where
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the log messages are sent.
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews <p><span><strong class="command">lwres</strong></span></p>
dde130e859339194eebd7184eaf440981838a7f0Mark Andrews configures <span><strong class="command">named</strong></span> to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews also act as a light-weight resolver daemon (<span><strong class="command">lwresd</strong></span>).
f48877f10cfccd0cdbb7aa5f832fbafcf60ce1daTinderbox User <p><span><strong class="command">masters</strong></span></p>
c4d2e7c8c8fe06009165275bee0703b0ef85e19fTinderbox User defines a named masters list for
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews inclusion in stub and slave zones'
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">masters</strong></span> or
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">also-notify</strong></span> lists.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">options</strong></span></p>
c4d2e7c8c8fe06009165275bee0703b0ef85e19fTinderbox User controls global server configuration
c4d2e7c8c8fe06009165275bee0703b0ef85e19fTinderbox User options and sets defaults for other statements.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">server</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews sets certain configuration options on
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews a per-server basis.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">statistics-channels</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews declares communication channels to get access to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">named</strong></span> statistics.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">trusted-keys</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews defines trusted DNSSEC keys.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">managed-keys</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews lists DNSSEC keys to be kept up to date
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews using RFC 5011 trust anchor maintenance.
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User <p><span><strong class="command">view</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews defines a view.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">zone</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews defines a zone.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <span><strong class="command">logging</strong></span> and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">options</strong></span> statements may only occur once
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews configuration.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h3 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="id2574022"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<pre class="programlisting"><span><strong class="command">acl</strong></span> acl-name {
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews address_match_list
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h3 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="acl"></a><span><strong class="command">acl</strong></span> Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <span><strong class="command">acl</strong></span> statement assigns a symbolic
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews name to an address match list. It gets its name from a primary
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews use of address match lists: Access Control Lists (ACLs).
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Note that an address match list's name must be defined
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews with <span><strong class="command">acl</strong></span> before it can be used
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews elsewhere; no forward references are allowed.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The following ACLs are built-in:
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington <p><span><strong class="command">any</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Matches all hosts.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">none</strong></span></p>
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews Matches no hosts.
8f977d4d64b0ebe562607aaa044671ed34609978Tinderbox User <p><span><strong class="command">localhost</strong></span></p>
6c2a76b3e2ccd32c35814b6e0f54da00190749d7Evan Hunt Matches the IPv4 and IPv6 addresses of all network
6c2a76b3e2ccd32c35814b6e0f54da00190749d7Evan Hunt interfaces on the system. When addresses are
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User added or removed, the <span><strong class="command">localhost</strong></span>
d786bb0f8beee4425dc5ba21ea19f8f353c85a65Evan Hunt ACL element is updated to reflect the changes.
d786bb0f8beee4425dc5ba21ea19f8f353c85a65Evan Hunt <p><span><strong class="command">localnets</strong></span></p>
efdfbc256c997060cfa0c2306c4fdd9dbc31342cTinderbox User Matches any host on an IPv4 or IPv6 network
d786bb0f8beee4425dc5ba21ea19f8f353c85a65Evan Hunt for which the system has an interface.
d786bb0f8beee4425dc5ba21ea19f8f353c85a65Evan Hunt When addresses are added or removed,
d786bb0f8beee4425dc5ba21ea19f8f353c85a65Evan Hunt the <span><strong class="command">localnets</strong></span>
d786bb0f8beee4425dc5ba21ea19f8f353c85a65Evan Hunt ACL element is updated to reflect the changes.
d786bb0f8beee4425dc5ba21ea19f8f353c85a65Evan Hunt Some systems do not provide a way to determine the prefix
d786bb0f8beee4425dc5ba21ea19f8f353c85a65Evan Hunt local IPv6 addresses.
d786bb0f8beee4425dc5ba21ea19f8f353c85a65Evan Hunt In such a case, <span><strong class="command">localnets</strong></span>
d786bb0f8beee4425dc5ba21ea19f8f353c85a65Evan Hunt only matches the local
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews IPv6 addresses, just like <span><strong class="command">localhost</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h3 class="title">
5b3dd19d815f0389d566d20c2fee57cb37d1dd47Tinderbox User<a name="id2574286"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div>
5b3dd19d815f0389d566d20c2fee57cb37d1dd47Tinderbox User<pre class="programlisting"><span><strong class="command">controls</strong></span> {
5b3dd19d815f0389d566d20c2fee57cb37d1dd47Tinderbox User [ inet ( ip_addr | * ) [ port ip_port ]
5b3dd19d815f0389d566d20c2fee57cb37d1dd47Tinderbox User allow { <em class="replaceable"><code> address_match_list </code></em> }
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews keys { <em class="replaceable"><code>key_list</code></em> }; ]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [ inet ...; ]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [ unix <em class="replaceable"><code>path</code></em> perm <em class="replaceable"><code>number</code></em> owner <em class="replaceable"><code>number</code></em> group <em class="replaceable"><code>number</code></em>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews keys { <em class="replaceable"><code>key_list</code></em> }; ]
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User [ unix ...; ]
4c3d55cb2d2db8a4c52c99b0a76109fb3fe32151Mark Andrews<div class="titlepage"><div><div><h3 class="title">
4c3d55cb2d2db8a4c52c99b0a76109fb3fe32151Mark Andrews<a name="controls_statement_definition_and_usage"></a><span><strong class="command">controls</strong></span> Statement Definition and
4c3d55cb2d2db8a4c52c99b0a76109fb3fe32151Mark Andrews The <span><strong class="command">controls</strong></span> statement declares control
4c3d55cb2d2db8a4c52c99b0a76109fb3fe32151Mark Andrews channels to be used by system administrators to control the
4c3d55cb2d2db8a4c52c99b0a76109fb3fe32151Mark Andrews operation of the name server. These control channels are
4c3d55cb2d2db8a4c52c99b0a76109fb3fe32151Mark Andrews used by the <span><strong class="command">rndc</strong></span> utility to send
4c3d55cb2d2db8a4c52c99b0a76109fb3fe32151Mark Andrews commands to and retrieve non-DNS results from a name server.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews An <span><strong class="command">inet</strong></span> control channel is a TCP socket
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews listening at the specified <span><strong class="command">ip_port</strong></span> on the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews specified <span><strong class="command">ip_addr</strong></span>, which can be an IPv4 or IPv6
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User interpreted as the IPv4 wildcard address; connections will be
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews accepted on any of the system's IPv4 addresses.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews To listen on the IPv6 wildcard address,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews use an <span><strong class="command">ip_addr</strong></span> of <code class="literal">::</code>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If you will only use <span><strong class="command">rndc</strong></span> on the local host,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews using the loopback address (<code class="literal">127.0.0.1</code>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews or <code class="literal">::1</code>) is recommended for maximum security.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If no port is specified, port 953 is used. The asterisk
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews "<code class="literal">*</code>" cannot be used for <span><strong class="command">ip_port</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The ability to issue commands over the control channel is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews restricted by the <span><strong class="command">allow</strong></span> and
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User <span><strong class="command">keys</strong></span> clauses.
7692464e78fc43578c394b8d1d30e81fec1d8523Tinderbox User Connections to the control channel are permitted based on the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">address_match_list</strong></span>. This is for simple
34f0f38b72c3ee40233b7b4e09ccab0ac1a74d2aTinderbox User IP address based filtering only; any <span><strong class="command">key_id</strong></span>
5b3dd19d815f0389d566d20c2fee57cb37d1dd47Tinderbox User elements of the <span><strong class="command">address_match_list</strong></span>
076e51f1ff9497ae61a99994189ed8bf5a0d3472Tinderbox User A <span><strong class="command">unix</strong></span> control channel is a UNIX domain
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User socket listening at the specified path in the file system.
b625bdae12277225b076a002dd4af80902529181Tinderbox User Access to the socket is specified by the <span><strong class="command">perm</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">owner</strong></span> and <span><strong class="command">group</strong></span> clauses.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Note on some platforms (SunOS and Solaris) the permissions
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews (<span><strong class="command">perm</strong></span>) are applied to the parent directory
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews as the permissions on the socket itself are ignored.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The primary authorization mechanism of the command
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews channel is the <span><strong class="command">key_list</strong></span>, which
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews contains a list of <span><strong class="command">key_id</strong></span>s.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Each <span><strong class="command">key_id</strong></span> in the <span><strong class="command">key_list</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews is authorized to execute commands over the control channel.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews See <a href="Bv9ARM.ch03.html#rndc">Remote Name Daemon Control application</a> in <a href="Bv9ARM.ch03.html#admin_tools" title="Administrative Tools">the section called “Administrative Tools”</a>)
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews for information about configuring keys in <span><strong class="command">rndc</strong></span>.
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews If no <span><strong class="command">controls</strong></span> statement is present,
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews <span><strong class="command">named</strong></span> will set up a default
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews control channel listening on the loopback address 127.0.0.1
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews and its IPv6 counterpart ::1.
7354f3248ddf6b3c331f7da4cc0089e5514fd205Evan Hunt In this case, and also when the <span><strong class="command">controls</strong></span> statement
7354f3248ddf6b3c331f7da4cc0089e5514fd205Evan Hunt is present but does not have a <span><strong class="command">keys</strong></span> clause,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">named</strong></span> will attempt to load the command channel key
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews from the file <code class="filename">rndc.key</code> in
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <code class="filename">/etc</code> (or whatever <code class="varname">sysconfdir</code>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews was specified as when <acronym class="acronym">BIND</acronym> was built).
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews To create a <code class="filename">rndc.key</code> file, run
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt <strong class="userinput"><code>rndc-confgen -a</code></strong>.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt The <code class="filename">rndc.key</code> feature was created to
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt ease the transition of systems from <acronym class="acronym">BIND</acronym> 8,
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt which did not have digital signatures on its command channel
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt messages and thus did not have a <span><strong class="command">keys</strong></span> clause.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt It makes it possible to use an existing <acronym class="acronym">BIND</acronym> 8
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews configuration file in <acronym class="acronym">BIND</acronym> 9 unchanged,
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User and still have <span><strong class="command">rndc</strong></span> work the same way
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt <span><strong class="command">ndc</strong></span> worked in BIND 8, simply by executing the
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt command <strong class="userinput"><code>rndc-confgen -a</code></strong> after BIND 9 is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Since the <code class="filename">rndc.key</code> feature
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews is only intended to allow the backward-compatible usage of
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <acronym class="acronym">BIND</acronym> 8 configuration files, this
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews feature does not
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews have a high degree of configurability. You cannot easily change
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the key name or the size of the secret, so you should make a
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <code class="filename">rndc.conf</code> with your own key if you
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews wish to change
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews those things. The <code class="filename">rndc.key</code> file
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews also has its
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews permissions set such that only the owner of the file (the user that
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">named</strong></span> is running as) can access it.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews desire greater flexibility in allowing other users to access
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">rndc</strong></span> commands, then you need to create
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <code class="filename">rndc.conf</code> file and make it group
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews readable by a group
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User that contains the users who should have access.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews To disable the command channel, use an empty
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">controls</strong></span> statement:
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">controls { };</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h3 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="id2574646"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<pre class="programlisting"><span><strong class="command">include</strong></span> <em class="replaceable"><code>filename</code></em>;</pre>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h3 class="title">
06ea55a43397bc38c34a6d7e5c6219fe483edbb2Tinderbox User<a name="id2574663"></a><span><strong class="command">include</strong></span> Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <span><strong class="command">include</strong></span> statement inserts the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews specified file at the point where the <span><strong class="command">include</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews statement is encountered. The <span><strong class="command">include</strong></span>
5e145d312503505bed49bcd72d1062b82989cadaTinderbox User statement facilitates the administration of configuration
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews by permitting the reading or writing of some things but not
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews others. For example, the statement could include private keys
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews that are readable only by the name server.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h3 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="id2574755"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<pre class="programlisting"><span><strong class="command">key</strong></span> <em class="replaceable"><code>key_id</code></em> {
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews algorithm <em class="replaceable"><code>string</code></em>;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews secret <em class="replaceable"><code>string</code></em>;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h3 class="title">
e1ebc476b08b4a498fcf3477e42c986eb1991360Tinderbox User<a name="id2574778"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div>
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews The <span><strong class="command">key</strong></span> statement defines a shared
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews secret key for use with TSIG (see <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
6eb9141841e6ed9cbbdbbf41ab0e1c9592c5d078Mark Andrews or the command channel
6eb9141841e6ed9cbbdbbf41ab0e1c9592c5d078Mark Andrews (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Usage”</a>).
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <span><strong class="command">key</strong></span> statement can occur at the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews of the configuration file or inside a <span><strong class="command">view</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews statement. Keys defined in top-level <span><strong class="command">key</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews statements can be used in all views. Keys intended for use in
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews a <span><strong class="command">controls</strong></span> statement
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
6eb9141841e6ed9cbbdbbf41ab0e1c9592c5d078Mark Andrews Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews Usage”</a>)
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews must be defined at the top level.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews The <em class="replaceable"><code>key_id</code></em>, also known as the
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews key name, is a domain name uniquely identifying the key. It can
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews be used in a <span><strong class="command">server</strong></span>
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews statement to cause requests sent to that
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews server to be signed with this key, or in address match lists to
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews verify that incoming requests have been signed with a key
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews matching this name, algorithm, and secret.
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews The <em class="replaceable"><code>algorithm_id</code></em> is a string
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews that specifies a security/authentication algorithm. The
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <span><strong class="command">named</strong></span> server supports <code class="literal">hmac-md5</code>,
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews and <code class="literal">hmac-sha512</code> TSIG authentication.
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews Truncated hashes are supported by appending the minimum
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews number of required bits preceded by a dash, e.g.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <em class="replaceable"><code>secret_string</code></em> is the secret
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to be used by the algorithm, and is treated as a base-64
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews encoded string.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h3 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="id2574872"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div>
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User<pre class="programlisting"><span><strong class="command">logging</strong></span> {
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt [ <span><strong class="command">channel</strong></span> <em class="replaceable"><code>channel_name</code></em> {
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt ( <span><strong class="command">file</strong></span> <em class="replaceable"><code>path_name</code></em>
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt [ <span><strong class="command">versions</strong></span> ( <em class="replaceable"><code>number</code></em> | <span><strong class="command">unlimited</strong></span> ) ]
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt [ <span><strong class="command">size</strong></span> <em class="replaceable"><code>size_spec</code></em> ]
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt | <span><strong class="command">syslog</strong></span> <em class="replaceable"><code>syslog_facility</code></em>
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt | <span><strong class="command">stderr</strong></span>
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt | <span><strong class="command">null</strong></span> );
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt [ <span><strong class="command">severity</strong></span> (<code class="option">critical</code> | <code class="option">error</code> | <code class="option">warning</code> | <code class="option">notice</code> |
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt <code class="option">info</code> | <code class="option">debug</code> [ <em class="replaceable"><code>level</code></em> ] | <code class="option">dynamic</code> ); ]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [ <span><strong class="command">print-category</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [ <span><strong class="command">print-severity</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [ <span><strong class="command">print-time</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [ <span><strong class="command">buffered</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [ <span><strong class="command">category</strong></span> <em class="replaceable"><code>category_name</code></em> {
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <em class="replaceable"><code>channel_name</code></em> ; [ <em class="replaceable"><code>channel_name</code></em> ; ... ]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h3 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="id2575008"></a><span><strong class="command">logging</strong></span> Statement Definition and
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User The <span><strong class="command">logging</strong></span> statement configures a
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews variety of logging options for the name server. Its <span><strong class="command">channel</strong></span> phrase
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews associates output methods, format options and severity levels with
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews a name that can then be used with the <span><strong class="command">category</strong></span> phrase
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to select how various classes of messages are logged.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Only one <span><strong class="command">logging</strong></span> statement is used to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews as many channels and categories as are wanted. If there is no <span><strong class="command">logging</strong></span> statement,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the logging configuration will be:
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews category default { default_syslog; default_debug; };
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews category unmatched { null; };
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews In <acronym class="acronym">BIND</acronym> 9, the logging configuration
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews is only established when
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the entire configuration file has been parsed. In <acronym class="acronym">BIND</acronym> 8, it was
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews established as soon as the <span><strong class="command">logging</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews was parsed. When the server is starting up, all logging messages
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews regarding syntax errors in the configuration file go to the default
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews channels, or to standard error if the "<code class="option">-g</code>" option
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews was specified.
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User<div class="titlepage"><div><div><h4 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="id2575060"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews All log output goes to one or more <span class="emphasis"><em>channels</em></span>;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews you can make as many of them as you want.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Every channel definition must include a destination clause that
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews says whether messages selected for the channel go to a file, to a
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews particular syslog facility, to the standard error stream, or are
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews discarded. It can optionally also limit the message severity level
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User that will be accepted by the channel (the default is
8ac5ddf659a81ed668579818981fc1a5f28405d1Tinderbox User <span><strong class="command">info</strong></span>), and whether to include a
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">named</strong></span>-generated time stamp, the
2b7254075b883d70852a2757210793603085a0f1Tinderbox User category name
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews and/or severity level (the default is not to include any).
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <span><strong class="command">null</strong></span> destination clause
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews causes all messages sent to the channel to be discarded;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews in that case, other options for the channel are meaningless.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <span><strong class="command">file</strong></span> destination clause directs
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to a disk file. It can include limitations
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews both on how large the file is allowed to become, and how many
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews of the file will be saved each time the file is opened.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If you use the <span><strong class="command">versions</strong></span> log file
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews option, then
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">named</strong></span> will retain that many backup
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews versions of the file by
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews renaming them when opening. For example, if you choose to keep
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews three old versions
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews of the file <code class="filename">lamers.log</code>, then just
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews before it is opened
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <code class="filename">lamers.log.1</code> is renamed to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <code class="filename">lamers.log.2</code>, <code class="filename">lamers.log.0</code> is renamed
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to <code class="filename">lamers.log.1</code>, and <code class="filename">lamers.log</code> is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews renamed to <code class="filename">lamers.log.0</code>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews You can say <span><strong class="command">versions unlimited</strong></span> to
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User the number of versions.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If a <span><strong class="command">size</strong></span> option is associated with
ebe53509ca55a141131c104b6d722236b606e0efTinderbox User the log file,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews then renaming is only done when the file being opened exceeds the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews indicated size. No backup versions are kept by default; any
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews log file is simply appended.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <span><strong class="command">size</strong></span> option for files is used
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to limit log
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews growth. If the file ever exceeds the size, then <span><strong class="command">named</strong></span> will
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews stop writing to the file unless it has a <span><strong class="command">versions</strong></span> option
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews associated with it. If backup versions are kept, the files are
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews described above and a new one begun. If there is no
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">versions</strong></span> option, no more data will
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews be written to the log
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews until some out-of-band mechanism removes or truncates the log to
e1a389f7478d094ffbe592df28328a10d484cb38Tinderbox User less than the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews maximum size. The default behavior is not to limit the size of
e1a389f7478d094ffbe592df28328a10d484cb38Tinderbox User Example usage of the <span><strong class="command">size</strong></span> and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">versions</strong></span> options:
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<pre class="programlisting">channel an_example_channel {
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews file "example.log" versions 3 size 20m;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews print-time yes;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews print-category yes;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <span><strong class="command">syslog</strong></span> destination clause
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews channel to the system log. Its argument is a
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews syslog facility as described in the <span><strong class="command">syslog</strong></span> man
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews page. Known facilities are <span><strong class="command">kern</strong></span>, <span><strong class="command">user</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">mail</strong></span>, <span><strong class="command">daemon</strong></span>, <span><strong class="command">auth</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">syslog</strong></span>, <span><strong class="command">lpr</strong></span>, <span><strong class="command">news</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">uucp</strong></span>, <span><strong class="command">cron</strong></span>, <span><strong class="command">authpriv</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">ftp</strong></span>, <span><strong class="command">local0</strong></span>, <span><strong class="command">local1</strong></span>,
e1a389f7478d094ffbe592df28328a10d484cb38Tinderbox User <span><strong class="command">local2</strong></span>, <span><strong class="command">local3</strong></span>, <span><strong class="command">local4</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">local5</strong></span>, <span><strong class="command">local6</strong></span> and
e1a389f7478d094ffbe592df28328a10d484cb38Tinderbox User <span><strong class="command">local7</strong></span>, however not all facilities
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews are supported on
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews all operating systems.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews How <span><strong class="command">syslog</strong></span> will handle messages
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews this facility is described in the <span><strong class="command">syslog.conf</strong></span> man
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews page. If you have a system which uses a very old version of <span><strong class="command">syslog</strong></span> that
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews only uses two arguments to the <span><strong class="command">openlog()</strong></span> function,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews then this clause is silently ignored.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews On Windows machines syslog messages are directed to the EventViewer.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <span><strong class="command">severity</strong></span> clause works like <span><strong class="command">syslog</strong></span>'s
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews "priorities", except that they can also be used if you are writing
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews straight to a file rather than using <span><strong class="command">syslog</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Messages which are not at least of the severity level given will
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews not be selected for the channel; messages of higher severity
e1a389f7478d094ffbe592df28328a10d484cb38Tinderbox User will be accepted.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If you are using <span><strong class="command">syslog</strong></span>, then the <span><strong class="command">syslog.conf</strong></span> priorities
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews will also determine what eventually passes through. For example,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews defining a channel facility and severity as <span><strong class="command">daemon</strong></span> and <span><strong class="command">debug</strong></span> but
f48877f10cfccd0cdbb7aa5f832fbafcf60ce1daTinderbox User only logging <span><strong class="command">daemon.warning</strong></span> via <span><strong class="command">syslog.conf</strong></span> will
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews cause messages of severity <span><strong class="command">info</strong></span> and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">notice</strong></span> to
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews be dropped. If the situation were reversed, with <span><strong class="command">named</strong></span> writing
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews messages of only <span><strong class="command">warning</strong></span> or higher,
82b96702f09ed6bc5cd0f1aa5e54198c04cc192bTinderbox User then <span><strong class="command">syslogd</strong></span> would
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews print all messages it received from the channel.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <span><strong class="command">stderr</strong></span> destination clause
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews channel to the server's standard error stream. This is intended
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews use when the server is running as a foreground process, for
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews when debugging a configuration.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The server can supply extensive debugging information when
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews it is in debugging mode. If the server's global debug level is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews than zero, then debugging mode will be active. The global debug
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews level is set either by starting the <span><strong class="command">named</strong></span> server
549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User with the <code class="option">-d</code> flag followed by a positive integer,
549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User or by running <span><strong class="command">rndc trace</strong></span>.
e1ebc476b08b4a498fcf3477e42c986eb1991360Tinderbox User The global debug level
7204d08a319cf590ae4280b8cc20999320398574Mark Andrews can be set to zero, and debugging mode turned off, by running <span><strong class="command">rndc
7204d08a319cf590ae4280b8cc20999320398574Mark Andrewsnotrace</strong></span>. All debugging messages in the server have a debug
7204d08a319cf590ae4280b8cc20999320398574Mark Andrews level, and higher debug levels give more detailed output. Channels
7204d08a319cf590ae4280b8cc20999320398574Mark Andrews that specify a specific debug severity, for example:
7204d08a319cf590ae4280b8cc20999320398574Mark Andrews<pre class="programlisting">channel specific_debug_level {
7204d08a319cf590ae4280b8cc20999320398574Mark Andrews severity debug 3;
7204d08a319cf590ae4280b8cc20999320398574Mark Andrews will get debugging output of level 3 or less any time the
8927a982bde7e4b665966b55f0fa57c5cf21b9d8Mark Andrews server is in debugging mode, regardless of the global debugging
7204d08a319cf590ae4280b8cc20999320398574Mark Andrews level. Channels with <span><strong class="command">dynamic</strong></span>
7204d08a319cf590ae4280b8cc20999320398574Mark Andrews severity use the
7204d08a319cf590ae4280b8cc20999320398574Mark Andrews server's global debug level to determine what messages to print.
7204d08a319cf590ae4280b8cc20999320398574Mark Andrews If <span><strong class="command">print-time</strong></span> has been turned on,
7204d08a319cf590ae4280b8cc20999320398574Mark Andrews the date and time will be logged. <span><strong class="command">print-time</strong></span> may
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews be specified for a <span><strong class="command">syslog</strong></span> channel,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews but is usually
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews pointless since <span><strong class="command">syslog</strong></span> also logs
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the date and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews time. If <span><strong class="command">print-category</strong></span> is
052969f1f134d31c7f0fd0d55a89bfd53d538e77Tinderbox User requested, then the
81573f7b114a4c71c0bf47058c00fffd245323ceTinderbox User category of the message will be logged as well. Finally, if <span><strong class="command">print-severity</strong></span> is
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews on, then the severity level of the message will be logged. The <span><strong class="command">print-</strong></span> options may
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews be used in any combination, and will always be printed in the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews order: time, category, severity. Here is an example where all
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews three <span><strong class="command">print-</strong></span> options
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews <code class="computeroutput">28-Feb-2000 15:05:32.863 general: notice: running</code>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If <span><strong class="command">buffered</strong></span> has been turned on the output
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to files will not be flushed after each log entry. By default
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews all log messages are flushed.
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews There are four predefined channels that are used for
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">named</strong></span>'s default logging as follows.
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews How they are
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews used is described in <a href="Bv9ARM.ch06.html#the_category_phrase" title="The category Phrase">the section called “The <span><strong class="command">category</strong></span> Phrase”</a>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<pre class="programlisting">channel default_syslog {
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews // send to syslog's daemon facility
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews syslog daemon;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews // only send priority info and higher
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews severity info;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrewschannel default_debug {
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews // write to named.run in the working directory
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews // Note: stderr is used instead of "named.run" if
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews // the server is started with the '-f' option.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews // log at the server's current debug level
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User severity dynamic;
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrewschannel default_stderr {
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews // writes to stderr
f4f4b97a35429a21480a3858f96b8020f2a9f45dTinderbox User // only send priority info and higher
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews severity info;
9dde9ce5558696850b6b9850a8475ae518409518Tinderbox Userchannel null {
903fcd6a60c6420f5dbd753ab068ba5ca2af8e62Tinderbox User // toss anything sent to this channel
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews The <span><strong class="command">default_debug</strong></span> channel has the
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews property that it only produces output when the server's debug
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews nonzero. It normally writes to a file called <code class="filename">named.run</code>
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews in the server's working directory.
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User For security reasons, when the "<code class="option">-u</code>"
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews command line option is used, the <code class="filename">named.run</code> file
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews is created only after <span><strong class="command">named</strong></span> has
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews changed to the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews new UID, and any debug output generated while <span><strong class="command">named</strong></span> is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews starting up and still running as root is discarded. If you need
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to capture this output, you must run the server with the "<code class="option">-g</code>"
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews option and redirect standard error to a file.
c4a35623959c143db02800584b8116d5b9cd72adTinderbox User Once a channel is defined, it cannot be redefined. Thus you
c4a35623959c143db02800584b8116d5b9cd72adTinderbox User cannot alter the built-in channels directly, but you can modify
c4a35623959c143db02800584b8116d5b9cd72adTinderbox User the default logging by pointing categories at channels you have
c4a35623959c143db02800584b8116d5b9cd72adTinderbox User<div class="titlepage"><div><div><h4 class="title">
c4a35623959c143db02800584b8116d5b9cd72adTinderbox User<a name="the_category_phrase"></a>The <span><strong class="command">category</strong></span> Phrase</h4></div></div></div>
c4a35623959c143db02800584b8116d5b9cd72adTinderbox User There are many categories, so you can send the logs you want
c4a35623959c143db02800584b8116d5b9cd72adTinderbox User to see wherever you want, without seeing logs you don't want. If
c4a35623959c143db02800584b8116d5b9cd72adTinderbox User you don't specify a list of channels for a category, then log
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews in that category will be sent to the <span><strong class="command">default</strong></span> category
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews instead. If you don't specify a default category, the following
bd89a8c38d51f0a3035f6aa411e55e34a4b6f470Tinderbox User "default default" is used:
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<pre class="programlisting">category default { default_syslog; default_debug; };
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews As an example, let's say you want to log security events to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews a file, but you also want keep the default logging behavior. You'd
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews specify the following:
620745a4c70077221fdeecaafd3252e9d3f944f3Tinderbox User<pre class="programlisting">channel my_security_channel {
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews file "my_security_file";
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews severity info;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrewscategory security {
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews my_security_channel;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews default_syslog;
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User default_debug;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews To discard all messages in a category, specify the <span><strong class="command">null</strong></span> channel:
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<pre class="programlisting">category xfer-out { null; };
dda78c0f84895c174ef7206dca6082939c030792Tinderbox Usercategory notify { null; };
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Following are the available categories and brief descriptions
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews of the types of log information they contain. More
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews categories may be added in future <acronym class="acronym">BIND</acronym> releases.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">default</strong></span></p>
dcf17dea53e63f2787924e8e89783d931d8c8fecTinderbox User The default category defines the logging
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews options for those categories where no specific
dcf17dea53e63f2787924e8e89783d931d8c8fecTinderbox User configuration has been
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">general</strong></span></p>
dcf17dea53e63f2787924e8e89783d931d8c8fecTinderbox User The catch-all. Many things still aren't
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews classified into categories, and they all end up here.
dcf17dea53e63f2787924e8e89783d931d8c8fecTinderbox User <p><span><strong class="command">database</strong></span></p>
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews Messages relating to the databases used
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews internally by the name server to store zone and cache
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">security</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Approval and denial of requests.
93ca5ee4c4c77aca8d3bcffd70216f30ef398387Mark Andrews <p><span><strong class="command">config</strong></span></p>
93ca5ee4c4c77aca8d3bcffd70216f30ef398387Mark Andrews Configuration file parsing and processing.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <p><span><strong class="command">resolver</strong></span></p>
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews DNS resolution, such as the recursive
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews lookups performed on behalf of clients by a caching name
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <p><span><strong class="command">xfer-in</strong></span></p>
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews Zone transfers the server is receiving.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">xfer-out</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Zone transfers the server is sending.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">notify</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The NOTIFY protocol.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <p><span><strong class="command">client</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Processing of client requests.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews <p><span><strong class="command">unmatched</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Messages that <span><strong class="command">named</strong></span> was unable to determine the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews class of or for which there was no matching <span><strong class="command">view</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews A one line summary is also logged to the <span><strong class="command">client</strong></span> category.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews This category is best sent to a file or stderr, by
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User default it is sent to
415d630b6309922caee8469384a6fab75cf05032Mark Andrews the <span><strong class="command">null</strong></span> channel.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">network</strong></span></p>
81573f7b114a4c71c0bf47058c00fffd245323ceTinderbox User Network operations.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">update</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Dynamic updates.
2b7254075b883d70852a2757210793603085a0f1Tinderbox User <p><span><strong class="command">update-security</strong></span></p>
e1ebc476b08b4a498fcf3477e42c986eb1991360Tinderbox User Approval and denial of update requests.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">queries</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Specify where queries should be logged to.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews At startup, specifying the category <span><strong class="command">queries</strong></span> will also
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews enable query logging unless <span><strong class="command">querylog</strong></span> option has been
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews The query log entry reports the client's IP
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews address and port number, and the query name,
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews class and type. Next it reports whether the
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews Recursion Desired flag was set (+ if set, -
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews if not set), if the query was signed (S),
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews EDNS was in use (E), if TCP was used (T), if
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews DO (DNSSEC Ok) was set (D), or if CD (Checking
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews Disabled) was set (C). After this the
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews destination address the query was sent to is
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <code class="computeroutput">client 127.0.0.1#62536 (www.example.com): query: www.example.com IN AAAA +SE</code>
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <code class="computeroutput">client ::1#62537 (www.example.net): query: www.example.net IN AAAA -SE</code>
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews (The first part of this log message, showing the
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews repeated in all subsequent log messages related
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews to the same query.)
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <p><span><strong class="command">query-errors</strong></span></p>
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt Information about queries that resulted in some
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews <p><span><strong class="command">dispatch</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Dispatching of incoming packets to the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews server modules where they are to be processed.
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User <p><span><strong class="command">dnssec</strong></span></p>
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User DNSSEC and TSIG protocol processing.
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User <p><span><strong class="command">lame-servers</strong></span></p>
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User Lame servers. These are misconfigurations
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews in remote servers, discovered by BIND 9 when trying to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews query those servers during resolution.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">delegation-only</strong></span></p>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Delegation only. Logs queries that have been
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington forced to NXDOMAIN as the result of a
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington delegation-only zone or a
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span><strong class="command">delegation-only</strong></span> in a
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington forward, hint or stub zone declaration.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">edns-disabled</strong></span></p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Log queries that have been forced to use plain
0d22fc8758297da217ac71ffdd6e47643bd506a2Mark Andrews DNS due to timeouts. This is often due to
74d98566ed6a2280ea84d146e7c81275f1c5649dMark Andrews the remote servers not being RFC 1034 compliant
127d2b350ec0e5759e9fdc675ae63502208009bfTinderbox User (not always returning FORMERR or similar to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews EDNS queries and other extensions to the DNS
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews when they are not understood). In other words, this is
7ebc315084c44cffd63b3f801055986664f2a770Tinderbox User targeted at servers that fail to respond to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews DNS queries that they don't understand.
4c3d55cb2d2db8a4c52c99b0a76109fb3fe32151Mark Andrews Note: the log message can also be due to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews packet loss. Before reporting servers for
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews non-RFC 1034 compliance they should be re-tested
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to determine the nature of the non-compliance.
e062b72f783cdb436a1a57a630bdff471dbb3038Mark Andrews This testing should prevent or reduce the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews number of false-positive reports.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Note: eventually <span><strong class="command">named</strong></span> will have to stop
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews treating such timeouts as due to RFC 1034 non
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews compliance and start treating it as plain
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews packet loss. Falsely classifying packet
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User loss as due to RFC 1034 non compliance impacts
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews on DNSSEC validation which requires EDNS for
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews the DNSSEC records to be returned.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">RPZ</strong></span></p>
c855e7170a7ddb5d4ebab69a771f35dc93e95e43Mark Andrews Information about errors in response policy zone files,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews rewritten responses, and at the highest
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">debug</strong></span> levels, mere rewriting
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">rate-limit</strong></span></p>
c2becd6ae3f45f67f353abac830f8a04ba2de9ecTinderbox User The start, periodic, and final notices of the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews rate limiting of a stream of responses are logged at
4674e9e023d152960b580eeadb0accc14dba7627Tinderbox User <span><strong class="command">info</strong></span> severity in this category.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews These messages include a hash value of the domain name
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews of the response and the name itself,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews except when there is insufficient memory to record
4674e9e023d152960b580eeadb0accc14dba7627Tinderbox User the name for the final notice
8a718a0c547e256edabd2c91f77ed668d1dfc7f8Evan Hunt The final notice is normally delayed until about one
d9f80ee2ba80cc16d60f20b6f0a11a2307412ab4Tinderbox User minute after rate limit stops.
d9f80ee2ba80cc16d60f20b6f0a11a2307412ab4Tinderbox User A lack of memory can hurry the final notice,
d9f80ee2ba80cc16d60f20b6f0a11a2307412ab4Tinderbox User in which case it starts with an asterisk (*).
d9f80ee2ba80cc16d60f20b6f0a11a2307412ab4Tinderbox User Various internal events are logged at debug 1 level
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Rate limiting of individual requests
d9f80ee2ba80cc16d60f20b6f0a11a2307412ab4Tinderbox User is logged in the <span><strong class="command">query-errors</strong></span> category.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h4 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="id2576626"></a>The <span><strong class="command">query-errors</strong></span> Category</h4></div></div></div>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <span><strong class="command">query-errors</strong></span> category is
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User specifically intended for debugging purposes: To identify
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews why and how specific queries result in responses which
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews indicate an error.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Messages of this category are therefore only logged
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews with <span><strong class="command">debug</strong></span> levels.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews At the debug levels of 1 or higher, each response with the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews rcode of SERVFAIL is logged as follows:
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <code class="computeroutput">client 127.0.0.1#61502: query failed (SERVFAIL) for www.example.com/IN/AAAA at query.c:3880</code>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews This means an error resulting in SERVFAIL was
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews detected at line 3880 of source file
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Log messages of this level will particularly
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt help identify the cause of SERVFAIL for an
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews authoritative server.
4b14dedee8b236fc66413d8589c4cb3d950092ceTinderbox User At the debug levels of 2 or higher, detailed context
98240f34c38524fd6d0db5a42b9d47cd95ec0fa1Tinderbox User information of recursive resolutions that resulted in
12ee3c02ab36d7e7430bd705cc289db1a69a5733Mark Andrews SERVFAIL is logged.
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater The log message will look like as follows:
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrewsfetch completed at resolver.c:2970 for www.example.com/A
edfc6f05eaff086af661b2535a766373dc1e8345Tinderbox Userin 30.000183: timed out/success [domain:example.com,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrewsreferral:2,restart:7,qrysent:8,timeout:5,lame:0,neterr:0,
edfc6f05eaff086af661b2535a766373dc1e8345Tinderbox Userbadresp:1,adberr:0,findfail:0,valfail:0]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The first part before the colon shows that a recursive
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews resolution for AAAA records of www.example.com completed
5382b244c33da2a91116127313d6e8ad47175b41Tinderbox User in 30.000183 seconds and the final result that led to the
98240f34c38524fd6d0db5a42b9d47cd95ec0fa1Tinderbox User SERVFAIL was determined at line 2970 of source file
98240f34c38524fd6d0db5a42b9d47cd95ec0fa1Tinderbox User The following part shows the detected final result and the
80eaeb6c6f1b8170a84f8faef7264bd821036e8eTinderbox User latest result of DNSSEC validation.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The latter is always success when no validation attempt
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt In this example, this query resulted in SERVFAIL probably
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt because all name servers are down or unreachable, leading
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt to a timeout in 30 seconds.
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt DNSSEC validation was probably not attempted.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The last part enclosed in square brackets shows statistics
fd8fb4df8499e292daeac765f599ac7c507d9ca3Mark Andrews information collected for this particular resolution
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <code class="varname">domain</code> field shows the deepest zone
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews that the resolver reached;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews it is the zone where the error was finally detected.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The meaning of the other fields is summarized in the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews following table.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The number of referrals the resolver received
bac4435d473c9a0281507524f084480c34aa942aTinderbox User throughout the resolution process.
bac4435d473c9a0281507524f084480c34aa942aTinderbox User In the above example this is 2, which are most
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews likely com and example.com.
bac4435d473c9a0281507524f084480c34aa942aTinderbox User The number of cycles that the resolver tried
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews remote servers at the <code class="varname">domain</code>
2128e98a141572c7cf701f3faee1a80c9c2a1a01Tinderbox User In each cycle the resolver sends one query
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews (possibly resending it, depending on the response)
baeaed18341c015e9ad54ffa21973184c1bc432bMark Andrews to each known name server of
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The number of queries the resolver sent at the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The number of timeouts since the resolver
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews received the last response.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The number of lame servers the resolver detected
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews at the <code class="varname">domain</code> zone.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews A server is detected to be lame either by an
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews invalid response or as a result of lookup in
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews BIND9's address database (ADB), where lame
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews servers are cached.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The number of erroneous results that the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews resolver encountered in sending queries
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews at the <code class="varname">domain</code> zone.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews One common case is the remote server is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews unreachable and the resolver receives an ICMP
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews unreachable error message.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The number of unexpected responses (other than
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <code class="varname">lame</code>) to queries sent by the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews resolver at the <code class="varname">domain</code> zone.
6b9225c4be71da5d6c426072c231a611b86459a7Tinderbox User Failures in finding remote server addresses
1dbe80aade5bed39893d903cf9d7318a5265813aTinderbox User of the <code class="varname">domain</code> zone in the ADB.
632a81d4535df620c89e29c3948d1c197944570eTinderbox User One common case of this is that the remote
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews server's name does not have any address records.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Failures of resolving remote server addresses.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews This is a total number of failures throughout
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the resolution process.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Failures of DNSSEC validation.
8760668accc65fa979e533074409396829eb85ffTinderbox User Validation failures are counted throughout
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the resolution process (not limited to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the <code class="varname">domain</code> zone), but should
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User only happen in <code class="varname">domain</code>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews At the debug levels of 3 or higher, the same messages
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews as those at the debug 1 level are logged for other errors
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews than SERVFAIL.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Note that negative responses such as NXDOMAIN are not
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews regarded as errors here.
2706fce75f04398595d9648122c6b67164e94fccTinderbox User At the debug levels of 4 or higher, the same messages
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews as those at the debug 2 level are logged for other errors
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews than SERVFAIL.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Unlike the above case of level 3, messages are logged for
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews negative responses.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews This is because any unexpected results can be difficult to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews debug in the recursion case.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h3 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="id2577145"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews This is the grammar of the <span><strong class="command">lwres</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews statement in the <code class="filename">named.conf</code> file:
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<pre class="programlisting"><span><strong class="command">lwres</strong></span> {
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> listen-on { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; ... </span>] }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> view <em class="replaceable"><code>view_name</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> search { <em class="replaceable"><code>domain_name</code></em> ; [<span class="optional"> <em class="replaceable"><code>domain_name</code></em> ; ... </span>] }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> ndots <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> lwres-tasks <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> lwres-clients <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h3 class="title">
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User<a name="id2577242"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <span><strong class="command">lwres</strong></span> statement configures the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews server to also act as a lightweight resolver server. (See
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be multiple
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">lwres</strong></span> statements configuring
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews lightweight resolver servers with different properties.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <span><strong class="command">listen-on</strong></span> statement specifies a
f4e993861df6317cf0dea2ad72f315e3c96d942aMark Andrews IPv4 addresses (and ports) that this instance of a lightweight
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews resolver daemon
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews should accept requests on. If no port is specified, port 921 is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If this statement is omitted, requests will be accepted on
f4e993861df6317cf0dea2ad72f315e3c96d942aMark Andrews The <span><strong class="command">view</strong></span> statement binds this
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews instance of a
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews lightweight resolver daemon to a view in the DNS namespace, so that
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews response will be constructed in the same manner as a normal DNS
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews matching this view. If this statement is omitted, the default view
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User used, and if there is no default view, an error is triggered.
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User The <span><strong class="command">search</strong></span> statement is equivalent to
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User <span><strong class="command">search</strong></span> statement in
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User <code class="filename">/etc/resolv.conf</code>. It provides a
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews list of domains
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User which are appended to relative names in queries.
015f044f7f916eb18d053f2e5dcbee481425bc66Mark Andrews The <span><strong class="command">ndots</strong></span> statement is equivalent to
015f044f7f916eb18d053f2e5dcbee481425bc66Mark Andrews <span><strong class="command">ndots</strong></span> statement in
8f977d4d64b0ebe562607aaa044671ed34609978Tinderbox User <code class="filename">/etc/resolv.conf</code>. It indicates the
bec9d04b657e1582d2531bdc02503bebde2aa978Tinderbox User number of dots in a relative domain name that should result in an
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt exact match lookup before search path elements are appended.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <code class="option">lwres-tasks</code> statement specifies the number
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews of worker threads the lightweight resolver will dedicate to serving
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews clients. By default the number is the same as the number of CPUs on
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the system; this can be overridden using the <code class="option">-n</code>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews command line option when starting the server.
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt The <code class="option">lwres-clients</code> specifies
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt the number of client objects per thread the lightweight
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt resolver should create to serve client queries.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews By default, if the lightweight resolver runs as a part
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt of <span><strong class="command">named</strong></span>, 256 client objects are
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews created for each task; if it runs as <span><strong class="command">lwresd</strong></span>,
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews 1024 client objects are created for each thread. The maximum
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews value is 32768; higher values will be silently ignored and
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews the maximum will be used instead.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews Note that setting too high a value may overconsume
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews system resources.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews The maximum number of client queries that the lightweight
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews resolver can handle at any one time equals
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews <code class="option">lwres-tasks</code> times <code class="option">lwres-clients</code>.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews<div class="titlepage"><div><div><h3 class="title">
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews<a name="id2577338"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div>
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews<span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> |
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] };
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews<div class="titlepage"><div><div><h3 class="title">
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews<a name="id2577456"></a><span><strong class="command">masters</strong></span> Statement Definition and
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews<p><span><strong class="command">masters</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews lists allow for a common set of masters to be easily used by
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews multiple stub and slave zones in their <span><strong class="command">masters</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews or <span><strong class="command">also-notify</strong></span> lists.
3a988722ad9e209ba4064604d482dc4efe0e19ebTinderbox User<div class="titlepage"><div><div><h3 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="id2577477"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews This is the grammar of the <span><strong class="command">options</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews statement in the <code class="filename">named.conf</code> file:
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<pre class="programlisting"><span><strong class="command">options</strong></span> {
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> attach-cache <em class="replaceable"><code>cache_name</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> version <em class="replaceable"><code>version_string</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> hostname <em class="replaceable"><code>hostname_string</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> server-id <em class="replaceable"><code>server_id_string</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> directory <em class="replaceable"><code>path_name</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> geoip-directory <em class="replaceable"><code>path_name</code></em>; </span>]
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews [<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews [<span class="optional"> managed-keys-directory <em class="replaceable"><code>path_name</code></em>; </span>]
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews [<span class="optional"> named-xfer <em class="replaceable"><code>path_name</code></em>; </span>]
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews [<span class="optional"> tkey-gssapi-keytab <em class="replaceable"><code>path_name</code></em>; </span>]
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews [<span class="optional"> tkey-gssapi-credential <em class="replaceable"><code>principal</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> tkey-domain <em class="replaceable"><code>domainname</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> tkey-dhkey <em class="replaceable"><code>key_name</code></em> <em class="replaceable"><code>key_tag</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> cache-file <em class="replaceable"><code>path_name</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dump-file <em class="replaceable"><code>path_name</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> bindkeys-file <em class="replaceable"><code>path_name</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> secroots-file <em class="replaceable"><code>path_name</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> session-keyfile <em class="replaceable"><code>path_name</code></em>; </span>]
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User [<span class="optional"> session-keyname <em class="replaceable"><code>key_name</code></em>; </span>]
000b9bc9dc696babb3908802e9145562b797c1b0Tinderbox User [<span class="optional"> session-keyalg <em class="replaceable"><code>algorithm_id</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> memstatistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> memstatistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
8a718a0c547e256edabd2c91f77ed668d1dfc7f8Evan Hunt [<span class="optional"> pid-file <em class="replaceable"><code>path_name</code></em>; </span>]
8a718a0c547e256edabd2c91f77ed668d1dfc7f8Evan Hunt [<span class="optional"> recursing-file <em class="replaceable"><code>path_name</code></em>; </span>]
8a718a0c547e256edabd2c91f77ed668d1dfc7f8Evan Hunt [<span class="optional"> statistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
8a718a0c547e256edabd2c91f77ed668d1dfc7f8Evan Hunt [<span class="optional"> zone-statistics <em class="replaceable"><code>full</code></em> | <em class="replaceable"><code>terse</code></em> | <em class="replaceable"><code>none</code></em>; </span>]
8a718a0c547e256edabd2c91f77ed668d1dfc7f8Evan Hunt [<span class="optional"> auth-nxdomain <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8a718a0c547e256edabd2c91f77ed668d1dfc7f8Evan Hunt [<span class="optional"> deallocate-on-exit <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8a718a0c547e256edabd2c91f77ed668d1dfc7f8Evan Hunt [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em>; </span>]
8a718a0c547e256edabd2c91f77ed668d1dfc7f8Evan Hunt [<span class="optional"> fake-iquery <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8a718a0c547e256edabd2c91f77ed668d1dfc7f8Evan Hunt [<span class="optional"> fetch-glue <em class="replaceable"><code>yes_or_no</code></em>; </span>]
8a718a0c547e256edabd2c91f77ed668d1dfc7f8Evan Hunt [<span class="optional"> flush-zones-on-shutdown <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> has-old-clients <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> host-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> host-statistics-max <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> minimal-responses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> multiple-cnames <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> recursion <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> request-sit <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> sit-secret <em class="replaceable"><code>secret_string</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> request-nsid <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> rfc2308-type1 <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> use-id-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> ixfr-from-differences (<em class="replaceable"><code>yes_or_no</code></em> | <code class="constant">master</code> | <code class="constant">slave</code>); </span>]
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User [<span class="optional"> dnssec-enable <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dnssec-validation (<em class="replaceable"><code>yes_or_no</code></em> | <code class="constant">auto</code>); </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dnssec-lookaside ( <em class="replaceable"><code>auto</code></em> |
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em> ); </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dnssec-must-be-secure <em class="replaceable"><code>domain yes_or_no</code></em>; </span>]
08b7d0694645b474e8a57b663662c8162e7d8b8eTinderbox User [<span class="optional"> dnssec-accept-expired <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> forward ( <em class="replaceable"><code>only</code></em> | <em class="replaceable"><code>first</code></em> ); </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; ... </span>] }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dual-stack-servers [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] {
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews ( <em class="replaceable"><code>domain_name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] |
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>]) ;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews ... }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> check-names ( <em class="replaceable"><code>master</code></em> | <em class="replaceable"><code>slave</code></em> | <em class="replaceable"><code>response</code></em> )
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User [<span class="optional"> check-dup-records ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
efdfbc256c997060cfa0c2306c4fdd9dbc31342cTinderbox User [<span class="optional"> check-mx ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> check-mx-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> check-srv-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> check-sibling <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> check-spf ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> allow-new-zones { <em class="replaceable"><code>yes_or_no</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> allow-query-cache { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> allow-query-cache-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> allow-recursion { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> allow-recursion-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> automatic-interface-scan { <em class="replaceable"><code>yes_or_no</code></em> }; </span>]
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews [<span class="optional"> geoip-use-ecs <em class="replaceable"><code>yes_or_no</code></em>;</span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dnssec-update-mode ( <em class="replaceable"><code>maintain</code></em> | <em class="replaceable"><code>no-resign</code></em> ); </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dnssec-loadkeys-interval <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dnssec-secure-to-insecure <em class="replaceable"><code>yes_or_no</code></em> ;</span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> allow-v6-synthesis { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> blackhole { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> no-case-compress { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> use-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> avoid-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> use-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> avoid-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> listen-on [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> listen-on-v6 [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews{ <em class="replaceable"><code>address_match_list</code></em> }; </span>]
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User [<span class="optional"> query-source ( ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> )
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dscp <em class="replaceable"><code>ip_dscp</code></em></span>] |
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> address ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] )
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> query-source-v6 ( ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> )
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dscp <em class="replaceable"><code>ip_dscp</code></em></span>] |
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> address ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] )
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User [<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> queryport-pool-updateinterval <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em>; </span>]
20648865f1f76c4c34cbe33c18b62cfa0cfe0fc8Tinderbox User [<span class="optional"> tcp-clients <em class="replaceable"><code>number</code></em>; </span>]
20648865f1f76c4c34cbe33c18b62cfa0cfe0fc8Tinderbox User [<span class="optional"> reserved-sockets <em class="replaceable"><code>number</code></em>; </span>]
8fabea916f73d0b7c7371998dd041b41d1ad5296Tinderbox User [<span class="optional"> recursive-clients <em class="replaceable"><code>number</code></em>; </span>]
20648865f1f76c4c34cbe33c18b62cfa0cfe0fc8Tinderbox User [<span class="optional"> notify-rate <em class="replaceable"><code>number</code></em>; </span>]
20648865f1f76c4c34cbe33c18b62cfa0cfe0fc8Tinderbox User [<span class="optional"> startup-notify-rate <em class="replaceable"><code>number</code></em>; </span>]
70d987def5a58ebeb8243017c0ec2e9b2c326cf4Evan Hunt [<span class="optional"> serial-query-rate <em class="replaceable"><code>number</code></em>; </span>]
70d987def5a58ebeb8243017c0ec2e9b2c326cf4Evan Hunt [<span class="optional"> serial-queries <em class="replaceable"><code>number</code></em>; </span>]
70d987def5a58ebeb8243017c0ec2e9b2c326cf4Evan Hunt [<span class="optional"> tcp-listen-queue <em class="replaceable"><code>number</code></em>; </span>]
2706fce75f04398595d9648122c6b67164e94fccTinderbox User [<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em>; </span>]
2706fce75f04398595d9648122c6b67164e94fccTinderbox User [<span class="optional"> transfers-in <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> transfers-out <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> transfers-per-ns <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User [<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] [<span class="optional">key <em class="replaceable"><code>keyname</code></em></span>] ;
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] [<span class="optional">key <em class="replaceable"><code>keyname</code></em></span>] ; ... </span>] }; </span>]
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews [<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> coresize <em class="replaceable"><code>size_spec</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> datasize <em class="replaceable"><code>size_spec</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> files <em class="replaceable"><code>size_spec</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> stacksize <em class="replaceable"><code>size_spec</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User [<span class="optional"> heartbeat-interval <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> interface-interval <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> statistics-interval <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> topology { <em class="replaceable"><code>address_match_list</code></em> }</span>];
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> sortlist { <em class="replaceable"><code>address_match_list</code></em> }</span>];
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> rrset-order { <em class="replaceable"><code>order_spec</code></em> ; [<span class="optional"> <em class="replaceable"><code>order_spec</code></em> ; ... </span>] </span>] };
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> lame-ttl <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> max-ncache-ttl <em class="replaceable"><code>number</code></em>; </span>]
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User [<span class="optional"> max-cache-ttl <em class="replaceable"><code>number</code></em>; </span>]
baeaed18341c015e9ad54ffa21973184c1bc432bMark Andrews [<span class="optional"> max-zone-ttl <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> servfail-ttl <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> min-roots <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> use-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> request-expire <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> treat-cr-as-space <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User [<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User [<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> min-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User [<span class="optional"> nta-lifetime <em class="replaceable"><code>duration</code></em> ; </span>]
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User [<span class="optional"> nta-recheck <em class="replaceable"><code>duration</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ;
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater [<span class="optional"> additional-from-auth <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater [<span class="optional"> additional-from-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
8f536463f9fdfa7da6a8310e4f4895373beb2961Mark Andrews [<span class="optional"> random-device <em class="replaceable"><code>path_name</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> max-cache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater [<span class="optional"> match-mapped-addresses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> filter-aaaa-on-v4 ( <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>break-dnssec</code></em> ); </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> filter-aaaa-on-v6 ( <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>break-dnssec</code></em> ); </span>]
5e145d312503505bed49bcd72d1062b82989cadaTinderbox User [<span class="optional"> filter-aaaa { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dns64 <em class="replaceable"><code>ipv6-prefix</code></em> {
dcd42a39d311b44877161ffd1e27fa62700c0171Mark Andrews [<span class="optional"> clients { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> mapped { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> exclude { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> suffix IPv6-address; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> recursive-only <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> break-dnssec <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews }; </span>];
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dns64-server <em class="replaceable"><code>name</code></em> </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> dns64-contact <em class="replaceable"><code>name</code></em> </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> preferred-glue ( <em class="replaceable"><code>A</code></em> | <em class="replaceable"><code>AAAA</code></em> | <em class="replaceable"><code>NONE</code></em> ); </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> edns-udp-size <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> max-udp-size <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> max-rsa-exponent-size <em class="replaceable"><code>number</code></em>; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> root-delegation-only [<span class="optional"> exclude { <em class="replaceable"><code>namelist</code></em> } </span>] ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> querylog <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> disable-algorithms <em class="replaceable"><code>domain</code></em> { <em class="replaceable"><code>algorithm</code></em>;
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User [<span class="optional"> <em class="replaceable"><code>algorithm</code></em>; </span>] }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> disable-ds-digests <em class="replaceable"><code>domain</code></em> { <em class="replaceable"><code>digest_type</code></em>;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> <em class="replaceable"><code>digest_type</code></em>; </span>] }; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> acache-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> acache-cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> max-acache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> max-clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">map</code>) ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews (<code class="constant">relative</code>|<code class="constant">full</code>) ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> empty-server <em class="replaceable"><code>name</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> empty-contact <em class="replaceable"><code>name</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> empty-zones-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User [<span class="optional"> disable-empty-zone <em class="replaceable"><code>zone_name</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> zero-no-soa-ttl-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> resolver-query-timeout <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> deny-answer-addresses { <em class="replaceable"><code>address_match_list</code></em> } [<span class="optional"> except-from { <em class="replaceable"><code>namelist</code></em> } </span>];</span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> deny-answer-aliases { <em class="replaceable"><code>namelist</code></em> } [<span class="optional"> except-from { <em class="replaceable"><code>namelist</code></em> } </span>];</span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> prefetch <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User [<span class="optional"> responses-per-second <em class="replaceable"><code>number</code></em> ; </span>]
415d630b6309922caee8469384a6fab75cf05032Mark Andrews [<span class="optional"> referrals-per-second <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> nodata-per-second <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> nxdomains-per-second <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> errors-per-second <em class="replaceable"><code>number</code></em> ; </span>]
b625bdae12277225b076a002dd4af80902529181Tinderbox User [<span class="optional"> all-per-second <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> window <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> log-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> qps-scale <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> ipv4-prefix-length <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> ipv6-prefix-length <em class="replaceable"><code>number</code></em> ; </span>]
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User [<span class="optional"> slip <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> exempt-clients { <em class="replaceable"><code>address_match_list</code></em> } ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> max-table-size <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> min-table-size <em class="replaceable"><code>number</code></em> ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews } ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews zone <em class="replaceable"><code>zone_name</code></em> ;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> policy <em class="replaceable"><code>given | disabled | passthru | drop | tcp-only | nxdomain | nodata | cname</code></em> <em class="replaceable"><code>domain</code></em> </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> recursive-only <em class="replaceable"><code>yes_or_no</code></em> </span>]
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User [<span class="optional"> max-policy-ttl <em class="replaceable"><code>number</code></em> </span>] ;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> recursive-only <em class="replaceable"><code>yes_or_no</code></em> </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> max-policy-ttl <em class="replaceable"><code>number</code></em> </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> break-dnssec <em class="replaceable"><code>yes_or_no</code></em> </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> min-ns-dots <em class="replaceable"><code>number</code></em> </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews [<span class="optional"> qname-wait-recurse <em class="replaceable"><code>yes_or_no</code></em> </span>] ; </span>]
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h3 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="options"></a><span><strong class="command">options</strong></span> Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The <span><strong class="command">options</strong></span> statement sets up global
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to be used by <acronym class="acronym">BIND</acronym>. This statement
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews may appear only
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews once in a configuration file. If there is no <span><strong class="command">options</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews statement, an options block with each option set to its default will
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">attach-cache</strong></span></span></dt>
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User Allows multiple views to share a single cache
415d630b6309922caee8469384a6fab75cf05032Mark Andrews Each view has its own cache database by default, but
415d630b6309922caee8469384a6fab75cf05032Mark Andrews if multiple views have the same operational policy
415d630b6309922caee8469384a6fab75cf05032Mark Andrews for name resolution and caching, those views can
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User share a single cache to save memory and possibly
415d630b6309922caee8469384a6fab75cf05032Mark Andrews improve resolution efficiency by using this option.
620745a4c70077221fdeecaafd3252e9d3f944f3Tinderbox User The <span><strong class="command">attach-cache</strong></span> option
620745a4c70077221fdeecaafd3252e9d3f944f3Tinderbox User may also be specified in <span><strong class="command">view</strong></span>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User statements, in which case it overrides the
620745a4c70077221fdeecaafd3252e9d3f944f3Tinderbox User global <span><strong class="command">attach-cache</strong></span> option.
415d630b6309922caee8469384a6fab75cf05032Mark Andrews The <em class="replaceable"><code>cache_name</code></em> specifies
415d630b6309922caee8469384a6fab75cf05032Mark Andrews the cache to be shared.
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User When the <span><strong class="command">named</strong></span> server configures
415d630b6309922caee8469384a6fab75cf05032Mark Andrews views which are supposed to share a cache, it
415d630b6309922caee8469384a6fab75cf05032Mark Andrews creates a cache with the specified name for the
415d630b6309922caee8469384a6fab75cf05032Mark Andrews first view of these sharing views.
415d630b6309922caee8469384a6fab75cf05032Mark Andrews The rest of the views will simply refer to the
415d630b6309922caee8469384a6fab75cf05032Mark Andrews already created cache.
415d630b6309922caee8469384a6fab75cf05032Mark Andrews One common configuration to share a cache would be to
415d630b6309922caee8469384a6fab75cf05032Mark Andrews allow all views to share a single cache.
415d630b6309922caee8469384a6fab75cf05032Mark Andrews This can be done by specifying
415d630b6309922caee8469384a6fab75cf05032Mark Andrews the <span><strong class="command">attach-cache</strong></span> as a global
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User option with an arbitrary name.
415d630b6309922caee8469384a6fab75cf05032Mark Andrews Another possible operation is to allow a subset of
415d630b6309922caee8469384a6fab75cf05032Mark Andrews all views to share a cache while the others to
415d630b6309922caee8469384a6fab75cf05032Mark Andrews retain their own caches.
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User For example, if there are three views A, B, and C,
415d630b6309922caee8469384a6fab75cf05032Mark Andrews and only A and B should share a cache, specify the
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <span><strong class="command">attach-cache</strong></span> option as a view A (or
415d630b6309922caee8469384a6fab75cf05032Mark Andrews B)'s option, referring to the other view name:
415d630b6309922caee8469384a6fab75cf05032Mark Andrews // this view has its own cache
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater // this view refers to A's cache
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater attach-cache "A";
1ddabe157ced6d2d2ce6e9ddc1a29db588dd6908Tinderbox User // this view has its own cache
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Views that share a cache must have the same policy
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews on configurable parameters that may affect caching.
7f514657e26e5eb066c2be710fd64ec6bfee1475Mark Andrews The current implementation requires the following
7f514657e26e5eb066c2be710fd64ec6bfee1475Mark Andrews configurable options be consistent among these
7f514657e26e5eb066c2be710fd64ec6bfee1475Mark Andrews <span><strong class="command">check-names</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">cleaning-interval</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">dnssec-accept-expired</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">dnssec-validation</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">max-cache-ttl</strong></span>,
50cfe402e61ba8d816d845a9f297e3de18f4fc15Tinderbox User <span><strong class="command">max-ncache-ttl</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">max-cache-size</strong></span>, and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">zero-no-soa-ttl</strong></span>.
549c517e2ecad52bb1d32f08920e29d4e8cda71eTinderbox User Note that there may be other parameters that may
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews cause confusion if they are inconsistent for
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews different views that share a single cache.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews For example, if these views define different sets of
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews forwarders that can return different answers for the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews same question, sharing the answer does not make
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews sense or could even be harmful.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews It is administrator's responsibility to ensure
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews configuration differences in different views do
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews not cause disruption with a shared cache.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">directory</strong></span></span></dt>
06ea55a43397bc38c34a6d7e5c6219fe483edbb2Tinderbox User The working directory of the server.
cdf1c3d486ec082ef6c92297d22d54a67cca0c90Tinderbox User Any non-absolute pathnames in the configuration file will be
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews as relative to this directory. The default location for most
cdf1c3d486ec082ef6c92297d22d54a67cca0c90Tinderbox User output files (e.g. <code class="filename">named.run</code>)
cdf1c3d486ec082ef6c92297d22d54a67cca0c90Tinderbox User is this directory.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If a directory is not specified, the working directory
f39894c0b1cafb24035c14c74868e48be25f04a5Mark Andrews defaults to `<code class="filename">.</code>', the directory from
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews which the server
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews was started. The directory specified should be an absolute
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">geoip-directory</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Specifies the directory containing GeoIP
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <code class="filename">.dat</code> database files for GeoIP
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews initialization. By default, this option is unset
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews and the GeoIP support will use libGeoIP's
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews built-in directory.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews (For details, see <a href="Bv9ARM.ch06.html#acl" title="acl Statement Definition and
dda78c0f84895c174ef7206dca6082939c030792Tinderbox User Usage">the section called “<span><strong class="command">acl</strong></span> Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Usage”</a> about the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">geoip</strong></span> ACL.)
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">key-directory</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews When performing dynamic update of secure zones, the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews directory where the public and private DNSSEC key files
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews should be found, if different than the current working
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User directory. (Note that this option has no effect on the
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont paths for files containing non-DNSSEC keys such as
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">managed-keys-directory</strong></span></span></dt>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User Specifies the directory in which to store the files that
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews track managed DNSSEC keys. By default, this is the working
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If <span><strong class="command">named</strong></span> is not configured to use views,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews then managed keys for the server will be tracked in a single
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews file called <code class="filename">managed-keys.bind</code>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Otherwise, managed keys will be tracked in separate files,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews one file per view; each file name will be the view name
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews (or, if it contains characters that are incompatible with
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews use as a file name, the SHA256 hash of the view name),
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews followed by the extension
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews (Note: in previous releases, file names for views
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews always used the SHA256 hash of the view name. To ensure
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews compatibility after upgrade, if a file using the old
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews name format is found to exist, it will be used instead
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews of the new format.)
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">named-xfer</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span class="emphasis"><em>This option is obsolete.</em></span> It
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews was used in <acronym class="acronym">BIND</acronym> 8 to specify
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the pathname to the <span><strong class="command">named-xfer</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews program. In <acronym class="acronym">BIND</acronym> 9, no separate
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">named-xfer</strong></span> program is needed;
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews its functionality is built into the name server.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">tkey-gssapi-keytab</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The KRB5 keytab file to use for GSS-TSIG updates. If
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews this option is set and tkey-gssapi-credential is not
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews set, then updates will be allowed with any key
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews matching a principal in the specified keytab.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">tkey-gssapi-credential</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The security credential with which the server should
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews authenticate keys requested by the GSS-TSIG protocol.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Currently only Kerberos 5 authentication is available
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews and the credential is a Kerberos principal which the
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User server can acquire through the default system key
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews file, normally <code class="filename">/etc/krb5.keytab</code>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The location keytab file can be overridden using the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews tkey-gssapi-keytab option. Normally this principal is
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews of the form "<strong class="userinput"><code>DNS/</code></strong><code class="varname">server.domain</code>".
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews To use GSS-TSIG, <span><strong class="command">tkey-domain</strong></span> must
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User also be set if a specific keytab is not set with
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews tkey-gssapi-keytab.
415d630b6309922caee8469384a6fab75cf05032Mark Andrews<dt><span class="term"><span><strong class="command">tkey-domain</strong></span></span></dt>
415d630b6309922caee8469384a6fab75cf05032Mark Andrews The domain appended to the names of all shared keys
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User generated with <span><strong class="command">TKEY</strong></span>. When a
415d630b6309922caee8469384a6fab75cf05032Mark Andrews client requests a <span><strong class="command">TKEY</strong></span> exchange,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews it may or may not specify the desired name for the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews key. If present, the name of the shared key will
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews be <code class="varname">client specified part</code> +
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <code class="varname">tkey-domain</code>. Otherwise, the
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User name of the shared key will be <code class="varname">random hex
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews digits</code> + <code class="varname">tkey-domain</code>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews In most cases, the <span><strong class="command">domainname</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews should be the server's domain name, or an otherwise
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews non-existent subdomain like
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews "_tkey.<code class="varname">domainname</code>". If you are
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User using GSS-TSIG, this variable must be defined, unless
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews you specify a specific keytab using tkey-gssapi-keytab.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">tkey-dhkey</strong></span></span></dt>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews The Diffie-Hellman key used by the server
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User to generate shared keys with clients using the Diffie-Hellman
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews of <span><strong class="command">TKEY</strong></span>. The server must be
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews able to load the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews public and private keys from files in the working directory.
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User most cases, the keyname should be the server's host name.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">cache-file</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews This is for testing only. Do not use.
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User<dt><span class="term"><span><strong class="command">dump-file</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The pathname of the file the server dumps
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the database to when instructed to do so with
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span><strong class="command">rndc dumpdb</strong></span>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington If not specified, the default is <code class="filename">named_dump.db</code>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">memstatistics-file</strong></span></span></dt>
3ccf87473f7cf6d9faac156df38a935a238f96fdTinderbox User The pathname of the file the server writes memory
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews usage statistics to on exit. If not specified,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the default is <code class="filename">named.memstats</code>.
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews<dt><span class="term"><span><strong class="command">pid-file</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The pathname of the file the server writes its process ID
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews in. If not specified, the default is
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews <code class="filename">/var/run/named/named.pid</code>.
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews The PID file is used by programs that want to send signals to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews name server. Specifying <span><strong class="command">pid-file none</strong></span> disables the
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews use of a PID file — no file will be written and any
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews existing one will be removed. Note that <span><strong class="command">none</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews is a keyword, not a filename, and therefore is not enclosed
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews double quotes.
abe52cd9882c2c27482a2781f30a34d67501fdf8Tinderbox User<dt><span class="term"><span><strong class="command">recursing-file</strong></span></span></dt>
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont The pathname of the file the server dumps
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews the queries that are currently recursing when instructed
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to do so with <span><strong class="command">rndc recursing</strong></span>.
32eb4cec6f191d30c40b63e4f22647650b3bc9d4Tinderbox User If not specified, the default is <code class="filename">named.recursing</code>.
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt<dt><span class="term"><span><strong class="command">statistics-file</strong></span></span></dt>
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt The pathname of the file the server appends statistics
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt to when instructed to do so using <span><strong class="command">rndc stats</strong></span>.
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews If not specified, the default is <code class="filename">named.stats</code> in the
33b0d10552ea5f7716385b2cedff64daa1486c50Tinderbox User server's current directory. The format of the file is
fec6e13f2d1e69fe1c2b8fac36f732f124cf5398Mark Andrews in <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">bindkeys-file</strong></span></span></dt>
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews The pathname of a file to override the built-in trusted
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews keys provided by <span><strong class="command">named</strong></span>.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater See the discussion of <span><strong class="command">dnssec-lookaside</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews and <span><strong class="command">dnssec-validation</strong></span> for details.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews If not specified, the default is
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User <code class="filename">/etc/bind.keys</code>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">secroots-file</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The pathname of the file the server dumps
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews security roots to when instructed to do so with
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User <span><strong class="command">rndc secroots</strong></span>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews If not specified, the default is
415d630b6309922caee8469384a6fab75cf05032Mark Andrews<dt><span class="term"><span><strong class="command">session-keyfile</strong></span></span></dt>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User The pathname of the file into which to write a TSIG
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews session key generated by <span><strong class="command">named</strong></span> for use by
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">nsupdate -l</strong></span>. If not specified, the
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater default is <code class="filename">/var/run/named/session.key</code>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews (See <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>, and in
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews particular the discussion of the
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User <span><strong class="command">update-policy</strong></span> statement's
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <strong class="userinput"><code>local</code></strong> option for more
415d630b6309922caee8469384a6fab75cf05032Mark Andrews information about this feature.)
415d630b6309922caee8469384a6fab75cf05032Mark Andrews<dt><span class="term"><span><strong class="command">session-keyname</strong></span></span></dt>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User The key name to use for the TSIG session key.
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont If not specified, the default is "local-ddns".
c7f686829f05e44169d46746cfb25cadcf078585Tinderbox User<dt><span class="term"><span><strong class="command">session-keyalg</strong></span></span></dt>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews The algorithm to use for the TSIG session key.
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User Valid values are hmac-sha1, hmac-sha224, hmac-sha256,
c7f686829f05e44169d46746cfb25cadcf078585Tinderbox User hmac-sha384, hmac-sha512 and hmac-md5. If not
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews specified, the default is hmac-sha256.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">port</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews receiving and sending DNS protocol traffic.
3524df526a4ee88e017e218b70ea8712ff6147a1Tinderbox User The default is 53. This option is mainly intended for server
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews a server using a port other than 53 will not be able to
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews communicate with
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson the global DNS.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<dt><span class="term"><span><strong class="command">random-device</strong></span></span></dt>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews The source of entropy to be used by the server. Entropy is
30370d905e9be3be7d9b947fd432bacecbb13bb9Evan Hunt primarily needed
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews for DNSSEC operations, such as TKEY transactions and dynamic
80eaeb6c6f1b8170a84f8faef7264bd821036e8eTinderbox User update of signed
3524df526a4ee88e017e218b70ea8712ff6147a1Tinderbox User zones. This options specifies the device (or file) from which
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews entropy. If this is a file, operations requiring entropy will
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews file has been exhausted. If not specified, the default value
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson <code class="filename">/dev/random</code>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson (or equivalent) when present, and none otherwise. The
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson <span><strong class="command">random-device</strong></span> option takes
edd791fb53fab504d52ccdda41e6acbf543ac0d0Tinderbox User the initial configuration load at server startup time and
edd791fb53fab504d52ccdda41e6acbf543ac0d0Tinderbox User is ignored on subsequent reloads.
c317b09bf112121245fafe61f38b95dc6e96acabTinderbox User<dt><span class="term"><span><strong class="command">preferred-glue</strong></span></span></dt>
8bc3d252395842452a6d2c775cf8445f6349e331Tinderbox User If specified, the listed type (A or AAAA) will be emitted
de7b9a1dac0c293b39994c91d4376883da25554fTinderbox User before other glue
c7fd128f8ea8a527fe27c1b95ab46df7155bc8e4Tinderbox User in the additional section of a query response.
c7fd128f8ea8a527fe27c1b95ab46df7155bc8e4Tinderbox User The default is not to prefer any type (NONE).
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="root_delegation_only"></a><span class="term"><span><strong class="command">root-delegation-only</strong></span></span>
467a823e57af687ebd486dfd73ea32f9d2a145beTinderbox User Turn on enforcement of delegation-only in TLDs
467a823e57af687ebd486dfd73ea32f9d2a145beTinderbox User (top level domains) and root zones with an optional
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User exclude list.
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt DS queries are expected to be made to and be answered by
12343c067e12be071a68bbb10d1d1c4870696769Tinderbox User delegation only zones. Such queries and responses are
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User treated as an exception to delegation-only processing
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt and are not converted to NXDOMAIN responses provided
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt a CNAME is not discovered at the query name.
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt If a delegation only zone server also serves a child
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt zone it is not always possible to determine whether
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt an answer comes from the delegation only zone or the
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt child zone. SOA NS and DNSKEY records are apex
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt only records and a matching response that contains
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt these records or DS is treated as coming from a
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews child zone. RRSIG records are also examined to see
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews if they are signed by a child zone or not. The
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater authority section is also examined to see if there
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews is evidence that the answer is from the child zone.
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews Answers that are determined to be from a child zone
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews are not converted to NXDOMAIN responses. Despite
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews all these checks there is still a possibility of
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews false negatives when a child zone is being served.
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews Similarly false positives can arise from empty nodes
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater (no records at the name) in the delegation only zone
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt when the query type is not ANY.
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User Note some TLDs are not delegation only (e.g. "DE", "LV",
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User "US" and "MUSEUM"). This list is not exhaustive.
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User<dt><span class="term"><span><strong class="command">disable-algorithms</strong></span></span></dt>
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt Disable the specified DNSSEC algorithms at and below the
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User specified name.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User Multiple <span><strong class="command">disable-algorithms</strong></span>
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User statements are allowed.
3bd8b5a8fb126e45c67ff53b68183c889cc27918Tinderbox User Only the best match <span><strong class="command">disable-algorithms</strong></span>
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User clause will be used to determine which algorithms are used.
6d114a4c5cddb176ae5199eee154c0273d652ba4Tinderbox User If all supported algorithms are disabled, the zones covered
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User by the <span><strong class="command">disable-algorithms</strong></span> will be treated
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt as insecure.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User<dt><span class="term"><span><strong class="command">disable-ds-digests</strong></span></span></dt>
12343c067e12be071a68bbb10d1d1c4870696769Tinderbox User Disable the specified DS/DLV digest types at and below the
654db68d60c767b5d8c03375cc9b85115d7eac1eMark Andrews specified name.
cdf1c3d486ec082ef6c92297d22d54a67cca0c90Tinderbox User Multiple <span><strong class="command">disable-ds-digests</strong></span>
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User statements are allowed.
12343c067e12be071a68bbb10d1d1c4870696769Tinderbox User Only the best match <span><strong class="command">disable-ds-digests</strong></span>
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User clause will be used to determine which digest types are used.
654db68d60c767b5d8c03375cc9b85115d7eac1eMark Andrews If all supported digest types are disabled, the zones covered
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User by the <span><strong class="command">disable-ds-digests</strong></span> will be treated
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User<dt><span class="term"><span><strong class="command">dnssec-lookaside</strong></span></span></dt>
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User When set, <span><strong class="command">dnssec-lookaside</strong></span> provides the
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User validator with an alternate method to validate DNSKEY
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User records at the top of a zone. When a DNSKEY is at or
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt below a domain specified by the deepest
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User <span><strong class="command">dnssec-lookaside</strong></span>, and the normal DNSSEC
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User validation has left the key untrusted, the trust-anchor
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User will be appended to the key name and a DLV record will be
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User looked up to see if it can validate the key. If the DLV
cdf1c3d486ec082ef6c92297d22d54a67cca0c90Tinderbox User record validates a DNSKEY (similarly to the way a DS
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User record does) the DNSKEY RRset is deemed to be trusted.
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User If <span><strong class="command">dnssec-lookaside</strong></span> is set to
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User <strong class="userinput"><code>auto</code></strong>, then built-in default
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User values for the DLV domain and trust anchor will be
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt used, along with a built-in key for validation.
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User If <span><strong class="command">dnssec-lookaside</strong></span> is set to
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User <strong class="userinput"><code>no</code></strong>, then dnssec-lookaside
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User The default DLV key is stored in the file
dc7e5458bbcb59ea310ed64ac7e77016e62e9c15Tinderbox User <span><strong class="command">named</strong></span> will load that key at
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User startup if <span><strong class="command">dnssec-lookaside</strong></span> is set to
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User <code class="constant">auto</code>. A copy of the file is
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User installed along with <acronym class="acronym">BIND</acronym> 9, and is
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User current as of the release date. If the DLV key expires, a
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User new copy of <code class="filename">bind.keys</code> can be downloaded
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User from <a href="https://www.isc.org/solutions/dlv/" target="_top">https://www.isc.org/solutions/dlv/</a>.
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User (To prevent problems if <code class="filename">bind.keys</code> is
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User not found, the current key is also compiled in to
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User <span><strong class="command">named</strong></span>. Relying on this is not
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User recommended, however, as it requires <span><strong class="command">named</strong></span>
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User to be recompiled with a new key when the DLV key expires.)
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User NOTE: <span><strong class="command">named</strong></span> only loads certain specific
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User keys from <code class="filename">bind.keys</code>: those for the
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User DLV zone and for the DNS root zone. The file cannot be
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User used to store keys for other zones.
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User<dt><span class="term"><span><strong class="command">dnssec-must-be-secure</strong></span></span></dt>
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User Specify hierarchies which must be or may not be secure
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User (signed and validated). If <strong class="userinput"><code>yes</code></strong>,
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User then <span><strong class="command">named</strong></span> will only accept answers if
391130fffd3f517aa72c5e6bd35dc7894d7730f4Tinderbox User they are secure. If <strong class="userinput"><code>no</code></strong>, then normal
36ec0d374836d070ba05b495e6f0a27f60e94476Evan Hunt DNSSEC validation applies allowing for insecure answers to
36ec0d374836d070ba05b495e6f0a27f60e94476Evan Hunt be accepted. The specified domain must be under a
36ec0d374836d070ba05b495e6f0a27f60e94476Evan Hunt <span><strong class="command">trusted-keys</strong></span> or
2ec4ab21838e218863d052ebfa3e106e04f50820Evan Hunt <span><strong class="command">managed-keys</strong></span> statement, or
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User <span><strong class="command">dnssec-lookaside</strong></span> must be active.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">dns64</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews This directive instructs <span><strong class="command">named</strong></span> to
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews return mapped IPv4 addresses to AAAA queries when
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews there are no AAAA records. It is intended to be
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews used in conjunction with a NAT64. Each
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">dns64</strong></span> defines one DNS64 prefix.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Multiple DNS64 prefixes can be defined.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Compatible IPv6 prefixes have lengths of 32, 40, 48, 56,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews 64 and 96 as per RFC 6052.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Additionally a reverse IP6.ARPA zone will be created for
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the prefix to provide a mapping from the IP6.ARPA names
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews to the corresponding IN-ADDR.ARPA names using synthesized
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews CNAMEs. <span><strong class="command">dns64-server</strong></span> and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">dns64-contact</strong></span> can be used to specify
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the name of the server and contact for the zones. These
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews are settable at the view / options level. These are
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews not settable on a per-prefix basis.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Each <span><strong class="command">dns64</strong></span> supports an optional
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">clients</strong></span> ACL that determines which
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews clients are affected by this directive. If not defined,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews it defaults to <strong class="userinput"><code>any;</code></strong>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Each <span><strong class="command">dns64</strong></span> supports an optional
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">mapped</strong></span> ACL that selects which
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews IPv4 addresses are to be mapped in the corresponding
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews A RRset. If not defined it defaults to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <strong class="userinput"><code>any;</code></strong>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Normally, DNS64 won't apply to a domain name that
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews owns one or more AAAA records; these records will
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews simply be returned. The optional
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">exclude</strong></span> ACL allows specification
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews of a list of IPv6 addresses that will be ignored
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews if they appear in a domain name's AAAA records, and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews DNS64 will be applied to any A records the domain
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews name owns. If not defined, <span><strong class="command">exclude</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews defaults to none.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews A optional <span><strong class="command">suffix</strong></span> can also
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews be defined to set the bits trailing the mapped
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews IPv4 address bits. By default these bits are
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews set to <strong class="userinput"><code>::</code></strong>. The bits
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews matching the prefix and mapped IPv4 address
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews must be zero.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If <span><strong class="command">recursive-only</strong></span> is set to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">yes</strong></span> the DNS64 synthesis will
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews only happen for recursive queries. The default
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews is <span><strong class="command">no</strong></span>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If <span><strong class="command">break-dnssec</strong></span> is set to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">yes</strong></span> the DNS64 synthesis will
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews happen even if the result, if validated, would
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews cause a DNSSEC validation failure. If this option
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews is set to <span><strong class="command">no</strong></span> (the default), the DO
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews is set on the incoming query, and there are RRSIGs on
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the applicable records, then synthesis will not happen.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews dns64 64:FF9B::/96 {
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews clients { any; };
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews mapped { !rfc1918; any; };
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews exclude { 64:FF9B::/96; ::ffff:0000:0000/96; };
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">dnssec-update-mode</strong></span></span></dt>
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews If this option is set to its default value of
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="literal">maintain</code> in a zone of type
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="literal">master</code> which is DNSSEC-signed
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews and configured to allow dynamic updates (see
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>), and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews if <span><strong class="command">named</strong></span> has access to the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews private signing key(s) for the zone, then
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">named</strong></span> will automatically sign all new
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews or changed records and maintain signatures for the zone
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews by regenerating RRSIG records whenever they approach
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews their expiration date.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If the option is changed to <code class="literal">no-resign</code>,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews then <span><strong class="command">named</strong></span> will sign all new or
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews changed records, but scheduled maintenance of
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews signatures is disabled.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews With either of these settings, <span><strong class="command">named</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews will reject updates to a DNSSEC-signed zone when the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews signing keys are inactive or unavailable to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">named</strong></span>. (A planned third option,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="literal">external</code>, will disable all automatic
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews signing and allow DNSSEC data to be submitted into a zone
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews via dynamic update; this is not yet implemented.)
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">nta-lifetime</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Species the default lifetime, in seconds,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews that will be used for negative trust anchors added
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews via <span><strong class="command">rndc nta</strong></span>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews A negative trust anchor selectively disables
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews DNSSEC validation for zones that are known to be
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews failing because of misconfiguration rather than
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews an attack. When data to be validated is
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews at or below an active NTA (and above any other
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews configured trust anchors), <span><strong class="command">named</strong></span> will
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews abort the DNSSEC validation process and treat the data as
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews insecure rather than bogus. This continues until the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews NTA's lifetime is elapsed, or until the server is
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews restarted (NTAs do not persist across restarts).
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews For convenience, TTL-style time unit suffixes can be
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews used to specify the NTA lifetime in seconds, minutes
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews or hours. <code class="option">nta-lifetime</code> defaults to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews one hour. It cannot exceed one week.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">nta-recheck</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Species how often to check whether negative
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews trust anchors added via <span><strong class="command">rndc nta</strong></span>
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater are still necessary.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews A negative trust anchor is normally used when a
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews domain has stopped validating due to operator error;
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews it temporarily disables DNSSEC validation for that
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews domain. In the interest of ensuring that DNSSEC
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews validation is turned back on as soon as possible,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">named</strong></span> will periodically send a
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews query to the domain, ignoring negative trust anchors,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews to find out whether it can now be validated. If so,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the negative trust anchor is allowed to expire early.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Validity checks can be disabled for an individual
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews NTA by using <span><strong class="command">rndc nta -f</strong></span>, or
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews for all NTAs by setting <code class="option">nta-recheck</code>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews For convenience, TTL-style time unit suffixes can be
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews used to specify the NTA recheck interval in seconds,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews minutes or hours. The default is five minutes. It
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews cannot be longer than <code class="option">nta-lifetime</code>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews (which cannot be longer than a week).
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">max-zone-ttl</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Specifies a maximum permissible TTL value.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews When loading a zone file using a
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="option">masterfile-format</code> of
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="constant">text</code> or <code class="constant">raw</code>,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews any record encountered with a TTL higher than
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="option">max-zone-ttl</code> will cause the zone to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews be rejected.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews This is useful in DNSSEC-signed zones because when
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews rolling to a new DNSKEY, the old key needs to remain
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews available until RRSIG records have expired from
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews caches. The<code class="option">max-zone-ttl</code> option guarantees
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews that the largest TTL in the zone will be no higher
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the set value.
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews (NOTE: Because <code class="constant">map</code>-format files
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews load directly into memory, this option cannot be
ab833877278ad5535eef57e4f62291becaea5bc5Mark Andrews used with them.)
214af784e91553d387246fd9ce46cb1291697b9aTinderbox User<dt><span class="term"><span><strong class="command">zone-statistics</strong></span></span></dt>
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User If <strong class="userinput"><code>full</code></strong>, the server will collect
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews statistical data on all zones (unless specifically
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson turned off on a per-zone basis by specifying
309b912841e8b97bf0b0df0d96c3eaf16990c080Automatic Updater <span><strong class="command">zone-statistics terse</strong></span> or
66d24a46538c7c2d29fdb5611ab1173e83685b1dTinderbox User <span><strong class="command">zone-statistics none</strong></span>
66d24a46538c7c2d29fdb5611ab1173e83685b1dTinderbox User in the <span><strong class="command">zone</strong></span> statement).
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson The default is <strong class="userinput"><code>terse</code></strong>, providing
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson minimal statistics on zones (including name and
754ebd37e782356aedbb2987e3c1a8ab4f29574eMark Andrews current serial number, but not query type
dfc3a0fffd5d0b9f174ebca77860ae9ffa616314Tinderbox User These statistics may be accessed via the
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User <span><strong class="command">statistics-channel</strong></span> or
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews using <span><strong class="command">rndc stats</strong></span>, which
55affca0c40ca8862a5283a837f0c7a19b326ab3Tinderbox User will dump them to the file listed
089d5091b781af7dfef225fbc828eb4e6d04bf4fTinderbox User in the <span><strong class="command">statistics-file</strong></span>. See
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews also <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
5c679dbb66df92766f6a7e7bb93c18d61275d1feMark Andrews For backward compatibility with earlier versions
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User of BIND 9, the <span><strong class="command">zone-statistics</strong></span>
5c679dbb66df92766f6a7e7bb93c18d61275d1feMark Andrews option can also accept <strong class="userinput"><code>yes</code></strong>
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater or <strong class="userinput"><code>no</code></strong>; <strong class="userinput"><code>yes</code></strong>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews has the same meaning as <strong class="userinput"><code>full</code></strong>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews As of <acronym class="acronym">BIND</acronym> 9.10,
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews <strong class="userinput"><code>no</code></strong> has the same meaning
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews as <strong class="userinput"><code>none</code></strong>; previously, it
9e295ad801d5c986eb6c7745637b5dc0efb28711Tinderbox User was the same as <strong class="userinput"><code>terse</code></strong>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h4 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="boolean_options"></a>Boolean Options</h4></div></div></div>
f6056ad06781c95198505ae3a361e6dd98df4b91Automatic Updater<dt><span class="term"><span><strong class="command">automatic-interface-scan</strong></span></span></dt>
2fee8782a6fd57d86a67949092ab9197111af390Evan Hunt If <strong class="userinput"><code>yes</code></strong> and supported by the OS,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews automatically rescan network interfaces when the interface
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews addresses are added or removed. The default is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <strong class="userinput"><code>yes</code></strong>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Currently the OS needs to support routing sockets for
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews <span><strong class="command">automatic-interface-scan</strong></span> to be
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User<dt><span class="term"><span><strong class="command">allow-new-zones</strong></span></span></dt>
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User If <strong class="userinput"><code>yes</code></strong>, then zones can be
edd791fb53fab504d52ccdda41e6acbf543ac0d0Tinderbox User added at runtime via <span><strong class="command">rndc addzone</strong></span>
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User or deleted via <span><strong class="command">rndc delzone</strong></span>.
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User The default is <strong class="userinput"><code>no</code></strong>.
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User<dt><span class="term"><span><strong class="command">auth-nxdomain</strong></span></span></dt>
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User If <strong class="userinput"><code>yes</code></strong>, then the <span><strong class="command">AA</strong></span> bit
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User is always set on NXDOMAIN responses, even if the server is
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews not actually
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User authoritative. The default is <strong class="userinput"><code>no</code></strong>;
a42655602677933f768df30059ac23cc98d71958Tinderbox User a change from <acronym class="acronym">BIND</acronym> 8. If you
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews are using very old DNS software, you
d0d09653ddbb5ff3c8d8bfe7537a58c3ee628157Tinderbox User may need to set it to <strong class="userinput"><code>yes</code></strong>.
246b604d6c1895c107b3add17120e3743e3af200Tinderbox User<dt><span class="term"><span><strong class="command">deallocate-on-exit</strong></span></span></dt>
644973f327e9db74779e7c0426db90909173b284Automatic Updater This option was used in <acronym class="acronym">BIND</acronym>
644973f327e9db74779e7c0426db90909173b284Automatic Updater 8 to enable checking
0c3fdb471fd0977f3c592f9394e2ab98cc2d0419Tinderbox User for memory leaks on exit. <acronym class="acronym">BIND</acronym> 9 ignores the option and always performs
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User<dt><span class="term"><span><strong class="command">memstatistics</strong></span></span></dt>
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User Write memory statistics to the file specified by
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User <span><strong class="command">memstatistics-file</strong></span> at exit.
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User The default is <strong class="userinput"><code>no</code></strong> unless
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User '-m record' is specified on the command line in
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User which case it is <strong class="userinput"><code>yes</code></strong>.
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User<dt><span class="term"><span><strong class="command">dialup</strong></span></span></dt>
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User If <strong class="userinput"><code>yes</code></strong>, then the
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User server treats all zones as if they are doing zone transfers
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User a dial-on-demand dialup link, which can be brought up by
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User originating from this server. This has different effects
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User to zone type and concentrates the zone maintenance so that
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User happens in a short interval, once every <span><strong class="command">heartbeat-interval</strong></span> and
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User hopefully during the one call. It also suppresses some of
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User zone maintenance traffic. The default is <strong class="userinput"><code>no</code></strong>.
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User The <span><strong class="command">dialup</strong></span> option
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User may also be specified in the <span><strong class="command">view</strong></span> and
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User <span><strong class="command">zone</strong></span> statements,
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User in which case it overrides the global <span><strong class="command">dialup</strong></span>
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User If the zone is a master zone, then the server will send out a
4e40289129b2a87cea5ec403620b3bb9a6182f9fTinderbox User request to all the slaves (default). This should trigger the
246b604d6c1895c107b3add17120e3743e3af200Tinderbox User number check in the slave (providing it supports NOTIFY)
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews allowing the slave
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews to verify the zone while the connection is active.
08b7d0694645b474e8a57b663662c8162e7d8b8eTinderbox User The set of servers to which NOTIFY is sent can be controlled
e1ebc476b08b4a498fcf3477e42c986eb1991360Tinderbox User <span><strong class="command">notify</strong></span> and <span><strong class="command">also-notify</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews zone is a slave or stub zone, then the server will suppress
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews "zone up to date" (refresh) queries and only perform them
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">heartbeat-interval</strong></span> expires in
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews addition to sending
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews NOTIFY requests.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Finer control can be achieved by using
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <strong class="userinput"><code>notify</code></strong> which only sends NOTIFY
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <strong class="userinput"><code>notify-passive</code></strong> which sends NOTIFY
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews messages and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews suppresses the normal refresh queries, <strong class="userinput"><code>refresh</code></strong>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews which suppresses normal refresh processing and sends refresh
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews when the <span><strong class="command">heartbeat-interval</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews expires, and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <strong class="userinput"><code>passive</code></strong> which just disables normal
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews normal refresh
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews heart-beat refresh
5b3dd19d815f0389d566d20c2fee57cb37d1dd47Tinderbox User heart-beat notify
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews <p><span><strong class="command">no</strong></span> (default)</p>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <p><span><strong class="command">yes</strong></span></p>
5b3dd19d815f0389d566d20c2fee57cb37d1dd47Tinderbox User <p><span><strong class="command">notify</strong></span></p>
37bf3e124e8b9689ed0890e462bfc5854dc3d252Tinderbox User <p><span><strong class="command">refresh</strong></span></p>
dc7e5458bbcb59ea310ed64ac7e77016e62e9c15Tinderbox User <p><span><strong class="command">passive</strong></span></p>
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User <p><span><strong class="command">notify-passive</strong></span></p>
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews Note that normal NOTIFY processing is not affected by
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">dialup</strong></span>.
ace87434ed3dc7b9d8b36835fd2ce497d29d8191Tinderbox User<dt><span class="term"><span><strong class="command">fake-iquery</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews In <acronym class="acronym">BIND</acronym> 8, this option
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews enabled simulating the obsolete DNS query type
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User IQUERY. <acronym class="acronym">BIND</acronym> 9 never does
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews IQUERY simulation.
80eaeb6c6f1b8170a84f8faef7264bd821036e8eTinderbox User<dt><span class="term"><span><strong class="command">fetch-glue</strong></span></span></dt>
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt This option is obsolete.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews In BIND 8, <strong class="userinput"><code>fetch-glue yes</code></strong>
6c2a76b3e2ccd32c35814b6e0f54da00190749d7Evan Hunt caused the server to attempt to fetch glue resource records
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews didn't have when constructing the additional
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews data section of a response. This is now considered a bad
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews and BIND 9 never does it.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">flush-zones-on-shutdown</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews When the nameserver exits due receiving SIGTERM,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews flush or do not flush any pending zone writes. The default
bd49a41f9688a35bcdc3c9217df9b7fb239e3b52Tinderbox User <span><strong class="command">flush-zones-on-shutdown</strong></span> <strong class="userinput"><code>no</code></strong>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">geoip-use-ecs</strong></span></span></dt>
0c3fdb471fd0977f3c592f9394e2ab98cc2d0419Tinderbox User When BIND is compiled with GeoIP support and configured
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews with "geoip" ACL elements, this option indicates whether
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the EDNS Client Subnet option, if present in a request,
b6980a79a510bf28b7b789c6e638070c135696f1Tinderbox User should be used for matching against the GeoIP database.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The default is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">geoip-use-ecs</strong></span> <strong class="userinput"><code>yes</code></strong>.
81573f7b114a4c71c0bf47058c00fffd245323ceTinderbox User<dt><span class="term"><span><strong class="command">has-old-clients</strong></span></span></dt>
4c721f0e4530612d3c6aa8d9dd02b5e316b4a959Tinderbox User This option was incorrectly implemented
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews in <acronym class="acronym">BIND</acronym> 8, and is ignored by <acronym class="acronym">BIND</acronym> 9.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews To achieve the intended effect
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">has-old-clients</strong></span> <strong class="userinput"><code>yes</code></strong>, specify
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the two separate options <span><strong class="command">auth-nxdomain</strong></span> <strong class="userinput"><code>yes</code></strong>
b91d11bfcc30b96f2c80f3a76d12e3dcc8597a68Mark Andrews and <span><strong class="command">rfc2308-type1</strong></span> <strong class="userinput"><code>no</code></strong> instead.
a66a8912c6a0c1288e88d54940c617158e4dee82Tinderbox User<dt><span class="term"><span><strong class="command">host-statistics</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews In BIND 8, this enables keeping of
1ef84760d1d9c2f4610c3f9c777267388971ae80Tinderbox User statistics for every host that the name server interacts
edd791fb53fab504d52ccdda41e6acbf543ac0d0Tinderbox User Not implemented in BIND 9.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">maintain-ixfr-base</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span class="emphasis"><em>This option is obsolete</em></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews It was used in <acronym class="acronym">BIND</acronym> 8 to
98240f34c38524fd6d0db5a42b9d47cd95ec0fa1Tinderbox User determine whether a transaction log was
cdf1c3d486ec082ef6c92297d22d54a67cca0c90Tinderbox User kept for Incremental Zone Transfer. <acronym class="acronym">BIND</acronym> 9 maintains a transaction
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews log whenever possible. If you need to disable outgoing
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews incremental zone
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews transfers, use <span><strong class="command">provide-ixfr</strong></span> <strong class="userinput"><code>no</code></strong>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">minimal-responses</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If <strong class="userinput"><code>yes</code></strong>, then when generating
4c721f0e4530612d3c6aa8d9dd02b5e316b4a959Tinderbox User responses the server will only add records to the authority
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews and additional data sections when they are required (e.g.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews delegations, negative responses). This may improve the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews performance of the server.
5b3dd19d815f0389d566d20c2fee57cb37d1dd47Tinderbox User The default is <strong class="userinput"><code>no</code></strong>.
c4d2e7c8c8fe06009165275bee0703b0ef85e19fTinderbox User<dt><span class="term"><span><strong class="command">multiple-cnames</strong></span></span></dt>
c4d2e7c8c8fe06009165275bee0703b0ef85e19fTinderbox User This option was used in <acronym class="acronym">BIND</acronym> 8 to allow
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews a domain name to have multiple CNAME records in violation of
baeaed18341c015e9ad54ffa21973184c1bc432bMark Andrews the DNS standards. <acronym class="acronym">BIND</acronym> 9.2 onwards
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews always strictly enforces the CNAME rules both in master
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews files and dynamic updates.
6c2a76b3e2ccd32c35814b6e0f54da00190749d7Evan Hunt<dt><span class="term"><span><strong class="command">notify</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If <strong class="userinput"><code>yes</code></strong> (the default),
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews DNS NOTIFY messages are sent when a zone the server is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews authoritative for
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews changes, see <a href="Bv9ARM.ch04.html#notify" title="Notify">the section called “Notify”</a>. The messages are
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews servers listed in the zone's NS records (except the master
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews server identified
51aeb0ae19596e99b029cfa933e73b76ebec480aTinderbox User in the SOA MNAME field), and to any servers listed in the
4c721f0e4530612d3c6aa8d9dd02b5e316b4a959Tinderbox User <span><strong class="command">also-notify</strong></span> option.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If <strong class="userinput"><code>master-only</code></strong>, notifies are only
51aeb0ae19596e99b029cfa933e73b76ebec480aTinderbox User for master zones.
51aeb0ae19596e99b029cfa933e73b76ebec480aTinderbox User If <strong class="userinput"><code>explicit</code></strong>, notifies are sent only
40e10611ee6a22ea17f13c15f2701385fe90ccc8Tinderbox User servers explicitly listed using <span><strong class="command">also-notify</strong></span>.
40e10611ee6a22ea17f13c15f2701385fe90ccc8Tinderbox User If <strong class="userinput"><code>no</code></strong>, no notifies are sent.
40e10611ee6a22ea17f13c15f2701385fe90ccc8Tinderbox User The <span><strong class="command">notify</strong></span> option may also be
08b7d0694645b474e8a57b663662c8162e7d8b8eTinderbox User specified in the <span><strong class="command">zone</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews in which case it overrides the <span><strong class="command">options notify</strong></span> statement.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews It would only be necessary to turn off this option if it
c7fd128f8ea8a527fe27c1b95ab46df7155bc8e4Tinderbox User caused slaves
c7fd128f8ea8a527fe27c1b95ab46df7155bc8e4Tinderbox User<dt><span class="term"><span><strong class="command">notify-to-soa</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If <strong class="userinput"><code>yes</code></strong> do not check the nameservers
51aeb0ae19596e99b029cfa933e73b76ebec480aTinderbox User in the NS RRset against the SOA MNAME. Normally a NOTIFY
51aeb0ae19596e99b029cfa933e73b76ebec480aTinderbox User message is not sent to the SOA MNAME (SOA ORIGIN) as it is
e1ebc476b08b4a498fcf3477e42c986eb1991360Tinderbox User supposed to contain the name of the ultimate master.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Sometimes, however, a slave is listed as the SOA MNAME in
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews hidden master configurations and in that case you would
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews want the ultimate master to still send NOTIFY messages to
baeaed18341c015e9ad54ffa21973184c1bc432bMark Andrews all the nameservers listed in the NS RRset.
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User<dt><span class="term"><span><strong class="command">recursion</strong></span></span></dt>
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User If <strong class="userinput"><code>yes</code></strong>, and a
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews DNS query requests recursion, then the server will attempt
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews all the work required to answer the query. If recursion is
34348322c7016b6b5d1bceee5b1cf42e2d2216b4Tinderbox User and the server does not already know the answer, it will
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews referral response. The default is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <strong class="userinput"><code>yes</code></strong>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Note that setting <span><strong class="command">recursion no</strong></span> does not prevent
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews clients from getting data from the server's cache; it only
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews prevents new data from being cached as an effect of client
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Caching may still occur as an effect the server's internal
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews operation, such as NOTIFY address lookups.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews See also <span><strong class="command">fetch-glue</strong></span> above.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">request-nsid</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If <strong class="userinput"><code>yes</code></strong>, then an empty EDNS(0)
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews NSID (Name Server Identifier) option is sent with all
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews queries to authoritative name servers during iterative
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews resolution. If the authoritative server returns an NSID
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews option in its response, then its contents are logged in
98240f34c38524fd6d0db5a42b9d47cd95ec0fa1Tinderbox User the <span><strong class="command">resolver</strong></span> category at level
98240f34c38524fd6d0db5a42b9d47cd95ec0fa1Tinderbox User <span><strong class="command">info</strong></span>.
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User The default is <strong class="userinput"><code>no</code></strong>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">request-sit</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If <strong class="userinput"><code>yes</code></strong>, then a SIT (Source
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Identity Token) EDNS option is sent along with
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the query. If the resolver has previously talked
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to the server, the SIT returned in the previous
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews transaction is sent. This is used by the server
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to determine whether the resolver has talked to
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User it before. A resolver sending the correct SIT is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews assumed not to be an off-path attacker sending a
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User spoofed-source query; the query is therefore
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews unlikely to be part of a reflection/amplification
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews attack, so resolvers sending a correct SIT option
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews are not subject to response rate limiting (RRL).
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User Resolvers which do not send a correct SIT option
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews may be limited to receiving smaller responses via
51aeb0ae19596e99b029cfa933e73b76ebec480aTinderbox User the <span><strong class="command">nosit-udp-size</strong></span> option.
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User<dt><span class="term"><span><strong class="command">sit-secret</strong></span></span></dt>
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User If set, this is a shared secret used for generating
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews and verifying Source Identity Token EDNS options
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User within an anycast cluster. If not set, the system
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews will generate a random secret at startup. The
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User shared secret is encoded as a hex string and needs
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to be 128 bits for AES128, 160 bits for SHA1 and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews 256 bits for SHA256.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">rfc2308-type1</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Setting this to <strong class="userinput"><code>yes</code></strong> will
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews cause the server to send NS records along with the SOA
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews record for negative
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews answers. The default is <strong class="userinput"><code>no</code></strong>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Not yet implemented in <acronym class="acronym">BIND</acronym>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">use-id-pool</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span class="emphasis"><em>This option is obsolete</em></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <acronym class="acronym">BIND</acronym> 9 always allocates query
f39894c0b1cafb24035c14c74868e48be25f04a5Mark Andrews IDs from a pool.
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User<dt><span class="term"><span><strong class="command">use-ixfr</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span class="emphasis"><em>This option is obsolete</em></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If you need to disable IXFR to a particular server or
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews servers, see
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the information on the <span><strong class="command">provide-ixfr</strong></span> option
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User in <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Usage”</a>.
bd49a41f9688a35bcdc3c9217df9b7fb239e3b52Tinderbox User <a href="Bv9ARM.ch04.html#incremental_zone_transfers" title="Incremental Zone Transfers (IXFR)">the section called “Incremental Zone Transfers (IXFR)”</a>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">provide-ixfr</strong></span></span></dt>
4873082219e63eb3285f416c137931a6005575d6Tinderbox User See the description of
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">provide-ixfr</strong></span> in
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Usage”</a>.
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User<dt><span class="term"><span><strong class="command">request-ixfr</strong></span></span></dt>
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User See the description of
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">request-ixfr</strong></span> in
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User Usage”</a>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">request-expire</strong></span></span></dt>
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User See the description of
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">request-expire</strong></span> in
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User Usage”</a>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">treat-cr-as-space</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews This option was used in <acronym class="acronym">BIND</acronym>
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User the server treat carriage return ("<span><strong class="command">\r</strong></span>") characters the same way
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews as a space or tab character,
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User to facilitate loading of zone files on a UNIX system that
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews were generated
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews on an NT or DOS machine. In <acronym class="acronym">BIND</acronym> 9, both UNIX "<span><strong class="command">\n</strong></span>"
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews and NT/DOS "<span><strong class="command">\r\n</strong></span>" newlines
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews are always accepted,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews and the option is ignored.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<span class="term"><span><strong class="command">additional-from-auth</strong></span>, </span><span class="term"><span><strong class="command">additional-from-cache</strong></span></span>
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User These options control the behavior of an authoritative
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews answering queries which have additional data, or when
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews following CNAME
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews and DNAME chains.
fda4ac481c16bb138e9d32e650264c89c12005faTinderbox User When both of these options are set to <strong class="userinput"><code>yes</code></strong>
40e10611ee6a22ea17f13c15f2701385fe90ccc8Tinderbox User (the default) and a
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews query is being answered from authoritative data (a zone
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User configured into the server), the additional data section of
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews reply will be filled in using data from other authoritative
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User and from the cache. In some situations this is undesirable,
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User as when there is concern over the correctness of the cache,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews in servers where slave zones may be added and modified by
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews untrusted third parties. Also, avoiding
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User the search for this additional data will speed up server
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews at the possible expense of additional queries to resolve
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews otherwise be provided in the additional section.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews For example, if a query asks for an MX record for host <code class="literal">foo.example.com</code>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews and the record found is "<code class="literal">MX 10 mail.example.net</code>", normally the address
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews records (A and AAAA) for <code class="literal">mail.example.net</code> will be provided as well,
abe52cd9882c2c27482a2781f30a34d67501fdf8Tinderbox User if known, even though they are not in the example.com zone.
ab0417b81b77394a48cbfdd8ec0aefc3530c1137Tinderbox User Setting these options to <span><strong class="command">no</strong></span>
83a719787256d2a9909f94eadde46a53ea5d4168Tinderbox User disables this behavior and makes
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews the server only search for additional data in the zone it
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews answers from.
adeafa4320b38ec9e809b43a0e48f41e25ca856fTinderbox User These options are intended for use in authoritative-only
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews servers, or in authoritative-only views. Attempts to set
0d3490f93bb980fde704055e74c1b508987a5fe4Mark Andrews them to <span><strong class="command">no</strong></span> without also
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">recursion no</strong></span> will cause the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews ignore the options and log a warning message.
cdf1c3d486ec082ef6c92297d22d54a67cca0c90Tinderbox User Specifying <span><strong class="command">additional-from-cache no</strong></span> actually
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews disables the use of the cache not only for additional data
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews but also when looking up the answer. This is usually the
048b775e5c130c7f99965cb10fc4361df8d266aaTinderbox User behavior in an authoritative-only server where the
5382b244c33da2a91116127313d6e8ad47175b41Tinderbox User correctness of
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the cached data is an issue.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews When a name server is non-recursively queried for a name
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews below the apex of any served zone, it normally answers with
97f57cf53467d30ea0f448b64f2d9c056aa9f80cTinderbox User "upwards referral" to the root servers or the servers of
2b7254075b883d70852a2757210793603085a0f1Tinderbox User known parent of the query name. Since the data in an
2b7254075b883d70852a2757210793603085a0f1Tinderbox User upwards referral
77743327f19cede0f94538f4c2564f02afffe1f6Tinderbox User comes from the cache, the server will not be able to provide
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews referrals when <span><strong class="command">additional-from-cache no</strong></span>
98240f34c38524fd6d0db5a42b9d47cd95ec0fa1Tinderbox User has been specified. Instead, it will respond to such
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews with REFUSED. This should not cause any problems since
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews upwards referrals are not required for the resolution
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">match-mapped-addresses</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If <strong class="userinput"><code>yes</code></strong>, then an
42c81cf2de732ec6d00e73fc755a399ca037e543Mark Andrews IPv4-mapped IPv6 address will match any address match
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews list entries that match the corresponding IPv4 address.
dc7e5458bbcb59ea310ed64ac7e77016e62e9c15Tinderbox User This option was introduced to work around a kernel quirk
dc7e5458bbcb59ea310ed64ac7e77016e62e9c15Tinderbox User in some operating systems that causes IPv4 TCP
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt connections, such as zone transfers, to be accepted on an
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt IPv6 socket using mapped addresses. This caused address
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt match lists designed for IPv4 to fail to match. However,
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt <span><strong class="command">named</strong></span> now solves this problem
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User internally. The use of this option is discouraged.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater<dt><span class="term"><span><strong class="command">filter-aaaa-on-v4</strong></span></span></dt>
71fc4775d04aea66809e3eb5b5159c55413bdc5cMark Andrews This option is only available when
7d704e522860496310bb29c28e76064868401a9cMark Andrews <acronym class="acronym">BIND</acronym> 9 is compiled with the
7d704e522860496310bb29c28e76064868401a9cMark Andrews <strong class="userinput"><code>--enable-filter-aaaa</code></strong> option on the
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews "configure" command line. It is intended to help the
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater transition from IPv4 to IPv6 by not giving IPv6 addresses
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater to DNS clients unless they have connections to the IPv6
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater Internet. This is not recommended unless absolutely
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater necessary. The default is <strong class="userinput"><code>no</code></strong>.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater The <span><strong class="command">filter-aaaa-on-v4</strong></span> option
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater may also be specified in <span><strong class="command">view</strong></span> statements
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater to override the global <span><strong class="command">filter-aaaa-on-v4</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If <strong class="userinput"><code>yes</code></strong>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the DNS client is at an IPv4 address, in <span><strong class="command">filter-aaaa</strong></span>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews and if the response does not include DNSSEC signatures,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews then all AAAA records are deleted from the response.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews This filtering applies to all responses and not only
048b775e5c130c7f99965cb10fc4361df8d266aaTinderbox User authoritative responses.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If <strong class="userinput"><code>break-dnssec</code></strong>,
33b0d10552ea5f7716385b2cedff64daa1486c50Tinderbox User then AAAA records are deleted even when DNSSEC is enabled.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews As suggested by the name, this makes the response not verify,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews because the DNSSEC protocol is designed detect deletions.
8ac5ddf659a81ed668579818981fc1a5f28405d1Tinderbox User This mechanism can erroneously cause other servers to
5835beb229e17d583fb4b6fd4246bd014a68ddf6Tinderbox User not give AAAA records to their clients.
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews A recursing server with both IPv6 and IPv4 network connections
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews that queries an authoritative server using this mechanism
5b3dd19d815f0389d566d20c2fee57cb37d1dd47Tinderbox User via IPv4 will be denied AAAA records even if its client is
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews This mechanism is applied to authoritative as well as
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews non-authoritative records.
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User A client using IPv4 that is not allowed recursion can
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews erroneously be given AAAA records because the server is not
c4d2e7c8c8fe06009165275bee0703b0ef85e19fTinderbox User allowed to check for A records.
baeaed18341c015e9ad54ffa21973184c1bc432bMark Andrews Some AAAA records are given to IPv4 clients in glue records.
baeaed18341c015e9ad54ffa21973184c1bc432bMark Andrews IPv4 clients that are servers can then erroneously
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User answer requests for AAAA records received via IPv4.
33b0d10552ea5f7716385b2cedff64daa1486c50Tinderbox User<dt><span class="term"><span><strong class="command">filter-aaaa-on-v6</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Identical to <span><strong class="command">filter-aaaa-on-v4</strong></span>,
c4d2e7c8c8fe06009165275bee0703b0ef85e19fTinderbox User except it filters AAAA responses to queries from IPv6
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews clients instead of IPv4 clients. To filter all
20648865f1f76c4c34cbe33c18b62cfa0cfe0fc8Tinderbox User responses, set both options to <strong class="userinput"><code>yes</code></strong>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
35eb1a5f072b9f1b7d7cbcc0c25e38611f373f6fTinderbox User When <strong class="userinput"><code>yes</code></strong> and the server loads a new
2b7254075b883d70852a2757210793603085a0f1Tinderbox User version of a master zone from its zone file or receives a
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews new version of a slave file via zone transfer, it will
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews compare the new version to the previous one and calculate
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews a set of differences. The differences are then logged in
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the zone's journal file such that the changes can be
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews transmitted to downstream slaves as an incremental zone
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews By allowing incremental zone transfers to be used for
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews non-dynamic zones, this option saves bandwidth at the
d0d09653ddbb5ff3c8d8bfe7537a58c3ee628157Tinderbox User expense of increased CPU and memory consumption at the
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews In particular, if the new version of a zone is completely
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews different from the previous one, the set of differences
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews will be of a size comparable to the combined size of the
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews old and new zone version, and the server will need to
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews temporarily allocate memory to hold this complete
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews difference set.
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews<p><span><strong class="command">ixfr-from-differences</strong></span>
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews also accepts <span><strong class="command">master</strong></span> and
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews <span><strong class="command">slave</strong></span> at the view and options
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews levels which causes
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews <span><strong class="command">ixfr-from-differences</strong></span> to be enabled for
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews all <span><strong class="command">master</strong></span> or
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews <span><strong class="command">slave</strong></span> zones respectively.
c29c3e51b1d7502c8d9978633df43e6a267bc427Mark Andrews It is off by default.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">multi-master</strong></span></span></dt>
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User This should be set when you have multiple masters for a zone
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews addresses refer to different machines. If <strong class="userinput"><code>yes</code></strong>, <span><strong class="command">named</strong></span> will
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt when the serial number on the master is less than what <span><strong class="command">named</strong></span>
0e573cdd111e060e5f6c18249b5ccacbe8abe278Tinderbox User has. The default is <strong class="userinput"><code>no</code></strong>.
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User<dt><span class="term"><span><strong class="command">dnssec-enable</strong></span></span></dt>
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt Enable DNSSEC support in <span><strong class="command">named</strong></span>. Unless set to <strong class="userinput"><code>yes</code></strong>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">named</strong></span> behaves as if it does not support DNSSEC.
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User The default is <strong class="userinput"><code>yes</code></strong>.
20648865f1f76c4c34cbe33c18b62cfa0cfe0fc8Tinderbox User<dt><span class="term"><span><strong class="command">dnssec-validation</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Enable DNSSEC validation in <span><strong class="command">named</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews set to <strong class="userinput"><code>yes</code></strong> to be effective.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If set to <strong class="userinput"><code>no</code></strong>, DNSSEC validation
0726d872f6f36901ea09321df57084614e5bb6faTinderbox User is disabled. If set to <strong class="userinput"><code>auto</code></strong>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews DNSSEC validation is enabled, and a default
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews trust-anchor for the DNS root zone is used. If set to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <strong class="userinput"><code>yes</code></strong>, DNSSEC validation is enabled,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews but a trust anchor must be manually configured using
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews a <span><strong class="command">trusted-keys</strong></span> or
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">managed-keys</strong></span> statement. The default
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews is <strong class="userinput"><code>yes</code></strong>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">dnssec-accept-expired</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Accept expired signatures when verifying DNSSEC signatures.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The default is <strong class="userinput"><code>no</code></strong>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Setting this option to <strong class="userinput"><code>yes</code></strong>
33b0d10552ea5f7716385b2cedff64daa1486c50Tinderbox User leaves <span><strong class="command">named</strong></span> vulnerable to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews replay attacks.
2b7254075b883d70852a2757210793603085a0f1Tinderbox User<dt><span class="term"><span><strong class="command">querylog</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Specify whether query logging should be started when <span><strong class="command">named</strong></span>
baeaed18341c015e9ad54ffa21973184c1bc432bMark Andrews If <span><strong class="command">querylog</strong></span> is not specified,
baeaed18341c015e9ad54ffa21973184c1bc432bMark Andrews then the query logging
6c2a76b3e2ccd32c35814b6e0f54da00190749d7Evan Hunt is determined by the presence of the logging category <span><strong class="command">queries</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">check-names</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews This option is used to restrict the character set and syntax
1ef84760d1d9c2f4610c3f9c777267388971ae80Tinderbox User certain domain names in master files and/or DNS responses
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews from the network. The default varies according to usage
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews For <span><strong class="command">slave</strong></span> zones the default
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews is <span><strong class="command">warn</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews For answers received from the network (<span><strong class="command">response</strong></span>)
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the default is <span><strong class="command">ignore</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The rules for legal hostnames and mail domains are derived
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews from RFC 952 and RFC 821 as modified by RFC 1123.
1ef84760d1d9c2f4610c3f9c777267388971ae80Tinderbox User<p><span><strong class="command">check-names</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews applies to the owner names of A, AAAA and MX records.
903fcd6a60c6420f5dbd753ab068ba5ca2af8e62Tinderbox User It also applies to the domain names in the RDATA of NS, SOA,
37bf3e124e8b9689ed0890e462bfc5854dc3d252Tinderbox User MX, and SRV records.
e1ebc476b08b4a498fcf3477e42c986eb1991360Tinderbox User It also applies to the RDATA of PTR records where the owner
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews name indicated that it is a reverse lookup of a hostname
2b7254075b883d70852a2757210793603085a0f1Tinderbox User (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT).
1ef84760d1d9c2f4610c3f9c777267388971ae80Tinderbox User<dt><span class="term"><span><strong class="command">check-dup-records</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Check master zones for records that are treated as different
16afb24a0006e01f1b9d9256b44be035b1bb2d32Tinderbox User by DNSSEC but are semantically equal in plain DNS. The
16afb24a0006e01f1b9d9256b44be035b1bb2d32Tinderbox User default is to <span><strong class="command">warn</strong></span>. Other possible
6c2a76b3e2ccd32c35814b6e0f54da00190749d7Evan Hunt values are <span><strong class="command">fail</strong></span> and
361967ea970ea8f0ef8875e769505ecdac74bfb0Tinderbox User <span><strong class="command">ignore</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">check-mx</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Check whether the MX record appears to refer to a IP address.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The default is to <span><strong class="command">warn</strong></span>. Other possible
3718b6ecfc40479988a9182701a4af5b3f8233f4Tinderbox User values are <span><strong class="command">fail</strong></span> and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">ignore</strong></span>.
1ef84760d1d9c2f4610c3f9c777267388971ae80Tinderbox User<dt><span class="term"><span><strong class="command">check-wildcard</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews This option is used to check for non-terminal wildcards.
1ef84760d1d9c2f4610c3f9c777267388971ae80Tinderbox User The use of non-terminal wildcards is almost always as a
16afb24a0006e01f1b9d9256b44be035b1bb2d32Tinderbox User result of a failure
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to understand the wildcard matching algorithm (RFC 1034).
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews affects master zones. The default (<span><strong class="command">yes</strong></span>) is to check
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews for non-terminal wildcards and issue a warning.
98240f34c38524fd6d0db5a42b9d47cd95ec0fa1Tinderbox User<dt><span class="term"><span><strong class="command">check-integrity</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Perform post load zone integrity checks on master
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews zones. This checks that MX and SRV records refer
40e10611ee6a22ea17f13c15f2701385fe90ccc8Tinderbox User to address (A or AAAA) records and that glue
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews address records exist for delegated zones. For
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews MX and SRV records only in-zone hostnames are
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews checked (for out-of-zone hostnames use
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">named-checkzone</strong></span>).
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews For NS records only names below top of zone are
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews checked (for out-of-zone names and glue consistency
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews checks use <span><strong class="command">named-checkzone</strong></span>).
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The default is <span><strong class="command">yes</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The use of the SPF record for publishing Sender
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Policy Framework is deprecated as the migration
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews from using TXT records to SPF records was abandoned.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Enabling this option also checks that a TXT Sender
40e10611ee6a22ea17f13c15f2701385fe90ccc8Tinderbox User Policy Framework record exists (starts with "v=spf1")
40e10611ee6a22ea17f13c15f2701385fe90ccc8Tinderbox User if there is an SPF record. Warnings are emitted if the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews TXT record does not exist and can be suppressed with
16afb24a0006e01f1b9d9256b44be035b1bb2d32Tinderbox User <span><strong class="command">check-spf</strong></span>.
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User<dt><span class="term"><span><strong class="command">check-mx-cname</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If <span><strong class="command">check-integrity</strong></span> is set then
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews fail, warn or ignore MX records that refer
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to CNAMES. The default is to <span><strong class="command">warn</strong></span>.
b6980a79a510bf28b7b789c6e638070c135696f1Tinderbox User<dt><span class="term"><span><strong class="command">check-srv-cname</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If <span><strong class="command">check-integrity</strong></span> is set then
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews fail, warn or ignore SRV records that refer
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to CNAMES. The default is to <span><strong class="command">warn</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">check-sibling</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews When performing integrity checks, also check that
c7fd128f8ea8a527fe27c1b95ab46df7155bc8e4Tinderbox User sibling glue exists. The default is <span><strong class="command">yes</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">check-spf</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If <span><strong class="command">check-integrity</strong></span> is set then
c7fd128f8ea8a527fe27c1b95ab46df7155bc8e4Tinderbox User check that there is a TXT Sender Policy Framework
baeaed18341c015e9ad54ffa21973184c1bc432bMark Andrews record present (starts with "v=spf1") if there is an
baeaed18341c015e9ad54ffa21973184c1bc432bMark Andrews SPF record present. The default is
872e1437295dce8162ac7374317d593320ac2dd6Tinderbox User <span><strong class="command">warn</strong></span>.
872e1437295dce8162ac7374317d593320ac2dd6Tinderbox User<dt><span class="term"><span><strong class="command">zero-no-soa-ttl</strong></span></span></dt>
2b7254075b883d70852a2757210793603085a0f1Tinderbox User When returning authoritative negative responses to
51aeb0ae19596e99b029cfa933e73b76ebec480aTinderbox User SOA queries set the TTL of the SOA record returned in
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the authority section to zero.
3718b6ecfc40479988a9182701a4af5b3f8233f4Tinderbox User The default is <span><strong class="command">yes</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">zero-no-soa-ttl-cache</strong></span></span></dt>
16afb24a0006e01f1b9d9256b44be035b1bb2d32Tinderbox User When caching a negative response to a SOA query
51aeb0ae19596e99b029cfa933e73b76ebec480aTinderbox User set the TTL to zero.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The default is <span><strong class="command">no</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">update-check-ksk</strong></span></span></dt>
2b7254075b883d70852a2757210793603085a0f1Tinderbox User When set to the default value of <code class="literal">yes</code>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews check the KSK bit in each key to determine how the key
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews should be used when generating RRSIGs for a secure zone.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Ordinarily, zone-signing keys (that is, keys without the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews KSK bit set) are used to sign the entire zone, while
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews key-signing keys (keys with the KSK bit set) are only
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews used to sign the DNSKEY RRset at the zone apex.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews However, if this option is set to <code class="literal">no</code>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews then the KSK bit is ignored; KSKs are treated as if they
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews were ZSKs and are used to sign the entire zone. This is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews similar to the <span><strong class="command">dnssec-signzone -z</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews command line option.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews When this option is set to <code class="literal">yes</code>, there
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews must be at least two active keys for every algorithm
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews represented in the DNSKEY RRset: at least one KSK and one
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews ZSK per algorithm. If there is any algorithm for which
c7fd128f8ea8a527fe27c1b95ab46df7155bc8e4Tinderbox User this requirement is not met, this option will be ignored
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews for that algorithm.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">dnssec-dnskey-kskonly</strong></span></span></dt>
51aeb0ae19596e99b029cfa933e73b76ebec480aTinderbox User When this option and <span><strong class="command">update-check-ksk</strong></span>
33b0d10552ea5f7716385b2cedff64daa1486c50Tinderbox User are both set to <code class="literal">yes</code>, only key-signing
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews keys (that is, keys with the KSK bit set) will be used
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to sign the DNSKEY RRset at the zone apex. Zone-signing
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews keys (keys without the KSK bit set) will be used to sign
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the remainder of the zone, but not the DNSKEY RRset.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews This is similar to the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">dnssec-signzone -x</strong></span> command line option.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The default is <span><strong class="command">no</strong></span>. If
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews <span><strong class="command">update-check-ksk</strong></span> is set to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <code class="literal">no</code>, this option is ignored.
e1ebc476b08b4a498fcf3477e42c986eb1991360Tinderbox User<dt><span class="term"><span><strong class="command">dnssec-loadkeys-interval</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews When a zone is configured with <span><strong class="command">auto-dnssec
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews maintain;</strong></span> its key repository must be checked
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews periodically to see if any new keys have been added
40e10611ee6a22ea17f13c15f2701385fe90ccc8Tinderbox User or any existing keys' timing metadata has been updated
40e10611ee6a22ea17f13c15f2701385fe90ccc8Tinderbox User (see <a href="man.dnssec-keygen.html" title="dnssec-keygen"><span class="refentrytitle"><span class="application">dnssec-keygen</span></span>(8)</a> and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <a href="man.dnssec-settime.html" title="dnssec-settime"><span class="refentrytitle"><span class="application">dnssec-settime</span></span>(8)</a>). The
16afb24a0006e01f1b9d9256b44be035b1bb2d32Tinderbox User <span><strong class="command">dnssec-loadkeys-interval</strong></span> option
16afb24a0006e01f1b9d9256b44be035b1bb2d32Tinderbox User sets the frequency of automatic repository checks, in
2b7254075b883d70852a2757210793603085a0f1Tinderbox User minutes. The default is <code class="literal">60</code> (1 hour),
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the minimum is <code class="literal">1</code> (1 minute), and the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews maximum is <code class="literal">1440</code> (24 hours); any higher
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews value is silently reduced.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">try-tcp-refresh</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Try to refresh the zone using TCP if UDP queries fail.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews For BIND 8 compatibility, the default is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">yes</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">dnssec-secure-to-insecure</strong></span></span></dt>
d0d09653ddbb5ff3c8d8bfe7537a58c3ee628157Tinderbox User Allow a dynamic zone to transition from secure to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews insecure (i.e., signed to unsigned) by deleting all
6c2a76b3e2ccd32c35814b6e0f54da00190749d7Evan Hunt of the DNSKEY records. The default is <span><strong class="command">no</strong></span>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If set to <span><strong class="command">yes</strong></span>, and if the DNSKEY RRset
903fcd6a60c6420f5dbd753ab068ba5ca2af8e62Tinderbox User at the zone apex is deleted, all RRSIG and NSEC records
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews will be removed from the zone as well.
a564a0a6d0cb9279b6d82d280e857dd036c9c5e0Tinderbox User If the zone uses NSEC3, then it is also necessary to
39c56dd2b86e306f1416c352645920855f65648fTinderbox User delete the NSEC3PARAM RRset from the zone apex; this will
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews cause the removal of all corresponding NSEC3 records.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews (It is expected that this requirement will be eliminated
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews in a future release.)
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Note that if a zone has been configured with
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">auto-dnssec maintain</strong></span> and the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews private keys remain accessible in the key repository,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews then the zone will be automatically signed again the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews next time <span><strong class="command">named</strong></span> is started.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h4 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="id2584173"></a>Forwarding</h4></div></div></div>
5ee9f7f23852d92772c08ca6e4b46c549beaf660Mark Andrews The forwarding facility can be used to create a large site-wide
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews cache on a few servers, reducing traffic over links to external
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews name servers. It can also be used to allow queries by servers that
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews do not have direct access to the Internet, but wish to look up
3ccf87473f7cf6d9faac156df38a935a238f96fdTinderbox User names anyway. Forwarding occurs only on those queries for which
80eaeb6c6f1b8170a84f8faef7264bd821036e8eTinderbox User the server is not authoritative and does not have the answer in
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">forward</strong></span></span></dt>
2b7254075b883d70852a2757210793603085a0f1Tinderbox User This option is only meaningful if the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews forwarders list is not empty. A value of <code class="varname">first</code>,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the default, causes the server to query the forwarders
3fb635d1c5fad0b7380b8195750dc1057bb1abd6Tinderbox User first — and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews if that doesn't answer the question, the server will then
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the answer itself. If <code class="varname">only</code> is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews specified, the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews server will only query the forwarders.
a564a0a6d0cb9279b6d82d280e857dd036c9c5e0Tinderbox User<dt><span class="term"><span><strong class="command">forwarders</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Specifies the IP addresses to be used
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews for forwarding. The default is the empty list (no
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews forwarding).
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Forwarding can also be configured on a per-domain basis, allowing
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt for the global forwarding options to be overridden in a variety
2b7254075b883d70852a2757210793603085a0f1Tinderbox User of ways. You can set particular domains to use different
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews or have a different <span><strong class="command">forward only/first</strong></span> behavior,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews or not forward at all, see <a href="Bv9ARM.ch06.html#zone_statement_grammar" title="zone
f549a65f4cbc84f2a4e5ce4ff78c30bb8f3a32d4Tinderbox User Statement Grammar">the section called “<span><strong class="command">zone</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Statement Grammar”</a>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h4 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="id2584232"></a>Dual-stack Servers</h4></div></div></div>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Dual-stack servers are used as servers of last resort to work
5835beb229e17d583fb4b6fd4246bd014a68ddf6Tinderbox User problems in reachability due the lack of support for either IPv4
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews on the host machine.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">dual-stack-servers</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Specifies host names or addresses of machines with access to
903fcd6a60c6420f5dbd753ab068ba5ca2af8e62Tinderbox User both IPv4 and IPv6 transports. If a hostname is used, the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews server must be able
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to resolve the name using only the transport it has. If the
2b7254075b883d70852a2757210793603085a0f1Tinderbox User machine is dual
2b7254075b883d70852a2757210793603085a0f1Tinderbox User stacked, then the <span><strong class="command">dual-stack-servers</strong></span> have no effect unless
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews access to a transport has been disabled on the command line
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews (e.g. <span><strong class="command">named -4</strong></span>).
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="titlepage"><div><div><h4 class="title">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<a name="access_control"></a>Access Control</h4></div></div></div>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Access to the server can be restricted based on the IP address
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews of the requesting system. See <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a> for
a564a0a6d0cb9279b6d82d280e857dd036c9c5e0Tinderbox User details on how to specify IP address lists.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Specifies which hosts are allowed to
689fb19ba11ed40363cbc031d0396befdb409b89Tinderbox User notify this server, a slave, of zone changes in addition
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to the zone masters.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">allow-notify</strong></span> may also be
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews specified in the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">zone</strong></span> statement, in which case
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews it overrides the
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt <span><strong class="command">options allow-notify</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews statement. It is only meaningful
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews for a slave zone. If not specified, the default is to
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt process notify messages
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews only from a zone's master.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">allow-query</strong></span></span></dt>
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews Specifies which hosts are allowed to ask ordinary
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User DNS questions. <span><strong class="command">allow-query</strong></span> may
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson also be specified in the <span><strong class="command">zone</strong></span>
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User statement, in which case it overrides the
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User <span><strong class="command">options allow-query</strong></span> statement.
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User If not specified, the default is to allow queries
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews from all hosts.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
2b7254075b883d70852a2757210793603085a0f1Tinderbox User <span><strong class="command">allow-query-cache</strong></span> is now
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews used to specify access to the cache.
ebe53509ca55a141131c104b6d722236b606e0efTinderbox User<dt><span class="term"><span><strong class="command">allow-query-on</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Specifies which local addresses can accept ordinary
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews DNS questions. This makes it possible, for instance,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to allow queries on internal-facing interfaces but
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews disallow them on external-facing ones, without
8ac5ddf659a81ed668579818981fc1a5f28405d1Tinderbox User necessarily knowing the internal network's addresses.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Note that <span><strong class="command">allow-query-on</strong></span> is only
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews checked for queries that are permitted by
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">allow-query</strong></span>. A query must be
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews allowed by both ACLs, or it will be refused.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">allow-query-on</strong></span> may
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews also be specified in the <span><strong class="command">zone</strong></span>
1ef84760d1d9c2f4610c3f9c777267388971ae80Tinderbox User statement, in which case it overrides the
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">options allow-query-on</strong></span> statement.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If not specified, the default is to allow queries
fab54780409846f7c71f6026d665f18c77c649efTinderbox User on all addresses.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">allow-query-cache</strong></span> is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews used to specify access to the cache.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">allow-query-cache</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Specifies which hosts are allowed to get answers
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews from the cache. If <span><strong class="command">allow-query-cache</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews is not set then <span><strong class="command">allow-recursion</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews is used if set, otherwise <span><strong class="command">allow-query</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews is used if set unless <span><strong class="command">recursion no;</strong></span> is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews set in which case <span><strong class="command">none;</strong></span> is used,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews otherwise the default (<span><strong class="command">localnets;</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">localhost;</strong></span>) is used.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">allow-query-cache-on</strong></span></span></dt>
cb5446c26093277f40e4c02c9eafcd9e50535994Tinderbox User Specifies which local addresses can give answers
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User from the cache. If not specified, the default is
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson to allow cache queries on any address,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span><strong class="command">localnets</strong></span> and
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User <span><strong class="command">localhost</strong></span>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">allow-recursion</strong></span></span></dt>
bd7a552249814fa4b03c69418c8d6828fc013f6bTinderbox User Specifies which hosts are allowed to make recursive
20648865f1f76c4c34cbe33c18b62cfa0cfe0fc8Tinderbox User queries through this server. If
33b0d10552ea5f7716385b2cedff64daa1486c50Tinderbox User <span><strong class="command">allow-recursion</strong></span> is not set
c75bf330fc68e1c07cfb14631e7d3de7e2786ee7Mark Andrews then <span><strong class="command">allow-query-cache</strong></span> is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews used if set, otherwise <span><strong class="command">allow-query</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews is used if set, otherwise the default
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews (<span><strong class="command">localnets;</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">localhost;</strong></span>) is used.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">allow-recursion-on</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Specifies which local addresses can accept recursive
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews queries. If not specified, the default is to allow
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews recursive queries on all addresses.
5b3dd19d815f0389d566d20c2fee57cb37d1dd47Tinderbox User<dt><span class="term"><span><strong class="command">allow-update</strong></span></span></dt>
d0d09653ddbb5ff3c8d8bfe7537a58c3ee628157Tinderbox User Specifies which hosts are allowed to
bd7a552249814fa4b03c69418c8d6828fc013f6bTinderbox User submit Dynamic DNS updates for master zones. The default is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews updates from all hosts. Note that allowing updates based
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews on the requestor's IP address is insecure; see
cb5446c26093277f40e4c02c9eafcd9e50535994Tinderbox User <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a> for details.
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User Specifies which hosts are allowed to
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews submit Dynamic DNS updates to slave zones to be forwarded to
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews master. The default is <strong class="userinput"><code>{ none; }</code></strong>,
c75bf330fc68e1c07cfb14631e7d3de7e2786ee7Mark Andrews means that no update forwarding will be performed. To
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews update forwarding, specify
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <strong class="userinput"><code>allow-update-forwarding { any; };</code></strong>.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Specifying values other than <strong class="userinput"><code>{ none; }</code></strong> or
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <strong class="userinput"><code>{ any; }</code></strong> is usually
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews counterproductive, since
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the responsibility for update access control should rest
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews master server, not the slaves.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Note that enabling the update forwarding feature on a slave
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews may expose master servers relying on insecure IP address
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews access control to attacks; see <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews for more details.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">allow-v6-synthesis</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews This option was introduced for the smooth transition from
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to A6 and from "nibble labels" to binary labels.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews However, since both A6 and binary labels were then
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews this option was also deprecated.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews It is now ignored with some warning messages.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">allow-transfer</strong></span></span></dt>
51aeb0ae19596e99b029cfa933e73b76ebec480aTinderbox User Specifies which hosts are allowed to
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews receive zone transfers from the server. <span><strong class="command">allow-transfer</strong></span> may
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews also be specified in the <span><strong class="command">zone</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews statement, in which
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews case it overrides the <span><strong class="command">options allow-transfer</strong></span> statement.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If not specified, the default is to allow transfers to all
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><span><strong class="command">blackhole</strong></span></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Specifies a list of addresses that the
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews server will not accept queries from or use to resolve a
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews query. Queries
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews from these addresses will not be responded to. The default
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews is <strong class="userinput"><code>none</code></strong>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><span><strong class="command">filter-aaaa</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Specifies a list of addresses to which
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">filter-aaaa-on-v4</strong></span>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews is applies. The default is <strong class="userinput"><code>any</code></strong>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><span><strong class="command">no-case-compress</strong></span></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Specifies a list of addresses which require responses
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews to use case-insensitive compression. This ACL can be
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews used when <span><strong class="command">named</strong></span> needs to work with
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews clients that do not comply with the requirement in RFC
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews 1034 to use case-insensitive name comparisons when
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews checking for matching domain names.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If left undefined, the ACL defaults to
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">none</strong></span>: case-insensitive compression
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews will be used for all clients. If the ACL is defined and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews matches a client, then case will be ignored when
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews compressing domain names in DNS responses sent to that
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews This can result in slightly smaller responses: if
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews a response contains the names "example.com" and
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews "example.COM", case-insensitive compression would treat
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews the second one as a duplicate. It also ensures
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews that the case of the query name exactly matches the
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews case of the owner names of returned records, rather
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews than matching the case of the records entered in
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the zone file. This allows responses to exactly
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews match the query, which is required by some clients
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews due to incorrect use of case-sensitive comparisons.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Case-insensitive compression is <span class="emphasis"><em>always</em></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews used in AXFR and IXFR responses, regardless of whether
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews the client matches this ACL.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews There are circumstances in which <span><strong class="command">named</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews will not preserve the case of owner names of records:
33b0d10552ea5f7716385b2cedff64daa1486c50Tinderbox User if a zone file defines records of different types with
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the same name, but the capitalization of the name is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews "WWW.EXAMPLE.COM/AAAA"), then all responses for that
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews name will use the <span class="emphasis"><em>first</em></span> version
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews of the name that was used in the zone file. This
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews limitation may be addressed in a future release. However,
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews domain names specified in the rdata of resource records
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews (i.e., records of type NS, MX, CNAME, etc) will always
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews have their case preserved unless the client matches this
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">resolver-query-timeout</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The amount of time the resolver will spend attempting
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to resolve a recursive query before failing. The default
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews and minimum is <code class="literal">10</code> and the maximum is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <code class="literal">30</code>. Setting it to <code class="literal">0</code>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews will result in the default being used.
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User<a name="id2584974"></a>Interfaces</h4></div></div></div>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The interfaces and ports that the server will answer queries
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews an optional port and an <code class="varname">address_match_list</code>
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User of IPv4 addresses. (IPv6 addresses are ignored, with a
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews logged warning.)
3ccf87473f7cf6d9faac156df38a935a238f96fdTinderbox User The server will listen on all interfaces allowed by the address
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews match list. If a port is not specified, port 53 will be used.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Multiple <span><strong class="command">listen-on</strong></span> statements are
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews For example,
415d630b6309922caee8469384a6fab75cf05032Mark Andrews<pre class="programlisting">listen-on { 5.6.7.8; };
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User will enable the name server on port 53 for the IP address
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt 5.6.7.8, and on port 1234 of an address on the machine in net
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt 1.2 that is not 1.2.3.4.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews If no <span><strong class="command">listen-on</strong></span> is specified, the
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User server will listen on port 53 on all IPv4 interfaces.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt The <span><strong class="command">listen-on-v6</strong></span> option is used to
415d630b6309922caee8469384a6fab75cf05032Mark Andrews specify the interfaces and the ports on which the server will
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews listen for incoming queries sent using IPv6. If not specified,
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User the server will listen on port 53 on all IPv6 interfaces.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt as the <code class="varname">address_match_list</code> for the
415d630b6309922caee8469384a6fab75cf05032Mark Andrews <span><strong class="command">listen-on-v6</strong></span> option,
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt the server does not bind a separate socket to each IPv6 interface
415d630b6309922caee8469384a6fab75cf05032Mark Andrews address as it does for IPv4 if the operating system has enough API
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews support for IPv6 (specifically if it conforms to RFC 3493 and RFC
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt Instead, it listens on the IPv6 wildcard address.
415d630b6309922caee8469384a6fab75cf05032Mark Andrews If the system only has incomplete API support for IPv6, however,
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt the behavior is the same as that for IPv4.
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox User A list of particular IPv6 addresses can also be specified, in
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the server listens on a separate socket for each specified
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews regardless of whether the desired API is supported by the system.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews IPv4 addresses specified in <span><strong class="command">listen-on-v6</strong></span>
33b0d10552ea5f7716385b2cedff64daa1486c50Tinderbox User will be ignored, with a logged warning.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Multiple <span><strong class="command">listen-on-v6</strong></span> options can
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews For example,
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<pre class="programlisting">listen-on-v6 { any; };
9218b940febade3085fd6d95a15e67d5f94833f0Tinderbox Userlisten-on-v6 port 1234 { !2001:db8::/32; any; };
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews will enable the name server on port 53 for any IPv6 addresses
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson (with a single wildcard socket),
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews and on port 1234 of IPv6 addresses that is not in the prefix
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews 2001:db8::/32 (with separate sockets for each matched address.)
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews To make the server not listen on any IPv6 address, use
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews<pre class="programlisting">listen-on-v6 { none; };
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews<div class="titlepage"><div><div><h4 class="title">
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<a name="query_address"></a>Query Address</h4></div></div></div>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews If the server doesn't know the answer to a question, it will
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User query other name servers. <span><strong class="command">query-source</strong></span> specifies
1f9754245cbd5eec2d2a667bb292f62f72386d4bMark Andrews the address and port used for such queries. For queries sent over
922e6a3c2ac4ef900dd9dc99f0cc137f18372583Andreas Gustafsson IPv6, there is a separate <span><strong class="command">query-source-v6</strong></span> option.
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User If <span><strong class="command">address</strong></span> is <span><strong class="command">*</strong></span> (asterisk) or is omitted,
613fa3ce9d39f0c4057e4a14094ff29b7897406bMark Andrews a wildcard IP address (<span><strong class="command">INADDR_ANY</strong></span>)
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User will be used.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If <span><strong class="command">port</strong></span> is <span><strong class="command">*</strong></span> or is omitted,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User a random port number from a pre-configured
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User range is picked up and will be used for each query.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The port range(s) is that specified in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the <span><strong class="command">use-v4-udp-ports</strong></span> (for IPv4)
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User and <span><strong class="command">use-v6-udp-ports</strong></span> (for IPv6)
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews options, excluding the ranges specified in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the <span><strong class="command">avoid-v4-udp-ports</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User and <span><strong class="command">avoid-v6-udp-ports</strong></span> options, respectively.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The defaults of the <span><strong class="command">query-source</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">query-source-v6</strong></span> options
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<pre class="programlisting">query-source address * port *;
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox Userquery-source-v6 address * port *;
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If <span><strong class="command">use-v4-udp-ports</strong></span> or
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">use-v6-udp-ports</strong></span> is unspecified,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">named</strong></span> will check if the operating
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User system provides a programming interface to retrieve the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User system's default range for ephemeral ports.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews If such an interface is available,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">named</strong></span> will use the corresponding system
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User default range; otherwise, it will use its own defaults:
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<pre class="programlisting">use-v4-udp-ports { range 1024 65535; };
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrewsuse-v6-udp-ports { range 1024 65535; };
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Note: make sure the ranges be sufficiently large for
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews security. A desirable size depends on various parameters,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User but we generally recommend it contain at least 16384 ports
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (14 bits of entropy).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Note also that the system's default range when used may be
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User too small for this purpose, and that the range may even be
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User changed while <span><strong class="command">named</strong></span> is running; the new
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User range will automatically be applied when <span><strong class="command">named</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User It is encouraged to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User configure <span><strong class="command">use-v4-udp-ports</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">use-v6-udp-ports</strong></span> explicitly so that the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User ranges are sufficiently large and are reasonably
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User independent from the ranges used by other applications.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Note: the operational configuration
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User where <span><strong class="command">named</strong></span> runs may prohibit the use
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of some ports. For example, UNIX systems will not allow
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">named</strong></span> running without a root privilege
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to use ports less than 1024.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If such ports are included in the specified (or detected)
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User set of query ports, the corresponding query attempts will
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User fail, resulting in resolution failures or delay.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User It is therefore important to configure the set of ports
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User that can be safely used in the expected operational environment.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The defaults of the <span><strong class="command">avoid-v4-udp-ports</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">avoid-v6-udp-ports</strong></span> options
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<pre class="programlisting">avoid-v4-udp-ports {};
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox Useravoid-v6-udp-ports {};
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Note: BIND 9.5.0 introduced
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the <span><strong class="command">use-queryport-pool</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User option to support a pool of such random ports, but this
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User option is now obsolete because reusing the same ports in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the pool may not be sufficiently secure.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews For the same reason, it is generally strongly discouraged to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User specify a particular port for the
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater <span><strong class="command">query-source</strong></span> or
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">query-source-v6</strong></span> options;
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User it implicitly disables the use of randomized port numbers.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">use-queryport-pool</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User This option is obsolete.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">queryport-pool-ports</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User This option is obsolete.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">queryport-pool-updateinterval</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User This option is obsolete.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The address specified in the <span><strong class="command">query-source</strong></span> option
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews is used for both UDP and TCP queries, but the port applies only
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews to UDP queries. TCP queries always use a random
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews unprivileged port.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Solaris 2.5.1 and earlier does not support setting the source
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User address for TCP sockets.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User See also <span><strong class="command">transfer-source</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">notify-source</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="zone_transfers"></a>Zone Transfers</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <acronym class="acronym">BIND</acronym> has mechanisms in place to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User facilitate zone transfers
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User and set limits on the amount of load that transfers place on the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User system. The following options apply to zone transfers.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">also-notify</strong></span></span></dt>
d3be47a4a841ca6fc07e8f18004cf72174e2d117Tinderbox User Defines a global list of IP addresses of name servers
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User that are also sent NOTIFY messages whenever a fresh copy of
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User zone is loaded, in addition to the servers listed in the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User zone's NS records.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User This helps to ensure that copies of the zones will
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User quickly converge on stealth servers.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Optionally, a port may be specified with each
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">also-notify</strong></span> address to send
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the notify messages to a port other than the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User default of 53.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User An optional TSIG key can also be specified with each
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User address to cause the notify messages to be signed; this
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews can be useful when sending notifies to multiple views.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User In place of explicit addresses, one or more named
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews <span><strong class="command">masters</strong></span> lists can be used.
3d2e052eb879189e6d853097f8b568d887323bebTinderbox User If an <span><strong class="command">also-notify</strong></span> list
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is given in a <span><strong class="command">zone</strong></span> statement,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User it will override
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the <span><strong class="command">options also-notify</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User statement. When a <span><strong class="command">zone notify</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is set to <span><strong class="command">no</strong></span>, the IP
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User addresses in the global <span><strong class="command">also-notify</strong></span> list will
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User not be sent NOTIFY messages for that zone. The default is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User list (no global notification list).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Inbound zone transfers running longer than
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User this many minutes will be terminated. The default is 120
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews (2 hours). The maximum value is 28 days (40320 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Inbound zone transfers making no progress
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in this many minutes will be terminated. The default is 60
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (1 hour). The maximum value is 28 days (40320 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Outbound zone transfers running longer than
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User this many minutes will be terminated. The default is 120
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (2 hours). The maximum value is 28 days (40320 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Outbound zone transfers making no progress
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in this many minutes will be terminated. The default is 60
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User hour). The maximum value is 28 days (40320 minutes).
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater<dt><span class="term"><span><strong class="command">notify-rate</strong></span></span></dt>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews The rate at which NOTIFY requests will be sent
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User during normal zone maintenance operations. (NOTIFY
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews requests due to initial zone loading are subject
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to a separate rate limit; see below.) The default is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User 20 per second.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The lowest possible rate is one per second; when set
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to zero, it will be silently raised to one.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">startup-notify-rate</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The rate at which NOTIFY requests will be sent
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User when the name server is first starting up, or when
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User zones have been newly added to the nameserver.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews The default is 20 per second.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The lowest possible rate is one per second; when set
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater to zero, it will be silently raised to one.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">serial-query-rate</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Slave servers will periodically query master
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User servers to find out if zone serial numbers have
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User changed. Each such query uses a minute amount of
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the slave server's network bandwidth. To limit
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews the amount of bandwidth used, BIND 9 limits the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User rate at which queries are sent. The value of the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">serial-query-rate</strong></span> option, an
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User integer, is the maximum number of queries sent
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews per second. The default is 20 per second.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The lowest possible rate is one per second; when set
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to zero, it will be silently raised to one.
3e1a17d65ec6227900f388ba2f7561365f7d4f5cTinderbox User<dt><span class="term"><span><strong class="command">serial-queries</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User In BIND 8, the <span><strong class="command">serial-queries</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User set the maximum number of concurrent serial number queries
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews allowed to be outstanding at any given time.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User BIND 9 does not limit the number of outstanding
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User serial queries and ignores the <span><strong class="command">serial-queries</strong></span> option.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Instead, it limits the rate at which the queries are sent
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User as defined using the <span><strong class="command">serial-query-rate</strong></span> option.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">transfer-format</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Zone transfers can be sent using two different formats,
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater <span><strong class="command">one-answer</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">many-answers</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The <span><strong class="command">transfer-format</strong></span> option is used
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on the master server to determine which format it sends.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">one-answer</strong></span> uses one DNS message per
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User resource record transferred.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">many-answers</strong></span> packs as many resource
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User records as possible into a message.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">many-answers</strong></span> is more efficient, but is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User only supported by relatively new slave servers,
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews such as <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User 8.x and <acronym class="acronym">BIND</acronym> 4.9.5 onwards.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The <span><strong class="command">many-answers</strong></span> format is also supported by
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User recent Microsoft Windows nameservers.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default is <span><strong class="command">many-answers</strong></span>.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews <span><strong class="command">transfer-format</strong></span> may be overridden on a
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User per-server basis by using the <span><strong class="command">server</strong></span>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<dt><span class="term"><span><strong class="command">transfers-in</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The maximum number of inbound zone transfers
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User that can be running concurrently. The default value is <code class="literal">10</code>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Increasing <span><strong class="command">transfers-in</strong></span> may
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User speed up the convergence
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of slave zones, but it also may increase the load on the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User local system.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">transfers-out</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The maximum number of outbound zone transfers
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User that can be running concurrently. Zone transfer requests in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of the limit will be refused. The default value is <code class="literal">10</code>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">transfers-per-ns</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The maximum number of inbound zone transfers
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User that can be concurrently transferring from a given remote
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default value is <code class="literal">2</code>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Increasing <span><strong class="command">transfers-per-ns</strong></span>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews speed up the convergence of slave zones, but it also may
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews the load on the remote name server. <span><strong class="command">transfers-per-ns</strong></span> may
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews be overridden on a per-server basis by using the <span><strong class="command">transfers</strong></span> phrase
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of the <span><strong class="command">server</strong></span> statement.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">transfer-source</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<p><span><strong class="command">transfer-source</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User determines which local address will be bound to IPv4
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews TCP connections used to fetch zones transferred
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User inbound by the server. It also determines the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User source IPv4 address, and optionally the UDP port,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User used for the refresh queries and forwarded dynamic
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User updates. If not set, it defaults to a system
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews controlled value which will usually be the address
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of the interface "closest to" the remote end. This
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User address must appear in the remote end's
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">allow-transfer</strong></span> option for the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User zone being transferred, if one is specified. This
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User statement sets the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">transfer-source</strong></span> for all zones,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User but can be overridden on a per-view or per-zone
5ca309a0fb9a75162852653f881d1e6290e28c2aTinderbox User basis by including a
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">transfer-source</strong></span> statement within
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews the <span><strong class="command">view</strong></span> or
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">zone</strong></span> block in the configuration
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Solaris 2.5.1 and earlier does not support setting the
12343c067e12be071a68bbb10d1d1c4870696769Tinderbox User source address for TCP sockets.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<dt><span class="term"><span><strong class="command">transfer-source-v6</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews The same as <span><strong class="command">transfer-source</strong></span>,
de2cc8b8729d88140cad62506769d0f9fedc7e48Tinderbox User except zone transfers are performed using IPv6.
9160e27507ba636887f6352bee5cb3729108fc76Tinderbox User<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews An alternate transfer source if the one listed in
baeaed18341c015e9ad54ffa21973184c1bc432bMark Andrews <span><strong class="command">transfer-source</strong></span> fails and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">use-alt-transfer-source</strong></span> is
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
1ca2cf024391992fe14b2df7d3ae0f575d074452Evan Hunt If you do not wish the alternate transfer source
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews to be used, you should set
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">use-alt-transfer-source</strong></span>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews appropriately and you should not depend upon
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews getting an answer back to the first refresh
e1ebc476b08b4a498fcf3477e42c986eb1991360Tinderbox User<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
12343c067e12be071a68bbb10d1d1c4870696769Tinderbox User An alternate transfer source if the one listed in
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User <span><strong class="command">transfer-source-v6</strong></span> fails and
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews <span><strong class="command">use-alt-transfer-source</strong></span> is
8927a982bde7e4b665966b55f0fa57c5cf21b9d8Mark Andrews<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews Use the alternate transfer sources or not. If views are
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews specified this defaults to <span><strong class="command">no</strong></span>
8927a982bde7e4b665966b55f0fa57c5cf21b9d8Mark Andrews otherwise it defaults to
See <a href="Bv9ARM.ch06.html#query_address" title="Query Address">the section called “Query Address”</a> about how the
to prevent <span><strong class="command">named</strong></span> from choosing as its random source port a
of <span><strong class="command">size_spec</strong></span> in <a href="Bv9ARM.ch06.html#configuration_file_elements" title="Configuration File Elements">the section called “Configuration File Elements”</a>.
(see <a href="Bv9ARM.ch04.html#journal" title="The journal file">the section called “The journal file”</a>). When the journal file
<dt><span class="term"><span><strong class="command">host-statistics-max</strong></span></span></dt>
interfaces <span><strong class="command">named</strong></span> listens on, <span><strong class="command">tcp-clients</strong></span> as well as
<dt><span class="term"><span><strong class="command">statistics-interval</strong></span></span></dt>
topologically closest to itself. The <span><strong class="command">topology</strong></span> statement
<a name="the_sortlist_statement"></a>The <span><strong class="command">sortlist</strong></span> Statement</h4></div></div></div>
statement in <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>).
does (<a href="Bv9ARM.ch06.html#topology" title="Topology">the section called “Topology”</a>).
an IP prefix, an ACL name or a nested <span><strong class="command">address_match_list</strong></span>)
to the behavior of the address sort in <acronym class="acronym">BIND</acronym> 4.9.x. Responses sent
<a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a>.
If no name is specified, the default is "<span><strong class="command">*</strong></span>" (asterisk).
class IN type A name "host.example.com" order random;
<span><strong class="command">max-ncache-ttl</strong></span> is <code class="literal">10800</code> seconds (3 hours).
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
result of dynamic updates (<a href="Bv9ARM.ch04.html#dynamic_update" title="Dynamic Update">the section called “Dynamic Update”</a>) will expire. There
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
a zone-signing process, i.e., whether it is still active
<span><strong class="command">rndc signing -list <em class="replaceable"><code>zone</code></em></strong></span>.
<span><strong class="command">rndc signing -clear <em class="replaceable"><code>keyid/algorithm</code></em> <em class="replaceable"><code>zone</code></em></strong></span>.
<span><strong class="command">rndc signing -clear all <em class="replaceable"><code>zone</code></em></strong></span>.
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
<a href="Bv9ARM.ch06.html#zonefile_format" title="Additional File Formats">the section called “Additional File Formats”</a>).
<a name="clients-per-query"></a><span class="term"><span><strong class="command">clients-per-query</strong></span>, </span><span class="term"><span><strong class="command">max-clients-per-query</strong></span></span>
If the number of queries exceed this value, <span><strong class="command">named</strong></span> will
<dt><span class="term"><span><strong class="command">max-rsa-exponent-size</strong></span></span></dt>
built-in view (see <a href="Bv9ARM.ch06.html#view_statement_grammar" title="view Statement Grammar">the section called “<span><strong class="command">view</strong></span> Statement Grammar”</a>) of
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
<span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
Specifying <span><strong class="command">server-id hostname;</strong></span> will cause <span><strong class="command">named</strong></span> to
The default <span><strong class="command">server-id</strong></span> is <span><strong class="command">none</strong></span>.
<dt><span class="term"><span><strong class="command">acache-cleaning-interval</strong></span></span></dt>
name (i.e., the CNAME alias or the substituted query name
for example, even if "example.com" is specified for
returned by an "example.com" server will be accepted.
For example, if you own a domain named "example.net" and
deny-answer-aliases { "example.net"; };
network look up an IPv4 address of "attacker.example.com",
internal web server "www.example.net" and the
it will be accepted since the owner name "www.example.net"
"example.net".
IPv4 address as in IN-ADDR.ARPA.
but reversed as in IN-ADDR.ARPA.
wildcard such as *.example.com.
<span class="term"><span><strong class="command">PASSTHRU</strong></span>, </span><span class="term"><span><strong class="command">DROP</strong></span>, </span><span class="term"><span><strong class="command">TCP-Only</strong></span>, </span><span class="term"><span><strong class="command">NXDOMAIN</strong></span>, </span><span class="term"><span><strong class="command">NODATA</strong></span></span>
<pre class="programlisting"> zone "badlist" {type master; file "master/badlist"; allow-query {none;}; };</pre>
@ SOA LOCALHOST. named-mgr.example.com (1 1h 15m 30d 2h)
nxdomain.domain.com CNAME . ; NXDOMAIN policy
*.nxdomain.domain.com CNAME . ; NXDOMAIN policy
nodata.domain.com CNAME *. ; NODATA policy
*.nodata.domain.com CNAME *. ; NODATA policy
bad.domain.com A 10.0.0.1 ; redirect to a walled garden
; do not rewrite (PASSTHRU) OK.DOMAIN.COM
ok.domain.com CNAME rpz-passthru.
8.0.0.0.127.rpz-ip CNAME .
32.1.0.0.127.rpz-ip CNAME rpz-passthru.
ns.domain.com.rpz-nsdname CNAME .
48.zz.2.2001.rpz-nsip CNAME .
112.zz.2001.rpz-client-ip CNAME rpz-drop.
8.0.0.0.127.rpz-client-ip CNAME rpz-drop.
; force some DNS clients and responses in the example.com zone to TCP
16.0.0.1.10.rpz-client-ip CNAME rpz-tcp-only.
example.com CNAME rpz-tcp-only.
*.example.com CNAME rpz-tcp-only.
<span><strong class="command">options</strong></span> or <span><strong class="command">view</strong></span> statement.
This controls flooding using random.wild.example.com.
<span><strong class="command">rate-limit</strong></span> statements in <span><strong class="command">view</strong></span>
<span><strong class="command">RateDropped</strong></span> and <span><strong class="command">QryDropped</strong></span>
<span><strong class="command">RateSlipped</strong></span> and <span><strong class="command">RespTruncated</strong></span>.
<a name="server_statement_grammar"></a><span><strong class="command">server</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">server</strong></span> <em class="replaceable"><code>ip_addr[/prefixlen]</code></em> {
[<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> request-expire <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> request-nsid <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em> ; ]</span>]
[<span class="optional"> keys <em class="replaceable"><code>{ string ; [<span class="optional"> string ; [<span class="optional">...</span>]</span>] }</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> query-source [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
[<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> query-source-v6 [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
[<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> queryport-pool-updateinterval <em class="replaceable"><code>number</code></em>; </span>]
<a name="server_statement_definition_and_usage"></a><span><strong class="command">server</strong></span> Statement Definition and
value of <span><strong class="command">bogus</strong></span> is <span><strong class="command">no</strong></span>.
The server supports two zone transfer methods. The first, <span><strong class="command">one-answer</strong></span>,
uses one DNS message per resource record transferred. <span><strong class="command">many-answers</strong></span> packs
as many resource records as possible into a message. <span><strong class="command">many-answers</strong></span> is
more efficient, but is only known to be understood by <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
<span><strong class="command">key_id</strong></span> defined by the <span><strong class="command">key</strong></span> statement,
to be used for transaction security (TSIG, <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
<a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<a name="statschannels"></a><span><strong class="command">statistics-channels</strong></span> Statement Grammar</h3></div></div></div>
<a name="id2592246"></a><span><strong class="command">statistics-channels</strong></span> Statement Definition and
<a href="http://127.0.0.1:8888/xml/v3" target="_top">http://127.0.0.1:8888/xml/v3</a> for version 3.
<a href="http://127.0.0.1:8888/json/v1/status" target="_top">http://127.0.0.1:8888/json/v1/status</a>
<a href="http://127.0.0.1:8888/json/v1/server" target="_top">http://127.0.0.1:8888/json/v1/server</a>
<a name="trusted-keys"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div>
<em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
[<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
<a name="id2592595"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition
DNSSEC security roots. DNSSEC is described in <a href="Bv9ARM.ch04.html#DNSSEC" title="DNSSEC">the section called “DNSSEC”</a>. A security root is defined when the
<a name="id2592648"></a><span><strong class="command">managed-keys</strong></span> Statement Grammar</h3></div></div></div>
<em class="replaceable"><code>name</code></em> initial-key <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key-data</code></em> ;
[<span class="optional"> <em class="replaceable"><code>name</code></em> initial-key <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key-data</code></em> ; [<span class="optional">...</span>]</span>]
<a name="managed-keys"></a><span><strong class="command">managed-keys</strong></span> Statement Definition
set to <strong class="userinput"><code>auto</code></strong>, <span><strong class="command">named</strong></span>
<a name="view_statement_grammar"></a><span><strong class="command">view</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">view</strong></span> <em class="replaceable"><code>view_name</code></em>
<a name="id2593152"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
// Provide a complete view of the example.com
zone "example.com" {
file "example-internal.db";
// Provide a restricted view of the example.com
zone "example.com" {
file "example-external.db";
<pre class="programlisting"><span><strong class="command">zone</strong></span> <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> dnssec-loadkeys-interval <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> update-policy <em class="replaceable"><code>local</code></em> | { <em class="replaceable"><code>update_policy_rule</code></em> [<span class="optional">...</span>] }; </span>]
[<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ;
[<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-mx (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> check-spf ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
[<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">map</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>full</code></em> | <em class="replaceable"><code>terse</code></em> | <em class="replaceable"><code>none</code></em>; </span>]
[<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
[<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> auto-dnssec <code class="constant">allow</code>|<code class="constant">maintain</code>|<code class="constant">off</code>; </span>]
[<span class="optional"> inline-signing <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> serial-update-method <code class="constant">increment</code>|<code class="constant">unixtime</code>|<code class="constant">date</code>; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> dnssec-update-mode ( <em class="replaceable"><code>maintain</code></em> | <em class="replaceable"><code>no-resign</code></em> ); </span>]
[<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> dnssec-loadkeys-interval <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> dnssec-secure-to-insecure <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> also-notify [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">map</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>full</code></em> | <em class="replaceable"><code>terse</code></em> | <em class="replaceable"><code>none</code></em>; </span>]
[<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
[<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> auto-dnssec <code class="constant">allow</code>|<code class="constant">maintain</code>|<code class="constant">off</code>; </span>]
[<span class="optional"> inline-signing <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>] // Not Implemented.
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">map</code>) ; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> server-addresses { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> ; ... </span>] }; </span>]
[<span class="optional"> server-names { [<span class="optional"> <em class="replaceable"><code>namelist</code></em> </span>] }; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>"."</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">map</code>) ; </span>]
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
<a name="id2595031"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div>
Non recursive queries (i.e., those with the RD
commercial Spanish names (under COM.ES) one
would use wildcard entries called "*.COM.ES.".
status of infrastructure zones (e.g. COM,
See caveats in <a href="Bv9ARM.ch06.html#root_delegation_only"><span><strong class="command">root-delegation-only</strong></span></a>.
a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>),
in the mid-1970s. Zone data for it can be specified with the <code class="literal">CHAOS</code> class.
<span><strong class="command">allow-notify</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query-on</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>.
<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
network. The default varies according to zone type. For <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>. For <span><strong class="command">slave</strong></span>
<span><strong class="command">check-mx</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-spf</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-wildcard</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-integrity</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-sibling</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">zero-no-soa-ttl</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">update-check-ksk</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">dnssec-update-mode</strong></span> in <a href="Bv9ARM.ch06.html#options" title="options Statement Definition and
Usage">the section called “<span><strong class="command">options</strong></span> Statement Definition and
<dt><span class="term"><span><strong class="command">dnssec-dnskey-kskonly</strong></span></span></dt>
<span><strong class="command">dnssec-dnskey-kskonly</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">try-tcp-refresh</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">dialup</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
See caveats in <a href="Bv9ARM.ch06.html#root_delegation_only"><span><strong class="command">root-delegation-only</strong></span></a>.
after trying the forwarders and getting no answer, while <span><strong class="command">first</strong></span> would
This is applicable to <span><strong class="command">master</strong></span> and <span><strong class="command">slave</strong></span> zones.
<span><strong class="command">max-journal-size</strong></span> in <a href="Bv9ARM.ch06.html#server_resource_limits" title="Server Resource Limits">the section called “Server Resource Limits”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
<span><strong class="command">max-transfer-time-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
<span><strong class="command">max-transfer-time-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">notify-delay</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
zones when they are loaded from disk. <acronym class="acronym">BIND</acronym> 9 does not verify signatures
For example, if "example.com" is configured as a
example.com. A 192.0.2.1
"www.example.com" with the RD bit on, the server
That is, when "example.net" is the origin of a
static-stub zone, "ns.example" and
"master.example.com" can be specified in the
"ns.example.net" cannot, and will be rejected by
For example, if "example.com" is configured as a
static-stub zone with "ns1.example.net" and
"www.example.com" with the RD bit on, the server
"ns2.example.net" to IP addresses, and then send
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
<span><strong class="command">sig-validity-interval</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-nodes</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span><strong class="command">sig-signing-signatures</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-type</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
<span><strong class="command">alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
<span><strong class="command">alt-transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
<span><strong class="command">use-alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
See the description in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
<span><strong class="command">ixfr-from-differences</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">key-directory</strong></span> in <a href="Bv9ARM.ch06.html#options" title="options Statement Definition and
Usage">the section called “<span><strong class="command">options</strong></span> Statement Definition and
(see <a href="man.dnssec-keygen.html" title="dnssec-keygen"><span class="refentrytitle"><span class="application">dnssec-keygen</span></span>(8)</a> and
<a href="man.dnssec-settime.html" title="dnssec-settime"><span class="refentrytitle"><span class="application">dnssec-settime</span></span>(8)</a>). The command
<dt><span class="term"><span><strong class="command">serial-update-method</strong></span></span></dt>
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
Usage">the section called “<span><strong class="command">options</strong></span> Statement Definition and
<dt><span class="term"><span><strong class="command">dnssec-secure-to-insecure</strong></span></span></dt>
<span><strong class="command">dnssec-secure-to-insecure</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
( <span><strong class="command">grant</strong></span> | <span><strong class="command">deny</strong></span> ) <em class="replaceable"><code>identity</code></em> <em class="replaceable"><code>nametype</code></em> [<span class="optional"> <em class="replaceable"><code>name</code></em> </span>] [<span class="optional"> <em class="replaceable"><code>types</code></em> </span>]
and converts it machine.realm allowing the machine
to update machine.realm. The REALM to be matched
converts it to machine.realm allowing the machine
to update subdomains of machine.realm. The REALM
and converts it machine.realm allowing the machine
to update machine.realm. The REALM to be matched
converts it to machine.realm allowing the machine
to update subdomains of machine.realm. The REALM
zone example.com {
file "example-external.db";
zone example.com {
<a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div>
that a particular nearby server be tried first. See <a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a> and <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>.
built-in server information zones, e.g.,
any order), and if neither of those succeed, delivery to <code class="literal">mail.backup.org</code> will
and PTR records. Entries in the in-addr.arpa domain are made in
in-addr.arpa name of
3.2.1.10.in-addr.arpa. This name should have a PTR resource record
Master File Directives include <span><strong class="command">$ORIGIN</strong></span>, <span><strong class="command">$INCLUDE</strong></span>,
<a name="id2601788"></a>The <span><strong class="command">@</strong></span> (at-sign)</h4></div></div></div>
<a name="id2601804"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div>
$ORIGIN example.com.
<a name="id2601933"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div>
if it were included into the file at this point. If <span><strong class="command">origin</strong></span> is
revert to the values they had prior to the <span><strong class="command">$INCLUDE</strong></span> once
<a name="id2602071"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div>
<a name="id2602107"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div>
Classless IN-ADDR.ARPA delegation.
HOST-1.EXAMPLE. MX 0 .
HOST-2.EXAMPLE. A 1.2.3.2
HOST-2.EXAMPLE. MX 0 .
HOST-3.EXAMPLE. A 1.2.3.3
HOST-3.EXAMPLE. MX 0 .
HOST-127.EXAMPLE. A 1.2.3.127
HOST-127.EXAMPLE. MX 0 .
(<span><strong class="command">n</strong></span> or <span><strong class="command">N</strong></span>\
The <span><strong class="command">$GENERATE</strong></span> directive is a <acronym class="acronym">BIND</acronym> extension
(see <a href="Bv9ARM.ch06.html#statschannels" title="statistics-channels Statement Grammar">the section called “<span><strong class="command">statistics-channels</strong></span> Statement Grammar”</a>.)
<a href="Bv9ARM.ch06.html#clients-per-query"><span><strong class="command">clients-per-query</strong></span></a>.)
<a name="id2606653"></a>Compatibility with <span class="emphasis"><em>BIND</em></span> 8 Counters</h4></div></div></div>
<td width="40%" align="left" valign="top">Chapter�5.�The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver�</td>