Bv9ARM.ch06.html revision 9011c72c568aedd03709f56f21d639fd55944a74
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User - Copyright (C) 2000-2003 Internet Software Consortium.
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews - Permission to use, copy, modify, and distribute this software for any
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User - purpose with or without fee is hereby granted, provided that the above
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User - copyright notice and this permission notice appear in all copies.
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
02b47c5d62e1e827743684c28a08e871da454a2dMark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User - PERFORMANCE OF THIS SOFTWARE.
e20309353e6246485c521278131d3fced73d7957Tinderbox User<!-- $Id: Bv9ARM.ch06.html,v 1.177 2008/04/03 03:41:16 tbox Exp $ -->
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<title>Chapter�6.�BIND 9 Configuration Reference</title>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
e20309353e6246485c521278131d3fced73d7957Tinderbox User<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
e20309353e6246485c521278131d3fced73d7957Tinderbox User<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="prev" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<link rel="next" href="Bv9ARM.ch07.html" title="Chapter�7.�BIND 9 Security Considerations">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<table width="100%" summary="Navigation header">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<tr><th colspan="3" align="center">Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</th></tr>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<a accesskey="p" href="Bv9ARM.ch05.html">Prev</a>�</td>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch07.html">Next</a>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<div class="titlepage"><div><div><h2 class="title">
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<a name="Bv9ARM.ch06"></a>Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</h2></div></div></div>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt>
24934f08b9ff81c2be711e566e8002d145573031Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573555">Comment Syntax</a></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574194"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574384"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and
cdfc81e048bd34c1d628380247bda6b80a89e20eAutomatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574881"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574898"><span><strong class="command">include</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574921"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574945"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575104"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575229"><span><strong class="command">logging</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576541"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576615"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576679"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576723"><span><strong class="command">masters</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576738"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585364"><span><strong class="command">statistics-channels</strong></span> Statement Grammar</a></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585382"><span><strong class="command">statistics-channels</strong></span> Statement Definition and
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt>
24934f08b9ff81c2be711e566e8002d145573031Tinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586066"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586117"><span><strong class="command">trusted-keys</strong></span> Statement Definition
ad411d8ccf8a27eb903b842ab507ba6729d0246bTinderbox User<dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt>
80faf1588895fd26490f82f95a7a1b771df1c324Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586199"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587785"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2590305">Zone File</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592189">Discussion of MX Records</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592877">Inverse Mapping in IPv4</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2593073">Other Zone File Directives</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2593330"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <acronym class="acronym">BIND</acronym> 9 configuration is broadly similar
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson to <acronym class="acronym">BIND</acronym> 8; however, there are a few new
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews of configuration, such as views. <acronym class="acronym">BIND</acronym>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews 8 configuration files should work with few alterations in <acronym class="acronym">BIND</acronym>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews 9, although more complex configurations should be reviewed to check
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews if they can be more efficiently implemented using the new features
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson found in <acronym class="acronym">BIND</acronym> 9.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <acronym class="acronym">BIND</acronym> 4 configuration files can be
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews converted to the new format
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews using the shell script
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews <code class="filename">contrib/named-bootconf/named-bootconf.sh</code>.
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews<a name="configuration_file_elements"></a>Configuration File Elements</h2></div></div></div>
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews Following is a list of elements used throughout the <acronym class="acronym">BIND</acronym> configuration
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews file documentation:
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater The name of an <code class="varname">address_match_list</code> as
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews defined by the <span><strong class="command">acl</strong></span> statement.
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews <code class="varname">address_match_list</code>
cdfc81e048bd34c1d628380247bda6b80a89e20eAutomatic Updater A list of one or more
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <code class="varname">ip_prefix</code>, <code class="varname">key_id</code>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews or <code class="varname">acl_name</code> elements, see
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews A named list of one or more <code class="varname">ip_addr</code>
fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater with optional <code class="varname">key_id</code> and/or
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews A <code class="varname">masters_list</code> may include other
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews A quoted string which will be used as
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews a DNS name, for example "<code class="literal">my.test.domain</code>".
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews One to four integers valued 0 through
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews 255 separated by dots (`.'), such as <span><strong class="command">123</strong></span>,
5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User <span><strong class="command">45.67</strong></span> or <span><strong class="command">89.123.45.67</strong></span>.
d642d3857129678797a01adee14fbd70335b05a9Mark Andrews An IPv4 address with exactly four elements
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User in <code class="varname">dotted_decimal</code> notation.
6a9d2121152c94cb9e35832126c3f2e4d18d81edTinderbox User An IPv6 address, such as <span><strong class="command">2001:db8::1234</strong></span>.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews IPv6 scoped addresses that have ambiguity on their
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews scope zones must be disambiguated by an appropriate
bc0a53583d92309bebcf93c408e2f3247ebd3d3cAutomatic Updater zone ID with the percent character (`%') as
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater delimiter. It is strongly recommended to use
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater string zone names rather than numeric identifiers,
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater in order to be robust against system configuration
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater changes. However, since there is no standard
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater mapping for such names and identifier values,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews currently only interface names as link identifiers
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater are supported, assuming one-to-one mapping between
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater interfaces and links. For example, a link-local
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews address <span><strong class="command">fe80::1</strong></span> on the link
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews attached to the interface <span><strong class="command">ne0</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater can be specified as <span><strong class="command">fe80::1%ne0</strong></span>.
19b3dc94bce93fa76bd7e066f9298630dbc9dcb4Automatic Updater Note that on most systems link-local addresses
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater always have the ambiguity, and need to be
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater disambiguated.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater An <code class="varname">ip4_addr</code> or <code class="varname">ip6_addr</code>.
bf5e2127e92e52cbf661e77dd6a76e5aef43542fTinderbox User An IP port <code class="varname">number</code>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews The <code class="varname">number</code> is limited to 0
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User through 65535, with values
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews below 1024 typically restricted to use by processes running
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User In some cases, an asterisk (`*') character can be used as a
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User placeholder to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater select a random high-numbered port.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews An IP network specified as an <code class="varname">ip_addr</code>,
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson followed by a slash (`/') and then the number of bits in the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Trailing zeros in a <code class="varname">ip_addr</code>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews may omitted.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews For example, <span><strong class="command">127/8</strong></span> is the
cd6e9010079a4e58f7e30063df3dec0ff154ad59Tinderbox User network <span><strong class="command">127.0.0.0</strong></span> with
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews netmask <span><strong class="command">255.0.0.0</strong></span> and <span><strong class="command">1.2.3.0/28</strong></span> is
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User network <span><strong class="command">1.2.3.0</strong></span> with netmask <span><strong class="command">255.255.255.240</strong></span>.
e20309353e6246485c521278131d3fced73d7957Tinderbox User When specifying a prefix involving a IPv6 scoped address
3857cb6fcabeb79d85de4b3e3e4ab99912b701f8Mark Andrews the scope may be omitted. In that case the prefix will
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User match packets from any scope.
0b57424d28c9a67018107133f9fbc0a7dcf057e2Mark Andrews A <code class="varname">domain_name</code> representing
0b57424d28c9a67018107133f9fbc0a7dcf057e2Mark Andrews the name of a shared key, to be used for transaction
3351ccbd5c1961404044f8273d54dad405f53960Mark Andrews A list of one or more
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews separated by semicolons and ending with a semicolon.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews A non-negative 32-bit integer
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews (i.e., a number between 0 and 4294967295, inclusive).
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Its acceptable value might further
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews be limited by the context in which it is used.
01a5c5503482fb3ba52088bf0178a7213273bf96Mark Andrews A quoted string which will be used as
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User a pathname, such as <code class="filename">zones/master/my.test.domain</code>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews A number, the word <strong class="userinput"><code>unlimited</code></strong>,
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User or the word <strong class="userinput"><code>default</code></strong>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews An <code class="varname">unlimited</code> <code class="varname">size_spec</code> requests unlimited
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater use, or the maximum available amount. A <code class="varname">default size_spec</code> uses
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater the limit that was in force when the server was started.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews A <code class="varname">number</code> can optionally be
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews followed by a scaling factor:
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <strong class="userinput"><code>K</code></strong> or <strong class="userinput"><code>k</code></strong>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews for kilobytes,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <strong class="userinput"><code>M</code></strong> or <strong class="userinput"><code>m</code></strong>
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews for megabytes, and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <strong class="userinput"><code>G</code></strong> or <strong class="userinput"><code>g</code></strong> for gigabytes,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews which scale by 1024, 1024*1024, and 1024*1024*1024
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews respectively.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The value must be representable as a 64-bit unsigned integer
e20309353e6246485c521278131d3fced73d7957Tinderbox User (0 to 18446744073709551615, inclusive).
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews Using <code class="varname">unlimited</code> is the best
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews to safely set a really large number.
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews Either <strong class="userinput"><code>yes</code></strong> or <strong class="userinput"><code>no</code></strong>.
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews The words <strong class="userinput"><code>true</code></strong> and <strong class="userinput"><code>false</code></strong> are
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews also accepted, as are the numbers <strong class="userinput"><code>1</code></strong>
f7369b2881b5e63d69600adcedc8ba938303d30cTinderbox User and <strong class="userinput"><code>0</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington One of <strong class="userinput"><code>yes</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>no</code></strong>, <strong class="userinput"><code>notify</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>notify-passive</code></strong>, <strong class="userinput"><code>refresh</code></strong> or
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>passive</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington When used in a zone, <strong class="userinput"><code>notify-passive</code></strong>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>refresh</code></strong>, and <strong class="userinput"><code>passive</code></strong>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington are restricted to slave and stub zones.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h3 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="address_match_lists"></a>Address Match Lists</h3></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573401"></a>Syntax</h4></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ;
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> address_match_list_element; ... </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] |
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington key key_id | acl_name | { address_match_list } )
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573429"></a>Definition and Usage</h4></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Address match lists are primarily used to determine access
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington control for various server operations. They are also used in
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the <span><strong class="command">listen-on</strong></span> and <span><strong class="command">sortlist</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington statements. The elements which constitute an address match
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington list can be any of the following:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington a key ID, as defined by the <span><strong class="command">key</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<li>the name of an address match list defined with
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the <span><strong class="command">acl</strong></span> statement
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<li>a nested address match list enclosed in braces</li>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Elements can be negated with a leading exclamation mark (`!'),
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews and the match list names "any", "none", "localhost", and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews "localnets" are predefined. More information on those names
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User can be found in the description of the acl statement.
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater The addition of the key clause made the name of this syntactic
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater element something of a misnomer, since security keys can be used
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater to validate access without regard to a host or network address.
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater Nonetheless, the term "address match list" is still used
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User throughout the documentation.
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater When a given IP address or prefix is compared to an address
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater match list, the comparison takes place in approximately O(1)
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater time. However, key comparisons require that the list of keys
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater be traversed until a matching key is found, and therefore may
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater be somewhat slower.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User The interpretation of a match depends on whether the list is being
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User used for access control, defining listen-on ports, or in a
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User sortlist, and whether the element was negated.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User When used as an access control list, a non-negated match
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User allows access and a negated match denies access. If
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User there is no match, access is denied. The clauses
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <span><strong class="command">allow-notify</strong></span>,
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <span><strong class="command">allow-recursion</strong></span>,
02b47c5d62e1e827743684c28a08e871da454a2dMark Andrews <span><strong class="command">allow-recursion-on</strong></span>,
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <span><strong class="command">allow-query</strong></span>,
da59e63e7af147a8bcef985b98b04443e04c3a0eTinderbox User <span><strong class="command">allow-query-on</strong></span>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">allow-query-cache</strong></span>,
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <span><strong class="command">allow-query-cache-on</strong></span>,
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <span><strong class="command">allow-transfer</strong></span>,
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <span><strong class="command">allow-update</strong></span>,
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <span><strong class="command">allow-update-forwarding</strong></span>, and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">blackhole</strong></span> all use address match
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews lists. Similarly, the listen-on option will cause the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews server to refuse queries on any of the machine's
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews addresses which do not match the list.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Order of insertion is signficant. If more than one element
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews in an ACL is found to match a given IP address or prefix,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater preference will be given to the one that came
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="emphasis"><em>first</em></span> in the ACL definition.
febbdb34a7f7759922e239655e7429d78d3a8d26Tinderbox User Because of this first-match behavior, an element that
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater defines a subset of another element in the list should
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater come before the broader element, regardless of whether
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User either is negated. For example, in
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">1.2.3/24; ! 1.2.3.13;</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the 1.2.3.13 element is completely useless because the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews algorithm will match any lookup for 1.2.3.13 to the 1.2.3/24
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews element. Using <span><strong class="command">! 1.2.3.13; 1.2.3/24</strong></span> fixes
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews that problem by having 1.2.3.13 blocked by the negation, but
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews all other 1.2.3.* hosts fall through.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2573555"></a>Comment Syntax</h3></div></div></div>
3de6db3208d51de1e138b63b9670430c03f99694Automatic Updater The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater comments to appear
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration
e20309353e6246485c521278131d3fced73d7957Tinderbox User file. To appeal to programmers of all kinds, they can be written
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id2573570"></a>Syntax</h4></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting">// This is a <acronym class="acronym">BIND</acronym> comment as in C++</pre>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting"># This is a <acronym class="acronym">BIND</acronym> comment as in common UNIX shells and perl</pre>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews<a name="id2573668"></a>Definition and Usage</h4></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Comments may appear anywhere that whitespace may appear in
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington a <acronym class="acronym">BIND</acronym> configuration file.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews C-style comments start with the two characters /* (slash,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews star) and end with */ (star, slash). Because they are completely
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews delimited with these characters, they can be used to comment only
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews a portion of a line or to span multiple lines.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User C-style comments cannot be nested. For example, the following
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews is not valid because the entire comment ends with the first */:
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<pre class="programlisting">/* This is the start of a comment.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews This is still part of the comment.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater/* This is an incorrect attempt at nesting a comment. */
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater This is no longer in any comment. */
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington C++-style comments start with the two characters // (slash,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington slash) and continue to the end of the physical line. They cannot
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington be continued across multiple physical lines; to have one logical
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington comment span multiple lines, each line must use the // pair.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting">// This is the start of a comment. The next line
409ba95e573b40cf36acf97dd62ee7e9c7775851Tinderbox User// is a new comment, even though it is logically
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews// part of the previous comment.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Shell-style (or perl-style, if you prefer) comments start
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User with the character <code class="literal">#</code> (number sign)
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews and continue to the end of the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews physical line, as in C++ comments.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews For example:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting"># This is the start of a comment. The next line
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington# is a new comment, even though it is logically
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington# part of the previous comment.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater You cannot use the semicolon (`;') character
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to start a comment such as you would in a zone file. The
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater semicolon indicates the end of a configuration
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews<div class="titlepage"><div><div><h2 class="title" style="clear: both">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="Configuration_File_Grammar"></a>Configuration File Grammar</h2></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington A <acronym class="acronym">BIND</acronym> 9 configuration consists of
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews statements and comments.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews Statements end with a semicolon. Statements and comments are the
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews only elements that can appear without enclosing braces. Many
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews statements contain a block of sub-statements, which are also
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews terminated with a semicolon.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The following statements are supported:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="informaltable"><table border="1">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <p><span><strong class="command">acl</strong></span></p>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews defines a named IP address
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews matching list, for access control and other uses.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">controls</strong></span></p>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews declares control channels to be used
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews by the <span><strong class="command">rndc</strong></span> utility.
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User <p><span><strong class="command">include</strong></span></p>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews includes a file.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <p><span><strong class="command">key</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User specifies key information for use in
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User authentication and authorization using TSIG.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">logging</strong></span></p>
532d27b39244fadfcf8d8b4593f4c65434c9c664Automatic Updater specifies what the server logs, and where
91faa748a27dee38f6caea461d3e87f15b93abeaTinderbox User the log messages are sent.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews <p><span><strong class="command">lwres</strong></span></p>
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews configures <span><strong class="command">named</strong></span> to
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews also act as a light-weight resolver daemon (<span><strong class="command">lwresd</strong></span>).
861836e5f5df62bfaea9ad8923a05278d5ab2f3dTinderbox User <p><span><strong class="command">masters</strong></span></p>
9c446b72069d0ab9f710502f4d7048e50875fccbAutomatic Updater defines a named masters list for
665ba746c0585088d0c314dcfc4671aa2c7b2dc1Automatic Updater inclusion in stub and slave zone masters clauses.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">options</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater controls global server configuration
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater options and sets defaults for other statements.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">statistics-channels</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater declares communication channels to get access to
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <span><strong class="command">named</strong></span> statistics.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">server</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater sets certain configuration options on
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater a per-server basis.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">trusted-keys</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater defines trusted DNSSEC keys.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span><strong class="command">view</strong></span></p>
3a988722ad9e209ba4064604d482dc4efe0e19ebTinderbox User defines a view.
bf8c3776f1bf1a1270e5e0443ae5a8df022632a8Mark Andrews <p><span><strong class="command">zone</strong></span></p>
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater defines a zone.
ec8755f605d7dcb2de1076040e77bc2d7ec33b4aTinderbox User The <span><strong class="command">logging</strong></span> and
4ea3649f028ea6a1e42377082a7ccf8f789fb950Automatic Updater <span><strong class="command">options</strong></span> statements may only occur once
60d5d17479b47c03b9c7c86f54269718103750b8Automatic Updater configuration.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User<div class="titlepage"><div><div><h3 class="title">
60d5d17479b47c03b9c7c86f54269718103750b8Automatic Updater<a name="id2574194"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div>
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater<pre class="programlisting"><span><strong class="command">acl</strong></span> acl-name {
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater address_match_list
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater<div class="titlepage"><div><div><h3 class="title">
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater<a name="acl"></a><span><strong class="command">acl</strong></span> Statement Definition and
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater The <span><strong class="command">acl</strong></span> statement assigns a symbolic
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater name to an address match list. It gets its name from a primary
19dbf2e20df03f2b81ed1f347e27718084374059Automatic Updater use of address match lists: Access Control Lists (ACLs).
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater Note that an address match list's name must be defined
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater with <span><strong class="command">acl</strong></span> before it can be used
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater elsewhere; no forward references are allowed.
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater The following ACLs are built-in:
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews <p><span><strong class="command">any</strong></span></p>
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews Matches all hosts.
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User <p><span><strong class="command">none</strong></span></p>
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews Matches no hosts.
789875a1bd6d50c00d3bd883cad17ead1d3c21cdMark Andrews <p><span><strong class="command">localhost</strong></span></p>
7e8129652903780873ba91f379f9ffca1f59773cMark Andrews Matches the IPv4 and IPv6 addresses of all network
7e8129652903780873ba91f379f9ffca1f59773cMark Andrews interfaces on the system.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt <p><span><strong class="command">localnets</strong></span></p>
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt Matches any host on an IPv4 or IPv6 network
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt for which the system has an interface.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt Some systems do not provide a way to determine the prefix
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt local IPv6 addresses.
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User In such a case, <span><strong class="command">localnets</strong></span>
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User only matches the local
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt IPv6 addresses, just like <span><strong class="command">localhost</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2574384"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<pre class="programlisting"><span><strong class="command">controls</strong></span> {
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [ inet ( ip_addr | * ) [ port ip_port ] allow { <em class="replaceable"><code> address_match_list </code></em> }
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater keys { <em class="replaceable"><code>key_list</code></em> }; ]
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater [ unix <em class="replaceable"><code>path</code></em> perm <em class="replaceable"><code>number</code></em> owner <em class="replaceable"><code>number</code></em> group <em class="replaceable"><code>number</code></em> keys { <em class="replaceable"><code>key_list</code></em> }; ]
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews<div class="titlepage"><div><div><h3 class="title">
ff62ab3c2e6274f19190ded15548c723d38bbbe3Automatic Updater<a name="controls_statement_definition_and_usage"></a><span><strong class="command">controls</strong></span> Statement Definition and
e20309353e6246485c521278131d3fced73d7957Tinderbox User The <span><strong class="command">controls</strong></span> statement declares control
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User channels to be used by system administrators to control the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User operation of the name server. These control channels are
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User used by the <span><strong class="command">rndc</strong></span> utility to send
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User commands to and retrieve non-DNS results from a name server.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews An <span><strong class="command">inet</strong></span> control channel is a TCP socket
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews listening at the specified <span><strong class="command">ip_port</strong></span> on the
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews specified <span><strong class="command">ip_addr</strong></span>, which can be an IPv4 or IPv6
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews interpreted as the IPv4 wildcard address; connections will be
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews accepted on any of the system's IPv4 addresses.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews To listen on the IPv6 wildcard address,
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews use an <span><strong class="command">ip_addr</strong></span> of <code class="literal">::</code>.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews If you will only use <span><strong class="command">rndc</strong></span> on the local host,
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews using the loopback address (<code class="literal">127.0.0.1</code>
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews or <code class="literal">::1</code>) is recommended for maximum security.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews If no port is specified, port 953 is used. The asterisk
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews "<code class="literal">*</code>" cannot be used for <span><strong class="command">ip_port</strong></span>.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews The ability to issue commands over the control channel is
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User restricted by the <span><strong class="command">allow</strong></span> and
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User <span><strong class="command">keys</strong></span> clauses.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Connections to the control channel are permitted based on the
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <span><strong class="command">address_match_list</strong></span>. This is for simple
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User IP address based filtering only; any <span><strong class="command">key_id</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User elements of the <span><strong class="command">address_match_list</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater A <span><strong class="command">unix</strong></span> control channel is a UNIX domain
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater socket listening at the specified path in the file system.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Access to the socket is specified by the <span><strong class="command">perm</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">owner</strong></span> and <span><strong class="command">group</strong></span> clauses.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Note on some platforms (SunOS and Solaris) the permissions
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User (<span><strong class="command">perm</strong></span>) are applied to the parent directory
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User as the permissions on the socket itself are ignored.
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater The primary authorization mechanism of the command
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater channel is the <span><strong class="command">key_list</strong></span>, which
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater contains a list of <span><strong class="command">key_id</strong></span>s.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Each <span><strong class="command">key_id</strong></span> in the <span><strong class="command">key_list</strong></span>
88d58d79c5bc7ce3c20a42461a5070116c736836Automatic Updater is authorized to execute commands over the control channel.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater See <a href="Bv9ARM.ch03.html#rndc">Remote Name Daemon Control application</a> in <a href="Bv9ARM.ch03.html#admin_tools" title="Administrative Tools">the section called “Administrative Tools”</a>)
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater for information about configuring keys in <span><strong class="command">rndc</strong></span>.
48b36fa08b2b5bc0d552dc2a4425b3f7007b3d59Automatic Updater If no <span><strong class="command">controls</strong></span> statement is present,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">named</strong></span> will set up a default
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater control channel listening on the loopback address 127.0.0.1
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater and its IPv6 counterpart ::1.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User In this case, and also when the <span><strong class="command">controls</strong></span> statement
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is present but does not have a <span><strong class="command">keys</strong></span> clause,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">named</strong></span> will attempt to load the command channel key
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater from the file <code class="filename">rndc.key</code> in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <code class="filename">/etc</code> (or whatever <code class="varname">sysconfdir</code>
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User was specified as when <acronym class="acronym">BIND</acronym> was built).
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User To create a <code class="filename">rndc.key</code> file, run
48b36fa08b2b5bc0d552dc2a4425b3f7007b3d59Automatic Updater <strong class="userinput"><code>rndc-confgen -a</code></strong>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The <code class="filename">rndc.key</code> feature was created to
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User ease the transition of systems from <acronym class="acronym">BIND</acronym> 8,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User which did not have digital signatures on its command channel
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User messages and thus did not have a <span><strong class="command">keys</strong></span> clause.
1959fd489a8832e4e3d311670f64ae18e5d08156Automatic Updater It makes it possible to use an existing <acronym class="acronym">BIND</acronym> 8
1959fd489a8832e4e3d311670f64ae18e5d08156Automatic Updater configuration file in <acronym class="acronym">BIND</acronym> 9 unchanged,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User and still have <span><strong class="command">rndc</strong></span> work the same way
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <span><strong class="command">ndc</strong></span> worked in BIND 8, simply by executing the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User command <strong class="userinput"><code>rndc-confgen -a</code></strong> after BIND 9 is
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews Since the <code class="filename">rndc.key</code> feature
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews is only intended to allow the backward-compatible usage of
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews <acronym class="acronym">BIND</acronym> 8 configuration files, this
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews feature does not
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews have a high degree of configurability. You cannot easily change
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the key name or the size of the secret, so you should make a
560d6da48f066000541dd43f5d407644dee12bebTinderbox User <code class="filename">rndc.conf</code> with your own key if you
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User wish to change
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User those things. The <code class="filename">rndc.key</code> file
f751b1576ee6fef4023bf7101d10167e4fe520f3Tinderbox User permissions set such that only the owner of the file (the user that
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater <span><strong class="command">named</strong></span> is running as) can access it.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User desire greater flexibility in allowing other users to access
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">rndc</strong></span> commands, then you need to create
dc5552b4df5e3821783821c8d4e734c1608c446eTinderbox User <code class="filename">rndc.conf</code> file and make it group
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews readable by a group
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews that contains the users who should have access.
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews To disable the command channel, use an empty
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews <span><strong class="command">controls</strong></span> statement:
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews <span><strong class="command">controls { };</strong></span>.
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont<div class="titlepage"><div><div><h3 class="title">
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont<a name="id2574881"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div>
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont<pre class="programlisting"><span><strong class="command">include</strong></span> <em class="replaceable"><code>filename</code></em>;</pre>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<div class="titlepage"><div><div><h3 class="title">
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<a name="id2574898"></a><span><strong class="command">include</strong></span> Statement Definition and
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater The <span><strong class="command">include</strong></span> statement inserts the
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater specified file at the point where the <span><strong class="command">include</strong></span>
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater statement is encountered. The <span><strong class="command">include</strong></span>
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater statement facilitates the administration of configuration
7169f76a893666eb20fc7750782e7f411db742d6Tinderbox User by permitting the reading or writing of some things but not
7169f76a893666eb20fc7750782e7f411db742d6Tinderbox User others. For example, the statement could include private keys
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater that are readable only by the name server.
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater<div class="titlepage"><div><div><h3 class="title">
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User<a name="id2574921"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div>
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater<pre class="programlisting"><span><strong class="command">key</strong></span> <em class="replaceable"><code>key_id</code></em> {
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater algorithm <em class="replaceable"><code>string</code></em>;
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User secret <em class="replaceable"><code>string</code></em>;
229ea4644b3a7d9c7fdaa43888e7f55ba01e2ee3Automatic Updater<div class="titlepage"><div><div><h3 class="title">
e20309353e6246485c521278131d3fced73d7957Tinderbox User<a name="id2574945"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">key</strong></span> statement defines a shared
e20309353e6246485c521278131d3fced73d7957Tinderbox User secret key for use with TSIG (see <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
e20309353e6246485c521278131d3fced73d7957Tinderbox User or the command channel
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
665ba746c0585088d0c314dcfc4671aa2c7b2dc1Automatic Updater Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater Usage”</a>).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">key</strong></span> statement can occur at the
50fa300826799727204b93cbe63bebc341c5eadeTinderbox User of the configuration file or inside a <span><strong class="command">view</strong></span>
da82e232161d67b77df2d67898bdac693f647be1Automatic Updater statement. Keys defined in top-level <span><strong class="command">key</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater statements can be used in all views. Keys intended for use in
2da2220fe7af2c45724b50b0187523b1fab0cf08Rob Austein a <span><strong class="command">controls</strong></span> statement
af9cf290cea6ada6ce27b51c724ab77ad5d73fa0Tinderbox User (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
e171a4137c6ba348957e61b7c4c3541493c0da02Automatic Updater Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
c53a6f37deaa396660adb6a4ca600c4a58adfd3fAutomatic Updater Usage”</a>)
c53a6f37deaa396660adb6a4ca600c4a58adfd3fAutomatic Updater must be defined at the top level.
19ad308d84cbf446a144e5a91f2032389a9d65c1Tinderbox User The <em class="replaceable"><code>key_id</code></em>, also known as the
19ad308d84cbf446a144e5a91f2032389a9d65c1Tinderbox User key name, is a domain name uniquely identifying the key. It can
b3386fba31414344f38f0c30849c056dceb22dceTinderbox User be used in a <span><strong class="command">server</strong></span>
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater statement to cause requests sent to that
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater server to be signed with this key, or in address match lists to
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater verify that incoming requests have been signed with a key
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater matching this name, algorithm, and secret.
af9cf290cea6ada6ce27b51c724ab77ad5d73fa0Tinderbox User The <em class="replaceable"><code>algorithm_id</code></em> is a string
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater that specifies a security/authentication algorithm. Named
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User supports <code class="literal">hmac-md5</code>,
6671e343b8c7e44ac10a7900fde59555fbc71571Automatic Updater <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater and <code class="literal">hmac-sha512</code> TSIG authentication.
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater Truncated hashes are supported by appending the minimum
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater number of required bits preceded by a dash, e.g.
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater <code class="literal">hmac-sha1-80</code>. The
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater <em class="replaceable"><code>secret_string</code></em> is the secret
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater to be used by the algorithm, and is treated as a base-64
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater encoded string.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater<div class="titlepage"><div><div><h3 class="title">
50fa300826799727204b93cbe63bebc341c5eadeTinderbox User<a name="id2575104"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div>
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater<pre class="programlisting"><span><strong class="command">logging</strong></span> {
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater [ <span><strong class="command">channel</strong></span> <em class="replaceable"><code>channel_name</code></em> {
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews ( <span><strong class="command">file</strong></span> <em class="replaceable"><code>path name</code></em>
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews [ <span><strong class="command">versions</strong></span> ( <em class="replaceable"><code>number</code></em> | <span><strong class="command">unlimited</strong></span> ) ]
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews [ <span><strong class="command">size</strong></span> <em class="replaceable"><code>size spec</code></em> ]
99c231a3bd27893583204cd0a3e3103dc78dbc28Tinderbox User | <span><strong class="command">syslog</strong></span> <em class="replaceable"><code>syslog_facility</code></em>
8e9f3b69914ee02a80b87c97b1f8093edb3e9ae0Automatic Updater | <span><strong class="command">stderr</strong></span>
8e9f3b69914ee02a80b87c97b1f8093edb3e9ae0Automatic Updater | <span><strong class="command">null</strong></span> );
664917bedafa65dee4349c84324a31731aa1e228Francis Dupont [ <span><strong class="command">severity</strong></span> (<code class="option">critical</code> | <code class="option">error</code> | <code class="option">warning</code> | <code class="option">notice</code> |
c53a6f37deaa396660adb6a4ca600c4a58adfd3fAutomatic Updater <code class="option">info</code> | <code class="option">debug</code> [ <em class="replaceable"><code>level</code></em> ] | <code class="option">dynamic</code> ); ]
af9cf290cea6ada6ce27b51c724ab77ad5d73fa0Tinderbox User [ <span><strong class="command">print-category</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [ <span><strong class="command">print-severity</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [ <span><strong class="command">print-time</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
50fa300826799727204b93cbe63bebc341c5eadeTinderbox User [ <span><strong class="command">category</strong></span> <em class="replaceable"><code>category_name</code></em> {
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater <em class="replaceable"><code>channel_name</code></em> ; [ <em class="replaceable"><code>channel_name</code></em> ; ... ]
f8a9a38ee40c139a8d145ac76ecbff3a0f986453Mark Andrews<div class="titlepage"><div><div><h3 class="title">
e628576d3b3d91c8954679077f4c208f1e43b433Automatic Updater<a name="id2575229"></a><span><strong class="command">logging</strong></span> Statement Definition and
9d80d23172c30fd63e5046a7e69b8445e564ff31Automatic Updater The <span><strong class="command">logging</strong></span> statement configures a
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews variety of logging options for the name server. Its <span><strong class="command">channel</strong></span> phrase
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews associates output methods, format options and severity levels with
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews a name that can then be used with the <span><strong class="command">category</strong></span> phrase
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews to select how various classes of messages are logged.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews Only one <span><strong class="command">logging</strong></span> statement is used to
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews as many channels and categories as are wanted. If there is no <span><strong class="command">logging</strong></span> statement,
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews the logging configuration will be:
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews category default { default_syslog; default_debug; };
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews category unmatched { null; };
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews In <acronym class="acronym">BIND</acronym> 9, the logging configuration
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews is only established when
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews the entire configuration file has been parsed. In <acronym class="acronym">BIND</acronym> 8, it was
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User established as soon as the <span><strong class="command">logging</strong></span>
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User was parsed. When the server is starting up, all logging messages
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User regarding syntax errors in the configuration file go to the default
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User channels, or to standard error if the "<code class="option">-g</code>" option
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User was specified.
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User<div class="titlepage"><div><div><h4 class="title">
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User<a name="id2575282"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div>
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User All log output goes to one or more <span class="emphasis"><em>channels</em></span>;
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User you can make as many of them as you want.
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User Every channel definition must include a destination clause that
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User says whether messages selected for the channel go to a file, to a
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User particular syslog facility, to the standard error stream, or are
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User discarded. It can optionally also limit the message severity level
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User that will be accepted by the channel (the default is
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User <span><strong class="command">info</strong></span>), and whether to include a
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User <span><strong class="command">named</strong></span>-generated time stamp, the
e80c7005e3d59dfeb04dad186d36f3c15622954cTinderbox User category name
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User and/or severity level (the default is not to include any).
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews The <span><strong class="command">null</strong></span> destination clause
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews causes all messages sent to the channel to be discarded;
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews in that case, other options for the channel are meaningless.
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews The <span><strong class="command">file</strong></span> destination clause directs
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews to a disk file. It can include limitations
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews both on how large the file is allowed to become, and how many
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews of the file will be saved each time the file is opened.
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews If you use the <span><strong class="command">versions</strong></span> log file
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <span><strong class="command">named</strong></span> will retain that many backup
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User versions of the file by
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater renaming them when opening. For example, if you choose to keep
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User three old versions
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater of the file <code class="filename">lamers.log</code>, then just
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater before it is opened
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews <code class="filename">lamers.log.1</code> is renamed to
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <code class="filename">lamers.log.2</code>, <code class="filename">lamers.log.0</code> is renamed
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User to <code class="filename">lamers.log.1</code>, and <code class="filename">lamers.log</code> is
8c9c79e5fea0cb698026a74821695907c8312a46Mark Andrews renamed to <code class="filename">lamers.log.0</code>.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User You can say <span><strong class="command">versions unlimited</strong></span> to
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User the number of versions.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User If a <span><strong class="command">size</strong></span> option is associated with
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User then renaming is only done when the file being opened exceeds the
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater indicated size. No backup versions are kept by default; any
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User log file is simply appended.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews The <span><strong class="command">size</strong></span> option for files is used
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews to limit log
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews growth. If the file ever exceeds the size, then <span><strong class="command">named</strong></span> will
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews stop writing to the file unless it has a <span><strong class="command">versions</strong></span> option
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews associated with it. If backup versions are kept, the files are
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews described above and a new one begun. If there is no
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews <span><strong class="command">versions</strong></span> option, no more data will
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User be written to the log
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington until some out-of-band mechanism removes or truncates the log to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater maximum size. The default behavior is not to limit the size of
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Example usage of the <span><strong class="command">size</strong></span> and
166c467a9414778bdd0f2a1e4a32220843c0fde3Tinderbox User <span><strong class="command">versions</strong></span> options:
e007e3e5b0316c6c05698a71101885743aca22bdAutomatic Updater<pre class="programlisting">channel an_example_channel {
e007e3e5b0316c6c05698a71101885743aca22bdAutomatic Updater file "example.log" versions 3 size 20m;
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews print-time yes;
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews print-category yes;
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews The <span><strong class="command">syslog</strong></span> destination clause
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews channel to the system log. Its argument is a
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews syslog facility as described in the <span><strong class="command">syslog</strong></span> man
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews page. Known facilities are <span><strong class="command">kern</strong></span>, <span><strong class="command">user</strong></span>,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <span><strong class="command">mail</strong></span>, <span><strong class="command">daemon</strong></span>, <span><strong class="command">auth</strong></span>,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <span><strong class="command">syslog</strong></span>, <span><strong class="command">lpr</strong></span>, <span><strong class="command">news</strong></span>,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <span><strong class="command">uucp</strong></span>, <span><strong class="command">cron</strong></span>, <span><strong class="command">authpriv</strong></span>,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <span><strong class="command">ftp</strong></span>, <span><strong class="command">local0</strong></span>, <span><strong class="command">local1</strong></span>,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <span><strong class="command">local2</strong></span>, <span><strong class="command">local3</strong></span>, <span><strong class="command">local4</strong></span>,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <span><strong class="command">local5</strong></span>, <span><strong class="command">local6</strong></span> and
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <span><strong class="command">local7</strong></span>, however not all facilities
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews are supported on
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews all operating systems.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews How <span><strong class="command">syslog</strong></span> will handle messages
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews this facility is described in the <span><strong class="command">syslog.conf</strong></span> man
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews page. If you have a system which uses a very old version of <span><strong class="command">syslog</strong></span> that
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews only uses two arguments to the <span><strong class="command">openlog()</strong></span> function,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews then this clause is silently ignored.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews The <span><strong class="command">severity</strong></span> clause works like <span><strong class="command">syslog</strong></span>'s
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews "priorities", except that they can also be used if you are writing
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews straight to a file rather than using <span><strong class="command">syslog</strong></span>.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews Messages which are not at least of the severity level given will
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews not be selected for the channel; messages of higher severity
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews will be accepted.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews If you are using <span><strong class="command">syslog</strong></span>, then the <span><strong class="command">syslog.conf</strong></span> priorities
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews will also determine what eventually passes through. For example,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews defining a channel facility and severity as <span><strong class="command">daemon</strong></span> and <span><strong class="command">debug</strong></span> but
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews only logging <span><strong class="command">daemon.warning</strong></span> via <span><strong class="command">syslog.conf</strong></span> will
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews cause messages of severity <span><strong class="command">info</strong></span> and
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews <span><strong class="command">notice</strong></span> to
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews be dropped. If the situation were reversed, with <span><strong class="command">named</strong></span> writing
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews messages of only <span><strong class="command">warning</strong></span> or higher,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User then <span><strong class="command">syslogd</strong></span> would
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington print all messages it received from the channel.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">stderr</strong></span> destination clause
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater channel to the server's standard error stream. This is intended
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater use when the server is running as a foreground process, for
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User when debugging a configuration.
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User The server can supply extensive debugging information when
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User it is in debugging mode. If the server's global debug level is
95cfad51a3f71246d263af79a7861a6821f7a0beAutomatic Updater than zero, then debugging mode will be active. The global debug
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User level is set either by starting the <span><strong class="command">named</strong></span> server
95cfad51a3f71246d263af79a7861a6821f7a0beAutomatic Updater with the <code class="option">-d</code> flag followed by a positive integer,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User or by running <span><strong class="command">rndc trace</strong></span>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The global debug level
e80c7005e3d59dfeb04dad186d36f3c15622954cTinderbox User can be set to zero, and debugging mode turned off, by running <span><strong class="command">rndc
e135e3c4b1f4f986f00997f5ad5866effb203139Tinderbox Usernotrace</strong></span>. All debugging messages in the server have a debug
6d20a14c6c5f0c89fb01f88b8d91b654b07c7247Tinderbox User level, and higher debug levels give more detailed output. Channels
6fd5f289d8455283fad33d1051e6fbaa3bec43d5Tinderbox User that specify a specific debug severity, for example:
99c231a3bd27893583204cd0a3e3103dc78dbc28Tinderbox User<pre class="programlisting">channel specific_debug_level {
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater severity debug 3;
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater will get debugging output of level 3 or less any time the
ec7751119a08c6a7250f3187beed69a8b836d349Tinderbox User server is in debugging mode, regardless of the global debugging
6fd5f289d8455283fad33d1051e6fbaa3bec43d5Tinderbox User level. Channels with <span><strong class="command">dynamic</strong></span>
6fd5f289d8455283fad33d1051e6fbaa3bec43d5Tinderbox User severity use the
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater server's global debug level to determine what messages to print.
07d9d0dbcc0c79deb3c34f4a8af05ac68a6800e4Mark Andrews If <span><strong class="command">print-time</strong></span> has been turned on,
99c231a3bd27893583204cd0a3e3103dc78dbc28Tinderbox User the date and time will be logged. <span><strong class="command">print-time</strong></span> may
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User be specified for a <span><strong class="command">syslog</strong></span> channel,
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater but is usually
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User pointless since <span><strong class="command">syslog</strong></span> also prints
e135e3c4b1f4f986f00997f5ad5866effb203139Tinderbox User time. If <span><strong class="command">print-category</strong></span> is
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User requested, then the
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater category of the message will be logged as well. Finally, if <span><strong class="command">print-severity</strong></span> is
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater on, then the severity level of the message will be logged. The <span><strong class="command">print-</strong></span> options may
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater be used in any combination, and will always be printed in the
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater order: time, category, severity. Here is an example where all
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater three <span><strong class="command">print-</strong></span> options
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User <code class="computeroutput">28-Feb-2000 15:05:32.863 general: notice: running</code>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington There are four predefined channels that are used for
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span><strong class="command">named</strong></span>'s default logging as follows.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington used is described in <a href="Bv9ARM.ch06.html#the_category_phrase" title="The category Phrase">the section called “The <span><strong class="command">category</strong></span> Phrase”</a>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<pre class="programlisting">channel default_syslog {
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater syslog daemon; // send to syslog's daemon
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User severity info; // only send priority info
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User // and higher
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox Userchannel default_debug {
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User // the working directory
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater // Note: stderr is used instead
6a9d2121152c94cb9e35832126c3f2e4d18d81edTinderbox User // if the server is started
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User // with the '-f' option.
85b52a5959291f5014442814488ccb267cdea369Tinderbox User severity dynamic; // log at the server's
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater // current debug level
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updaterchannel default_stderr {
e062b72f783cdb436a1a57a630bdff471dbb3038Mark Andrews stderr; // writes to stderr
d145b64cacc8d9cda51f9924ec70cd4661c3e2cfAutomatic Updater severity info; // only send priority info
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater null; // toss anything sent to
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User // this channel
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews The <span><strong class="command">default_debug</strong></span> channel has the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater property that it only produces output when the server's debug
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater nonzero. It normally writes to a file called <code class="filename">named.run</code>
2cdbfcdad94eba75f3f8e77343a0eefabf553b8eAutomatic Updater in the server's working directory.
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews For security reasons, when the "<code class="option">-u</code>"
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews command line option is used, the <code class="filename">named.run</code> file
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is created only after <span><strong class="command">named</strong></span> has
52cfbde0bd391cfb37e3c1a1b460c16ba6bf1a73Automatic Updater changed to the
5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User new UID, and any debug output generated while <span><strong class="command">named</strong></span> is
5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User starting up and still running as root is discarded. If you need
24e0e8d17df315d5d494ca933874e545eadce773Automatic Updater to capture this output, you must run the server with the "<code class="option">-g</code>"
52cfbde0bd391cfb37e3c1a1b460c16ba6bf1a73Automatic Updater option and redirect standard error to a file.
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews Once a channel is defined, it cannot be redefined. Thus you
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater cannot alter the built-in channels directly, but you can modify
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the default logging by pointing categories at channels you have
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<div class="titlepage"><div><div><h4 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="the_category_phrase"></a>The <span><strong class="command">category</strong></span> Phrase</h4></div></div></div>
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater There are many categories, so you can send the logs you want
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater to see wherever you want, without seeing logs you don't want. If
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater you don't specify a list of channels for a category, then log
0c7657e9302e7f9a8fe4f32fe561dc7e7e7ee6b5Automatic Updater in that category will be sent to the <span><strong class="command">default</strong></span> category
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater instead. If you don't specify a default category, the following
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User "default default" is used:
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<pre class="programlisting">category default { default_syslog; default_debug; };
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews As an example, let's say you want to log security events to
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater a file, but you also want keep the default logging behavior. You'd
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater specify the following:
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews<pre class="programlisting">channel my_security_channel {
8ccd7da886e93cd490fcb6f4c4e98a6514f35820Automatic Updater file "my_security_file";
cd839f5cf5f84cf163f55ff05cb88ce37efd24d1Automatic Updater severity info;
cd839f5cf5f84cf163f55ff05cb88ce37efd24d1Automatic Updatercategory security {
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User my_security_channel;
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User default_syslog;
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User default_debug;
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews To discard all messages in a category, specify the <span><strong class="command">null</strong></span> channel:
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<pre class="programlisting">category xfer-out { null; };
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox Usercategory notify { null; };
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Following are the available categories and brief descriptions
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater of the types of log information they contain. More
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater categories may be added in future <acronym class="acronym">BIND</acronym> releases.
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater<div class="informaltable"><table border="1">
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">default</strong></span></p>
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User The default category defines the logging
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User options for those categories where no specific
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User configuration has been
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater <p><span><strong class="command">general</strong></span></p>
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater The catch-all. Many things still aren't
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater classified into categories, and they all end up here.
9bc394fffdd50f6e47614b2d317da7274122366fTinderbox User <p><span><strong class="command">database</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Messages relating to the databases used
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater internally by the name server to store zone and cache
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater <p><span><strong class="command">security</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Approval and denial of requests.
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater <p><span><strong class="command">config</strong></span></p>
2cdbfcdad94eba75f3f8e77343a0eefabf553b8eAutomatic Updater Configuration file parsing and processing.
2cdbfcdad94eba75f3f8e77343a0eefabf553b8eAutomatic Updater <p><span><strong class="command">resolver</strong></span></p>
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater DNS resolution, such as the recursive
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews lookups performed on behalf of clients by a caching name
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater <p><span><strong class="command">xfer-in</strong></span></p>
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User Zone transfers the server is receiving.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <p><span><strong class="command">xfer-out</strong></span></p>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews Zone transfers the server is sending.
e8e87ede5c36b95806c77bcd34894ad9c4b39a78Tinderbox User <p><span><strong class="command">notify</strong></span></p>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews The NOTIFY protocol.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <p><span><strong class="command">client</strong></span></p>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews Processing of client requests.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <p><span><strong class="command">unmatched</strong></span></p>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews Messages that named was unable to determine the
d98b4b724343547314bde32a54966c8f124a5f03Mark Andrews class of or for which there was no matching <span><strong class="command">view</strong></span>.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews A one line summary is also logged to the <span><strong class="command">client</strong></span> category.
015f044f7f916eb18d053f2e5dcbee481425bc66Mark Andrews This category is best sent to a file or stderr, by
e7d35dad55e8deae14f29aabfb20d540b4b6ab3dMark Andrews default it is sent to
015f044f7f916eb18d053f2e5dcbee481425bc66Mark Andrews the <span><strong class="command">null</strong></span> channel.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <p><span><strong class="command">network</strong></span></p>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews Network operations.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews <p><span><strong class="command">update</strong></span></p>
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews Dynamic updates.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews <p><span><strong class="command">update-security</strong></span></p>
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews Approval and denial of update requests.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews <p><span><strong class="command">queries</strong></span></p>
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews Specify where queries should be logged to.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater At startup, specifying the category <span><strong class="command">queries</strong></span> will also
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater enable query logging unless <span><strong class="command">querylog</strong></span> option has been
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews The query log entry reports the client's IP
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews address and port number, and the query name,
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews class and type. It also reports whether the
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews Recursion Desired flag was set (+ if set, -
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews if not set), if the query was signed (S),
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews EDNS was in use (E), if DO (DNSSEC Ok) was
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews set (D), or if CD (Checking Disabled) was set
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews <code class="computeroutput">client 127.0.0.1#62536: query: www.example.com IN AAAA +SE</code>
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews <code class="computeroutput">client ::1#62537: query: www.example.net IN AAAA -SE</code>
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews <p><span><strong class="command">dispatch</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Dispatching of incoming packets to the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User server modules where they are to be processed.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">dnssec</strong></span></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater DNSSEC and TSIG protocol processing.
9a5217f827ac0e006016745e5305b31dc0c7767fTinderbox User <p><span><strong class="command">lame-servers</strong></span></p>
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater Lame servers. These are misconfigurations
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater in remote servers, discovered by BIND 9 when trying to
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater those servers during resolution.
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater <p><span><strong class="command">delegation-only</strong></span></p>
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater Delegation only. Logs queries that have have
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater been forced to NXDOMAIN as the result of a
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater delegation-only zone or
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews a <span><strong class="command">delegation-only</strong></span> in a
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater hint or stub zone declaration.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">edns-disabled</strong></span></p>
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater Log queries that have been forced to use plain
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User DNS due to timeouts. This is often due to
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater the remote servers not being RFC 1034 compliant
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User (not always returning FORMERR or similar to
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews EDNS queries and other extensions to the DNS
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User when they are not understood). In other words, this is
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User targeted at servers that fail to respond to
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User DNS queries that they don't understand.
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User Note: the log message can also be due to
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User packet loss. Before reporting servers for
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User non-RFC 1034 compliance they should be re-tested
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User to determine the nature of the non-compliance.
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User This testing should prevent or reduce the
059cd1994d4ac5c1b967ce777d2c7409dc829a42Tinderbox User number of false-positive reports.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Note: eventually named will have to stop
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User treating such timeouts as due to RFC 1034 non
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater compliance and start treating it as plain
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater packet loss. Falsely classifying packet
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User loss as due to RFC 1034 non compliance impacts
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater on DNSSEC validation which requires EDNS for
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the DNSSEC records to be returned.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2576541"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div>
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater This is the grammar of the <span><strong class="command">lwres</strong></span>
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews statement in the <code class="filename">named.conf</code> file:
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<pre class="programlisting"><span><strong class="command">lwres</strong></span> {
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> listen-on { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews [<span class="optional"> view <em class="replaceable"><code>view_name</code></em>; </span>]
da59e63e7af147a8bcef985b98b04443e04c3a0eTinderbox User [<span class="optional"> search { <em class="replaceable"><code>domain_name</code></em> ; [<span class="optional"> <em class="replaceable"><code>domain_name</code></em> ; ... </span>] }; </span>]
3e5340279d8875d136a4dd815cccad0044aa2644Automatic Updater [<span class="optional"> ndots <em class="replaceable"><code>number</code></em>; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews<div class="titlepage"><div><div><h3 class="title">
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews<a name="id2576615"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div>
ec7751119a08c6a7250f3187beed69a8b836d349Tinderbox User The <span><strong class="command">lwres</strong></span> statement configures the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User server to also act as a lightweight resolver server. (See
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be multiple
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">lwres</strong></span> statements configuring
ace530234c82bbfcd03bbfd4ba6c6a04293d497fMark Andrews lightweight resolver servers with different properties.
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater The <span><strong class="command">listen-on</strong></span> statement specifies a
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User addresses (and ports) that this instance of a lightweight resolver
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User should accept requests on. If no port is specified, port 921 is
ace530234c82bbfcd03bbfd4ba6c6a04293d497fMark Andrews If this statement is omitted, requests will be accepted on
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">view</strong></span> statement binds this
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater lightweight resolver daemon to a view in the DNS namespace, so that
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater response will be constructed in the same manner as a normal DNS
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User matching this view. If this statement is omitted, the default view
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User used, and if there is no default view, an error is triggered.
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User The <span><strong class="command">search</strong></span> statement is equivalent to
c5f7f6aa6c51d35353a9485b32abbabfe8358b4eMark Andrews <span><strong class="command">search</strong></span> statement in
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <code class="filename">/etc/resolv.conf</code>. It provides a
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User list of domains
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington which are appended to relative names in queries.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The <span><strong class="command">ndots</strong></span> statement is equivalent to
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater <span><strong class="command">ndots</strong></span> statement in
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater <code class="filename">/etc/resolv.conf</code>. It indicates the
63654fea53d6a58a65112234bc8d0c322e0c81b5Automatic Updater number of dots in a relative domain name that should result in an
27aa770222192dda4ba4ff4b76defd4b8c846226Automatic Updater exact match lookup before search path elements are appended.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2576679"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] };
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<div class="titlepage"><div><div><h3 class="title">
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews<a name="id2576723"></a><span><strong class="command">masters</strong></span> Statement Definition and
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews<p><span><strong class="command">masters</strong></span>
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User lists allow for a common set of masters to be easily used by
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User multiple stub and slave zones.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h3 class="title">
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User<a name="id2576738"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This is the grammar of the <span><strong class="command">options</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater statement in the <code class="filename">named.conf</code> file:
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews<pre class="programlisting"><span><strong class="command">options</strong></span> {
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews [<span class="optional"> version <em class="replaceable"><code>version_string</code></em>; </span>]
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User [<span class="optional"> hostname <em class="replaceable"><code>hostname_string</code></em>; </span>]
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews [<span class="optional"> server-id <em class="replaceable"><code>server_id_string</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> directory <em class="replaceable"><code>path_name</code></em>; </span>]
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [<span class="optional"> named-xfer <em class="replaceable"><code>path_name</code></em>; </span>]
80f05de86cd3cd8e4a4215c4501643891b942dafTinderbox User [<span class="optional"> tkey-gssapi-credential <em class="replaceable"><code>principal</code></em>; </span>]
80f05de86cd3cd8e4a4215c4501643891b942dafTinderbox User [<span class="optional"> tkey-domain <em class="replaceable"><code>domainname</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> tkey-dhkey <em class="replaceable"><code>key_name</code></em> <em class="replaceable"><code>key_tag</code></em>; </span>]
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews [<span class="optional"> cache-file <em class="replaceable"><code>path_name</code></em>; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews [<span class="optional"> dump-file <em class="replaceable"><code>path_name</code></em>; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews [<span class="optional"> memstatistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews [<span class="optional"> memstatistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User [<span class="optional"> pid-file <em class="replaceable"><code>path_name</code></em>; </span>]
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User [<span class="optional"> recursing-file <em class="replaceable"><code>path_name</code></em>; </span>]
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User [<span class="optional"> statistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User [<span class="optional"> auth-nxdomain <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews [<span class="optional"> deallocate-on-exit <em class="replaceable"><code>yes_or_no</code></em>; </span>]
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em>; </span>]
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews [<span class="optional"> fake-iquery <em class="replaceable"><code>yes_or_no</code></em>; </span>]
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews [<span class="optional"> fetch-glue <em class="replaceable"><code>yes_or_no</code></em>; </span>]
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews [<span class="optional"> flush-zones-on-shutdown <em class="replaceable"><code>yes_or_no</code></em>; </span>]
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews [<span class="optional"> has-old-clients <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews [<span class="optional"> host-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews [<span class="optional"> host-statistics-max <em class="replaceable"><code>number</code></em>; </span>]
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews [<span class="optional"> minimal-responses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews [<span class="optional"> multiple-cnames <em class="replaceable"><code>yes_or_no</code></em>; </span>]
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater [<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em>; </span>]
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater [<span class="optional"> recursion <em class="replaceable"><code>yes_or_no</code></em>; </span>]
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater [<span class="optional"> rfc2308-type1 <em class="replaceable"><code>yes_or_no</code></em>; </span>]
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater [<span class="optional"> use-id-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater [<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em>; </span>]
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater [<span class="optional"> dnssec-enable <em class="replaceable"><code>yes_or_no</code></em>; </span>]
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User [<span class="optional"> dnssec-validation <em class="replaceable"><code>yes_or_no</code></em>; </span>]
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews [<span class="optional"> dnssec-lookaside <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em>; </span>]
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews [<span class="optional"> dnssec-must-be-secure <em class="replaceable"><code>domain yes_or_no</code></em>; </span>]
e130ab53e992670e2a2ecf043976ac09f21358d1Automatic Updater [<span class="optional"> dnssec-accept-expired <em class="replaceable"><code>yes_or_no</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> forward ( <em class="replaceable"><code>only</code></em> | <em class="replaceable"><code>first</code></em> ); </span>]
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User [<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User [<span class="optional"> dual-stack-servers [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] {
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User ( <em class="replaceable"><code>domain_name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] |
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ) ;
183b6c7fca54001820078f324d102fc33e64bbc6Automatic Updater ... }; </span>]
e130ab53e992670e2a2ecf043976ac09f21358d1Automatic Updater [<span class="optional"> check-names ( <em class="replaceable"><code>master</code></em> | <em class="replaceable"><code>slave</code></em> | <em class="replaceable"><code>response</code></em> )
e130ab53e992670e2a2ecf043976ac09f21358d1Automatic Updater ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> check-mx ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User [<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User [<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> check-mx-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> check-srv-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> check-sibling <em class="replaceable"><code>yes_or_no</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> allow-query-cache { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> allow-query-cache-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> allow-recursion { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> allow-recursion-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> allow-v6-synthesis { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> blackhole { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> avoid-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User [<span class="optional"> avoid-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> listen-on [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> listen-on-v6 [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater [<span class="optional"> query-source ( ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> )
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> address ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [<span class="optional"> query-source-v6 ( ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> )
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> address ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
3497d225321ed571428ed011650deb229ccfc977Tinderbox User [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
3497d225321ed571428ed011650deb229ccfc977Tinderbox User [<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User [<span class="optional"> queryport-pool-interval <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> tcp-clients <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> recursive-clients <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> serial-query-rate <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> serial-queries <em class="replaceable"><code>number</code></em>; </span>]
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User [<span class="optional"> tcp-listen-queue <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfers-in <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfers-out <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfers-per-ns <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
17198e77b87667f796e910d31a4f47a80e256d09Mark Andrews [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> coresize <em class="replaceable"><code>size_spec</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> datasize <em class="replaceable"><code>size_spec</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> files <em class="replaceable"><code>size_spec</code></em> ; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> stacksize <em class="replaceable"><code>size_spec</code></em> ; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> heartbeat-interval <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> interface-interval <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> statistics-interval <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> topology { <em class="replaceable"><code>address_match_list</code></em> }</span>];
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> sortlist { <em class="replaceable"><code>address_match_list</code></em> }</span>];
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> rrset-order { <em class="replaceable"><code>order_spec</code></em> ; [<span class="optional"> <em class="replaceable"><code>order_spec</code></em> ; ... </span>] </span>] };
de73ef7ecdb9e009155993a6fa8dee5cd1bde319Mark Andrews [<span class="optional"> lame-ttl <em class="replaceable"><code>number</code></em>; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> max-ncache-ttl <em class="replaceable"><code>number</code></em>; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> max-cache-ttl <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> sig-re-signing-interval <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> min-roots <em class="replaceable"><code>number</code></em>; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> use-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> treat-cr-as-space <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> min-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> additional-from-auth <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> additional-from-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> random-device <em class="replaceable"><code>path_name</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-cache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> match-mapped-addresses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> preferred-glue ( <em class="replaceable"><code>A</code></em> | <em class="replaceable"><code>AAAA</code></em> | <em class="replaceable"><code>NONE</code></em> ); </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> edns-udp-size <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-udp-size <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> root-delegation-only [<span class="optional"> exclude { <em class="replaceable"><code>namelist</code></em> } </span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> querylog <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> disable-algorithms <em class="replaceable"><code>domain</code></em> { <em class="replaceable"><code>algorithm</code></em>; [<span class="optional"> <em class="replaceable"><code>algorithm</code></em>; </span>] }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> acache-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> acache-cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-acache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> empty-server <em class="replaceable"><code>name</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> empty-contact <em class="replaceable"><code>name</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> empty-zones-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> disable-empty-zone <em class="replaceable"><code>zone_name</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> zero-no-soa-ttl-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<div class="titlepage"><div><div><h3 class="title">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<a name="options"></a><span><strong class="command">options</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The <span><strong class="command">options</strong></span> statement sets up global
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews to be used by <acronym class="acronym">BIND</acronym>. This statement
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews may appear only
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews once in a configuration file. If there is no <span><strong class="command">options</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews statement, an options block with each option set to its default will
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">directory</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The working directory of the server.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Any non-absolute pathnames in the configuration file will be
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington as relative to this directory. The default location for most
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington output files (e.g. <code class="filename">named.run</code>)
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington is this directory.
febbdb34a7f7759922e239655e7429d78d3a8d26Tinderbox User If a directory is not specified, the working directory
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User defaults to `<code class="filename">.</code>', the directory from
e7d35dad55e8deae14f29aabfb20d540b4b6ab3dMark Andrews which the server
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews was started. The directory specified should be an absolute
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews<dt><span class="term"><span><strong class="command">key-directory</strong></span></span></dt>
6c910bd5e4a85a56e3a61fdf7b237a45bb2553eeTinderbox User When performing dynamic update of secure zones, the
6fab60452ed15c1039aee974a32d692d07eda4d2Automatic Updater directory where the public and private key files should be
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews if different than the current working directory. The
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater directory specified
b4846627b60aff904d523a433b44482b3b1825a7Tinderbox User must be an absolute path.
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews<dt><span class="term"><span><strong class="command">named-xfer</strong></span></span></dt>
71ba75c604df3604673232828a68bb28c420e698Mark Andrews <span class="emphasis"><em>This option is obsolete.</em></span> It
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews was used in <acronym class="acronym">BIND</acronym> 8 to specify
e7d35dad55e8deae14f29aabfb20d540b4b6ab3dMark Andrews the pathname to the <span><strong class="command">named-xfer</strong></span>
e7d35dad55e8deae14f29aabfb20d540b4b6ab3dMark Andrews program. In <acronym class="acronym">BIND</acronym> 9, no separate
e7d35dad55e8deae14f29aabfb20d540b4b6ab3dMark Andrews <span><strong class="command">named-xfer</strong></span> program is needed;
e7d35dad55e8deae14f29aabfb20d540b4b6ab3dMark Andrews its functionality is built into the name server.
dfd613f037c1385db661f17e086d34ea57fea9b0Automatic Updater<dt><span class="term"><span><strong class="command">tkey-gssapi-credential</strong></span></span></dt>
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews The security credential with which the server should
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews authenticate keys requested by the GSS-TSIG protocol.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater Currently only Kerberos 5 authentication is available
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews and the credential is a Kerberos principal which
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the server can acquire through the default system
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews key file, normally <code class="filename">/etc/krb5.keytab</code>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Normally this principal is of the form
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews "<strong class="userinput"><code>dns/</code></strong><code class="varname">server.domain</code>".
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater To use GSS-TSIG, <span><strong class="command">tkey-domain</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews must also be set.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">tkey-domain</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The domain appended to the names of all shared keys
56334ccb2d4b5a04fc12b70b5852049db5d24088Evan Hunt generated with <span><strong class="command">TKEY</strong></span>. When a
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews client requests a <span><strong class="command">TKEY</strong></span> exchange,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews it may or may not specify the desired name for the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews key. If present, the name of the shared key will
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews will be <code class="varname">client specified part</code> +
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <code class="varname">tkey-domain</code>. Otherwise, the
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater name of the shared key will be <code class="varname">random hex
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews digits</code> + <code class="varname">tkey-domain</code>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews In most cases, the <span><strong class="command">domainname</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews should be the server's domain name, or an otherwise
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews non-existent subdomain like
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews "_tkey.<code class="varname">domainname</code>". If you are
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater using GSS-TSIG, this variable must be defined.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">tkey-dhkey</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The Diffie-Hellman key used by the server
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews to generate shared keys with clients using the Diffie-Hellman
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews of <span><strong class="command">TKEY</strong></span>. The server must be
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews able to load the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews public and private keys from files in the working directory.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews most cases, the keyname should be the server's host name.
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater<dt><span class="term"><span><strong class="command">cache-file</strong></span></span></dt>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson This is for testing only. Do not use.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">dump-file</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The pathname of the file the server dumps
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the database to when instructed to do so with
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">rndc dumpdb</strong></span>.
ace6bfc72265153cb6123f7bb9e2751031f27150Tinderbox User If not specified, the default is <code class="filename">named_dump.db</code>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">memstatistics-file</strong></span></span></dt>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson The pathname of the file the server writes memory
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews usage statistics to on exit. If not specified,
7932a7637170550bc53b38c35db9a0187dcb3d3bAutomatic Updater the default is <code class="filename">named.memstats</code>.
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson<dt><span class="term"><span><strong class="command">pid-file</strong></span></span></dt>
3a9593055ead76cbbb417aee2d2e656c2c92cf46Automatic Updater The pathname of the file the server writes its process ID
229ea4644b3a7d9c7fdaa43888e7f55ba01e2ee3Automatic Updater in. If not specified, the default is <code class="filename">/var/run/named.pid</code>.
8bc3d252395842452a6d2c775cf8445f6349e331Tinderbox User The pid-file is used by programs that want to send signals to
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews name server. Specifying <span><strong class="command">pid-file none</strong></span> disables the
8bc3d252395842452a6d2c775cf8445f6349e331Tinderbox User use of a PID file — no file will be written and any
de7b9a1dac0c293b39994c91d4376883da25554fTinderbox User existing one will be removed. Note that <span><strong class="command">none</strong></span>
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews is a keyword, not a filename, and therefore is not enclosed
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater double quotes.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">recursing-file</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The pathname of the file the server dumps
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User the queries that are currently recursing when instructed
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User to do so with <span><strong class="command">rndc recursing</strong></span>.
0a50626faa2f8941f55bf435d3965d490bb5d026Tinderbox User If not specified, the default is <code class="filename">named.recursing</code>.
467a823e57af687ebd486dfd73ea32f9d2a145beTinderbox User<dt><span class="term"><span><strong class="command">statistics-file</strong></span></span></dt>
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews The pathname of the file the server appends statistics
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater to when instructed to do so using <span><strong class="command">rndc stats</strong></span>.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User If not specified, the default is <code class="filename">named.stats</code> in the
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews server's current directory. The format of the file is
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater in <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User<dt><span class="term"><span><strong class="command">port</strong></span></span></dt>
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews receiving and sending DNS protocol traffic.
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews The default is 53. This option is mainly intended for server
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews a server using a port other than 53 will not be able to
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews communicate with
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater the global DNS.
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews<dt><span class="term"><span><strong class="command">random-device</strong></span></span></dt>
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews The source of entropy to be used by the server. Entropy is
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews primarily needed
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews for DNSSEC operations, such as TKEY transactions and dynamic
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews update of signed
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews zones. This options specifies the device (or file) from which
409ba95e573b40cf36acf97dd62ee7e9c7775851Tinderbox User entropy. If this is a file, operations requiring entropy will
f751b1576ee6fef4023bf7101d10167e4fe520f3Tinderbox User fail when the
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User file has been exhausted. If not specified, the default value
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater (or equivalent) when present, and none otherwise. The
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater <span><strong class="command">random-device</strong></span> option takes
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User the initial configuration load at server startup time and
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User is ignored on subsequent reloads.
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User<dt><span class="term"><span><strong class="command">preferred-glue</strong></span></span></dt>
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User If specified, the listed type (A or AAAA) will be emitted
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User before other glue
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User in the additional section of a query response.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User The default is not to prefer any type (NONE).
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User<dt><span class="term"><span><strong class="command">root-delegation-only</strong></span></span></dt>
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User Turn on enforcement of delegation-only in TLDs (top level domains) and root zones
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User with an optional
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User exclude list.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User Note some TLDs are not delegation only (e.g. "DE", "LV", "US"
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User and "MUSEUM").
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
b8cc0c5d896c361525708a2be2e5af7df76c96d7Tinderbox User<dt><span class="term"><span><strong class="command">disable-algorithms</strong></span></span></dt>
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User Disable the specified DNSSEC algorithms at and below the
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User specified name.
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User Multiple <span><strong class="command">disable-algorithms</strong></span>
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User statements are allowed.
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User Only the most specific will be applied.
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User<dt><span class="term"><span><strong class="command">dnssec-lookaside</strong></span></span></dt>
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User When set, <span><strong class="command">dnssec-lookaside</strong></span>
2ec4ab21838e218863d052ebfa3e106e04f50820Evan Hunt validator with an alternate method to validate DNSKEY records
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews top of a zone. When a DNSKEY is at or below a domain
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews specified by the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews deepest <span><strong class="command">dnssec-lookaside</strong></span>, and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the normal dnssec validation
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews has left the key untrusted, the trust-anchor will be append to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews name and a DLV record will be looked up to see if it can
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews validate the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews key. If the DLV record validates a DNSKEY (similarly to the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews record does) the DNSKEY RRset is deemed to be trusted.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">dnssec-must-be-secure</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Specify hierarchies which must be or may not be secure (signed and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If <strong class="userinput"><code>yes</code></strong>, then named will only accept
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews answers if they
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If <strong class="userinput"><code>no</code></strong>, then normal dnssec validation
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews allowing for insecure answers to be accepted.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The specified domain must be under a <span><strong class="command">trusted-key</strong></span> or
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">dnssec-lookaside</strong></span> must be
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<div class="titlepage"><div><div><h4 class="title">
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<a name="boolean_options"></a>Boolean Options</h4></div></div></div>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">auth-nxdomain</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If <strong class="userinput"><code>yes</code></strong>, then the <span><strong class="command">AA</strong></span> bit
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews is always set on NXDOMAIN responses, even if the server is
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews not actually
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews authoritative. The default is <strong class="userinput"><code>no</code></strong>;
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews a change from <acronym class="acronym">BIND</acronym> 8. If you
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews are using very old DNS software, you
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews may need to set it to <strong class="userinput"><code>yes</code></strong>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">deallocate-on-exit</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews This option was used in <acronym class="acronym">BIND</acronym>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews 8 to enable checking
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews for memory leaks on exit. <acronym class="acronym">BIND</acronym> 9 ignores the option and always performs
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">memstatistics</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Write memory statistics to the file specfied by
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">memstatistics-file</strong></span> at exit.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The default is <strong class="userinput"><code>no</code></strong> unless
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews '-m record' is specified on the command line in
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews which case it is <strong class="userinput"><code>yes</code></strong>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span><strong class="command">dialup</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If <strong class="userinput"><code>yes</code></strong>, then the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews server treats all zones as if they are doing zone transfers
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews a dial-on-demand dialup link, which can be brought up by
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews originating from this server. This has different effects
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews to zone type and concentrates the zone maintenance so that
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews happens in a short interval, once every <span><strong class="command">heartbeat-interval</strong></span> and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews hopefully during the one call. It also suppresses some of
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews zone maintenance traffic. The default is <strong class="userinput"><code>no</code></strong>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The <span><strong class="command">dialup</strong></span> option
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews may also be specified in the <span><strong class="command">view</strong></span> and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">zone</strong></span> statements,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews in which case it overrides the global <span><strong class="command">dialup</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If the zone is a master zone, then the server will send out a
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews request to all the slaves (default). This should trigger the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews number check in the slave (providing it supports NOTIFY)
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews allowing the slave
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews to verify the zone while the connection is active.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The set of servers to which NOTIFY is sent can be controlled
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">notify</strong></span> and <span><strong class="command">also-notify</strong></span>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews zone is a slave or stub zone, then the server will suppress
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews "zone up to date" (refresh) queries and only perform them
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span><strong class="command">heartbeat-interval</strong></span> expires in
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews addition to sending
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews NOTIFY requests.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Finer control can be achieved by using
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <strong class="userinput"><code>notify</code></strong> which only sends NOTIFY
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <strong class="userinput"><code>notify-passive</code></strong> which sends NOTIFY
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews messages and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews suppresses the normal refresh queries, <strong class="userinput"><code>refresh</code></strong>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews which suppresses normal refresh processing and sends refresh
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews when the <span><strong class="command">heartbeat-interval</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews expires, and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <strong class="userinput"><code>passive</code></strong> which just disables normal
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews normal refresh
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews heart-beat refresh
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater heart-beat notify
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <p><span><strong class="command">no</strong></span> (default)</p>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <p><span><strong class="command">yes</strong></span></p>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <p><span><strong class="command">notify</strong></span></p>
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews <p><span><strong class="command">refresh</strong></span></p>
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater <p><span><strong class="command">passive</strong></span></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span><strong class="command">notify-passive</strong></span></p>
f8e61212a1b83e60f521577cc522e8bc1509c8cfAutomatic Updater Note that normal NOTIFY processing is not affected by
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater <span><strong class="command">dialup</strong></span>.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater<dt><span class="term"><span><strong class="command">fake-iquery</strong></span></span></dt>
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater In <acronym class="acronym">BIND</acronym> 8, this option
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater enabled simulating the obsolete DNS query type
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater IQUERY. <acronym class="acronym">BIND</acronym> 9 never does
f8e61212a1b83e60f521577cc522e8bc1509c8cfAutomatic Updater IQUERY simulation.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater<dt><span class="term"><span><strong class="command">fetch-glue</strong></span></span></dt>
78d7186253dfed549ec0ce2d7c2b08a7978ede9cAutomatic Updater This option is obsolete.
78d7186253dfed549ec0ce2d7c2b08a7978ede9cAutomatic Updater In BIND 8, <strong class="userinput"><code>fetch-glue yes</code></strong>
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater caused the server to attempt to fetch glue resource records
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater didn't have when constructing the additional
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater data section of a response. This is now considered a bad
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater and BIND 9 never does it.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater<dt><span class="term"><span><strong class="command">flush-zones-on-shutdown</strong></span></span></dt>
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater When the nameserver exits due receiving SIGTERM,
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater flush or do not flush any pending zone writes. The default
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater <span><strong class="command">flush-zones-on-shutdown</strong></span> <strong class="userinput"><code>no</code></strong>.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater<dt><span class="term"><span><strong class="command">has-old-clients</strong></span></span></dt>
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater This option was incorrectly implemented
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater in <acronym class="acronym">BIND</acronym> 8, and is ignored by <acronym class="acronym">BIND</acronym> 9.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater To achieve the intended effect
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater <span><strong class="command">has-old-clients</strong></span> <strong class="userinput"><code>yes</code></strong>, specify
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater the two separate options <span><strong class="command">auth-nxdomain</strong></span> <strong class="userinput"><code>yes</code></strong>
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater and <span><strong class="command">rfc2308-type1</strong></span> <strong class="userinput"><code>no</code></strong> instead.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater<dt><span class="term"><span><strong class="command">host-statistics</strong></span></span></dt>
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater In BIND 8, this enables keeping of
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater statistics for every host that the name server interacts
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater Not implemented in BIND 9.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater<dt><span class="term"><span><strong class="command">maintain-ixfr-base</strong></span></span></dt>
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater <span class="emphasis"><em>This option is obsolete</em></span>.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater It was used in <acronym class="acronym">BIND</acronym> 8 to
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater determine whether a transaction log was
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater kept for Incremental Zone Transfer. <acronym class="acronym">BIND</acronym> 9 maintains a transaction
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater log whenever possible. If you need to disable outgoing
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater incremental zone
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater transfers, use <span><strong class="command">provide-ixfr</strong></span> <strong class="userinput"><code>no</code></strong>.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater<dt><span class="term"><span><strong class="command">minimal-responses</strong></span></span></dt>
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater If <strong class="userinput"><code>yes</code></strong>, then when generating
0b580e05aec89f501a9c20cc00ceb42d043d3928Automatic Updater responses the server will only add records to the authority
78d7186253dfed549ec0ce2d7c2b08a7978ede9cAutomatic Updater and additional data sections when they are required (e.g.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater delegations, negative responses). This may improve the
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater performance of the server.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater The default is <strong class="userinput"><code>no</code></strong>.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater<dt><span class="term"><span><strong class="command">multiple-cnames</strong></span></span></dt>
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater This option was used in <acronym class="acronym">BIND</acronym> 8 to allow
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater a domain name to have multiple CNAME records in violation of
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater the DNS standards. <acronym class="acronym">BIND</acronym> 9.2 onwards
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater always strictly enforces the CNAME rules both in master
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater files and dynamic updates.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater<dt><span class="term"><span><strong class="command">notify</strong></span></span></dt>
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater If <strong class="userinput"><code>yes</code></strong> (the default),
78d7186253dfed549ec0ce2d7c2b08a7978ede9cAutomatic Updater DNS NOTIFY messages are sent when a zone the server is
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater authoritative for
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater changes, see <a href="Bv9ARM.ch04.html#notify" title="Notify">the section called “Notify”</a>. The messages are
0b580e05aec89f501a9c20cc00ceb42d043d3928Automatic Updater servers listed in the zone's NS records (except the master
78d7186253dfed549ec0ce2d7c2b08a7978ede9cAutomatic Updater server identified
78d7186253dfed549ec0ce2d7c2b08a7978ede9cAutomatic Updater in the SOA MNAME field), and to any servers listed in the
0b580e05aec89f501a9c20cc00ceb42d043d3928Automatic Updater <span><strong class="command">also-notify</strong></span> option.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater If <strong class="userinput"><code>master-only</code></strong>, notifies are only
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater for master zones.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater If <strong class="userinput"><code>explicit</code></strong>, notifies are sent only
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater servers explicitly listed using <span><strong class="command">also-notify</strong></span>.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater If <strong class="userinput"><code>no</code></strong>, no notifies are sent.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater The <span><strong class="command">notify</strong></span> option may also be
c57668a2fbbe558c1bd21652813616f2f517c469Tinderbox User specified in the <span><strong class="command">zone</strong></span>
f8e61212a1b83e60f521577cc522e8bc1509c8cfAutomatic Updater in which case it overrides the <span><strong class="command">options notify</strong></span> statement.
782b50b4ebbd48d570831f66d8ffc550e0db340cAutomatic Updater It would only be necessary to turn off this option if it
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User<dt><span class="term"><span><strong class="command">notify-to-soa</strong></span></span></dt>
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User If <strong class="userinput"><code>yes</code></strong> do not check the nameservers
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User in the NS RRset against the SOA MNAME. Normally a NOTIFY
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User message is not sent to the SOA MNAME (SOA ORIGIN) as it is
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User supposed to contain the name of the ultimate master.
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User Sometimes, however, a slave is listed as the SOA MNAME in
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User hidden master configurations and in that case you would
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User want the ultimate master to still send NOTIFY messages to
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User all the nameservers listed in the NS RRset.
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews<dt><span class="term"><span><strong class="command">recursion</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews If <strong class="userinput"><code>yes</code></strong>, and a
c7ef13f6c9ef4436bc804b150e0a93307b11fa27Tinderbox User DNS query requests recursion, then the server will attempt
644973f327e9db74779e7c0426db90909173b284Automatic Updater all the work required to answer the query. If recursion is
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User and the server does not already know the answer, it will
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User referral response. The default is
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User <strong class="userinput"><code>yes</code></strong>.
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User Note that setting <span><strong class="command">recursion no</strong></span> does not prevent
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User clients from getting data from the server's cache; it only
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User prevents new data from being cached as an effect of client
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User Caching may still occur as an effect the server's internal
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User operation, such as NOTIFY address lookups.
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User See also <span><strong class="command">fetch-glue</strong></span> above.
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User<dt><span class="term"><span><strong class="command">rfc2308-type1</strong></span></span></dt>
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User Setting this to <strong class="userinput"><code>yes</code></strong> will
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User cause the server to send NS records along with the SOA
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User record for negative
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User answers. The default is <strong class="userinput"><code>no</code></strong>.
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User Not yet implemented in <acronym class="acronym">BIND</acronym>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<dt><span class="term"><span><strong class="command">use-id-pool</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <span class="emphasis"><em>This option is obsolete</em></span>.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <acronym class="acronym">BIND</acronym> 9 always allocates query
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews IDs from a pool.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews<dt><span class="term"><span><strong class="command">zone-statistics</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews If <strong class="userinput"><code>yes</code></strong>, the server will collect
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews statistical data on all zones (unless specifically turned
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews on a per-zone basis by specifying <span><strong class="command">zone-statistics no</strong></span>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews in the <span><strong class="command">zone</strong></span> statement).
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews These statistics may be accessed
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews using <span><strong class="command">rndc stats</strong></span>, which will
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews dump them to the file listed
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews in the <span><strong class="command">statistics-file</strong></span>. See
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews also <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<dt><span class="term"><span><strong class="command">use-ixfr</strong></span></span></dt>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <span class="emphasis"><em>This option is obsolete</em></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If you need to disable IXFR to a particular server or
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews servers, see
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews the information on the <span><strong class="command">provide-ixfr</strong></span> option
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
68e1b398b5b1b417723e90b5e52b9148f8f93294Automatic Updater Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Usage”</a>.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <a href="Bv9ARM.ch04.html#incremental_zone_transfers" title="Incremental Zone Transfers (IXFR)">the section called “Incremental Zone Transfers (IXFR)”</a>.
45eca3a5d46ed15aee14d81f6cb6c9fb6f365344Mark Andrews<dt><span class="term"><span><strong class="command">provide-ixfr</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User See the description of
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">provide-ixfr</strong></span> in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
45eca3a5d46ed15aee14d81f6cb6c9fb6f365344Mark Andrews Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Usage”</a>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">request-ixfr</strong></span></span></dt>
872a5b83f68b8058945298715b0fa53442aad52fAutomatic Updater See the description of
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews <span><strong class="command">request-ixfr</strong></span> in
8f7809dd50b2471151ad272d083dd8c6a29d070eTinderbox User <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Usage”</a>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">treat-cr-as-space</strong></span></span></dt>
7a2a1b8b14fc804ac80612d7b98064095e445be5Automatic Updater This option was used in <acronym class="acronym">BIND</acronym>
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews the server treat carriage return ("<span><strong class="command">\r</strong></span>") characters the same way
e007e3e5b0316c6c05698a71101885743aca22bdAutomatic Updater as a space or tab character,
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews to facilitate loading of zone files on a UNIX system that
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington were generated
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington on an NT or DOS machine. In <acronym class="acronym">BIND</acronym> 9, both UNIX "<span><strong class="command">\n</strong></span>"
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington and NT/DOS "<span><strong class="command">\r\n</strong></span>" newlines
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington are always accepted,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington and the option is ignored.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<span class="term"><span><strong class="command">additional-from-auth</strong></span>, </span><span class="term"><span><strong class="command">additional-from-cache</strong></span></span>
cff0e0b52cf0928123bad6f3bccf56e22bbc07f5Automatic Updater These options control the behavior of an authoritative
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater answering queries which have additional data, or when
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater following CNAME
644973f327e9db74779e7c0426db90909173b284Automatic Updater and DNAME chains.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater When both of these options are set to <strong class="userinput"><code>yes</code></strong>
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews (the default) and a
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews query is being answered from authoritative data (a zone
5f7e0eb1cb917b788906d3e2aa01bfc4885dcae4Mark Andrews configured into the server), the additional data section of
15ae68f3db8261770fc33b8e0f83f5d8c7021e84Mark Andrews reply will be filled in using data from other authoritative
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User and from the cache. In some situations this is undesirable,
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User as when there is concern over the correctness of the cache,
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User in servers where slave zones may be added and modified by
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater untrusted third parties. Also, avoiding
02b47c5d62e1e827743684c28a08e871da454a2dMark Andrews the search for this additional data will speed up server
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews at the possible expense of additional queries to resolve
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater otherwise be provided in the additional section.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater For example, if a query asks for an MX record for host <code class="literal">foo.example.com</code>,
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater and the record found is "<code class="literal">MX 10 mail.example.net</code>", normally the address
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater records (A and AAAA) for <code class="literal">mail.example.net</code> will be provided as well,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater if known, even though they are not in the example.com zone.
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater Setting these options to <span><strong class="command">no</strong></span>
10640b2e3efc7bc8034108136d7487f7407fbf37Andreas Gustafsson disables this behavior and makes
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the server only search for additional data in the zone it
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews These options are intended for use in authoritative-only
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews servers, or in authoritative-only views. Attempts to set
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater them to <span><strong class="command">no</strong></span> without also
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater <span><strong class="command">recursion no</strong></span> will cause the
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews ignore the options and log a warning message.
f751b1576ee6fef4023bf7101d10167e4fe520f3Tinderbox User Specifying <span><strong class="command">additional-from-cache no</strong></span> actually
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User disables the use of the cache not only for additional data
a01aa536188bb3535dfc1107a623e6355a8e6b7cMark Andrews but also when looking up the answer. This is usually the
1d4f4d2db2d69e48fec2dde5c1535853677d22a7Automatic Updater behavior in an authoritative-only server where the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater correctness of
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews the cached data is an issue.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User When a name server is non-recursively queried for a name
8d0e57cdac5e28964ebe7c0d925d158f17b401a6Tinderbox User below the apex of any served zone, it normally answers with
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User "upwards referral" to the root servers or the servers of
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews known parent of the query name. Since the data in an
99c231a3bd27893583204cd0a3e3103dc78dbc28Tinderbox User upwards referral
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater comes from the cache, the server will not be able to provide
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews referrals when <span><strong class="command">additional-from-cache no</strong></span>
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User has been specified. Instead, it will respond to such
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews with REFUSED. This should not cause any problems since
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews upwards referrals are not required for the resolution
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews<dt><span class="term"><span><strong class="command">match-mapped-addresses</strong></span></span></dt>
7e8129652903780873ba91f379f9ffca1f59773cMark Andrews If <strong class="userinput"><code>yes</code></strong>, then an
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User IPv4-mapped IPv6 address will match any address match
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User list entries that match the corresponding IPv4 address.
4c9f230f7ca5b2b08ea8fd7a6944135801dbe152Tinderbox User Enabling this option is sometimes useful on IPv6-enabled
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews systems, to work around a kernel quirk that causes IPv4
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews TCP connections such as zone transfers to be accepted
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater on an IPv6 socket using mapped addresses, causing
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater address match lists designed for IPv4 to fail to match.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews The use of this option for any other purpose is discouraged.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater When <strong class="userinput"><code>yes</code></strong> and the server loads a new version of a master
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews zone from its zone file or receives a new version of a slave
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater file by a non-incremental zone transfer, it will compare
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the new version to the previous one and calculate a set
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews of differences. The differences are then logged in the
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews zone's journal file such that the changes can be transmitted
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews to downstream slaves as an incremental zone transfer.
e80c7005e3d59dfeb04dad186d36f3c15622954cTinderbox User By allowing incremental zone transfers to be used for
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User non-dynamic zones, this option saves bandwidth at the
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User expense of increased CPU and memory consumption at the
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater In particular, if the new version of a zone is completely
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater different from the previous one, the set of differences
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews will be of a size comparable to the combined size of the
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews old and new zone version, and the server will need to
53b97c9873a923f504893d1e2ab62000dfac221fTinderbox User temporarily allocate memory to hold this complete
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews difference set.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<p><span><strong class="command">ixfr-from-differences</strong></span>
8c6328ab5890aa79d84b86ed672e185dc111bb68Automatic Updater also accepts <span><strong class="command">master</strong></span> and
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User <span><strong class="command">slave</strong></span> at the view and options
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater levels which causes
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <span><strong class="command">ixfr-from-differences</strong></span> to apply to
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater all <span><strong class="command">master</strong></span> or
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews <span><strong class="command">slave</strong></span> zones respectively.
cd34c1adb0fa2120327fc8c11cda0d4a5f722aeeTinderbox User<dt><span class="term"><span><strong class="command">multi-master</strong></span></span></dt>
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews This should be set when you have multiple masters for a zone
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater addresses refer to different machines. If <strong class="userinput"><code>yes</code></strong>, named will
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews when the serial number on the master is less than what named
53b97c9873a923f504893d1e2ab62000dfac221fTinderbox User has. The default is <strong class="userinput"><code>no</code></strong>.
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater<dt><span class="term"><span><strong class="command">dnssec-enable</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Enable DNSSEC support in named. Unless set to <strong class="userinput"><code>yes</code></strong>,
ca904804e43f663f08eb1ac9d6d617930b9a3cd3Automatic Updater named behaves as if it does not support DNSSEC.
19ad308d84cbf446a144e5a91f2032389a9d65c1Tinderbox User The default is <strong class="userinput"><code>yes</code></strong>.
713a5e3080f112b3efde9235e9c92035056ff966Automatic Updater<dt><span class="term"><span><strong class="command">dnssec-validation</strong></span></span></dt>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews Enable DNSSEC validation in named.
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User set to <strong class="userinput"><code>yes</code></strong> to be effective.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <strong class="userinput"><code>no</code></strong>.
f8b9948a4116226ac41b5509cca152849006c66cAutomatic Updater<dt><span class="term"><span><strong class="command">dnssec-accept-expired</strong></span></span></dt>
be46cb4bee9253ee4832340c719920642e00c41aTinderbox User Accept expired signatures when verifying DNSSEC signatures.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User The default is <strong class="userinput"><code>no</code></strong>.
c243d779731a410f8dc2d2feeed20c15f299b6e3Automatic Updater Setting this option to "yes" leaves named vulnerable to replay attacks.
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater<dt><span class="term"><span><strong class="command">querylog</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Specify whether query logging should be started when named
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater If <span><strong class="command">querylog</strong></span> is not specified,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater then the query logging
572cb2c1c931f6bc6a4a019c103ae88239b0eb96Automatic Updater is determined by the presence of the logging category <span><strong class="command">queries</strong></span>.
3e5340279d8875d136a4dd815cccad0044aa2644Automatic Updater<dt><span class="term"><span><strong class="command">check-names</strong></span></span></dt>
f22980c16f244b7d7f33b5248f2d38bd4885f108Automatic Updater This option is used to restrict the character set and syntax
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews certain domain names in master files and/or DNS responses
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews from the network. The default varies according to usage
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>.
d630ef2ff74445949a482660938e9fa9da52ca14Automatic Updater For <span><strong class="command">slave</strong></span> zones the default
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User is <span><strong class="command">warn</strong></span>.
99c231a3bd27893583204cd0a3e3103dc78dbc28Tinderbox User For answers received from the network (<span><strong class="command">response</strong></span>)
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the default is <span><strong class="command">ignore</strong></span>.
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User The rules for legal hostnames and mail domains are derived
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User from RFC 952 and RFC 821 as modified by RFC 1123.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<p><span><strong class="command">check-names</strong></span>
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User applies to the owner names of A, AAAA and MX records.
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews It also applies to the domain names in the RDATA of NS, SOA
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews and MX records.
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User It also applies to the RDATA of PTR records where the owner
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews name indicated that it is a reverse lookup of a hostname
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT).
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">check-mx</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Check whether the MX record appears to refer to a IP address.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User The default is to <span><strong class="command">warn</strong></span>. Other possible
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User values are <span><strong class="command">fail</strong></span> and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">ignore</strong></span>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">check-wildcard</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User This option is used to check for non-terminal wildcards.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The use of non-terminal wildcards is almost always as a
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews result of a failure
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User to understand the wildcard matching algorithm (RFC 1034).
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User affects master zones. The default (<span><strong class="command">yes</strong></span>) is to check
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User for non-terminal wildcards and issue a warning.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">check-integrity</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Perform post load zone integrity checks on master
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User zones. This checks that MX and SRV records refer
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User to address (A or AAAA) records and that glue
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater address records exist for delegated zones. For
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User MX and SRV records only in-zone hostnames are
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater checked (for out-of-zone hostnames use named-checkzone).
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User For NS records only names below top of zone are
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater checked (for out-of-zone names and glue consistency
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User checks use named-checkzone). The default is
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">yes</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">check-mx-cname</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <span><strong class="command">check-integrity</strong></span> is set then
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater fail, warn or ignore MX records that refer
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to CNAMES. The default is to <span><strong class="command">warn</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">check-srv-cname</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <span><strong class="command">check-integrity</strong></span> is set then
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User fail, warn or ignore SRV records that refer
a61158fed2e0281a40e3e97e0b7c3f9789a07b4eTinderbox User to CNAMES. The default is to <span><strong class="command">warn</strong></span>.
a61158fed2e0281a40e3e97e0b7c3f9789a07b4eTinderbox User<dt><span class="term"><span><strong class="command">check-sibling</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater When performing integrity checks, also check that
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater sibling glue exists. The default is <span><strong class="command">yes</strong></span>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">zero-no-soa-ttl</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User When returning authoritative negative responses to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater SOA queries set the TTL of the SOA recored returned in
a1788473b239588464bdeac4ab9f3fbcae959450Tinderbox User the authority section to zero.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <span><strong class="command">yes</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">zero-no-soa-ttl-cache</strong></span></span></dt>
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater When caching a negative response to a SOA query
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User set the TTL to zero.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews The default is <span><strong class="command">no</strong></span>.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews<dt><span class="term"><span><strong class="command">update-check-ksk</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater When regenerating the RRSIGs following a UPDATE
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews request to a secure zone, check the KSK flag on
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews the DNSKEY RR to determine if this key should be
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater used to generate the RRSIG. This flag is ignored
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater if there are not DNSKEY RRs both with and without
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <span><strong class="command">yes</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">try-tcp-refresh</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Try to refresh the zone using TCP if UDP queries fail.
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater For BIND 8 compatibility, the default is
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">yes</strong></span>.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews<div class="titlepage"><div><div><h4 class="title">
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<a name="id2580907"></a>Forwarding</h4></div></div></div>
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews The forwarding facility can be used to create a large site-wide
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater cache on a few servers, reducing traffic over links to external
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater name servers. It can also be used to allow queries by servers that
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User do not have direct access to the Internet, but wish to look up
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater names anyway. Forwarding occurs only on those queries for which
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater the server is not authoritative and does not have the answer in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">forward</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This option is only meaningful if the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User forwarders list is not empty. A value of <code class="varname">first</code>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the default, causes the server to query the forwarders
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater first — and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater if that doesn't answer the question, the server will then
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the answer itself. If <code class="varname">only</code> is
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater specified, the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater server will only query the forwarders.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">forwarders</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Specifies the IP addresses to be used
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User for forwarding. The default is the empty list (no
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Forwarding can also be configured on a per-domain basis, allowing
324a8797b46d646fe8d3b2eef6785e0b2b3ac956Tinderbox User for the global forwarding options to be overridden in a variety
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater of ways. You can set particular domains to use different
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater or have a different <span><strong class="command">forward only/first</strong></span> behavior,
7169f76a893666eb20fc7750782e7f411db742d6Tinderbox User or not forward at all, see <a href="Bv9ARM.ch06.html#zone_statement_grammar" title="zone
7169f76a893666eb20fc7750782e7f411db742d6Tinderbox User Statement Grammar">the section called “<span><strong class="command">zone</strong></span>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Statement Grammar”</a>.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<div class="titlepage"><div><div><h4 class="title">
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<a name="id2581034"></a>Dual-stack Servers</h4></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Dual-stack servers are used as servers of last resort to work
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater problems in reachability due the lack of support for either IPv4
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater on the host machine.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">dual-stack-servers</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Specifies host names or addresses of machines with access to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater both IPv4 and IPv6 transports. If a hostname is used, the
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User server must be able
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to resolve the name using only the transport it has. If the
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater machine is dual
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater stacked, then the <span><strong class="command">dual-stack-servers</strong></span> have no effect unless
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater access to a transport has been disabled on the command line
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater (e.g. <span><strong class="command">named -4</strong></span>).
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater<div class="titlepage"><div><div><h4 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="access_control"></a>Access Control</h4></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Access to the server can be restricted based on the IP address
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater of the requesting system. See <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a> for
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater details on how to specify IP address lists.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Specifies which hosts are allowed to
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews notify this server, a slave, of zone changes in addition
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User to the zone masters.
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User <span><strong class="command">allow-notify</strong></span> may also be
b4846627b60aff904d523a433b44482b3b1825a7Tinderbox User specified in the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">zone</strong></span> statement, in which case
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User it overrides the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">options allow-notify</strong></span>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews statement. It is only meaningful
dc5552b4df5e3821783821c8d4e734c1608c446eTinderbox User for a slave zone. If not specified, the default is to
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater process notify messages
0d3490f93bb980fde704055e74c1b508987a5fe4Mark Andrews only from a zone's master.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">allow-query</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Specifies which hosts are allowed to ask ordinary
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews DNS questions. <span><strong class="command">allow-query</strong></span> may
114f7780384371121918624ae2c80ecfce545683Tinderbox User also be specified in the <span><strong class="command">zone</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater statement, in which case it overrides the
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater <span><strong class="command">options allow-query</strong></span> statement.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews If not specified, the default is to allow queries
49ab13eefc8841ea42865ae09d5a2f760577089eTinderbox User from all hosts.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User <span><strong class="command">allow-query-cache</strong></span> is now
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User used to specify access to the cache.
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater<dt><span class="term"><span><strong class="command">allow-query-on</strong></span></span></dt>
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews Specifies which local addresses can accept ordinary
19ad308d84cbf446a144e5a91f2032389a9d65c1Tinderbox User DNS questions. This makes it possible, for instance,
114f7780384371121918624ae2c80ecfce545683Tinderbox User to allow queries on internal-facing interfaces but
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User disallow them on external-facing ones, without
42c81cf2de732ec6d00e73fc755a399ca037e543Mark Andrews necessarily knowing the internal network's addresses.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span><strong class="command">allow-query-on</strong></span> may
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User also be specified in the <span><strong class="command">zone</strong></span>
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater statement, in which case it overrides the
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater <span><strong class="command">options allow-query-on</strong></span> statement.
71fc4775d04aea66809e3eb5b5159c55413bdc5cMark Andrews If not specified, the default is to allow queries
71fc4775d04aea66809e3eb5b5159c55413bdc5cMark Andrews on all addresses.
7d704e522860496310bb29c28e76064868401a9cMark Andrews<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater <span><strong class="command">allow-query-cache</strong></span> is
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater used to specify access to the cache.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater<dt><span class="term"><span><strong class="command">allow-query-cache</strong></span></span></dt>
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater Specifies which hosts are allowed to get answers
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater from the cache. If <span><strong class="command">allow-query-cache</strong></span>
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater is not set then <span><strong class="command">allow-recursion</strong></span>
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater is used if set, otherwise <span><strong class="command">allow-query</strong></span>
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater is used if set, otherwise the default
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User (<span><strong class="command">localnets;</strong></span>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span><strong class="command">localhost;</strong></span>) is used.
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User<dt><span class="term"><span><strong class="command">allow-query-cache-on</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Specifies which local addresses can give answers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater from the cache. If not specified, the default is
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User to allow cache queries on any address,
da24e725ff982595d74da7e75e9fbd6a696367ccAutomatic Updater <span><strong class="command">localnets</strong></span> and
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">localhost</strong></span>.
99c231a3bd27893583204cd0a3e3103dc78dbc28Tinderbox User<dt><span class="term"><span><strong class="command">allow-recursion</strong></span></span></dt>
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews Specifies which hosts are allowed to make recursive
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews queries through this server. If
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater <span><strong class="command">allow-recursion</strong></span> is not set
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews then <span><strong class="command">allow-query-cache</strong></span> is
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson used if set, otherwise <span><strong class="command">allow-query</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews is used if set, otherwise the default
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews (<span><strong class="command">localnets;</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">localhost;</strong></span>) is used.
4edbda219a416180ab80f443433197687524e805Mark Andrews<dt><span class="term"><span><strong class="command">allow-recursion-on</strong></span></span></dt>
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson Specifies which local addresses can accept recursive
e16b482740c5e7ad4c27e271fa829b957cdf67d4Mark Andrews queries. If not specified, the default is to allow
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews recursive queries on all addresses.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">allow-update</strong></span></span></dt>
ca5ba35827e475a824ec79d489dbcdb3341a35ccTinderbox User Specifies which hosts are allowed to
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User submit Dynamic DNS updates for master zones. The default is
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews updates from all hosts. Note that allowing updates based
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User on the requestor's IP address is insecure; see
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a> for details.
da59e63e7af147a8bcef985b98b04443e04c3a0eTinderbox User<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews Specifies which hosts are allowed to
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User submit Dynamic DNS updates to slave zones to be forwarded to
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater master. The default is <strong class="userinput"><code>{ none; }</code></strong>,
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater means that no update forwarding will be performed. To
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater update forwarding, specify
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater <strong class="userinput"><code>allow-update-forwarding { any; };</code></strong>.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater Specifying values other than <strong class="userinput"><code>{ none; }</code></strong> or
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <strong class="userinput"><code>{ any; }</code></strong> is usually
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater counterproductive, since
1fdd58445074579ee3b65c871137a7a1740eb542Mark Andrews the responsibility for update access control should rest
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User master server, not the slaves.
603cf17f33da24d460616389ec40d6f2a6e110a0Automatic Updater Note that enabling the update forwarding feature on a slave
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews may expose master servers relying on insecure IP address
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater access control to attacks; see <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews for more details.
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews<dt><span class="term"><span><strong class="command">allow-v6-synthesis</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User This option was introduced for the smooth transition from
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater to A6 and from "nibble labels" to binary labels.
b5423cbff7175727ed9046c8c670d8a7bb4d01eaTinderbox User However, since both A6 and binary labels were then
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater this option was also deprecated.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater It is now ignored with some warning messages.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">allow-transfer</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Specifies which hosts are allowed to
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User receive zone transfers from the server. <span><strong class="command">allow-transfer</strong></span> may
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User also be specified in the <span><strong class="command">zone</strong></span>
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews statement, in which
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User case it overrides the <span><strong class="command">options allow-transfer</strong></span> statement.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User If not specified, the default is to allow transfers to all
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">blackhole</strong></span></span></dt>
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews Specifies a list of addresses that the
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater server will not accept queries from or use to resolve a
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater query. Queries
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater from these addresses will not be responded to. The default
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is <strong class="userinput"><code>none</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h4 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id2581530"></a>Interfaces</h4></div></div></div>
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater The interfaces and ports that the server will answer queries
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater an optional port, and an <code class="varname">address_match_list</code>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The server will listen on all interfaces allowed by the address
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User match list. If a port is not specified, port 53 will be used.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Multiple <span><strong class="command">listen-on</strong></span> statements are
b4cebdb6ccde66a8f3e397a1b90b0cf788519d69Automatic Updater<pre class="programlisting">listen-on { 5.6.7.8; };
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater will enable the name server on port 53 for the IP address
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User 5.6.7.8, and on port 1234 of an address on the machine in net
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater 1.2 that is not 1.2.3.4.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater If no <span><strong class="command">listen-on</strong></span> is specified, the
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User server will listen on port 53 on all IPv4 interfaces.
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater The <span><strong class="command">listen-on-v6</strong></span> option is used to
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User specify the interfaces and the ports on which the server will
098097efb95046a4a5285b6dae95dea3e3b70853Automatic Updater for incoming queries sent using IPv6.
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews as the <code class="varname">address_match_list</code> for the
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User <span><strong class="command">listen-on-v6</strong></span> option,
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater the server does not bind a separate socket to each IPv6 interface
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater address as it does for IPv4 if the operating system has enough API
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User support for IPv6 (specifically if it conforms to RFC 3493 and RFC
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Instead, it listens on the IPv6 wildcard address.
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater If the system only has incomplete API support for IPv6, however,
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater the behavior is the same as that for IPv4.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews A list of particular IPv6 addresses can also be specified, in
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater the server listens on a separate socket for each specified
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater regardless of whether the desired API is supported by the system.
b4cebdb6ccde66a8f3e397a1b90b0cf788519d69Automatic Updater Multiple <span><strong class="command">listen-on-v6</strong></span> options can
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<pre class="programlisting">listen-on-v6 { any; };
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox Userlisten-on-v6 port 1234 { !2001:db8::/32; any; };
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews will enable the name server on port 53 for any IPv6 addresses
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User (with a single wildcard socket),
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User and on port 1234 of IPv6 addresses that is not in the prefix
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews 2001:db8::/32 (with separate sockets for each matched address.)
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater To make the server not listen on any IPv6 address, use
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<pre class="programlisting">listen-on-v6 { none; };
2bb3422dc683c013db7042f5736240de6b86f182Automatic Updater If no <span><strong class="command">listen-on-v6</strong></span> option is
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User specified, the server will not listen on any IPv6 address
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater unless <span><strong class="command">-6</strong></span> is specified when named is
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews invoked. If <span><strong class="command">-6</strong></span> is specified then
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User named will listen on port 53 on all IPv6 interfaces by default.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<div class="titlepage"><div><div><h4 class="title">
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<a name="query_address"></a>Query Address</h4></div></div></div>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User If the server doesn't know the answer to a question, it will
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User query other name servers. <span><strong class="command">query-source</strong></span> specifies
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the address and port used for such queries. For queries sent over
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User IPv6, there is a separate <span><strong class="command">query-source-v6</strong></span> option.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <span><strong class="command">address</strong></span> is <span><strong class="command">*</strong></span> (asterisk) or is omitted,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User a wildcard IP address (<span><strong class="command">INADDR_ANY</strong></span>)
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User will be used.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User If <span><strong class="command">port</strong></span> is <span><strong class="command">*</strong></span> or is omitted,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater a pool of random unprivileged ports will be used. See the
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User <span><strong class="command">use-queryport-pool</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">queryport-pool-ports</strong></span> and
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">queryport-pool-updateinterval</strong></span> options below for how the pool
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User is configured.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <span><strong class="command">avoid-v4-udp-ports</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater and <span><strong class="command">avoid-v6-udp-ports</strong></span> options can be used
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to prevent named
4cde88fbf4c5e78a785d40f364cdcf60f3575f0cTinderbox User from selecting certain ports.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The defaults are:
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<pre class="programlisting">query-source address * port *;
1ac49378a458420bc685293d12e567d7222d17b6Tinderbox Userquery-source-v6 address * port *;
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">use-queryport-pool</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Enable the use of query port pools. By default query port
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User pools are enabled unless there is a explicit port defined
b16e2045ac28229c31f1ea3ebad15cbcb13e1d24Automatic Updater in <span><strong class="command">query-source</strong></span> or
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">query-source-v6</strong></span>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">queryport-pool-ports</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Specify how many pool ports to use. The default is 8.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">queryport-pool-updateinterval</strong></span></span></dt>
71bfd0968456cc0c69fd400d2dafd02977c649d2Tinderbox User Specify how often, in minutes, that the queryport pool
83e281baf1b4149dc637d24dd41141129ae712c6Tinderbox User should be recreated (new ports selected). The default
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is 15 minutes.
6c910bd5e4a85a56e3a61fdf7b237a45bb2553eeTinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The address specified in the <span><strong class="command">query-source</strong></span> option
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater is used for both UDP and TCP queries, but the port applies only
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User to UDP queries. TCP queries always use a random
d3ba57ed92b7095fdeabc444af5dd18ac4781064Tinderbox User unprivileged port.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Solaris 2.5.1 and earlier does not support setting the source
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User address for TCP sockets.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
ca5ba35827e475a824ec79d489dbcdb3341a35ccTinderbox User See also <span><strong class="command">transfer-source</strong></span> and
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User <span><strong class="command">notify-source</strong></span>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<div class="titlepage"><div><div><h4 class="title">
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews<a name="zone_transfers"></a>Zone Transfers</h4></div></div></div>
b6e12209e3e7df826f5f8f949ad400ec6d1f6371Tinderbox User <acronym class="acronym">BIND</acronym> has mechanisms in place to
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User facilitate zone transfers
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User and set limits on the amount of load that transfers place on the
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User system. The following options apply to zone transfers.
6c910bd5e4a85a56e3a61fdf7b237a45bb2553eeTinderbox User<dt><span class="term"><span><strong class="command">also-notify</strong></span></span></dt>
049728912c39135db248f9b48f8f26675f456e9dTinderbox User Defines a global list of IP addresses of name servers
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User that are also sent NOTIFY messages whenever a fresh copy of
fd0f3e7cd8bc0e7fd08cc81ceb6ced861b706c97Mark Andrews zone is loaded, in addition to the servers listed in the
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews zone's NS records.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater This helps to ensure that copies of the zones will
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User quickly converge on stealth servers. If an <span><strong class="command">also-notify</strong></span> list
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews is given in a <span><strong class="command">zone</strong></span> statement,
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User it will override
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User the <span><strong class="command">options also-notify</strong></span>
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox User statement. When a <span><strong class="command">zone notify</strong></span>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User is set to <span><strong class="command">no</strong></span>, the IP
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater addresses in the global <span><strong class="command">also-notify</strong></span> list will
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User not be sent NOTIFY messages for that zone. The default is
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User list (no global notification list).
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Inbound zone transfers running longer than
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater this many minutes will be terminated. The default is 120
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater (2 hours). The maximum value is 28 days (40320 minutes).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
90ff38a0d8deaf5f9c2aa5916d99b2e572d28738Automatic Updater Inbound zone transfers making no progress
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in this many minutes will be terminated. The default is 60
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User (1 hour). The maximum value is 28 days (40320 minutes).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Outbound zone transfers running longer than
ce0fd07045292942bfa3e755d9ce596941528a63Automatic Updater this many minutes will be terminated. The default is 120
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater (2 hours). The maximum value is 28 days (40320 minutes).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Outbound zone transfers making no progress
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews in this many minutes will be terminated. The default is 60
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater hour). The maximum value is 28 days (40320 minutes).
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews<dt><span class="term"><span><strong class="command">serial-query-rate</strong></span></span></dt>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews Slave servers will periodically query master servers
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews to find out if zone serial numbers have changed. Each such
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater a minute amount of the slave server's network bandwidth. To
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews amount of bandwidth used, BIND 9 limits the rate at which
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User sent. The value of the <span><strong class="command">serial-query-rate</strong></span> option,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews an integer, is the maximum number of queries sent per
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is 20.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">serial-queries</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User In BIND 8, the <span><strong class="command">serial-queries</strong></span>
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater set the maximum number of concurrent serial number queries
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews allowed to be outstanding at any given time.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater BIND 9 does not limit the number of outstanding
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater serial queries and ignores the <span><strong class="command">serial-queries</strong></span> option.
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater Instead, it limits the rate at which the queries are sent
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater as defined using the <span><strong class="command">serial-query-rate</strong></span> option.
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews<dt><span class="term"><span><strong class="command">transfer-format</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User Zone transfers can be sent using two different formats,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">one-answer</strong></span> and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">many-answers</strong></span>.
d98b4b724343547314bde32a54966c8f124a5f03Mark Andrews The <span><strong class="command">transfer-format</strong></span> option is used
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews on the master server to determine which format it sends.
78bc8fdc2488c92d7228e8de19827e2c114c56caAutomatic Updater <span><strong class="command">one-answer</strong></span> uses one DNS message per
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User resource record transferred.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">many-answers</strong></span> packs as many resource
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater records as possible into a message.
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater <span><strong class="command">many-answers</strong></span> is more efficient, but is
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews only supported by relatively new slave servers,
e16b482740c5e7ad4c27e271fa829b957cdf67d4Mark Andrews such as <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson 8.x and <acronym class="acronym">BIND</acronym> 4.9.5 onwards.
e16b482740c5e7ad4c27e271fa829b957cdf67d4Mark Andrews The <span><strong class="command">many-answers</strong></span> format is also supported by
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews recent Microsoft Windows nameservers.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The default is <span><strong class="command">many-answers</strong></span>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">transfer-format</strong></span> may be overridden on a
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews per-server basis by using the <span><strong class="command">server</strong></span>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="term"><span><strong class="command">transfers-in</strong></span></span></dt>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews The maximum number of inbound zone transfers
e705db6d5d886dc14f4a75a2046a075c0750e7eeAutomatic Updater that can be running concurrently. The default value is <code class="literal">10</code>.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Increasing <span><strong class="command">transfers-in</strong></span> may
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox User speed up the convergence
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews of slave zones, but it also may increase the load on the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">transfers-out</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The maximum number of outbound zone transfers
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews that can be running concurrently. Zone transfer requests in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater of the limit will be refused. The default value is <code class="literal">10</code>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">transfers-per-ns</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The maximum number of inbound zone transfers
40696c4c389a780082fb77840c173b201ce696d6Automatic Updater that can be concurrently transferring from a given remote
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The default value is <code class="literal">2</code>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Increasing <span><strong class="command">transfers-per-ns</strong></span>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User speed up the convergence of slave zones, but it also may
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews the load on the remote name server. <span><strong class="command">transfers-per-ns</strong></span> may
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews be overridden on a per-server basis by using the <span><strong class="command">transfers</strong></span> phrase
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User of the <span><strong class="command">server</strong></span> statement.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">transfer-source</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<p><span><strong class="command">transfer-source</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater determines which local address will be bound to IPv4
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User TCP connections used to fetch zones transferred
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater inbound by the server. It also determines the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater source IPv4 address, and optionally the UDP port,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater used for the refresh queries and forwarded dynamic
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater updates. If not set, it defaults to a system
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater controlled value which will usually be the address
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater of the interface "closest to" the remote end. This
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater address must appear in the remote end's
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">allow-transfer</strong></span> option for the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User zone being transferred, if one is specified. This
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater statement sets the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">transfer-source</strong></span> for all zones,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater but can be overridden on a per-view or per-zone
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User basis by including a
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">transfer-source</strong></span> statement within
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the <span><strong class="command">view</strong></span> or
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater <span><strong class="command">zone</strong></span> block in the configuration
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Solaris 2.5.1 and earlier does not support setting the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews source address for TCP sockets.
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews<dt><span class="term"><span><strong class="command">transfer-source-v6</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The same as <span><strong class="command">transfer-source</strong></span>,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User except zone transfers are performed using IPv6.
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater An alternate transfer source if the one listed in
e5fe07a7ebff18f7ed4ac434b37daff6c8ee5d5bAutomatic Updater <span><strong class="command">transfer-source</strong></span> fails and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">use-alt-transfer-source</strong></span> is
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater If you do not wish the alternate transfer source
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews to be used, you should set
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">use-alt-transfer-source</strong></span>
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson appropriately and you should not depend upon
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews getting a answer back to the first refresh
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews An alternate transfer source if the one listed in
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span><strong class="command">transfer-source-v6</strong></span> fails and
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">use-alt-transfer-source</strong></span> is
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User Use the alternate transfer sources or not. If views are
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews specified this defaults to <span><strong class="command">no</strong></span>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User otherwise it defaults to
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span><strong class="command">yes</strong></span> (for BIND 8
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User compatibility).
a900e4f99ff134b567b6df5ac2c841c7d0c551d3Automatic Updater<dt><span class="term"><span><strong class="command">notify-source</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<p><span><strong class="command">notify-source</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater determines which local source address, and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater optionally UDP port, will be used to send NOTIFY
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater messages. This address must appear in the slave
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater server's <span><strong class="command">masters</strong></span> zone clause or
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in an <span><strong class="command">allow-notify</strong></span> clause. This
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater statement sets the <span><strong class="command">notify-source</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater for all zones, but can be overridden on a per-zone or
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater per-view basis by including a
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">notify-source</strong></span> statement within
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the <span><strong class="command">zone</strong></span> or
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span><strong class="command">view</strong></span> block in the configuration
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Solaris 2.5.1 and earlier does not support setting the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews source address for TCP sockets.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">notify-source-v6</strong></span></span></dt>
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews Like <span><strong class="command">notify-source</strong></span>,
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews but applies to notify messages sent to IPv6 addresses.
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews<div class="titlepage"><div><div><h4 class="title">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<a name="id2582572"></a>Bad UDP Port Lists</h4></div></div></div>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<p><span><strong class="command">avoid-v4-udp-ports</strong></span>
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews and <span><strong class="command">avoid-v6-udp-ports</strong></span> specify a list
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews of IPv4 and IPv6 UDP ports that will not be used as system
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews assigned source ports for UDP sockets. These lists
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews prevent named from choosing as its random source port a
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews port that is blocked by your firewall. If a query went
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews out with such a source port, the answer would not get by
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews the firewall and the name server would have to query
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<div class="titlepage"><div><div><h4 class="title">
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews<a name="id2582587"></a>Operating System Resource Limits</h4></div></div></div>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews The server's usage of many system resources can be limited.
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews Scaled values are allowed when specifying resource limits. For
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews example, <span><strong class="command">1G</strong></span> can be used instead of
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <span><strong class="command">1073741824</strong></span> to specify a limit of
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews gigabyte. <span><strong class="command">unlimited</strong></span> requests
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews unlimited use, or the
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews maximum available amount. <span><strong class="command">default</strong></span>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews uses the limit
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews that was in force when the server was started. See the description
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews of <span><strong class="command">size_spec</strong></span> in <a href="Bv9ARM.ch06.html#configuration_file_elements" title="Configuration File Elements">the section called “Configuration File Elements”</a>.
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews The following options set operating system resource limits for
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews the name server process. Some operating systems don't support
4b2cb1422c7c600fbc13b1cb06a8b4693bc11af8Mark Andrews any of the limits. On such systems, a warning will be issued if
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews unsupported limit is used.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><span><strong class="command">coresize</strong></span></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews The maximum size of a core dump. The default
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><span><strong class="command">datasize</strong></span></span></dt>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User The maximum amount of data memory the server
e23256e740b238bddb4ba41ffac5f81a01c92245Automatic Updater may use. The default is <code class="literal">default</code>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This is a hard limit on server memory usage.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User If the server attempts to allocate memory in excess of this
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User limit, the allocation will fail, which may in turn leave
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the server unable to perform DNS service. Therefore,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater this option is rarely useful as a way of limiting the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater amount of memory used by the server, but it can be used
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater to raise an operating system data size limit that is
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User too small by default. If you wish to limit the amount
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User of memory used by the server, use the
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span><strong class="command">max-cache-size</strong></span> and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span><strong class="command">recursive-clients</strong></span>
cd6e9010079a4e58f7e30063df3dec0ff154ad59Tinderbox User options instead.
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater<dt><span class="term"><span><strong class="command">files</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The maximum number of files the server
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson may have open concurrently. The default is <code class="literal">unlimited</code>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">stacksize</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The maximum amount of stack memory the server
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews may use. The default is <code class="literal">default</code>.
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews<div class="titlepage"><div><div><h4 class="title">
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<a name="id2582702"></a>Server Resource Limits</h4></div></div></div>
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User The following options set limits on the server's
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User resource consumption that are enforced internally by the
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User server rather than the operating system.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span><strong class="command">max-ixfr-log-size</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User This option is obsolete; it is accepted
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User and ignored for BIND 8 compatibility. The option
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span><strong class="command">max-journal-size</strong></span> performs a
0a50626faa2f8941f55bf435d3965d490bb5d026Tinderbox User similar function in BIND 9.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">max-journal-size</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Sets a maximum size for each journal file
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews (see <a href="Bv9ARM.ch04.html#journal" title="The journal file">the section called “The journal file”</a>). When the journal file
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the specified size, some of the oldest transactions in the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater will be automatically removed. The default is
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">host-statistics-max</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews In BIND 8, specifies the maximum number of host statistics
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews entries to be kept.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Not implemented in BIND 9.
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews<dt><span class="term"><span><strong class="command">recursive-clients</strong></span></span></dt>
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews The maximum number of simultaneous recursive lookups
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews the server will perform on behalf of clients. The default
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <code class="literal">1000</code>. Because each recursing
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User client uses a fair
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User bit of memory, on the order of 20 kilobytes, the value of
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews <span><strong class="command">recursive-clients</strong></span> option may
922e6a3c2ac4ef900dd9dc99f0cc137f18372583Andreas Gustafsson have to be decreased
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User on hosts with limited memory.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">tcp-clients</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The maximum number of simultaneous client TCP
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User connections that the server will accept.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default is <code class="literal">100</code>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">max-cache-size</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The maximum amount of memory to use for the
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews server's cache, in bytes. When the amount of data in the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User reaches this limit, the server will cause records to expire
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User prematurely so that the limit is not exceeded. In a server
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User multiple views, the limit applies separately to the cache of
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User view. The default is <code class="literal">32M</code>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">tcp-listen-queue</strong></span></span></dt>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews The listen queue depth. The default and minimum is 3.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews If the kernel supports the accept filter "dataready" this
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User also controls how
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User many TCP connections that will be queued in kernel space
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User some data before being passed to accept. Values less than 3
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews silently raised.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<div class="titlepage"><div><div><h4 class="title">
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<a name="id2582836"></a>Periodic Task Intervals</h4></div></div></div>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<dt><span class="term"><span><strong class="command">cleaning-interval</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The server will remove expired resource records
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User from the cache every <span><strong class="command">cleaning-interval</strong></span> minutes.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default is 60 minutes. The maximum value is 28 days
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (40320 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If set to 0, no periodic cleaning will occur.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">heartbeat-interval</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The server will perform zone maintenance tasks
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User for all zones marked as <span><strong class="command">dialup</strong></span> whenever this
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interval expires. The default is 60 minutes. Reasonable
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User values are up
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to 1 day (1440 minutes). The maximum value is 28 days
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (40320 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If set to 0, no zone maintenance for these zones will occur.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">interface-interval</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The server will scan the network interface list
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User every <span><strong class="command">interface-interval</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User minutes. The default
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is 60 minutes. The maximum value is 28 days (40320 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If set to 0, interface scanning will only occur when
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the configuration file is loaded. After the scan, the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User begin listening for queries on any newly discovered
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interfaces (provided they are allowed by the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span><strong class="command">listen-on</strong></span> configuration), and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User stop listening on interfaces that have gone away.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span><strong class="command">statistics-interval</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Name server statistics will be logged
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User every <span><strong class="command">statistics-interval</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User minutes. The default is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User 60. The maximum value is 28 days (40320 minutes).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If set to 0, no statistics will be logged.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Not yet implemented in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="topology"></a>Topology</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User All other things being equal, when the server chooses a name
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to query from a list of name servers, it prefers the one that is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User topologically closest to itself. The <span><strong class="command">topology</strong></span> statement
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User takes an <span><strong class="command">address_match_list</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interprets it
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews in a special way. Each top-level list element is assigned a
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Non-negated elements get a distance based on their position in the
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews list, where the closer the match is to the start of the list, the
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews shorter the distance is between it and the server. A negated match
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews will be assigned the maximum distance from the server. If there
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is no match, the address will get a distance which is further than
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User any non-negated list element, and closer than any negated element.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User will prefer servers on network 10 the most, followed by hosts
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on network 1.2.0.0 (netmask 255.255.0.0) and network 3, with the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User exception of hosts on network 1.2.3 (netmask 255.255.255.0), which
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is preferred least of all.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default topology is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<pre class="programlisting"> topology { localhost; localnets; };
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The <span><strong class="command">topology</strong></span> option
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is not implemented in <acronym class="acronym">BIND</acronym> 9.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<div class="titlepage"><div><div><h4 class="title">
d3be47a4a841ca6fc07e8f18004cf72174e2d117Tinderbox User<a name="the_sortlist_statement"></a>The <span><strong class="command">sortlist</strong></span> Statement</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The response to a DNS query may consist of multiple resource
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User records (RRs) forming a resource records set (RRset).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The name server will normally return the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User RRs within the RRset in an indeterminate order
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (but see the <span><strong class="command">rrset-order</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User statement in <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The client resolver code should rearrange the RRs as appropriate,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User that is, using any addresses on the local net in preference to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User other addresses.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User However, not all resolvers can do this or are correctly
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews When a client is using a local server, the sorting can be performed
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in the server, based on the client's address. This only requires
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews configuring the name servers, not all the clients.
3d2e052eb879189e6d853097f8b568d887323bebTinderbox User The <span><strong class="command">sortlist</strong></span> statement (see below)
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User an <span><strong class="command">address_match_list</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User interprets it even
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User more specifically than the <span><strong class="command">topology</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User does (<a href="Bv9ARM.ch06.html#topology" title="Topology">the section called “Topology”</a>).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Each top level statement in the <span><strong class="command">sortlist</strong></span> must
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User itself be an explicit <span><strong class="command">address_match_list</strong></span> with
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User one or two elements. The first element (which may be an IP
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User an IP prefix, an ACL name or a nested <span><strong class="command">address_match_list</strong></span>)
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews of each top level list is checked against the source address of
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the query until a match is found.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Once the source address of the query has been matched, if
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the top level statement contains only one element, the actual
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User element that matched the source address is used to select the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in the response to move to the beginning of the response. If the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User statement is a list of two elements, then the second element is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User treated the same as the <span><strong class="command">address_match_list</strong></span> in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User a <span><strong class="command">topology</strong></span> statement. Each top
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User level element
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is assigned a distance and the address in the response with the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User distance is moved to the beginning of the response.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User In the following example, any queries received from any of
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the addresses of the host itself will get responses preferring
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on any of the locally connected networks. Next most preferred are
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on the 192.168.1/24 network, and after that either the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User 192.168.3/24 network with no preference shown between these two
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User networks. Queries received from a host on the 192.168.1/24 network
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater will prefer other addresses on that network to the 192.168.2/24
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews 192.168.3/24 networks. Queries received from a host on the
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews or the 192.168.5/24 network will only prefer other addresses on
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User their directly connected networks.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User { localhost; // IF the local host
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User { localnets; // THEN first fit on the
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater { 192.168.3/24; // IF on class C 192.168.3
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User { { 192.168.4/24; 192.168.5/24; }; // if .4 or .5, prefer that net
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews The following example will give reasonable behavior for the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User local host and hosts on directly connected networks. It is similar
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to the behavior of the address sort in <acronym class="acronym">BIND</acronym> 4.9.x. Responses sent
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to queries from the local host will favor any of the directly
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User networks. Responses sent to queries from any other hosts on a
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User connected network will prefer addresses on that same network.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to other queries will not be sorted.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews { localhost; localnets; };
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User { localnets; };
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="rrset_ordering"></a>RRset Ordering</h4></div></div></div>
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater When multiple records are returned in an answer it may be
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User useful to configure the order of the records placed into the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The <span><strong class="command">rrset-order</strong></span> statement permits
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User configuration
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of the ordering of the records in a multiple record response.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User See also the <span><strong class="command">sortlist</strong></span> statement,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a>.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews An <span><strong class="command">order_spec</strong></span> is defined as
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User [<span class="optional">class <em class="replaceable"><code>class_name</code></em></span>]
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews [<span class="optional">type <em class="replaceable"><code>type_name</code></em></span>]
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User [<span class="optional">name <em class="replaceable"><code>"domain_name"</code></em></span>]
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User order <em class="replaceable"><code>ordering</code></em>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If no class is specified, the default is <span><strong class="command">ANY</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If no type is specified, the default is <span><strong class="command">ANY</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If no name is specified, the default is "<span><strong class="command">*</strong></span>" (asterisk).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The legal values for <span><strong class="command">ordering</strong></span> are:
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <p><span><strong class="command">fixed</strong></span></p>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Records are returned in the order they
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User are defined in the zone file.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews <p><span><strong class="command">random</strong></span></p>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Records are returned in some random order.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <p><span><strong class="command">cyclic</strong></span></p>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Records are returned in a round-robin
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews For example:
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater class IN type A name "host.example.com" order random;
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User will cause any responses for type A records in class IN that
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User have "<code class="literal">host.example.com</code>" as a
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User suffix, to always be returned
be41770245bd56746fbb61f9b5ba0aca683f318eTinderbox User in random order. All other records are returned in cyclic order.
af9dbf1ccdd53933aaae9300d13ce0965d39b067Evan Hunt If multiple <span><strong class="command">rrset-order</strong></span> statements
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User they are not combined — the last one applies.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User The <span><strong class="command">rrset-order</strong></span> statement
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User is not yet fully implemented in <acronym class="acronym">BIND</acronym> 9.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User BIND 9 currently does not fully support "fixed" ordering.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<div class="titlepage"><div><div><h4 class="title">
472bcea6e4e6198fa69a533ddd2eb5ad26647ebdTinderbox User<a name="tuning"></a>Tuning</h4></div></div></div>
b87da030df926d03cf53f299cc73b046cfd5e9fbTinderbox User<dt><span class="term"><span><strong class="command">lame-ttl</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Sets the number of seconds to cache a
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews lame server indication. 0 disables caching. (This is
7ac34650fa344f42211d6da744ae486b0145a083Tinderbox User <span class="bold"><strong>NOT</strong></span> recommended.)
5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User The default is <code class="literal">600</code> (10 minutes) and the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews maximum value is
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <code class="literal">1800</code> (30 minutes).
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span><strong class="command">max-ncache-ttl</strong></span></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews To reduce network traffic and increase performance,
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User the server stores negative answers. <span><strong class="command">max-ncache-ttl</strong></span> is
<span><strong class="command">max-ncache-ttl</strong></span> is <code class="literal">10800</code> seconds (3 hours).
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
result of dynamic updates (<a href="Bv9ARM.ch04.html#dynamic_update" title="Dynamic Update">the section called “Dynamic Update”</a>) will expire. There
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
<a href="Bv9ARM.ch06.html#zonefile_format" title="Additional File Formats">the section called “Additional File Formats”</a>).
<span class="term"><span><strong class="command">clients-per-query</strong></span>, </span><span class="term"><span><strong class="command">max-clients-per-query</strong></span></span>
built-in view (see <a href="Bv9ARM.ch06.html#view_statement_grammar" title="view Statement Grammar">the section called “<span><strong class="command">view</strong></span> Statement Grammar”</a>) of
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
<span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
The default <span><strong class="command">server-id</strong></span> is <span><strong class="command">none</strong></span>.
<dt><span class="term"><span><strong class="command">acache-cleaning-interval</strong></span></span></dt>
<a name="id2585364"></a><span><strong class="command">statistics-channels</strong></span> Statement Grammar</h3></div></div></div>
[ inet ( ip_addr | * ) [ port ip_port ] [allow { <em class="replaceable"><code> address_match_list </code></em> } ]; ]
<a name="id2585382"></a><span><strong class="command">statistics-channels</strong></span> Statement Definition and
address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
<a name="server_statement_grammar"></a><span><strong class="command">server</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">server</strong></span> <em class="replaceable"><code>ip_addr[/prefixlen]</code></em> {
[<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em> ; ]</span>]
[<span class="optional"> keys <em class="replaceable"><code>{ string ; [<span class="optional"> string ; [<span class="optional">...</span>]</span>] }</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> query-source [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
[<span class="optional"> query-source-v6 [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
[<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> queryport-pool-interval <em class="replaceable"><code>number</code></em>; </span>]
<a name="server_statement_definition_and_usage"></a><span><strong class="command">server</strong></span> Statement Definition and
value of <span><strong class="command">bogus</strong></span> is <span><strong class="command">no</strong></span>.
The server supports two zone transfer methods. The first, <span><strong class="command">one-answer</strong></span>,
uses one DNS message per resource record transferred. <span><strong class="command">many-answers</strong></span> packs
as many resource records as possible into a message. <span><strong class="command">many-answers</strong></span> is
more efficient, but is only known to be understood by <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
<span><strong class="command">key_id</strong></span> defined by the <span><strong class="command">key</strong></span> statement,
to be used for transaction security (TSIG, <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
<a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<a name="id2586066"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div>
<em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
[<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
<a name="id2586117"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition
DNSSEC security roots. DNSSEC is described in <a href="Bv9ARM.ch04.html#DNSSEC" title="DNSSEC">the section called “DNSSEC”</a>. A security root is defined when the
<a name="view_statement_grammar"></a><span><strong class="command">view</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">view</strong></span> <em class="replaceable"><code>view_name</code></em>
<a name="id2586199"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
// Provide a complete view of the example.com zone
zone "example.com" {
file "example-internal.db";
// Provide a restricted view of the example.com zone
zone "example.com" {
file "example-external.db";
<pre class="programlisting"><span><strong class="command">zone</strong></span> <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-policy { <em class="replaceable"><code>update_policy_rule</code></em> [<span class="optional">...</span>] }; </span>]
[<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-mx (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-re-signing-interval <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; // Not Implemented. </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
<a name="id2587785"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div>
status of infrastructure zones (e.g. COM, NET, ORG).
a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>),
in the mid-1970s. Zone data for it can be specified with the <code class="literal">CHAOS</code> class.
<span><strong class="command">allow-notify</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query-on</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>.
<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
network. The default varies according to zone type. For <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>. For <span><strong class="command">slave</strong></span>
<span><strong class="command">check-mx</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-wildcard</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-integrity</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-sibling</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">zero-no-soa-ttl</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">update-check-ksk</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">try-tcp-refresh</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">dialup</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
after trying the forwarders and getting no answer, while <span><strong class="command">first</strong></span> would
This is applicable to <span><strong class="command">master</strong></span> and <span><strong class="command">slave</strong></span> zones.
<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
<span><strong class="command">max-transfer-time-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
<span><strong class="command">max-transfer-time-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">notify-delay</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
zones when they are loaded from disk. <acronym class="acronym">BIND</acronym> 9 does not verify signatures
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
<span><strong class="command">sig-validity-interval</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">sig-re-signing-interval</strong></span></span></dt>
<span><strong class="command">sig-re-signing-interval</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-nodes</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span><strong class="command">sig-signing-signatures</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-type</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
<span><strong class="command">alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
<span><strong class="command">alt-transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
<span><strong class="command">use-alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
See the description in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
<span><strong class="command">ixfr-from-differences</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">key-directory</strong></span> in <a href="Bv9ARM.ch06.html#options" title="options Statement Definition and
Usage">the section called “<span><strong class="command">options</strong></span> Statement Definition and
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
( <span><strong class="command">grant</strong></span> | <span><strong class="command">deny</strong></span> ) <em class="replaceable"><code>identity</code></em> <em class="replaceable"><code>nametype</code></em> <em class="replaceable"><code>name</code></em> [<span class="optional"> <em class="replaceable"><code>types</code></em> </span>]
<a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div>
that a particular nearby server be tried first. See <a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a> and <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>.
built-in server information zones, e.g.,
any order), and if neither of those succeed, delivery to <code class="literal">mail.backup.org</code> will
and PTR records. Entries in the in-addr.arpa domain are made in
in-addr.arpa name of
3.2.1.10.in-addr.arpa. This name should have a PTR resource record
Master File Directives include <span><strong class="command">$ORIGIN</strong></span>, <span><strong class="command">$INCLUDE</strong></span>,
<a name="id2593095"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div>
$ORIGIN example.com.
<a name="id2593156"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div>
if it were included into the file at this point. If <span><strong class="command">origin</strong></span> is
revert to the values they had prior to the <span><strong class="command">$INCLUDE</strong></span> once
<a name="id2593293"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div>
<a name="id2593330"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div>
Classless IN-ADDR.ARPA delegation.
The <span><strong class="command">$GENERATE</strong></span> directive is a <acronym class="acronym">BIND</acronym> extension
<td width="40%" align="left" valign="top">Chapter�5.�The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver�</td>