Bv9ARM.ch06.html revision bec154197d3d640b0d5b416cd5218ea58dca5d3a
0dc2366f7b9f9f36e10909b1e95edbf2a261c2acVenugopal Iyer - Copyright (C) 2004-2013 Internet Systems Consortium, Inc. ("ISC")
e07d9cb85217949d497b02d7211de8a197d2f2ebzf - Copyright (C) 2000-2003 Internet Software Consortium.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf - Permission to use, copy, modify, and/or distribute this software for any
e07d9cb85217949d497b02d7211de8a197d2f2ebzf - purpose with or without fee is hereby granted, provided that the above
e07d9cb85217949d497b02d7211de8a197d2f2ebzf - copyright notice and this permission notice appear in all copies.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
e07d9cb85217949d497b02d7211de8a197d2f2ebzf - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
e07d9cb85217949d497b02d7211de8a197d2f2ebzf - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
e07d9cb85217949d497b02d7211de8a197d2f2ebzf - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
e07d9cb85217949d497b02d7211de8a197d2f2ebzf - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
e07d9cb85217949d497b02d7211de8a197d2f2ebzf - PERFORMANCE OF THIS SOFTWARE.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<!-- $Id$ -->
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<link rel="prev" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<link rel="next" href="Bv9ARM.ch07.html" title="Chapter�7.�BIND 9 Security Considerations">
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<tr><th colspan="3" align="center">Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</th></tr>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch07.html">Next</a>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="Bv9ARM.ch06"></a>Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</h2></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2564023">Comment Syntax</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575333"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575523"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575814"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575831"><span><strong class="command">include</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575923"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575946"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576037"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576231"><span><strong class="command">logging</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578326"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578400"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578464"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578576"><span><strong class="command">masters</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578597"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#statschannels"><span><strong class="command">statistics-channels</strong></span> Statement Grammar</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590679"><span><strong class="command">statistics-channels</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#trusted-keys"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590819"><span><strong class="command">trusted-keys</strong></span> Statement Definition
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590934"><span><strong class="command">managed-keys</strong></span> Statement Grammar</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#managed-keys"><span><strong class="command">managed-keys</strong></span> Statement Definition
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591360"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2593127"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2596625">Zone File</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2598718">Discussion of MX Records</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2599402">Inverse Mapping in IPv4</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2599529">Other Zone File Directives</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2599802"><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="sect1"><a href="Bv9ARM.ch06.html#statistics">BIND9 Statistics</a></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch06.html#statistics_counters">Statistics Counters</a></span></dt></dl></dd>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <acronym class="acronym">BIND</acronym> 9 configuration is broadly similar
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to <acronym class="acronym">BIND</acronym> 8; however, there are a few new
e07d9cb85217949d497b02d7211de8a197d2f2ebzf of configuration, such as views. <acronym class="acronym">BIND</acronym>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf 8 configuration files should work with few alterations in <acronym class="acronym">BIND</acronym>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf 9, although more complex configurations should be reviewed to check
e07d9cb85217949d497b02d7211de8a197d2f2ebzf if they can be more efficiently implemented using the new features
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <acronym class="acronym">BIND</acronym> 4 configuration files can be
e07d9cb85217949d497b02d7211de8a197d2f2ebzf converted to the new format
e07d9cb85217949d497b02d7211de8a197d2f2ebzf using the shell script
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="filename">contrib/named-bootconf/named-bootconf.sh</code>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<div class="titlepage"><div><div><h2 class="title" style="clear: both">
020c47705d28102a8df83a43ddf08e34dde21f22ql<a name="configuration_file_elements"></a>Configuration File Elements</h2></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Following is a list of elements used throughout the <acronym class="acronym">BIND</acronym> configuration
e07d9cb85217949d497b02d7211de8a197d2f2ebzf file documentation:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf</colgroup>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The name of an <code class="varname">address_match_list</code> as
e07d9cb85217949d497b02d7211de8a197d2f2ebzf defined by the <span><strong class="command">acl</strong></span> statement.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf A list of one or more
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="varname">ip_prefix</code>, <code class="varname">key_id</code>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a>.
0dc2366f7b9f9f36e10909b1e95edbf2a261c2acVenugopal Iyer A named list of one or more <code class="varname">ip_addr</code>
0dc2366f7b9f9f36e10909b1e95edbf2a261c2acVenugopal Iyer with optional <code class="varname">key_id</code> and/or
e07d9cb85217949d497b02d7211de8a197d2f2ebzf A <code class="varname">masters_list</code> may include other
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang A quoted string which will be used as
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang a DNS name, for example "<code class="literal">my.test.domain</code>".
e07d9cb85217949d497b02d7211de8a197d2f2ebzf A list of one or more <code class="varname">domain_name</code>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf One to four integers valued 0 through
e07d9cb85217949d497b02d7211de8a197d2f2ebzf 255 separated by dots (`.'), such as <span><strong class="command">123</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">45.67</strong></span> or <span><strong class="command">89.123.45.67</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf An IPv4 address with exactly four elements
e07d9cb85217949d497b02d7211de8a197d2f2ebzf An IPv6 address, such as <span><strong class="command">2001:db8::1234</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf IPv6 scoped addresses that have ambiguity on their
e07d9cb85217949d497b02d7211de8a197d2f2ebzf scope zones must be disambiguated by an appropriate
e07d9cb85217949d497b02d7211de8a197d2f2ebzf zone ID with the percent character (`%') as
e07d9cb85217949d497b02d7211de8a197d2f2ebzf delimiter. It is strongly recommended to use
e07d9cb85217949d497b02d7211de8a197d2f2ebzf string zone names rather than numeric identifiers,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf in order to be robust against system configuration
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang changes. However, since there is no standard
e07d9cb85217949d497b02d7211de8a197d2f2ebzf mapping for such names and identifier values,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf currently only interface names as link identifiers
e07d9cb85217949d497b02d7211de8a197d2f2ebzf are supported, assuming one-to-one mapping between
e07d9cb85217949d497b02d7211de8a197d2f2ebzf interfaces and links. For example, a link-local
e07d9cb85217949d497b02d7211de8a197d2f2ebzf address <span><strong class="command">fe80::1</strong></span> on the link
e07d9cb85217949d497b02d7211de8a197d2f2ebzf attached to the interface <span><strong class="command">ne0</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf can be specified as <span><strong class="command">fe80::1%ne0</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Note that on most systems link-local addresses
e07d9cb85217949d497b02d7211de8a197d2f2ebzf always have the ambiguity, and need to be
e07d9cb85217949d497b02d7211de8a197d2f2ebzf disambiguated.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf An <code class="varname">ip4_addr</code> or <code class="varname">ip6_addr</code>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf through 65535, with values
e07d9cb85217949d497b02d7211de8a197d2f2ebzf below 1024 typically restricted to use by processes running
e07d9cb85217949d497b02d7211de8a197d2f2ebzf In some cases, an asterisk (`*') character can be used as a
e07d9cb85217949d497b02d7211de8a197d2f2ebzf placeholder to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf select a random high-numbered port.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf An IP network specified as an <code class="varname">ip_addr</code>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf followed by a slash (`/') and then the number of bits in the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf may omitted.
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang For example, <span><strong class="command">127/8</strong></span> is the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf network <span><strong class="command">127.0.0.0</strong></span> with
e07d9cb85217949d497b02d7211de8a197d2f2ebzf netmask <span><strong class="command">255.0.0.0</strong></span> and <span><strong class="command">1.2.3.0/28</strong></span> is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf network <span><strong class="command">1.2.3.0</strong></span> with netmask <span><strong class="command">255.255.255.240</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf When specifying a prefix involving a IPv6 scoped address
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the scope may be omitted. In that case the prefix will
e07d9cb85217949d497b02d7211de8a197d2f2ebzf match packets from any scope.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the name of a shared key, to be used for transaction
e07d9cb85217949d497b02d7211de8a197d2f2ebzf A list of one or more
e07d9cb85217949d497b02d7211de8a197d2f2ebzf separated by semicolons and ending with a semicolon.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf A non-negative 32-bit integer
e07d9cb85217949d497b02d7211de8a197d2f2ebzf (i.e., a number between 0 and 4294967295, inclusive).
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Its acceptable value might further
e07d9cb85217949d497b02d7211de8a197d2f2ebzf be limited by the context in which it is used.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf A quoted string which will be used as
e07d9cb85217949d497b02d7211de8a197d2f2ebzf a pathname, such as <code class="filename">zones/master/my.test.domain</code>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf A list of an <code class="varname">ip_port</code> or a port
e07d9cb85217949d497b02d7211de8a197d2f2ebzf A port range is specified in the form of
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <strong class="userinput"><code>range</code></strong> followed by
e07d9cb85217949d497b02d7211de8a197d2f2ebzf port numbers from <code class="varname">port_low</code> through
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="varname">port_low</code> must not be larger than
e07d9cb85217949d497b02d7211de8a197d2f2ebzf For example,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <strong class="userinput"><code>range 1024 65535</code></strong> represents
e07d9cb85217949d497b02d7211de8a197d2f2ebzf ports from 1024 through 65535.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf In either case an asterisk (`*') character is not
e07d9cb85217949d497b02d7211de8a197d2f2ebzf A number, the word <strong class="userinput"><code>unlimited</code></strong>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf or the word <strong class="userinput"><code>default</code></strong>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf An <code class="varname">unlimited</code> <code class="varname">size_spec</code> requests unlimited
e07d9cb85217949d497b02d7211de8a197d2f2ebzf use, or the maximum available amount. A <code class="varname">default size_spec</code> uses
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the limit that was in force when the server was started.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf followed by a scaling factor:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <strong class="userinput"><code>K</code></strong> or <strong class="userinput"><code>k</code></strong>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf for kilobytes,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <strong class="userinput"><code>M</code></strong> or <strong class="userinput"><code>m</code></strong>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf for megabytes, and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <strong class="userinput"><code>G</code></strong> or <strong class="userinput"><code>g</code></strong> for gigabytes,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf which scale by 1024, 1024*1024, and 1024*1024*1024
e07d9cb85217949d497b02d7211de8a197d2f2ebzf respectively.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The value must be representable as a 64-bit unsigned integer
e07d9cb85217949d497b02d7211de8a197d2f2ebzf (0 to 18446744073709551615, inclusive).
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to safely set a really large number.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Either <strong class="userinput"><code>yes</code></strong> or <strong class="userinput"><code>no</code></strong>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The words <strong class="userinput"><code>true</code></strong> and <strong class="userinput"><code>false</code></strong> are
e07d9cb85217949d497b02d7211de8a197d2f2ebzf also accepted, as are the numbers <strong class="userinput"><code>1</code></strong>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf One of <strong class="userinput"><code>yes</code></strong>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <strong class="userinput"><code>no</code></strong>, <strong class="userinput"><code>notify</code></strong>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <strong class="userinput"><code>notify-passive</code></strong>, <strong class="userinput"><code>refresh</code></strong> or
e07d9cb85217949d497b02d7211de8a197d2f2ebzf When used in a zone, <strong class="userinput"><code>notify-passive</code></strong>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <strong class="userinput"><code>refresh</code></strong>, and <strong class="userinput"><code>passive</code></strong>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf are restricted to slave and stub zones.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="address_match_lists"></a>Address Match Lists</h3></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> address_match_list_element; ... </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] |
e07d9cb85217949d497b02d7211de8a197d2f2ebzf key key_id | acl_name | { address_match_list } )
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2574330"></a>Definition and Usage</h4></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Address match lists are primarily used to determine access
e07d9cb85217949d497b02d7211de8a197d2f2ebzf control for various server operations. They are also used in
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the <span><strong class="command">listen-on</strong></span> and <span><strong class="command">sortlist</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf statements. The elements which constitute an address match
e07d9cb85217949d497b02d7211de8a197d2f2ebzf list can be any of the following:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf a key ID, as defined by the <span><strong class="command">key</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<li>the name of an address match list defined with
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the <span><strong class="command">acl</strong></span> statement
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Elements can be negated with a leading exclamation mark (`!'),
e07d9cb85217949d497b02d7211de8a197d2f2ebzf and the match list names "any", "none", "localhost", and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf "localnets" are predefined. More information on those names
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang can be found in the description of the acl statement.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The addition of the key clause made the name of this syntactic
e07d9cb85217949d497b02d7211de8a197d2f2ebzf element something of a misnomer, since security keys can be used
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to validate access without regard to a host or network address.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Nonetheless, the term "address match list" is still used
e07d9cb85217949d497b02d7211de8a197d2f2ebzf throughout the documentation.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf When a given IP address or prefix is compared to an address
e07d9cb85217949d497b02d7211de8a197d2f2ebzf match list, the comparison takes place in approximately O(1)
e07d9cb85217949d497b02d7211de8a197d2f2ebzf time. However, key comparisons require that the list of keys
e07d9cb85217949d497b02d7211de8a197d2f2ebzf be traversed until a matching key is found, and therefore may
e07d9cb85217949d497b02d7211de8a197d2f2ebzf be somewhat slower.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The interpretation of a match depends on whether the list is being
e07d9cb85217949d497b02d7211de8a197d2f2ebzf used for access control, defining <span><strong class="command">listen-on</strong></span> ports, or in a
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">sortlist</strong></span>, and whether the element was negated.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf When used as an access control list, a non-negated match
e07d9cb85217949d497b02d7211de8a197d2f2ebzf allows access and a negated match denies access. If
e07d9cb85217949d497b02d7211de8a197d2f2ebzf there is no match, access is denied. The clauses
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">allow-notify</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">allow-recursion</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">allow-recursion-on</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">allow-query</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">allow-query-on</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">allow-query-cache</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">allow-query-cache-on</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">allow-transfer</strong></span>,
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang <span><strong class="command">allow-update</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">allow-update-forwarding</strong></span>, and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">blackhole</strong></span> all use address match
e07d9cb85217949d497b02d7211de8a197d2f2ebzf lists. Similarly, the <span><strong class="command">listen-on</strong></span> option will cause the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf server to refuse queries on any of the machine's
e07d9cb85217949d497b02d7211de8a197d2f2ebzf addresses which do not match the list.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Order of insertion is significant. If more than one element
e07d9cb85217949d497b02d7211de8a197d2f2ebzf in an ACL is found to match a given IP address or prefix,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf preference will be given to the one that came
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span class="emphasis"><em>first</em></span> in the ACL definition.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Because of this first-match behavior, an element that
e07d9cb85217949d497b02d7211de8a197d2f2ebzf defines a subset of another element in the list should
e07d9cb85217949d497b02d7211de8a197d2f2ebzf come before the broader element, regardless of whether
e07d9cb85217949d497b02d7211de8a197d2f2ebzf either is negated. For example, in
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">1.2.3/24; ! 1.2.3.13;</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the 1.2.3.13 element is completely useless because the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf algorithm will match any lookup for 1.2.3.13 to the 1.2.3/24
e07d9cb85217949d497b02d7211de8a197d2f2ebzf element. Using <span><strong class="command">! 1.2.3.13; 1.2.3/24</strong></span> fixes
e07d9cb85217949d497b02d7211de8a197d2f2ebzf that problem by having 1.2.3.13 blocked by the negation, but
e07d9cb85217949d497b02d7211de8a197d2f2ebzf all other 1.2.3.* hosts fall through.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2564023"></a>Comment Syntax</h3></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for
e07d9cb85217949d497b02d7211de8a197d2f2ebzf comments to appear
e07d9cb85217949d497b02d7211de8a197d2f2ebzf anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration
e07d9cb85217949d497b02d7211de8a197d2f2ebzf file. To appeal to programmers of all kinds, they can be written
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting">// This is a <acronym class="acronym">BIND</acronym> comment as in C++</pre>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting"># This is a <acronym class="acronym">BIND</acronym> comment as in common UNIX shells
e07d9cb85217949d497b02d7211de8a197d2f2ebzf# and perl</pre>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2564068"></a>Definition and Usage</h4></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Comments may appear anywhere that whitespace may appear in
e07d9cb85217949d497b02d7211de8a197d2f2ebzf a <acronym class="acronym">BIND</acronym> configuration file.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf C-style comments start with the two characters /* (slash,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf star) and end with */ (star, slash). Because they are completely
e07d9cb85217949d497b02d7211de8a197d2f2ebzf delimited with these characters, they can be used to comment only
e07d9cb85217949d497b02d7211de8a197d2f2ebzf a portion of a line or to span multiple lines.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf C-style comments cannot be nested. For example, the following
e07d9cb85217949d497b02d7211de8a197d2f2ebzf is not valid because the entire comment ends with the first */:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting">/* This is the start of a comment.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf This is still part of the comment.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf/* This is an incorrect attempt at nesting a comment. */
e07d9cb85217949d497b02d7211de8a197d2f2ebzf This is no longer in any comment. */
e07d9cb85217949d497b02d7211de8a197d2f2ebzf C++-style comments start with the two characters // (slash,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf slash) and continue to the end of the physical line. They cannot
e07d9cb85217949d497b02d7211de8a197d2f2ebzf be continued across multiple physical lines; to have one logical
e07d9cb85217949d497b02d7211de8a197d2f2ebzf comment span multiple lines, each line must use the // pair.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf For example:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting">// This is the start of a comment. The next line
e07d9cb85217949d497b02d7211de8a197d2f2ebzf// is a new comment, even though it is logically
e07d9cb85217949d497b02d7211de8a197d2f2ebzf// part of the previous comment.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Shell-style (or perl-style, if you prefer) comments start
e07d9cb85217949d497b02d7211de8a197d2f2ebzf with the character <code class="literal">#</code> (number sign)
e07d9cb85217949d497b02d7211de8a197d2f2ebzf and continue to the end of the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf physical line, as in C++ comments.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf For example:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting"># This is the start of a comment. The next line
e07d9cb85217949d497b02d7211de8a197d2f2ebzf# is a new comment, even though it is logically
e07d9cb85217949d497b02d7211de8a197d2f2ebzf# part of the previous comment.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
e07d9cb85217949d497b02d7211de8a197d2f2ebzf You cannot use the semicolon (`;') character
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to start a comment such as you would in a zone file. The
e07d9cb85217949d497b02d7211de8a197d2f2ebzf semicolon indicates the end of a configuration
e07d9cb85217949d497b02d7211de8a197d2f2ebzf statement.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<div class="titlepage"><div><div><h2 class="title" style="clear: both">
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="Configuration_File_Grammar"></a>Configuration File Grammar</h2></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf A <acronym class="acronym">BIND</acronym> 9 configuration consists of
e07d9cb85217949d497b02d7211de8a197d2f2ebzf statements and comments.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Statements end with a semicolon. Statements and comments are the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf only elements that can appear without enclosing braces. Many
e07d9cb85217949d497b02d7211de8a197d2f2ebzf statements contain a block of sub-statements, which are also
e07d9cb85217949d497b02d7211de8a197d2f2ebzf terminated with a semicolon.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The following statements are supported:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf</colgroup>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf defines a named IP address
e07d9cb85217949d497b02d7211de8a197d2f2ebzf matching list, for access control and other uses.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">controls</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf declares control channels to be used
e07d9cb85217949d497b02d7211de8a197d2f2ebzf by the <span><strong class="command">rndc</strong></span> utility.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">include</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf includes a file.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf specifies key information for use in
e07d9cb85217949d497b02d7211de8a197d2f2ebzf authentication and authorization using TSIG.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">logging</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf specifies what the server logs, and where
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the log messages are sent.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">lwres</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf configures <span><strong class="command">named</strong></span> to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf also act as a light-weight resolver daemon (<span><strong class="command">lwresd</strong></span>).
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">masters</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf defines a named masters list for
e07d9cb85217949d497b02d7211de8a197d2f2ebzf inclusion in stub and slave zones'
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">also-notify</strong></span> lists.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">options</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf controls global server configuration
e07d9cb85217949d497b02d7211de8a197d2f2ebzf options and sets defaults for other statements.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">server</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf sets certain configuration options on
e07d9cb85217949d497b02d7211de8a197d2f2ebzf a per-server basis.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">statistics-channels</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf declares communication channels to get access to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">named</strong></span> statistics.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">trusted-keys</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf defines trusted DNSSEC keys.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">managed-keys</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf lists DNSSEC keys to be kept up to date
e07d9cb85217949d497b02d7211de8a197d2f2ebzf using RFC 5011 trust anchor maintenance.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">view</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf defines a view.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">zone</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf defines a zone.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">logging</strong></span> and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">options</strong></span> statements may only occur once
e07d9cb85217949d497b02d7211de8a197d2f2ebzf configuration.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2575333"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting"><span><strong class="command">acl</strong></span> acl-name {
e07d9cb85217949d497b02d7211de8a197d2f2ebzf address_match_list
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="acl"></a><span><strong class="command">acl</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">acl</strong></span> statement assigns a symbolic
e07d9cb85217949d497b02d7211de8a197d2f2ebzf name to an address match list. It gets its name from a primary
e07d9cb85217949d497b02d7211de8a197d2f2ebzf use of address match lists: Access Control Lists (ACLs).
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Note that an address match list's name must be defined
e07d9cb85217949d497b02d7211de8a197d2f2ebzf with <span><strong class="command">acl</strong></span> before it can be used
e07d9cb85217949d497b02d7211de8a197d2f2ebzf elsewhere; no forward references are allowed.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The following ACLs are built-in:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf</colgroup>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Matches all hosts.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">none</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Matches no hosts.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">localhost</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Matches the IPv4 and IPv6 addresses of all network
e07d9cb85217949d497b02d7211de8a197d2f2ebzf interfaces on the system.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">localnets</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Matches any host on an IPv4 or IPv6 network
e07d9cb85217949d497b02d7211de8a197d2f2ebzf for which the system has an interface.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Some systems do not provide a way to determine the prefix
e07d9cb85217949d497b02d7211de8a197d2f2ebzf lengths of
e07d9cb85217949d497b02d7211de8a197d2f2ebzf local IPv6 addresses.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf In such a case, <span><strong class="command">localnets</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf only matches the local
e07d9cb85217949d497b02d7211de8a197d2f2ebzf IPv6 addresses, just like <span><strong class="command">localhost</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2575523"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting"><span><strong class="command">controls</strong></span> {
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [ inet ( ip_addr | * ) [ port ip_port ]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf allow { <em class="replaceable"><code> address_match_list </code></em> }
e07d9cb85217949d497b02d7211de8a197d2f2ebzf keys { <em class="replaceable"><code>key_list</code></em> }; ]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [ inet ...; ]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [ unix <em class="replaceable"><code>path</code></em> perm <em class="replaceable"><code>number</code></em> owner <em class="replaceable"><code>number</code></em> group <em class="replaceable"><code>number</code></em>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf keys { <em class="replaceable"><code>key_list</code></em> }; ]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [ unix ...; ]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="controls_statement_definition_and_usage"></a><span><strong class="command">controls</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">controls</strong></span> statement declares control
e07d9cb85217949d497b02d7211de8a197d2f2ebzf channels to be used by system administrators to control the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf operation of the name server. These control channels are
e07d9cb85217949d497b02d7211de8a197d2f2ebzf used by the <span><strong class="command">rndc</strong></span> utility to send
e07d9cb85217949d497b02d7211de8a197d2f2ebzf commands to and retrieve non-DNS results from a name server.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf An <span><strong class="command">inet</strong></span> control channel is a TCP socket
e07d9cb85217949d497b02d7211de8a197d2f2ebzf listening at the specified <span><strong class="command">ip_port</strong></span> on the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf specified <span><strong class="command">ip_addr</strong></span>, which can be an IPv4 or IPv6
e07d9cb85217949d497b02d7211de8a197d2f2ebzf address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf interpreted as the IPv4 wildcard address; connections will be
e07d9cb85217949d497b02d7211de8a197d2f2ebzf accepted on any of the system's IPv4 addresses.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf To listen on the IPv6 wildcard address,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf use an <span><strong class="command">ip_addr</strong></span> of <code class="literal">::</code>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If you will only use <span><strong class="command">rndc</strong></span> on the local host,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf using the loopback address (<code class="literal">127.0.0.1</code>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf or <code class="literal">::1</code>) is recommended for maximum security.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If no port is specified, port 953 is used. The asterisk
e07d9cb85217949d497b02d7211de8a197d2f2ebzf "<code class="literal">*</code>" cannot be used for <span><strong class="command">ip_port</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The ability to issue commands over the control channel is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf restricted by the <span><strong class="command">allow</strong></span> and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">keys</strong></span> clauses.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Connections to the control channel are permitted based on the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">address_match_list</strong></span>. This is for simple
e07d9cb85217949d497b02d7211de8a197d2f2ebzf IP address based filtering only; any <span><strong class="command">key_id</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf elements of the <span><strong class="command">address_match_list</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf are ignored.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf A <span><strong class="command">unix</strong></span> control channel is a UNIX domain
e07d9cb85217949d497b02d7211de8a197d2f2ebzf socket listening at the specified path in the file system.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Access to the socket is specified by the <span><strong class="command">perm</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">owner</strong></span> and <span><strong class="command">group</strong></span> clauses.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Note on some platforms (SunOS and Solaris) the permissions
e07d9cb85217949d497b02d7211de8a197d2f2ebzf (<span><strong class="command">perm</strong></span>) are applied to the parent directory
e07d9cb85217949d497b02d7211de8a197d2f2ebzf as the permissions on the socket itself are ignored.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The primary authorization mechanism of the command
e07d9cb85217949d497b02d7211de8a197d2f2ebzf channel is the <span><strong class="command">key_list</strong></span>, which
e07d9cb85217949d497b02d7211de8a197d2f2ebzf contains a list of <span><strong class="command">key_id</strong></span>s.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Each <span><strong class="command">key_id</strong></span> in the <span><strong class="command">key_list</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf is authorized to execute commands over the control channel.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf See <a href="Bv9ARM.ch03.html#rndc">Remote Name Daemon Control application</a> in <a href="Bv9ARM.ch03.html#admin_tools" title="Administrative Tools">the section called “Administrative Tools”</a>)
e07d9cb85217949d497b02d7211de8a197d2f2ebzf for information about configuring keys in <span><strong class="command">rndc</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If no <span><strong class="command">controls</strong></span> statement is present,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">named</strong></span> will set up a default
e07d9cb85217949d497b02d7211de8a197d2f2ebzf control channel listening on the loopback address 127.0.0.1
e07d9cb85217949d497b02d7211de8a197d2f2ebzf and its IPv6 counterpart ::1.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf In this case, and also when the <span><strong class="command">controls</strong></span> statement
e07d9cb85217949d497b02d7211de8a197d2f2ebzf is present but does not have a <span><strong class="command">keys</strong></span> clause,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">named</strong></span> will attempt to load the command channel key
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="filename">/etc</code> (or whatever <code class="varname">sysconfdir</code>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf was specified as when <acronym class="acronym">BIND</acronym> was built).
e07d9cb85217949d497b02d7211de8a197d2f2ebzf To create a <code class="filename">rndc.key</code> file, run
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <strong class="userinput"><code>rndc-confgen -a</code></strong>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <code class="filename">rndc.key</code> feature was created to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf ease the transition of systems from <acronym class="acronym">BIND</acronym> 8,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf which did not have digital signatures on its command channel
e07d9cb85217949d497b02d7211de8a197d2f2ebzf messages and thus did not have a <span><strong class="command">keys</strong></span> clause.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf It makes it possible to use an existing <acronym class="acronym">BIND</acronym> 8
e07d9cb85217949d497b02d7211de8a197d2f2ebzf configuration file in <acronym class="acronym">BIND</acronym> 9 unchanged,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf and still have <span><strong class="command">rndc</strong></span> work the same way
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">ndc</strong></span> worked in BIND 8, simply by executing the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf command <strong class="userinput"><code>rndc-confgen -a</code></strong> after BIND 9 is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf installed.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf is only intended to allow the backward-compatible usage of
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <acronym class="acronym">BIND</acronym> 8 configuration files, this
e07d9cb85217949d497b02d7211de8a197d2f2ebzf feature does not
e07d9cb85217949d497b02d7211de8a197d2f2ebzf have a high degree of configurability. You cannot easily change
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the key name or the size of the secret, so you should make a
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="filename">rndc.conf</code> with your own key if you
e07d9cb85217949d497b02d7211de8a197d2f2ebzf wish to change
e07d9cb85217949d497b02d7211de8a197d2f2ebzf those things. The <code class="filename">rndc.key</code> file
e07d9cb85217949d497b02d7211de8a197d2f2ebzf also has its
e07d9cb85217949d497b02d7211de8a197d2f2ebzf permissions set such that only the owner of the file (the user that
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">named</strong></span> is running as) can access it.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf desire greater flexibility in allowing other users to access
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang <span><strong class="command">rndc</strong></span> commands, then you need to create
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="filename">rndc.conf</code> file and make it group
e07d9cb85217949d497b02d7211de8a197d2f2ebzf readable by a group
e07d9cb85217949d497b02d7211de8a197d2f2ebzf that contains the users who should have access.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf To disable the command channel, use an empty
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang <span><strong class="command">controls</strong></span> statement:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">controls { };</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2575814"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div>
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang<pre class="programlisting"><span><strong class="command">include</strong></span> <em class="replaceable"><code>filename</code></em>;</pre>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2575831"></a><span><strong class="command">include</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">include</strong></span> statement inserts the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf specified file at the point where the <span><strong class="command">include</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf statement is encountered. The <span><strong class="command">include</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf statement facilitates the administration of configuration
e07d9cb85217949d497b02d7211de8a197d2f2ebzf by permitting the reading or writing of some things but not
e07d9cb85217949d497b02d7211de8a197d2f2ebzf others. For example, the statement could include private keys
e07d9cb85217949d497b02d7211de8a197d2f2ebzf that are readable only by the name server.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2575923"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting"><span><strong class="command">key</strong></span> <em class="replaceable"><code>key_id</code></em> {
e07d9cb85217949d497b02d7211de8a197d2f2ebzf algorithm <em class="replaceable"><code>string</code></em>;
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang secret <em class="replaceable"><code>string</code></em>;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2575946"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">key</strong></span> statement defines a shared
e07d9cb85217949d497b02d7211de8a197d2f2ebzf secret key for use with TSIG (see <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
e07d9cb85217949d497b02d7211de8a197d2f2ebzf or the command channel
e07d9cb85217949d497b02d7211de8a197d2f2ebzf (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Usage”</a>).
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">key</strong></span> statement can occur at the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf of the configuration file or inside a <span><strong class="command">view</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf statement. Keys defined in top-level <span><strong class="command">key</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf statements can be used in all views. Keys intended for use in
e07d9cb85217949d497b02d7211de8a197d2f2ebzf a <span><strong class="command">controls</strong></span> statement
e07d9cb85217949d497b02d7211de8a197d2f2ebzf (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Usage">the section called “<span><strong class="command">controls</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Usage”</a>)
e07d9cb85217949d497b02d7211de8a197d2f2ebzf must be defined at the top level.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <em class="replaceable"><code>key_id</code></em>, also known as the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf key name, is a domain name uniquely identifying the key. It can
e07d9cb85217949d497b02d7211de8a197d2f2ebzf be used in a <span><strong class="command">server</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf statement to cause requests sent to that
e07d9cb85217949d497b02d7211de8a197d2f2ebzf server to be signed with this key, or in address match lists to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf verify that incoming requests have been signed with a key
e07d9cb85217949d497b02d7211de8a197d2f2ebzf matching this name, algorithm, and secret.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <em class="replaceable"><code>algorithm_id</code></em> is a string
e07d9cb85217949d497b02d7211de8a197d2f2ebzf that specifies a security/authentication algorithm. Named
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf and <code class="literal">hmac-sha512</code> TSIG authentication.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Truncated hashes are supported by appending the minimum
e07d9cb85217949d497b02d7211de8a197d2f2ebzf number of required bits preceded by a dash, e.g.
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang <em class="replaceable"><code>secret_string</code></em> is the secret
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to be used by the algorithm, and is treated as a base-64
e07d9cb85217949d497b02d7211de8a197d2f2ebzf encoded string.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2576037"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting"><span><strong class="command">logging</strong></span> {
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [ <span><strong class="command">channel</strong></span> <em class="replaceable"><code>channel_name</code></em> {
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang ( <span><strong class="command">file</strong></span> <em class="replaceable"><code>path_name</code></em>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [ <span><strong class="command">versions</strong></span> ( <em class="replaceable"><code>number</code></em> | <span><strong class="command">unlimited</strong></span> ) ]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [ <span><strong class="command">size</strong></span> <em class="replaceable"><code>size_spec</code></em> ]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf | <span><strong class="command">syslog</strong></span> <em class="replaceable"><code>syslog_facility</code></em>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [ <span><strong class="command">severity</strong></span> (<code class="option">critical</code> | <code class="option">error</code> | <code class="option">warning</code> | <code class="option">notice</code> |
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang <code class="option">info</code> | <code class="option">debug</code> [ <em class="replaceable"><code>level</code></em> ] | <code class="option">dynamic</code> ); ]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [ <span><strong class="command">print-category</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [ <span><strong class="command">print-severity</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [ <span><strong class="command">print-time</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [ <span><strong class="command">category</strong></span> <em class="replaceable"><code>category_name</code></em> {
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <em class="replaceable"><code>channel_name</code></em> ; [ <em class="replaceable"><code>channel_name</code></em> ; ... ]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2576231"></a><span><strong class="command">logging</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">logging</strong></span> statement configures a
e07d9cb85217949d497b02d7211de8a197d2f2ebzf variety of logging options for the name server. Its <span><strong class="command">channel</strong></span> phrase
e07d9cb85217949d497b02d7211de8a197d2f2ebzf associates output methods, format options and severity levels with
e07d9cb85217949d497b02d7211de8a197d2f2ebzf a name that can then be used with the <span><strong class="command">category</strong></span> phrase
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to select how various classes of messages are logged.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Only one <span><strong class="command">logging</strong></span> statement is used to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf as many channels and categories as are wanted. If there is no <span><strong class="command">logging</strong></span> statement,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the logging configuration will be:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf category default { default_syslog; default_debug; };
e07d9cb85217949d497b02d7211de8a197d2f2ebzf category unmatched { null; };
e07d9cb85217949d497b02d7211de8a197d2f2ebzf In <acronym class="acronym">BIND</acronym> 9, the logging configuration
e07d9cb85217949d497b02d7211de8a197d2f2ebzf is only established when
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the entire configuration file has been parsed. In <acronym class="acronym">BIND</acronym> 8, it was
e07d9cb85217949d497b02d7211de8a197d2f2ebzf established as soon as the <span><strong class="command">logging</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf was parsed. When the server is starting up, all logging messages
e07d9cb85217949d497b02d7211de8a197d2f2ebzf regarding syntax errors in the configuration file go to the default
e07d9cb85217949d497b02d7211de8a197d2f2ebzf channels, or to standard error if the "<code class="option">-g</code>" option
e07d9cb85217949d497b02d7211de8a197d2f2ebzf was specified.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2576283"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf All log output goes to one or more <span class="emphasis"><em>channels</em></span>;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf you can make as many of them as you want.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Every channel definition must include a destination clause that
e07d9cb85217949d497b02d7211de8a197d2f2ebzf says whether messages selected for the channel go to a file, to a
e07d9cb85217949d497b02d7211de8a197d2f2ebzf particular syslog facility, to the standard error stream, or are
e07d9cb85217949d497b02d7211de8a197d2f2ebzf discarded. It can optionally also limit the message severity level
e07d9cb85217949d497b02d7211de8a197d2f2ebzf that will be accepted by the channel (the default is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">info</strong></span>), and whether to include a
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">named</strong></span>-generated time stamp, the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf category name
e07d9cb85217949d497b02d7211de8a197d2f2ebzf and/or severity level (the default is not to include any).
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">null</strong></span> destination clause
e07d9cb85217949d497b02d7211de8a197d2f2ebzf causes all messages sent to the channel to be discarded;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf in that case, other options for the channel are meaningless.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">file</strong></span> destination clause directs
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the channel
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to a disk file. It can include limitations
e07d9cb85217949d497b02d7211de8a197d2f2ebzf both on how large the file is allowed to become, and how many
e07d9cb85217949d497b02d7211de8a197d2f2ebzf of the file will be saved each time the file is opened.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If you use the <span><strong class="command">versions</strong></span> log file
e07d9cb85217949d497b02d7211de8a197d2f2ebzf option, then
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">named</strong></span> will retain that many backup
e07d9cb85217949d497b02d7211de8a197d2f2ebzf versions of the file by
e07d9cb85217949d497b02d7211de8a197d2f2ebzf renaming them when opening. For example, if you choose to keep
e07d9cb85217949d497b02d7211de8a197d2f2ebzf three old versions
e07d9cb85217949d497b02d7211de8a197d2f2ebzf of the file <code class="filename">lamers.log</code>, then just
e07d9cb85217949d497b02d7211de8a197d2f2ebzf before it is opened
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="filename">lamers.log.2</code>, <code class="filename">lamers.log.0</code> is renamed
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang to <code class="filename">lamers.log.1</code>, and <code class="filename">lamers.log</code> is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf You can say <span><strong class="command">versions unlimited</strong></span> to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the number of versions.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If a <span><strong class="command">size</strong></span> option is associated with
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang the log file,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf then renaming is only done when the file being opened exceeds the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf indicated size. No backup versions are kept by default; any
e07d9cb85217949d497b02d7211de8a197d2f2ebzf log file is simply appended.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">size</strong></span> option for files is used
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to limit log
e07d9cb85217949d497b02d7211de8a197d2f2ebzf growth. If the file ever exceeds the size, then <span><strong class="command">named</strong></span> will
e07d9cb85217949d497b02d7211de8a197d2f2ebzf stop writing to the file unless it has a <span><strong class="command">versions</strong></span> option
e07d9cb85217949d497b02d7211de8a197d2f2ebzf associated with it. If backup versions are kept, the files are
e07d9cb85217949d497b02d7211de8a197d2f2ebzf described above and a new one begun. If there is no
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">versions</strong></span> option, no more data will
e07d9cb85217949d497b02d7211de8a197d2f2ebzf be written to the log
e07d9cb85217949d497b02d7211de8a197d2f2ebzf until some out-of-band mechanism removes or truncates the log to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf less than the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf maximum size. The default behavior is not to limit the size of
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Example usage of the <span><strong class="command">size</strong></span> and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">versions</strong></span> options:
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang file "example.log" versions 3 size 20m;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf print-time yes;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf print-category yes;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">syslog</strong></span> destination clause
e07d9cb85217949d497b02d7211de8a197d2f2ebzf directs the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf channel to the system log. Its argument is a
e07d9cb85217949d497b02d7211de8a197d2f2ebzf syslog facility as described in the <span><strong class="command">syslog</strong></span> man
e07d9cb85217949d497b02d7211de8a197d2f2ebzf page. Known facilities are <span><strong class="command">kern</strong></span>, <span><strong class="command">user</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">mail</strong></span>, <span><strong class="command">daemon</strong></span>, <span><strong class="command">auth</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">syslog</strong></span>, <span><strong class="command">lpr</strong></span>, <span><strong class="command">news</strong></span>,
ff3124eff995e6cd8ebd8c6543648e0670920034ff <span><strong class="command">uucp</strong></span>, <span><strong class="command">cron</strong></span>, <span><strong class="command">authpriv</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">ftp</strong></span>, <span><strong class="command">local0</strong></span>, <span><strong class="command">local1</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">local2</strong></span>, <span><strong class="command">local3</strong></span>, <span><strong class="command">local4</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">local5</strong></span>, <span><strong class="command">local6</strong></span> and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">local7</strong></span>, however not all facilities
e07d9cb85217949d497b02d7211de8a197d2f2ebzf are supported on
e07d9cb85217949d497b02d7211de8a197d2f2ebzf all operating systems.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf How <span><strong class="command">syslog</strong></span> will handle messages
e07d9cb85217949d497b02d7211de8a197d2f2ebzf this facility is described in the <span><strong class="command">syslog.conf</strong></span> man
e07d9cb85217949d497b02d7211de8a197d2f2ebzf page. If you have a system which uses a very old version of <span><strong class="command">syslog</strong></span> that
ff3124eff995e6cd8ebd8c6543648e0670920034ff only uses two arguments to the <span><strong class="command">openlog()</strong></span> function,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf then this clause is silently ignored.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">severity</strong></span> clause works like <span><strong class="command">syslog</strong></span>'s
e07d9cb85217949d497b02d7211de8a197d2f2ebzf "priorities", except that they can also be used if you are writing
e07d9cb85217949d497b02d7211de8a197d2f2ebzf straight to a file rather than using <span><strong class="command">syslog</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Messages which are not at least of the severity level given will
e07d9cb85217949d497b02d7211de8a197d2f2ebzf not be selected for the channel; messages of higher severity
e07d9cb85217949d497b02d7211de8a197d2f2ebzf will be accepted.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If you are using <span><strong class="command">syslog</strong></span>, then the <span><strong class="command">syslog.conf</strong></span> priorities
e07d9cb85217949d497b02d7211de8a197d2f2ebzf will also determine what eventually passes through. For example,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf defining a channel facility and severity as <span><strong class="command">daemon</strong></span> and <span><strong class="command">debug</strong></span> but
e07d9cb85217949d497b02d7211de8a197d2f2ebzf only logging <span><strong class="command">daemon.warning</strong></span> via <span><strong class="command">syslog.conf</strong></span> will
e07d9cb85217949d497b02d7211de8a197d2f2ebzf cause messages of severity <span><strong class="command">info</strong></span> and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf be dropped. If the situation were reversed, with <span><strong class="command">named</strong></span> writing
e07d9cb85217949d497b02d7211de8a197d2f2ebzf messages of only <span><strong class="command">warning</strong></span> or higher,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf then <span><strong class="command">syslogd</strong></span> would
e07d9cb85217949d497b02d7211de8a197d2f2ebzf print all messages it received from the channel.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">stderr</strong></span> destination clause
e07d9cb85217949d497b02d7211de8a197d2f2ebzf directs the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf channel to the server's standard error stream. This is intended
e07d9cb85217949d497b02d7211de8a197d2f2ebzf use when the server is running as a foreground process, for
e07d9cb85217949d497b02d7211de8a197d2f2ebzf when debugging a configuration.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The server can supply extensive debugging information when
e07d9cb85217949d497b02d7211de8a197d2f2ebzf it is in debugging mode. If the server's global debug level is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf than zero, then debugging mode will be active. The global debug
e07d9cb85217949d497b02d7211de8a197d2f2ebzf level is set either by starting the <span><strong class="command">named</strong></span> server
e07d9cb85217949d497b02d7211de8a197d2f2ebzf with the <code class="option">-d</code> flag followed by a positive integer,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf or by running <span><strong class="command">rndc trace</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The global debug level
e07d9cb85217949d497b02d7211de8a197d2f2ebzf can be set to zero, and debugging mode turned off, by running <span><strong class="command">rndc
e07d9cb85217949d497b02d7211de8a197d2f2ebzfnotrace</strong></span>. All debugging messages in the server have a debug
e07d9cb85217949d497b02d7211de8a197d2f2ebzf level, and higher debug levels give more detailed output. Channels
e07d9cb85217949d497b02d7211de8a197d2f2ebzf that specify a specific debug severity, for example:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting">channel specific_debug_level {
e07d9cb85217949d497b02d7211de8a197d2f2ebzf file "foo";
e07d9cb85217949d497b02d7211de8a197d2f2ebzf severity debug 3;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf will get debugging output of level 3 or less any time the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf server is in debugging mode, regardless of the global debugging
e07d9cb85217949d497b02d7211de8a197d2f2ebzf level. Channels with <span><strong class="command">dynamic</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf severity use the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf server's global debug level to determine what messages to print.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If <span><strong class="command">print-time</strong></span> has been turned on,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the date and time will be logged. <span><strong class="command">print-time</strong></span> may
e07d9cb85217949d497b02d7211de8a197d2f2ebzf be specified for a <span><strong class="command">syslog</strong></span> channel,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf but is usually
e07d9cb85217949d497b02d7211de8a197d2f2ebzf pointless since <span><strong class="command">syslog</strong></span> also logs
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the date and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf time. If <span><strong class="command">print-category</strong></span> is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf requested, then the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf category of the message will be logged as well. Finally, if <span><strong class="command">print-severity</strong></span> is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf on, then the severity level of the message will be logged. The <span><strong class="command">print-</strong></span> options may
e07d9cb85217949d497b02d7211de8a197d2f2ebzf be used in any combination, and will always be printed in the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf order: time, category, severity. Here is an example where all
e07d9cb85217949d497b02d7211de8a197d2f2ebzf three <span><strong class="command">print-</strong></span> options
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="computeroutput">28-Feb-2000 15:05:32.863 general: notice: running</code>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf There are four predefined channels that are used for
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">named</strong></span>'s default logging as follows.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf How they are
e07d9cb85217949d497b02d7211de8a197d2f2ebzf used is described in <a href="Bv9ARM.ch06.html#the_category_phrase" title="The category Phrase">the section called “The <span><strong class="command">category</strong></span> Phrase”</a>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf // send to syslog's daemon facility
e07d9cb85217949d497b02d7211de8a197d2f2ebzf syslog daemon;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf // only send priority info and higher
e07d9cb85217949d497b02d7211de8a197d2f2ebzf severity info;
e07d9cb85217949d497b02d7211de8a197d2f2ebzfchannel default_debug {
e07d9cb85217949d497b02d7211de8a197d2f2ebzf // write to named.run in the working directory
e07d9cb85217949d497b02d7211de8a197d2f2ebzf // Note: stderr is used instead of "named.run" if
e07d9cb85217949d497b02d7211de8a197d2f2ebzf // the server is started with the '-f' option.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf // log at the server's current debug level
e07d9cb85217949d497b02d7211de8a197d2f2ebzf severity dynamic;
e07d9cb85217949d497b02d7211de8a197d2f2ebzfchannel default_stderr {
e07d9cb85217949d497b02d7211de8a197d2f2ebzf // writes to stderr
e07d9cb85217949d497b02d7211de8a197d2f2ebzf // only send priority info and higher
e07d9cb85217949d497b02d7211de8a197d2f2ebzf severity info;
e07d9cb85217949d497b02d7211de8a197d2f2ebzfchannel null {
e07d9cb85217949d497b02d7211de8a197d2f2ebzf // toss anything sent to this channel
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">default_debug</strong></span> channel has the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf property that it only produces output when the server's debug
e07d9cb85217949d497b02d7211de8a197d2f2ebzf nonzero. It normally writes to a file called <code class="filename">named.run</code>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf in the server's working directory.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf For security reasons, when the "<code class="option">-u</code>"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf command line option is used, the <code class="filename">named.run</code> file
e07d9cb85217949d497b02d7211de8a197d2f2ebzf is created only after <span><strong class="command">named</strong></span> has
e07d9cb85217949d497b02d7211de8a197d2f2ebzf changed to the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf new UID, and any debug output generated while <span><strong class="command">named</strong></span> is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf starting up and still running as root is discarded. If you need
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to capture this output, you must run the server with the "<code class="option">-g</code>"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf option and redirect standard error to a file.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Once a channel is defined, it cannot be redefined. Thus you
e07d9cb85217949d497b02d7211de8a197d2f2ebzf cannot alter the built-in channels directly, but you can modify
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the default logging by pointing categories at channels you have
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="the_category_phrase"></a>The <span><strong class="command">category</strong></span> Phrase</h4></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf There are many categories, so you can send the logs you want
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to see wherever you want, without seeing logs you don't want. If
e07d9cb85217949d497b02d7211de8a197d2f2ebzf you don't specify a list of channels for a category, then log
e07d9cb85217949d497b02d7211de8a197d2f2ebzf in that category will be sent to the <span><strong class="command">default</strong></span> category
e07d9cb85217949d497b02d7211de8a197d2f2ebzf instead. If you don't specify a default category, the following
e07d9cb85217949d497b02d7211de8a197d2f2ebzf "default default" is used:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting">category default { default_syslog; default_debug; };
e07d9cb85217949d497b02d7211de8a197d2f2ebzf As an example, let's say you want to log security events to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf a file, but you also want keep the default logging behavior. You'd
e07d9cb85217949d497b02d7211de8a197d2f2ebzf specify the following:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf file "my_security_file";
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang severity info;
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fangcategory security {
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang my_security_channel;
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang default_syslog;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf default_debug;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf To discard all messages in a category, specify the <span><strong class="command">null</strong></span> channel:
e07d9cb85217949d497b02d7211de8a197d2f2ebzfcategory notify { null; };
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Following are the available categories and brief descriptions
e07d9cb85217949d497b02d7211de8a197d2f2ebzf of the types of log information they contain. More
e07d9cb85217949d497b02d7211de8a197d2f2ebzf categories may be added in future <acronym class="acronym">BIND</acronym> releases.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf</colgroup>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">default</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The default category defines the logging
e07d9cb85217949d497b02d7211de8a197d2f2ebzf options for those categories where no specific
e07d9cb85217949d497b02d7211de8a197d2f2ebzf configuration has been
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">general</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The catch-all. Many things still aren't
e07d9cb85217949d497b02d7211de8a197d2f2ebzf classified into categories, and they all end up here.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">database</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Messages relating to the databases used
e07d9cb85217949d497b02d7211de8a197d2f2ebzf internally by the name server to store zone and cache
ff3124eff995e6cd8ebd8c6543648e0670920034ff <p><span><strong class="command">security</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Approval and denial of requests.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">config</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Configuration file parsing and processing.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">resolver</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf DNS resolution, such as the recursive
e07d9cb85217949d497b02d7211de8a197d2f2ebzf lookups performed on behalf of clients by a caching name
fb91fd8a302dfb13e250bbefb6a3970c2edc3ae3zf <p><span><strong class="command">xfer-in</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Zone transfers the server is receiving.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">xfer-out</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Zone transfers the server is sending.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">notify</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The NOTIFY protocol.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">client</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Processing of client requests.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">unmatched</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Messages that <span><strong class="command">named</strong></span> was unable to determine the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf class of or for which there was no matching <span><strong class="command">view</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf A one line summary is also logged to the <span><strong class="command">client</strong></span> category.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf This category is best sent to a file or stderr, by
e07d9cb85217949d497b02d7211de8a197d2f2ebzf default it is sent to
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang the <span><strong class="command">null</strong></span> channel.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">network</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Network operations.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">update</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Dynamic updates.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">update-security</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Approval and denial of update requests.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">queries</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Specify where queries should be logged to.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf At startup, specifying the category <span><strong class="command">queries</strong></span> will also
e07d9cb85217949d497b02d7211de8a197d2f2ebzf enable query logging unless <span><strong class="command">querylog</strong></span> option has been
e07d9cb85217949d497b02d7211de8a197d2f2ebzf specified.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The query log entry reports the client's IP
e07d9cb85217949d497b02d7211de8a197d2f2ebzf address and port number, and the query name,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf class and type. Next it reports whether the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Recursion Desired flag was set (+ if set, -
e07d9cb85217949d497b02d7211de8a197d2f2ebzf if not set), if the query was signed (S),
e07d9cb85217949d497b02d7211de8a197d2f2ebzf EDNS was in use (E), if TCP was used (T), if
e07d9cb85217949d497b02d7211de8a197d2f2ebzf DO (DNSSEC Ok) was set (D), or if CD (Checking
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Disabled) was set (C). After this the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf destination address the query was sent to is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="computeroutput">client 127.0.0.1#62536 (www.example.com): query: www.example.com IN AAAA +SE</code>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="computeroutput">client ::1#62537 (www.example.net): query: www.example.net IN AAAA -SE</code>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf (The first part of this log message, showing the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf repeated in all subsequent log messages related
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to the same query.)
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">query-errors</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Information about queries that resulted in some
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">dispatch</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Dispatching of incoming packets to the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf server modules where they are to be processed.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">dnssec</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf DNSSEC and TSIG protocol processing.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">lame-servers</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Lame servers. These are misconfigurations
e07d9cb85217949d497b02d7211de8a197d2f2ebzf in remote servers, discovered by BIND 9 when trying to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf query those servers during resolution.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <p><span><strong class="command">delegation-only</strong></span></p>
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang Delegation only. Logs queries that have been
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang forced to NXDOMAIN as the result of a
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang delegation-only zone or a
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang <span><strong class="command">delegation-only</strong></span> in a hint
e07d9cb85217949d497b02d7211de8a197d2f2ebzf or stub zone declaration.
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang <p><span><strong class="command">edns-disabled</strong></span></p>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Log queries that have been forced to use plain
e07d9cb85217949d497b02d7211de8a197d2f2ebzf DNS due to timeouts. This is often due to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the remote servers not being RFC 1034 compliant
e07d9cb85217949d497b02d7211de8a197d2f2ebzf (not always returning FORMERR or similar to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf EDNS queries and other extensions to the DNS
e07d9cb85217949d497b02d7211de8a197d2f2ebzf when they are not understood). In other words, this is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf targeted at servers that fail to respond to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf DNS queries that they don't understand.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Note: the log message can also be due to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf packet loss. Before reporting servers for
e07d9cb85217949d497b02d7211de8a197d2f2ebzf non-RFC 1034 compliance they should be re-tested
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to determine the nature of the non-compliance.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf This testing should prevent or reduce the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf number of false-positive reports.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Note: eventually <span><strong class="command">named</strong></span> will have to stop
e07d9cb85217949d497b02d7211de8a197d2f2ebzf treating such timeouts as due to RFC 1034 non
e07d9cb85217949d497b02d7211de8a197d2f2ebzf compliance and start treating it as plain
e07d9cb85217949d497b02d7211de8a197d2f2ebzf packet loss. Falsely classifying packet
e07d9cb85217949d497b02d7211de8a197d2f2ebzf loss as due to RFC 1034 non compliance impacts
e07d9cb85217949d497b02d7211de8a197d2f2ebzf on DNSSEC validation which requires EDNS for
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the DNSSEC records to be returned.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Information about errors in response policy zone files,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf rewritten responses, and at the highest
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">debug</strong></span> levels, mere rewriting
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2577670"></a>The <span><strong class="command">query-errors</strong></span> Category</h4></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">query-errors</strong></span> category is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf specifically intended for debugging purposes: To identify
e07d9cb85217949d497b02d7211de8a197d2f2ebzf why and how specific queries result in responses which
e07d9cb85217949d497b02d7211de8a197d2f2ebzf indicate an error.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Messages of this category are therefore only logged
e07d9cb85217949d497b02d7211de8a197d2f2ebzf with <span><strong class="command">debug</strong></span> levels.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf At the debug levels of 1 or higher, each response with the
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang rcode of SERVFAIL is logged as follows:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="computeroutput">client 127.0.0.1#61502: query failed (SERVFAIL) for www.example.com/IN/AAAA at query.c:3880</code>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf This means an error resulting in SERVFAIL was
e07d9cb85217949d497b02d7211de8a197d2f2ebzf detected at line 3880 of source file
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Log messages of this level will particularly
e07d9cb85217949d497b02d7211de8a197d2f2ebzf help identify the cause of SERVFAIL for an
e07d9cb85217949d497b02d7211de8a197d2f2ebzf authoritative server.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf At the debug levels of 2 or higher, detailed context
e07d9cb85217949d497b02d7211de8a197d2f2ebzf information of recursive resolutions that resulted in
e07d9cb85217949d497b02d7211de8a197d2f2ebzf SERVFAIL is logged.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The log message will look like as follows:
e07d9cb85217949d497b02d7211de8a197d2f2ebzfreferral:2,restart:7,qrysent:8,timeout:5,lame:0,neterr:0,
e07d9cb85217949d497b02d7211de8a197d2f2ebzfbadresp:1,adberr:0,findfail:0,valfail:0]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The first part before the colon shows that a recursive
e07d9cb85217949d497b02d7211de8a197d2f2ebzf resolution for AAAA records of www.example.com completed
e07d9cb85217949d497b02d7211de8a197d2f2ebzf in 30.000183 seconds and the final result that led to the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf SERVFAIL was determined at line 2970 of source file
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The following part shows the detected final result and the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf latest result of DNSSEC validation.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The latter is always success when no validation attempt
e07d9cb85217949d497b02d7211de8a197d2f2ebzf In this example, this query resulted in SERVFAIL probably
e07d9cb85217949d497b02d7211de8a197d2f2ebzf because all name servers are down or unreachable, leading
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to a timeout in 30 seconds.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf DNSSEC validation was probably not attempted.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The last part enclosed in square brackets shows statistics
e07d9cb85217949d497b02d7211de8a197d2f2ebzf information collected for this particular resolution
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <code class="varname">domain</code> field shows the deepest zone
e07d9cb85217949d497b02d7211de8a197d2f2ebzf that the resolver reached;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf it is the zone where the error was finally detected.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The meaning of the other fields is summarized in the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf following table.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The number of referrals the resolver received
e07d9cb85217949d497b02d7211de8a197d2f2ebzf throughout the resolution process.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf In the above example this is 2, which are most
e07d9cb85217949d497b02d7211de8a197d2f2ebzf likely com and example.com.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The number of cycles that the resolver tried
e07d9cb85217949d497b02d7211de8a197d2f2ebzf remote servers at the <code class="varname">domain</code>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf In each cycle the resolver sends one query
e07d9cb85217949d497b02d7211de8a197d2f2ebzf (possibly resending it, depending on the response)
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to each known name server of
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The number of queries the resolver sent at the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The number of timeouts since the resolver
e07d9cb85217949d497b02d7211de8a197d2f2ebzf received the last response.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The number of lame servers the resolver detected
e07d9cb85217949d497b02d7211de8a197d2f2ebzf A server is detected to be lame either by an
e07d9cb85217949d497b02d7211de8a197d2f2ebzf invalid response or as a result of lookup in
e07d9cb85217949d497b02d7211de8a197d2f2ebzf BIND9's address database (ADB), where lame
e07d9cb85217949d497b02d7211de8a197d2f2ebzf servers are cached.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The number of erroneous results that the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf resolver encountered in sending queries
e07d9cb85217949d497b02d7211de8a197d2f2ebzf One common case is the remote server is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf unreachable and the resolver receives an ICMP
e07d9cb85217949d497b02d7211de8a197d2f2ebzf unreachable error message.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The number of unexpected responses (other than
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="varname">lame</code>) to queries sent by the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf resolver at the <code class="varname">domain</code> zone.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Failures in finding remote server addresses
e07d9cb85217949d497b02d7211de8a197d2f2ebzf of the <code class="varname">domain</code> zone in the ADB.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf One common case of this is that the remote
e07d9cb85217949d497b02d7211de8a197d2f2ebzf server's name does not have any address records.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Failures of resolving remote server addresses.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf This is a total number of failures throughout
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the resolution process.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Failures of DNSSEC validation.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Validation failures are counted throughout
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the resolution process (not limited to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the <code class="varname">domain</code> zone), but should
e07d9cb85217949d497b02d7211de8a197d2f2ebzf At the debug levels of 3 or higher, the same messages
e07d9cb85217949d497b02d7211de8a197d2f2ebzf as those at the debug 1 level are logged for other errors
e07d9cb85217949d497b02d7211de8a197d2f2ebzf than SERVFAIL.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Note that negative responses such as NXDOMAIN are not
e07d9cb85217949d497b02d7211de8a197d2f2ebzf regarded as errors here.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf At the debug levels of 4 or higher, the same messages
e07d9cb85217949d497b02d7211de8a197d2f2ebzf as those at the debug 2 level are logged for other errors
e07d9cb85217949d497b02d7211de8a197d2f2ebzf than SERVFAIL.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Unlike the above case of level 3, messages are logged for
e07d9cb85217949d497b02d7211de8a197d2f2ebzf negative responses.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf This is because any unexpected results can be difficult to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf debug in the recursion case.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2578326"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf This is the grammar of the <span><strong class="command">lwres</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf statement in the <code class="filename">named.conf</code> file:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting"><span><strong class="command">lwres</strong></span> {
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> listen-on { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> view <em class="replaceable"><code>view_name</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> search { <em class="replaceable"><code>domain_name</code></em> ; [<span class="optional"> <em class="replaceable"><code>domain_name</code></em> ; ... </span>] }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> ndots <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2578400"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">lwres</strong></span> statement configures the
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang server to also act as a lightweight resolver server. (See
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be multiple
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">lwres</strong></span> statements configuring
e07d9cb85217949d497b02d7211de8a197d2f2ebzf lightweight resolver servers with different properties.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">listen-on</strong></span> statement specifies a
e07d9cb85217949d497b02d7211de8a197d2f2ebzf addresses (and ports) that this instance of a lightweight resolver
e07d9cb85217949d497b02d7211de8a197d2f2ebzf should accept requests on. If no port is specified, port 921 is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If this statement is omitted, requests will be accepted on
e07d9cb85217949d497b02d7211de8a197d2f2ebzf 127.0.0.1,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">view</strong></span> statement binds this
e07d9cb85217949d497b02d7211de8a197d2f2ebzf instance of a
e07d9cb85217949d497b02d7211de8a197d2f2ebzf lightweight resolver daemon to a view in the DNS namespace, so that
e07d9cb85217949d497b02d7211de8a197d2f2ebzf response will be constructed in the same manner as a normal DNS
e07d9cb85217949d497b02d7211de8a197d2f2ebzf matching this view. If this statement is omitted, the default view
e07d9cb85217949d497b02d7211de8a197d2f2ebzf used, and if there is no default view, an error is triggered.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">search</strong></span> statement is equivalent to
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang <span><strong class="command">search</strong></span> statement in
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="filename">/etc/resolv.conf</code>. It provides a
e07d9cb85217949d497b02d7211de8a197d2f2ebzf list of domains
e07d9cb85217949d497b02d7211de8a197d2f2ebzf which are appended to relative names in queries.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">ndots</strong></span> statement is equivalent to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">ndots</strong></span> statement in
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <code class="filename">/etc/resolv.conf</code>. It indicates the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf number of dots in a relative domain name that should result in an
e07d9cb85217949d497b02d7211de8a197d2f2ebzf exact match lookup before search path elements are appended.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2578464"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> |
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] };
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2578576"></a><span><strong class="command">masters</strong></span> Statement Definition and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf lists allow for a common set of masters to be easily used by
e07d9cb85217949d497b02d7211de8a197d2f2ebzf multiple stub and slave zones in their <span><strong class="command">masters</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf or <span><strong class="command">also-notify</strong></span> lists.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="id2578597"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf This is the grammar of the <span><strong class="command">options</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf statement in the <code class="filename">named.conf</code> file:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<pre class="programlisting"><span><strong class="command">options</strong></span> {
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> attach-cache <em class="replaceable"><code>cache_name</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> version <em class="replaceable"><code>version_string</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> hostname <em class="replaceable"><code>hostname_string</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> server-id <em class="replaceable"><code>server_id_string</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> directory <em class="replaceable"><code>path_name</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> managed-keys-directory <em class="replaceable"><code>path_name</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> named-xfer <em class="replaceable"><code>path_name</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> tkey-gssapi-keytab <em class="replaceable"><code>path_name</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> tkey-gssapi-credential <em class="replaceable"><code>principal</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> tkey-domain <em class="replaceable"><code>domainname</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> tkey-dhkey <em class="replaceable"><code>key_name</code></em> <em class="replaceable"><code>key_tag</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> cache-file <em class="replaceable"><code>path_name</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> dump-file <em class="replaceable"><code>path_name</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> bindkeys-file <em class="replaceable"><code>path_name</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> secroots-file <em class="replaceable"><code>path_name</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> session-keyfile <em class="replaceable"><code>path_name</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> session-keyname <em class="replaceable"><code>key_name</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> session-keyalg <em class="replaceable"><code>algorithm_id</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> memstatistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> memstatistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> pid-file <em class="replaceable"><code>path_name</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> recursing-file <em class="replaceable"><code>path_name</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> statistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> auth-nxdomain <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> deallocate-on-exit <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> fake-iquery <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> fetch-glue <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> flush-zones-on-shutdown <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> has-old-clients <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> host-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> host-statistics-max <em class="replaceable"><code>number</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> minimal-responses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> multiple-cnames <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> recursion <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> rfc2308-type1 <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> use-id-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> ixfr-from-differences (<em class="replaceable"><code>yes_or_no</code></em> | <code class="constant">master</code> | <code class="constant">slave</code>); </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> dnssec-enable <em class="replaceable"><code>yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> dnssec-validation (<em class="replaceable"><code>yes_or_no</code></em> | <code class="constant">auto</code>); </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> dnssec-lookaside ( <em class="replaceable"><code>auto</code></em> |
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em> ); </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> dnssec-must-be-secure <em class="replaceable"><code>domain yes_or_no</code></em>; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> dnssec-accept-expired <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0dc2366f7b9f9f36e10909b1e95edbf2a261c2acVenugopal Iyer [<span class="optional"> forward ( <em class="replaceable"><code>only</code></em> | <em class="replaceable"><code>first</code></em> ); </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> dual-stack-servers [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] {
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang ( <em class="replaceable"><code>domain_name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] |
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ) ;
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang ... }; </span>]
0dc2366f7b9f9f36e10909b1e95edbf2a261c2acVenugopal Iyer [<span class="optional"> check-names ( <em class="replaceable"><code>master</code></em> | <em class="replaceable"><code>slave</code></em> | <em class="replaceable"><code>response</code></em> )
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> check-dup-records ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> check-mx ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang [<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0dc2366f7b9f9f36e10909b1e95edbf2a261c2acVenugopal Iyer [<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0dc2366f7b9f9f36e10909b1e95edbf2a261c2acVenugopal Iyer [<span class="optional"> check-mx-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0dc2366f7b9f9f36e10909b1e95edbf2a261c2acVenugopal Iyer [<span class="optional"> check-srv-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0dc2366f7b9f9f36e10909b1e95edbf2a261c2acVenugopal Iyer [<span class="optional"> check-sibling <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0dc2366f7b9f9f36e10909b1e95edbf2a261c2acVenugopal Iyer [<span class="optional"> allow-new-zones { <em class="replaceable"><code>yes_or_no</code></em> }; </span>]
0dc2366f7b9f9f36e10909b1e95edbf2a261c2acVenugopal Iyer [<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0dc2366f7b9f9f36e10909b1e95edbf2a261c2acVenugopal Iyer [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0dc2366f7b9f9f36e10909b1e95edbf2a261c2acVenugopal Iyer [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0dc2366f7b9f9f36e10909b1e95edbf2a261c2acVenugopal Iyer [<span class="optional"> allow-query-cache { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> allow-query-cache-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> allow-recursion { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> allow-recursion-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> dnssec-update-mode ( <em class="replaceable"><code>maintain</code></em> | <em class="replaceable"><code>no-resign</code></em> ); </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> dnssec-loadkeys-interval <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> dnssec-secure-to-insecure <em class="replaceable"><code>yes_or_no</code></em> ;</span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> allow-v6-synthesis { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> blackhole { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> use-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> avoid-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> use-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> avoid-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> listen-on [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> listen-on-v6 [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> query-source ( ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> )
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> address ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> query-source-v6 ( ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> )
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> address ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> queryport-pool-updateinterval <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em>; </span>]
020c47705d28102a8df83a43ddf08e34dde21f22ql [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> tcp-clients <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> reserved-sockets <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> recursive-clients <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> serial-query-rate <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> serial-queries <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> tcp-listen-queue <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> transfers-in <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> transfers-out <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> transfers-per-ns <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>keyname</code></em></span>] ;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>keyname</code></em></span>] ; ... </span>] }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> coresize <em class="replaceable"><code>size_spec</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> datasize <em class="replaceable"><code>size_spec</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> files <em class="replaceable"><code>size_spec</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> stacksize <em class="replaceable"><code>size_spec</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> heartbeat-interval <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> interface-interval <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> statistics-interval <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> topology { <em class="replaceable"><code>address_match_list</code></em> }</span>];
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> sortlist { <em class="replaceable"><code>address_match_list</code></em> }</span>];
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> rrset-order { <em class="replaceable"><code>order_spec</code></em> ; [<span class="optional"> <em class="replaceable"><code>order_spec</code></em> ; ... </span>] </span>] };
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> lame-ttl <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> max-ncache-ttl <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> max-cache-ttl <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> min-roots <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> use-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> treat-cr-as-space <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> min-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
ff3124eff995e6cd8ebd8c6543648e0670920034ff [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> additional-from-auth <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> additional-from-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> random-device <em class="replaceable"><code>path_name</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> max-cache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> match-mapped-addresses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang [<span class="optional"> filter-aaaa-on-v4 ( <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>break-dnssec</code></em> ); </span>]
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang [<span class="optional"> filter-aaaa-on-v6 ( <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>break-dnssec</code></em> ); </span>]
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang [<span class="optional"> filter-aaaa { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang [<span class="optional"> dns64 <em class="replaceable"><code>IPv6-prefix</code></em> {
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang [<span class="optional"> clients { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang [<span class="optional"> mapped { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang [<span class="optional"> exclude { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang [<span class="optional"> suffix IPv6-address; </span>]
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang [<span class="optional"> recursive-only <em class="replaceable"><code>yes_or_no</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> break-dnssec <em class="replaceable"><code>yes_or_no</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf }; </span>];
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> dns64-server <em class="replaceable"><code>name</code></em> </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> dns64-contact <em class="replaceable"><code>name</code></em> </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> preferred-glue ( <em class="replaceable"><code>A</code></em> | <em class="replaceable"><code>AAAA</code></em> | <em class="replaceable"><code>NONE</code></em> ); </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> edns-udp-size <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> max-udp-size <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> max-rsa-exponent-size <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> root-delegation-only [<span class="optional"> exclude { <em class="replaceable"><code>namelist</code></em> } </span>] ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> querylog <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> disable-algorithms <em class="replaceable"><code>domain</code></em> { <em class="replaceable"><code>algorithm</code></em>;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> <em class="replaceable"><code>algorithm</code></em>; </span>] }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> disable-ds-digests <em class="replaceable"><code>domain</code></em> { <em class="replaceable"><code>digest_type</code></em>;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> <em class="replaceable"><code>digest_type</code></em>; </span>] }; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> acache-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> acache-cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> max-acache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> max-clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">fast</code>) ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> empty-server <em class="replaceable"><code>name</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> empty-contact <em class="replaceable"><code>name</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> empty-zones-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> disable-empty-zone <em class="replaceable"><code>zone_name</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> zero-no-soa-ttl-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> resolver-query-timeout <em class="replaceable"><code>number</code></em> ; </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> deny-answer-addresses { <em class="replaceable"><code>address_match_list</code></em> } [<span class="optional"> except-from { <em class="replaceable"><code>namelist</code></em> } </span>];</span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> deny-answer-aliases { <em class="replaceable"><code>namelist</code></em> } [<span class="optional"> except-from { <em class="replaceable"><code>namelist</code></em> } </span>];</span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> response-policy { <em class="replaceable"><code>zone_name</code></em>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> policy given | disabled | passthru | nxdomain | nodata | cname <em class="replaceable"><code>domain</code></em> </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> recursive-only <em class="replaceable"><code>yes_or_no</code></em> </span>] [<span class="optional"> max-policy-ttl <em class="replaceable"><code>number</code></em> </span>] ;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf } [<span class="optional"> recursive-only <em class="replaceable"><code>yes_or_no</code></em> </span>] [<span class="optional"> max-policy-ttl <em class="replaceable"><code>number</code></em> </span>]
e07d9cb85217949d497b02d7211de8a197d2f2ebzf [<span class="optional"> break-dnssec <em class="replaceable"><code>yes_or_no</code></em> </span>] ; </span>]
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang<a name="options"></a><span><strong class="command">options</strong></span> Statement Definition and
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang The <span><strong class="command">options</strong></span> statement sets up global
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang to be used by <acronym class="acronym">BIND</acronym>. This statement
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang may appear only
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang once in a configuration file. If there is no <span><strong class="command">options</strong></span>
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang statement, an options block with each option set to its default will
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">attach-cache</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Allows multiple views to share a single cache
5644143a6cf1e70bc2e78d5140970830aae0e8cdQuaker Fang Each view has its own cache database by default, but
e07d9cb85217949d497b02d7211de8a197d2f2ebzf if multiple views have the same operational policy
e07d9cb85217949d497b02d7211de8a197d2f2ebzf for name resolution and caching, those views can
e07d9cb85217949d497b02d7211de8a197d2f2ebzf share a single cache to save memory and possibly
e07d9cb85217949d497b02d7211de8a197d2f2ebzf improve resolution efficiency by using this option.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <span><strong class="command">attach-cache</strong></span> option
e07d9cb85217949d497b02d7211de8a197d2f2ebzf may also be specified in <span><strong class="command">view</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf statements, in which case it overrides the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf global <span><strong class="command">attach-cache</strong></span> option.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The <em class="replaceable"><code>cache_name</code></em> specifies
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the cache to be shared.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf When the <span><strong class="command">named</strong></span> server configures
e07d9cb85217949d497b02d7211de8a197d2f2ebzf views which are supposed to share a cache, it
e07d9cb85217949d497b02d7211de8a197d2f2ebzf creates a cache with the specified name for the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf first view of these sharing views.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The rest of the views will simply refer to the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf already created cache.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf One common configuration to share a cache would be to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf allow all views to share a single cache.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf This can be done by specifying
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the <span><strong class="command">attach-cache</strong></span> as a global
e07d9cb85217949d497b02d7211de8a197d2f2ebzf option with an arbitrary name.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Another possible operation is to allow a subset of
e07d9cb85217949d497b02d7211de8a197d2f2ebzf all views to share a cache while the others to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf retain their own caches.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf For example, if there are three views A, B, and C,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf and only A and B should share a cache, specify the
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang <span><strong class="command">attach-cache</strong></span> option as a view A (or
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang B)'s option, referring to the other view name:
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang // this view has its own cache
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang // this view refers to A's cache
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang attach-cache "A";
e07d9cb85217949d497b02d7211de8a197d2f2ebzf // this view has its own cache
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Views that share a cache must have the same policy
e07d9cb85217949d497b02d7211de8a197d2f2ebzf on configurable parameters that may affect caching.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The current implementation requires the following
e07d9cb85217949d497b02d7211de8a197d2f2ebzf configurable options be consistent among these
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">check-names</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">cleaning-interval</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">dnssec-accept-expired</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">dnssec-validation</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">max-cache-ttl</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">max-ncache-ttl</strong></span>,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">max-cache-size</strong></span>, and
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang <span><strong class="command">zero-no-soa-ttl</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Note that there may be other parameters that may
e07d9cb85217949d497b02d7211de8a197d2f2ebzf cause confusion if they are inconsistent for
e07d9cb85217949d497b02d7211de8a197d2f2ebzf different views that share a single cache.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf For example, if these views define different sets of
e07d9cb85217949d497b02d7211de8a197d2f2ebzf forwarders that can return different answers for the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf same question, sharing the answer does not make
e07d9cb85217949d497b02d7211de8a197d2f2ebzf sense or could even be harmful.
ff3124eff995e6cd8ebd8c6543648e0670920034ff It is administrator's responsibility to ensure
ff3124eff995e6cd8ebd8c6543648e0670920034ff configuration differences in different views do
ff3124eff995e6cd8ebd8c6543648e0670920034ff not cause disruption with a shared cache.
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang<dt><span class="term"><span><strong class="command">directory</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The working directory of the server.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Any non-absolute pathnames in the configuration file will be
e07d9cb85217949d497b02d7211de8a197d2f2ebzf as relative to this directory. The default location for most
e07d9cb85217949d497b02d7211de8a197d2f2ebzf output files (e.g. <code class="filename">named.run</code>)
ff3124eff995e6cd8ebd8c6543648e0670920034ff is this directory.
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang If a directory is not specified, the working directory
e07d9cb85217949d497b02d7211de8a197d2f2ebzf defaults to `<code class="filename">.</code>', the directory from
e07d9cb85217949d497b02d7211de8a197d2f2ebzf which the server
e07d9cb85217949d497b02d7211de8a197d2f2ebzf was started. The directory specified should be an absolute
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">key-directory</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf When performing dynamic update of secure zones, the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf directory where the public and private DNSSEC key files
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang should be found, if different than the current working
e07d9cb85217949d497b02d7211de8a197d2f2ebzf directory. (Note that this option has no effect on the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf paths for files containing non-DNSSEC keys such as
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">managed-keys-directory</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Specifies the directory in which to store the files that
e07d9cb85217949d497b02d7211de8a197d2f2ebzf track managed DNSSEC keys. By default, this is the working
e07d9cb85217949d497b02d7211de8a197d2f2ebzf directory.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If <span><strong class="command">named</strong></span> is not configured to use views,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf then managed keys for the server will be tracked in a single
e07d9cb85217949d497b02d7211de8a197d2f2ebzf file called <code class="filename">managed-keys.bind</code>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Otherwise, managed keys will be tracked in separate files,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf one file per view; each file name will be the SHA256 hash
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang of the view name, followed by the extension
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">named-xfer</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span class="emphasis"><em>This option is obsolete.</em></span> It
e07d9cb85217949d497b02d7211de8a197d2f2ebzf was used in <acronym class="acronym">BIND</acronym> 8 to specify
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang the pathname to the <span><strong class="command">named-xfer</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf program. In <acronym class="acronym">BIND</acronym> 9, no separate
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">named-xfer</strong></span> program is needed;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf its functionality is built into the name server.
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang<dt><span class="term"><span><strong class="command">tkey-gssapi-keytab</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The KRB5 keytab file to use for GSS-TSIG updates. If
e07d9cb85217949d497b02d7211de8a197d2f2ebzf this option is set and tkey-gssapi-credential is not
e07d9cb85217949d497b02d7211de8a197d2f2ebzf set, then updates will be allowed with any key
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang matching a principal in the specified keytab.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">tkey-gssapi-credential</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The security credential with which the server should
e07d9cb85217949d497b02d7211de8a197d2f2ebzf authenticate keys requested by the GSS-TSIG protocol.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Currently only Kerberos 5 authentication is available
e07d9cb85217949d497b02d7211de8a197d2f2ebzf and the credential is a Kerberos principal which the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf server can acquire through the default system key
e07d9cb85217949d497b02d7211de8a197d2f2ebzf file, normally <code class="filename">/etc/krb5.keytab</code>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The location keytab file can be overridden using the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf tkey-gssapi-keytab option. Normally this principal is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf of the form "<strong class="userinput"><code>DNS/</code></strong><code class="varname">server.domain</code>".
e07d9cb85217949d497b02d7211de8a197d2f2ebzf To use GSS-TSIG, <span><strong class="command">tkey-domain</strong></span> must
e07d9cb85217949d497b02d7211de8a197d2f2ebzf also be set if a specific keytab is not set with
e07d9cb85217949d497b02d7211de8a197d2f2ebzf tkey-gssapi-keytab.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">tkey-domain</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The domain appended to the names of all shared keys
e07d9cb85217949d497b02d7211de8a197d2f2ebzf generated with <span><strong class="command">TKEY</strong></span>. When a
e07d9cb85217949d497b02d7211de8a197d2f2ebzf client requests a <span><strong class="command">TKEY</strong></span> exchange,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf it may or may not specify the desired name for the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf key. If present, the name of the shared key will
e07d9cb85217949d497b02d7211de8a197d2f2ebzf name of the shared key will be <code class="varname">random hex
e07d9cb85217949d497b02d7211de8a197d2f2ebzf digits</code> + <code class="varname">tkey-domain</code>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf In most cases, the <span><strong class="command">domainname</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf should be the server's domain name, or an otherwise
e07d9cb85217949d497b02d7211de8a197d2f2ebzf non-existent subdomain like
e07d9cb85217949d497b02d7211de8a197d2f2ebzf "_tkey.<code class="varname">domainname</code>". If you are
e07d9cb85217949d497b02d7211de8a197d2f2ebzf using GSS-TSIG, this variable must be defined, unless
e07d9cb85217949d497b02d7211de8a197d2f2ebzf you specify a specific keytab using tkey-gssapi-keytab.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">tkey-dhkey</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The Diffie-Hellman key used by the server
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to generate shared keys with clients using the Diffie-Hellman
e07d9cb85217949d497b02d7211de8a197d2f2ebzf of <span><strong class="command">TKEY</strong></span>. The server must be
e07d9cb85217949d497b02d7211de8a197d2f2ebzf able to load the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf public and private keys from files in the working directory.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf most cases, the keyname should be the server's host name.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">cache-file</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf This is for testing only. Do not use.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">dump-file</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The pathname of the file the server dumps
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the database to when instructed to do so with
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">rndc dumpdb</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If not specified, the default is <code class="filename">named_dump.db</code>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">memstatistics-file</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The pathname of the file the server writes memory
e07d9cb85217949d497b02d7211de8a197d2f2ebzf usage statistics to on exit. If not specified,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the default is <code class="filename">named.memstats</code>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">pid-file</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The pathname of the file the server writes its process ID
3a1a8936dac0ebe7e956fa122b0b0d15e62d4108zf in. If not specified, the default is
3a1a8936dac0ebe7e956fa122b0b0d15e62d4108zf The PID file is used by programs that want to send signals to
3a1a8936dac0ebe7e956fa122b0b0d15e62d4108zf the running
e07d9cb85217949d497b02d7211de8a197d2f2ebzf name server. Specifying <span><strong class="command">pid-file none</strong></span> disables the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf use of a PID file — no file will be written and any
e07d9cb85217949d497b02d7211de8a197d2f2ebzf existing one will be removed. Note that <span><strong class="command">none</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf is a keyword, not a filename, and therefore is not enclosed
e07d9cb85217949d497b02d7211de8a197d2f2ebzf double quotes.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">recursing-file</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The pathname of the file the server dumps
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the queries that are currently recursing when instructed
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to do so with <span><strong class="command">rndc recursing</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If not specified, the default is <code class="filename">named.recursing</code>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">statistics-file</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The pathname of the file the server appends statistics
e07d9cb85217949d497b02d7211de8a197d2f2ebzf to when instructed to do so using <span><strong class="command">rndc stats</strong></span>.
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang If not specified, the default is <code class="filename">named.stats</code> in the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf server's current directory. The format of the file is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf in <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">bindkeys-file</strong></span></span></dt>
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang The pathname of a file to override the built-in trusted
e07d9cb85217949d497b02d7211de8a197d2f2ebzf keys provided by <span><strong class="command">named</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf See the discussion of <span><strong class="command">dnssec-lookaside</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf and <span><strong class="command">dnssec-validation</strong></span> for details.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If not specified, the default is
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang<dt><span class="term"><span><strong class="command">secroots-file</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The pathname of the file the server dumps
e07d9cb85217949d497b02d7211de8a197d2f2ebzf security roots to when instructed to do so with
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">rndc secroots</strong></span>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If not specified, the default is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">session-keyfile</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The pathname of the file into which to write a TSIG
e07d9cb85217949d497b02d7211de8a197d2f2ebzf session key generated by <span><strong class="command">named</strong></span> for use by
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">nsupdate -l</strong></span>. If not specified, the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf default is <code class="filename">/var/run/named/session.key</code>.
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang (See <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>, and in
e07d9cb85217949d497b02d7211de8a197d2f2ebzf particular the discussion of the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">update-policy</strong></span> statement's
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <strong class="userinput"><code>local</code></strong> option for more
e07d9cb85217949d497b02d7211de8a197d2f2ebzf information about this feature.)
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">session-keyname</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The key name to use for the TSIG session key.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If not specified, the default is "local-ddns".
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">session-keyalg</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The algorithm to use for the TSIG session key.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Valid values are hmac-sha1, hmac-sha224, hmac-sha256,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf hmac-sha384, hmac-sha512 and hmac-md5. If not
e07d9cb85217949d497b02d7211de8a197d2f2ebzf specified, the default is hmac-sha256.
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang<dt><span class="term"><span><strong class="command">port</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf receiving and sending DNS protocol traffic.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The default is 53. This option is mainly intended for server
e07d9cb85217949d497b02d7211de8a197d2f2ebzf a server using a port other than 53 will not be able to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf communicate with
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the global DNS.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">random-device</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The source of entropy to be used by the server. Entropy is
e07d9cb85217949d497b02d7211de8a197d2f2ebzf primarily needed
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang for DNSSEC operations, such as TKEY transactions and dynamic
e07d9cb85217949d497b02d7211de8a197d2f2ebzf update of signed
e07d9cb85217949d497b02d7211de8a197d2f2ebzf zones. This options specifies the device (or file) from which
e07d9cb85217949d497b02d7211de8a197d2f2ebzf entropy. If this is a file, operations requiring entropy will
e07d9cb85217949d497b02d7211de8a197d2f2ebzf fail when the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf file has been exhausted. If not specified, the default value
e07d9cb85217949d497b02d7211de8a197d2f2ebzf (or equivalent) when present, and none otherwise. The
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">random-device</strong></span> option takes
e07d9cb85217949d497b02d7211de8a197d2f2ebzf effect during
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the initial configuration load at server startup time and
e07d9cb85217949d497b02d7211de8a197d2f2ebzf is ignored on subsequent reloads.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">preferred-glue</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If specified, the listed type (A or AAAA) will be emitted
e07d9cb85217949d497b02d7211de8a197d2f2ebzf before other glue
e07d9cb85217949d497b02d7211de8a197d2f2ebzf in the additional section of a query response.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf The default is not to prefer any type (NONE).
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<a name="root_delegation_only"></a><span class="term"><span><strong class="command">root-delegation-only</strong></span></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Turn on enforcement of delegation-only in TLDs
e07d9cb85217949d497b02d7211de8a197d2f2ebzf (top level domains) and root zones with an optional
e07d9cb85217949d497b02d7211de8a197d2f2ebzf exclude list.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf DS queries are expected to be made to and be answered by
e07d9cb85217949d497b02d7211de8a197d2f2ebzf delegation only zones. Such queries and responses are
e07d9cb85217949d497b02d7211de8a197d2f2ebzf treated as an exception to delegation-only processing
e07d9cb85217949d497b02d7211de8a197d2f2ebzf and are not converted to NXDOMAIN responses provided
e07d9cb85217949d497b02d7211de8a197d2f2ebzf a CNAME is not discovered at the query name.
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang If a delegation only zone server also serves a child
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang zone it is not always possible to determine whether
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang an answer comes from the delegation only zone or the
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang child zone. SOA NS and DNSKEY records are apex
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang only records and a matching response that contains
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang these records or DS is treated as coming from a
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang child zone. RRSIG records are also examined to see
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang if they are signed by a child zone or not. The
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang authority section is also examined to see if there
e07d9cb85217949d497b02d7211de8a197d2f2ebzf is evidence that the answer is from the child zone.
fe3e6e3a98f98e7ab1a751934c0116fb914b9c82Quaker Fang Answers that are determined to be from a child zone
e07d9cb85217949d497b02d7211de8a197d2f2ebzf are not converted to NXDOMAIN responses. Despite
42516a0c6ebf6e259c2abcd1ca315fec43268f39xinghua wen - Sun Microsystems - Beijing China all these checks there is still a possibility of
42516a0c6ebf6e259c2abcd1ca315fec43268f39xinghua wen - Sun Microsystems - Beijing China false negatives when a child zone is being served.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Similarly false positives can arise from empty nodes
e07d9cb85217949d497b02d7211de8a197d2f2ebzf (no records at the name) in the delegation only zone
e07d9cb85217949d497b02d7211de8a197d2f2ebzf when the query type is not ANY.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Note some TLDs are not delegation only (e.g. "DE", "LV",
e07d9cb85217949d497b02d7211de8a197d2f2ebzf "US" and "MUSEUM"). This list is not exhaustive.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">disable-algorithms</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Disable the specified DNSSEC algorithms at and below the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf specified name.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Multiple <span><strong class="command">disable-algorithms</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf statements are allowed.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Only the best match <span><strong class="command">disable-algorithms</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf clause will be used to determine which algorithms are used.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If all supported algorithms are disabled, the zones covered
e07d9cb85217949d497b02d7211de8a197d2f2ebzf by the <span><strong class="command">disable-algorithms</strong></span> will be treated
e07d9cb85217949d497b02d7211de8a197d2f2ebzf as insecure.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">disable-ds-digests</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Disable the specified DS/DLV digest types at and below the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf specified name.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Multiple <span><strong class="command">disable-ds-digests</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf statements are allowed.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Only the best match <span><strong class="command">disable-ds-digests</strong></span>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf clause will be used to determine which digest types are used.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If all supported digest types are disabled, the zones covered
e07d9cb85217949d497b02d7211de8a197d2f2ebzf by the <span><strong class="command">disable-ds-digests</strong></span> will be treated
e07d9cb85217949d497b02d7211de8a197d2f2ebzf as insecure.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf<dt><span class="term"><span><strong class="command">dnssec-lookaside</strong></span></span></dt>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf When set, <span><strong class="command">dnssec-lookaside</strong></span> provides the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf validator with an alternate method to validate DNSKEY
e07d9cb85217949d497b02d7211de8a197d2f2ebzf records at the top of a zone. When a DNSKEY is at or
e07d9cb85217949d497b02d7211de8a197d2f2ebzf below a domain specified by the deepest
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <span><strong class="command">dnssec-lookaside</strong></span>, and the normal DNSSEC
e07d9cb85217949d497b02d7211de8a197d2f2ebzf validation has left the key untrusted, the trust-anchor
e07d9cb85217949d497b02d7211de8a197d2f2ebzf will be appended to the key name and a DLV record will be
e07d9cb85217949d497b02d7211de8a197d2f2ebzf looked up to see if it can validate the key. If the DLV
e07d9cb85217949d497b02d7211de8a197d2f2ebzf record validates a DNSKEY (similarly to the way a DS
e07d9cb85217949d497b02d7211de8a197d2f2ebzf record does) the DNSKEY RRset is deemed to be trusted.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If <span><strong class="command">dnssec-lookaside</strong></span> is set to
e07d9cb85217949d497b02d7211de8a197d2f2ebzf <strong class="userinput"><code>auto</code></strong>, then built-in default
e07d9cb85217949d497b02d7211de8a197d2f2ebzf values for the DLV domain and trust anchor will be
e07d9cb85217949d497b02d7211de8a197d2f2ebzf used, along with a built-in key for validation.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf If <span><strong class="command">dnssec-lookaside</strong></span> is set to
from <a href="https://www.isc.org/solutions/dlv/" target="_top">https://www.isc.org/solutions/dlv/</a>.
<dt><span class="term"><span><strong class="command">dnssec-must-be-secure</strong></span></span></dt>
Additionally a reverse IP6.ARPA zone will be created for
the prefix to provide a mapping from the IP6.ARPA names
to the corresponding IN-ADDR.ARPA names using synthesized
<a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>), and
If <strong class="userinput"><code>yes</code></strong>, then the <span><strong class="command">AA</strong></span> bit
for memory leaks on exit. <acronym class="acronym">BIND</acronym> 9 ignores the option and always performs
happens in a short interval, once every <span><strong class="command">heartbeat-interval</strong></span> and
<span><strong class="command">notify</strong></span> and <span><strong class="command">also-notify</strong></span>.
<dt><span class="term"><span><strong class="command">flush-zones-on-shutdown</strong></span></span></dt>
<span><strong class="command">flush-zones-on-shutdown</strong></span> <strong class="userinput"><code>no</code></strong>.
in <acronym class="acronym">BIND</acronym> 8, and is ignored by <acronym class="acronym">BIND</acronym> 9.
<span><strong class="command">has-old-clients</strong></span> <strong class="userinput"><code>yes</code></strong>, specify
the two separate options <span><strong class="command">auth-nxdomain</strong></span> <strong class="userinput"><code>yes</code></strong>
and <span><strong class="command">rfc2308-type1</strong></span> <strong class="userinput"><code>no</code></strong> instead.
kept for Incremental Zone Transfer. <acronym class="acronym">BIND</acronym> 9 maintains a transaction
transfers, use <span><strong class="command">provide-ixfr</strong></span> <strong class="userinput"><code>no</code></strong>.
and additional data sections when they are required (e.g.
changes, see <a href="Bv9ARM.ch04.html#notify" title="Notify">the section called “Notify”</a>. The messages are
in which case it overrides the <span><strong class="command">options notify</strong></span> statement.
also <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
in <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
<a href="Bv9ARM.ch04.html#incremental_zone_transfers" title="Incremental Zone Transfers (IXFR)">the section called “Incremental Zone Transfers (IXFR)”</a>.
<a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
<a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
Usage">the section called “<span><strong class="command">server</strong></span> Statement Definition and
the server treat carriage return ("<span><strong class="command">\r</strong></span>") characters the same way
on an NT or DOS machine. In <acronym class="acronym">BIND</acronym> 9, both UNIX "<span><strong class="command">\n</strong></span>"
<span class="term"><span><strong class="command">additional-from-auth</strong></span>, </span><span class="term"><span><strong class="command">additional-from-cache</strong></span></span>
For example, if a query asks for an MX record for host <code class="literal">foo.example.com</code>,
if known, even though they are not in the example.com zone.
<dt><span class="term"><span><strong class="command">match-mapped-addresses</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
addresses refer to different machines. If <strong class="userinput"><code>yes</code></strong>, <span><strong class="command">named</strong></span> will
when the serial number on the master is less than what <span><strong class="command">named</strong></span>
Enable DNSSEC support in <span><strong class="command">named</strong></span>. Unless set to <strong class="userinput"><code>yes</code></strong>,
<dt><span class="term"><span><strong class="command">dnssec-accept-expired</strong></span></span></dt>
Specify whether query logging should be started when <span><strong class="command">named</strong></span>
is determined by the presence of the logging category <span><strong class="command">queries</strong></span>.
<span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>.
<dt><span class="term"><span><strong class="command">zero-no-soa-ttl-cache</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">dnssec-dnskey-kskonly</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">dnssec-loadkeys-interval</strong></span></span></dt>
(see <a href="man.dnssec-keygen.html" title="dnssec-keygen"><span class="refentrytitle"><span class="application">dnssec-keygen</span></span>(8)</a> and
<a href="man.dnssec-settime.html" title="dnssec-settime"><span class="refentrytitle"><span class="application">dnssec-settime</span></span>(8)</a>). The
<dt><span class="term"><span><strong class="command">dnssec-secure-to-insecure</strong></span></span></dt>
insecure (i.e., signed to unsigned) by deleting all
stacked, then the <span><strong class="command">dual-stack-servers</strong></span> have no effect unless
of the requesting system. See <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a> for
<dt><span class="term"><span><strong class="command">allow-query-cache-on</strong></span></span></dt>
<a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a> for details.
<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
access control to attacks; see <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a>
receive zone transfers from the server. <span><strong class="command">allow-transfer</strong></span> may
case it overrides the <span><strong class="command">options allow-transfer</strong></span> statement.
<dt><span class="term"><span><strong class="command">resolver-query-timeout</strong></span></span></dt>
from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes
unless <span><strong class="command">-6</strong></span> is specified when <span><strong class="command">named</strong></span> is
<span><strong class="command">named</strong></span> will listen on port 53 on all IPv6 interfaces by default.
If <span><strong class="command">address</strong></span> is <span><strong class="command">*</strong></span> (asterisk) or is omitted,
If <span><strong class="command">port</strong></span> is <span><strong class="command">*</strong></span> or is omitted,
<dt><span class="term"><span><strong class="command">queryport-pool-ports</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">queryport-pool-updateinterval</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
the load on the remote name server. <span><strong class="command">transfers-per-ns</strong></span> may
be overridden on a per-server basis by using the <span><strong class="command">transfers</strong></span> phrase
<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
See <a href="Bv9ARM.ch06.html#query_address" title="Query Address">the section called “Query Address”</a> about how the
to prevent <span><strong class="command">named</strong></span> from choosing as its random source port a
of <span><strong class="command">size_spec</strong></span> in <a href="Bv9ARM.ch06.html#configuration_file_elements" title="Configuration File Elements">the section called “Configuration File Elements”</a>.
(see <a href="Bv9ARM.ch04.html#journal" title="The journal file">the section called “The journal file”</a>). When the journal file
<dt><span class="term"><span><strong class="command">host-statistics-max</strong></span></span></dt>
interfaces <span><strong class="command">named</strong></span> listens on, <span><strong class="command">tcp-clients</strong></span> as well as
<dt><span class="term"><span><strong class="command">statistics-interval</strong></span></span></dt>
topologically closest to itself. The <span><strong class="command">topology</strong></span> statement
<a name="the_sortlist_statement"></a>The <span><strong class="command">sortlist</strong></span> Statement</h4></div></div></div>
statement in <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>).
does (<a href="Bv9ARM.ch06.html#topology" title="Topology">the section called “Topology”</a>).
an IP prefix, an ACL name or a nested <span><strong class="command">address_match_list</strong></span>)
to the behavior of the address sort in <acronym class="acronym">BIND</acronym> 4.9.x. Responses sent
<a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a>.
If no name is specified, the default is "<span><strong class="command">*</strong></span>" (asterisk).
class IN type A name "host.example.com" order random;
<span><strong class="command">max-ncache-ttl</strong></span> is <code class="literal">10800</code> seconds (3 hours).
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
result of dynamic updates (<a href="Bv9ARM.ch04.html#dynamic_update" title="Dynamic Update">the section called “Dynamic Update”</a>) will expire. There
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
<a href="Bv9ARM.ch06.html#zonefile_format" title="Additional File Formats">the section called “Additional File Formats”</a>).
<a name="clients-per-query"></a><span class="term"><span><strong class="command">clients-per-query</strong></span>, </span><span class="term"><span><strong class="command">max-clients-per-query</strong></span></span>
before dropping additional clients. <span><strong class="command">named</strong></span> will attempt to
If the number of queries exceed this value, <span><strong class="command">named</strong></span> will
<dt><span class="term"><span><strong class="command">max-rsa-exponent-size</strong></span></span></dt>
built-in view (see <a href="Bv9ARM.ch06.html#view_statement_grammar" title="view Statement Grammar">the section called “<span><strong class="command">view</strong></span> Statement Grammar”</a>) of
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
<span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
Specifying <span><strong class="command">server-id hostname;</strong></span> will cause <span><strong class="command">named</strong></span> to
The default <span><strong class="command">server-id</strong></span> is <span><strong class="command">none</strong></span>.
<dt><span class="term"><span><strong class="command">acache-cleaning-interval</strong></span></span></dt>
name (i.e., the CNAME alias or the substituted query name
for example, even if "example.com" is specified for
returned by an "example.com" server will be accepted.
For example, if you own a domain named "example.net" and
deny-answer-aliases { "example.net"; };
network look up an IPv4 address of "attacker.example.com",
internal web server "www.example.net" and the
it will be accepted since the owner name "www.example.net"
"example.net".
IPv4 address as in IN-ADDR.ARPA.
representation of IPv6 addresses, but reversed as in IN-ADDR.ARPA.
wildcard such as *.example.com.
<pre class="programlisting"> zone "badlist" {type master; file "master/badlist"; allow-query {none;}; };</pre>
@ SOA LOCALHOST. named-mgr.example.com (1 1h 15m 30d 2h)
nxdomain.domain.com CNAME . ; NXDOMAIN policy
nodata.domain.com CNAME *. ; NODATA policy
bad.domain.com A 10.0.0.1 ; redirect to a walled garden
; do not rewrite (PASSTHRU) OK.DOMAIN.COM
ok.domain.com CNAME rpz-passthru.
8.0.0.0.127.rpz-ip CNAME .
32.1.0.0.127.rpz-ip CNAME rpz-passthru.
ns.domain.com.rpz-nsdname CNAME .
48.zz.2.2001.rpz-nsip CNAME .
<a name="server_statement_grammar"></a><span><strong class="command">server</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">server</strong></span> <em class="replaceable"><code>ip_addr[/prefixlen]</code></em> {
[<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em> ; ]</span>]
[<span class="optional"> keys <em class="replaceable"><code>{ string ; [<span class="optional"> string ; [<span class="optional">...</span>]</span>] }</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> query-source [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
[<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
[<span class="optional"> query-source-v6 [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
[<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
[<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> queryport-pool-updateinterval <em class="replaceable"><code>number</code></em>; </span>]
<a name="server_statement_definition_and_usage"></a><span><strong class="command">server</strong></span> Statement Definition and
value of <span><strong class="command">bogus</strong></span> is <span><strong class="command">no</strong></span>.
that is advertised by <span><strong class="command">named</strong></span> when querying the remote server.
The server supports two zone transfer methods. The first, <span><strong class="command">one-answer</strong></span>,
uses one DNS message per resource record transferred. <span><strong class="command">many-answers</strong></span> packs
as many resource records as possible into a message. <span><strong class="command">many-answers</strong></span> is
more efficient, but is only known to be understood by <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
<span><strong class="command">key_id</strong></span> defined by the <span><strong class="command">key</strong></span> statement,
to be used for transaction security (TSIG, <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
<a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<a name="statschannels"></a><span><strong class="command">statistics-channels</strong></span> Statement Grammar</h3></div></div></div>
<a name="id2590679"></a><span><strong class="command">statistics-channels</strong></span> Statement Definition and
address. An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
<a name="trusted-keys"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div>
<em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
[<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
<a name="id2590819"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition
DNSSEC security roots. DNSSEC is described in <a href="Bv9ARM.ch04.html#DNSSEC" title="DNSSEC">the section called “DNSSEC”</a>. A security root is defined when the
<a name="id2590934"></a><span><strong class="command">managed-keys</strong></span> Statement Grammar</h3></div></div></div>
<em class="replaceable"><code>string</code></em> initial-key <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
[<span class="optional"> <em class="replaceable"><code>string</code></em> initial-key <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
<a name="managed-keys"></a><span><strong class="command">managed-keys</strong></span> Statement Definition
set to <strong class="userinput"><code>auto</code></strong>, <span><strong class="command">named</strong></span>
<a name="view_statement_grammar"></a><span><strong class="command">view</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span><strong class="command">view</strong></span> <em class="replaceable"><code>view_name</code></em>
<a name="id2591360"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
<span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
// Provide a complete view of the example.com
zone "example.com" {
file "example-internal.db";
// Provide a restricted view of the example.com
zone "example.com" {
file "example-external.db";
<pre class="programlisting"><span><strong class="command">zone</strong></span> <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> dnssec-loadkeys-interval <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> update-policy <em class="replaceable"><code>local</code></em> | { <em class="replaceable"><code>update_policy_rule</code></em> [<span class="optional">...</span>] }; </span>]
[<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
[<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-mx (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">fast</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
[<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> auto-dnssec <code class="constant">allow</code>|<code class="constant">maintain</code>|<code class="constant">off</code>; </span>]
[<span class="optional"> inline-signing <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> serial-update-method <code class="constant">increment</code>|<code class="constant">unixtime</code>; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> dnssec-update-mode ( <em class="replaceable"><code>maintain</code></em> | <em class="replaceable"><code>no-resign</code></em> ); </span>]
[<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> dnssec-loadkeys-interval <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> dnssec-secure-to-insecure <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> also-notify [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">fast</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
[<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> auto-dnssec <code class="constant">allow</code>|<code class="constant">maintain</code>|<code class="constant">off</code>; </span>]
[<span class="optional"> inline-signing <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>] // Not Implemented.
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">fast</code>) ; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> server-addresses { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> ; ... </span>] }; </span>]
[<span class="optional"> server-names { [<span class="optional"> <em class="replaceable"><code>namelist</code></em> </span>] }; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>"."</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">fast</code>) ; </span>]
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
<a name="id2593127"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div>
Non recursive queries (i.e., those with the RD
status of infrastructure zones (e.g. COM,
See caveats in <a href="Bv9ARM.ch06.html#root_delegation_only"><span><strong class="command">root-delegation-only</strong></span></a>.
a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>),
in the mid-1970s. Zone data for it can be specified with the <code class="literal">CHAOS</code> class.
<span><strong class="command">allow-notify</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span><strong class="command">allow-query-on</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>.
<dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
network. The default varies according to zone type. For <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>. For <span><strong class="command">slave</strong></span>
<span><strong class="command">check-mx</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-wildcard</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-integrity</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">check-sibling</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">zero-no-soa-ttl</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">update-check-ksk</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">dnssec-update-mode</strong></span> in <a href="Bv9ARM.ch06.html#options" title="options Statement Definition and
Usage">the section called “<span><strong class="command">options</strong></span> Statement Definition and
<dt><span class="term"><span><strong class="command">dnssec-dnskey-kskonly</strong></span></span></dt>
<span><strong class="command">dnssec-dnskey-kskonly</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">try-tcp-refresh</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">dialup</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
See caveats in <a href="Bv9ARM.ch06.html#root_delegation_only"><span><strong class="command">root-delegation-only</strong></span></a>.
after trying the forwarders and getting no answer, while <span><strong class="command">first</strong></span> would
This is applicable to <span><strong class="command">master</strong></span> and <span><strong class="command">slave</strong></span> zones.
<span><strong class="command">max-journal-size</strong></span> in <a href="Bv9ARM.ch06.html#server_resource_limits" title="Server Resource Limits">the section called “Server Resource Limits”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
<span><strong class="command">max-transfer-time-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
<span><strong class="command">max-transfer-time-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
<span><strong class="command">max-transfer-idle-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">notify-delay</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
zones when they are loaded from disk. <acronym class="acronym">BIND</acronym> 9 does not verify signatures
For example, if "example.com" is configured as a
example.com. A 192.0.2.1
"www.example.com" with the RD bit on, the server
That is, when "example.net" is the origin of a
static-stub zone, "ns.example" and
"master.example.com" can be specified in the
"ns.example.net" cannot, and will be rejected by
For example, if "example.com" is configured as a
static-stub zone with "ns1.example.net" and
"www.example.com" with the RD bit on, the server
"ns2.example.net" to IP addresses, and then send
<dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
<span><strong class="command">sig-validity-interval</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-nodes</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
<span><strong class="command">sig-signing-signatures</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">sig-signing-type</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span><strong class="command">transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
<span><strong class="command">alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
<span><strong class="command">alt-transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
<span><strong class="command">use-alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span><strong class="command">notify-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
See the description in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
<span><strong class="command">ixfr-from-differences</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span><strong class="command">key-directory</strong></span> in <a href="Bv9ARM.ch06.html#options" title="options Statement Definition and
Usage">the section called “<span><strong class="command">options</strong></span> Statement Definition and
(see <a href="man.dnssec-keygen.html" title="dnssec-keygen"><span class="refentrytitle"><span class="application">dnssec-keygen</span></span>(8)</a> and
<a href="man.dnssec-settime.html" title="dnssec-settime"><span class="refentrytitle"><span class="application">dnssec-settime</span></span>(8)</a>). The command
<dt><span class="term"><span><strong class="command">serial-update-method</strong></span></span></dt>
<a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<dt><span class="term"><span><strong class="command">dnssec-secure-to-insecure</strong></span></span></dt>
<span><strong class="command">dnssec-secure-to-insecure</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
( <span><strong class="command">grant</strong></span> | <span><strong class="command">deny</strong></span> ) <em class="replaceable"><code>identity</code></em> <em class="replaceable"><code>nametype</code></em> [<span class="optional"> <em class="replaceable"><code>name</code></em> </span>] [<span class="optional"> <em class="replaceable"><code>types</code></em> </span>]
and converts it machine.realm allowing the machine
to update machine.realm. The REALM to be matched
converts it to machine.realm allowing the machine
to update subdomains of machine.realm. The REALM
and converts it machine.realm allowing the machine
to update machine.realm. The REALM to be matched
converts it to machine.realm allowing the machine
to update subdomains of machine.realm. The REALM
<a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div>
that a particular nearby server be tried first. See <a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span><strong class="command">sortlist</strong></span> Statement”</a> and <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>.
built-in server information zones, e.g.,
any order), and if neither of those succeed, delivery to <code class="literal">mail.backup.org</code> will
and PTR records. Entries in the in-addr.arpa domain are made in
in-addr.arpa name of
3.2.1.10.in-addr.arpa. This name should have a PTR resource record
Master File Directives include <span><strong class="command">$ORIGIN</strong></span>, <span><strong class="command">$INCLUDE</strong></span>,
<a name="id2599552"></a>The <span><strong class="command">@</strong></span> (at-sign)</h4></div></div></div>
<a name="id2599568"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div>
$ORIGIN example.com.
<a name="id2599628"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div>
if it were included into the file at this point. If <span><strong class="command">origin</strong></span> is
revert to the values they had prior to the <span><strong class="command">$INCLUDE</strong></span> once
<a name="id2599698"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div>
<a name="id2599802"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div>
Classless IN-ADDR.ARPA delegation.
HOST-1.EXAMPLE. MX 0 .
HOST-2.EXAMPLE. A 1.2.3.2
HOST-2.EXAMPLE. MX 0 .
HOST-3.EXAMPLE. A 1.2.3.3
HOST-3.EXAMPLE. MX 0 .
HOST-127.EXAMPLE. A 1.2.3.127
HOST-127.EXAMPLE. MX 0 .
(<span><strong class="command">n</strong></span> or <span><strong class="command">N</strong></span>\
The <span><strong class="command">$GENERATE</strong></span> directive is a <acronym class="acronym">BIND</acronym> extension
(see <a href="Bv9ARM.ch06.html#statschannels" title="statistics-channels Statement Grammar">the section called “<span><strong class="command">statistics-channels</strong></span> Statement Grammar”</a>.)
<a href="Bv9ARM.ch06.html#clients-per-query"><span><strong class="command">clients-per-query</strong></span></a>.)
<a name="id2604389"></a>Compatibility with <span class="emphasis"><em>BIND</em></span> 8 Counters</h4></div></div></div>
<td width="40%" align="left" valign="top">Chapter�5.�The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver�</td>