Bv9ARM.ch06.html revision e191be096ca7a731d7cd5095b3c0f9584c0a5453
59602f2a7c4e4809941583bed3e94cd26e628f1aTinderbox User - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater - Copyright (C) 2000-2003 Internet Software Consortium.
19558a04decde0e7261d489d92d04ad88104217bTinderbox User - Permission to use, copy, modify, and/or distribute this software for any
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews - purpose with or without fee is hereby granted, provided that the above
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews - copyright notice and this permission notice appear in all copies.
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
287a6a8f9040dc43560cd69cddf83bfc0f53b76fTinderbox User - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
8de3f14f1c300c3e1ed99084cc03485b42c92bf1Tinderbox User - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User - PERFORMANCE OF THIS SOFTWARE.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<title>Chapter�6.�BIND 9 Configuration Reference</title>
d5637bdbb931ff79fced3d4858d83212ea58ed15Tinderbox User<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<link rel="prev" href="Bv9ARM.ch05.html" title="Chapter�5.�The BIND 9 Lightweight Resolver">
d5637bdbb931ff79fced3d4858d83212ea58ed15Tinderbox User<link rel="next" href="Bv9ARM.ch07.html" title="Chapter�7.�BIND 9 Security Considerations">
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<table width="100%" summary="Navigation header">
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<tr><th colspan="3" align="center">Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</th></tr>
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<a accesskey="p" href="Bv9ARM.ch05.html">Prev</a>�</td>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch07.html">Next</a>
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User<div class="titlepage"><div><div><h1 class="title">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<a name="Bv9ARM.ch06"></a>Chapter�6.�<acronym class="acronym">BIND</acronym> 9 Configuration Reference</h1></div></div></div>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<dt><span class="section"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="section"><a href="Bv9ARM.ch06.html#comment_syntax">Comment Syntax</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="section"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#acl_grammar"><span class="command"><strong>acl</strong></span> Statement Grammar</a></span></dt>
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#acl"><span class="command"><strong>acl</strong></span> Statement Definition and
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#controls_grammar"><span class="command"><strong>controls</strong></span> Statement Grammar</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="section"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span class="command"><strong>controls</strong></span> Statement Definition and
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="section"><a href="Bv9ARM.ch06.html#include_grammar"><span class="command"><strong>include</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#include_statement"><span class="command"><strong>include</strong></span> Statement Definition and Usage</a></span></dt>
cdfc81e048bd34c1d628380247bda6b80a89e20eAutomatic Updater<dt><span class="section"><a href="Bv9ARM.ch06.html#key_grammar"><span class="command"><strong>key</strong></span> Statement Grammar</a></span></dt>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#key_statement"><span class="command"><strong>key</strong></span> Statement Definition and Usage</a></span></dt>
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#logging_grammar"><span class="command"><strong>logging</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#logging_statement"><span class="command"><strong>logging</strong></span> Statement Definition and Usage</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#lwres_grammar"><span class="command"><strong>lwres</strong></span> Statement Grammar</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="section"><a href="Bv9ARM.ch06.html#lwres_statement"><span class="command"><strong>lwres</strong></span> Statement Definition and Usage</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#masters_grammar"><span class="command"><strong>masters</strong></span> Statement Grammar</a></span></dt>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#masters_statement"><span class="command"><strong>masters</strong></span> Statement Definition and
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#options_grammar"><span class="command"><strong>options</strong></span> Statement Grammar</a></span></dt>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<dt><span class="section"><a href="Bv9ARM.ch06.html#options"><span class="command"><strong>options</strong></span> Statement Definition and
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span class="command"><strong>server</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span class="command"><strong>server</strong></span> Statement Definition and
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#statschannels"><span class="command"><strong>statistics-channels</strong></span> Statement Grammar</a></span></dt>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#statistics_channels"><span class="command"><strong>statistics-channels</strong></span> Statement Definition and
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#trusted-keys"><span class="command"><strong>trusted-keys</strong></span> Statement Grammar</a></span></dt>
294e9d4c34462d29a3e766c88f452b46aeb3702fTinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#trusted_keys"><span class="command"><strong>trusted-keys</strong></span> Statement Definition
4c6bae917bec70e1fc4d1b761a9765075af78441Tinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#managed_keys"><span class="command"><strong>managed-keys</strong></span> Statement Grammar</a></span></dt>
294e9d4c34462d29a3e766c88f452b46aeb3702fTinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#managed-keys"><span class="command"><strong>managed-keys</strong></span> Statement Definition
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="section"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span class="command"><strong>view</strong></span> Statement Grammar</a></span></dt>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="section"><a href="Bv9ARM.ch06.html#view_statement"><span class="command"><strong>view</strong></span> Statement Definition and Usage</a></span></dt>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span class="command"><strong>zone</strong></span>
2ae159b376dac23870d8005563c585acf85a4b5aEvan Hunt<dt><span class="section"><a href="Bv9ARM.ch06.html#zone_statement"><span class="command"><strong>zone</strong></span> Statement Definition and Usage</a></span></dt>
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#zone_file">Zone File</a></span></dt>
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt>
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#mx_records">Discussion of MX Records</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#ipv4_reverse">Inverse Mapping in IPv4</a></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#zone_directives">Other Zone File Directives</a></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#generate_directive"><acronym class="acronym">BIND</acronym> Master File Extension: the <span class="command"><strong>$GENERATE</strong></span> Directive</a></span></dt>
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews<dt><span class="section"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#statistics">BIND9 Statistics</a></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#statsfile">The Statistics File</a></span></dt>
aef6cf0f147a5014d4891c9689b9f463399e16e7Tinderbox User<dt><span class="section"><a href="Bv9ARM.ch06.html#statistics_counters">Statistics Counters</a></span></dt>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <acronym class="acronym">BIND</acronym> 9 configuration is broadly similar
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User to <acronym class="acronym">BIND</acronym> 8; however, there are a few new
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User of configuration, such as views. <acronym class="acronym">BIND</acronym>
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews 8 configuration files should work with few alterations in <acronym class="acronym">BIND</acronym>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews 9, although more complex configurations should be reviewed to check
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User if they can be more efficiently implemented using the new features
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews found in <acronym class="acronym">BIND</acronym> 9.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User <acronym class="acronym">BIND</acronym> 4 configuration files can be
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews converted to the new format
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User using the shell script
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <code class="filename">contrib/named-bootconf/named-bootconf.sh</code>.
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User<div class="titlepage"><div><div><h2 class="title" style="clear: both">
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<a name="configuration_file_elements"></a>Configuration File Elements</h2></div></div></div>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews Following is a list of elements used throughout the <acronym class="acronym">BIND</acronym> configuration
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews file documentation:
5747235bf35e7398984fd6b4632743396895ea7aTinderbox User The name of an <code class="varname">address_match_list</code> as
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews defined by the <span class="command"><strong>acl</strong></span> statement.
5747235bf35e7398984fd6b4632743396895ea7aTinderbox User <code class="varname">address_match_list</code>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews A list of one or more
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User <code class="varname">ip_prefix</code>, <code class="varname">key_id</code>,
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews or <code class="varname">acl_name</code> elements, see
01a5c5503482fb3ba52088bf0178a7213273bf96Mark Andrews <a class="xref" href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a>.
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User A named list of one or more <code class="varname">ip_addr</code>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews with optional <code class="varname">key_id</code> and/or
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User A <code class="varname">masters_list</code> may include other
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User A quoted string which will be used as
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews a DNS name, for example "<code class="literal">my.test.domain</code>".
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews A list of one or more <code class="varname">domain_name</code>
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User One to four integers valued 0 through
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews 255 separated by dots (`.'), such as <span class="command"><strong>123</strong></span>,
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User <span class="command"><strong>45.67</strong></span> or <span class="command"><strong>89.123.45.67</strong></span>.
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater An IPv4 address with exactly four elements
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in <code class="varname">dotted_decimal</code> notation.
b02be031b9ff37b042adc8e68e36b8bbc1f672b7Tinderbox User An IPv6 address, such as <span class="command"><strong>2001:db8::1234</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater IPv6 scoped addresses that have ambiguity on their
ba8b771c371967dd1254c7fa82ebe4158ee04b24Tinderbox User scope zones must be disambiguated by an appropriate
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater zone ID with the percent character (`%') as
3ec8f7777ea2b04fc1ebb63077f0916f63b1011aTinderbox User delimiter. It is strongly recommended to use
c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User string zone names rather than numeric identifiers,
b02be031b9ff37b042adc8e68e36b8bbc1f672b7Tinderbox User in order to be robust against system configuration
933799f3641f4f78445d015008bad0038900a82aTinderbox User changes. However, since there is no standard
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater mapping for such names and identifier values,
19b3dc94bce93fa76bd7e066f9298630dbc9dcb4Automatic Updater currently only interface names as link identifiers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater are supported, assuming one-to-one mapping between
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater interfaces and links. For example, a link-local
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews address <span class="command"><strong>fe80::1</strong></span> on the link
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater attached to the interface <span class="command"><strong>ne0</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater can be specified as <span class="command"><strong>fe80::1%ne0</strong></span>.
bac4435d473c9a0281507524f084480c34aa942aTinderbox User Note that on most systems link-local addresses
39ae0eafed076ef769fef5c18b22a8051df5c93aTinderbox User always have the ambiguity, and need to be
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews disambiguated.
c26604a73c4ce907ef6392f38b3fac838b1873a9Tinderbox User An <code class="varname">ip4_addr</code> or <code class="varname">ip6_addr</code>.
7f9e2fff07b9c17e0d7a0ea7abc9304ce9d01b61Tinderbox User A <code class="varname">number</code> between 0 and 63, used
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to select a differentiated services code point (DSCP)
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User value for use with outgoing traffic on operating systems
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews that support DSCP.
1bcc3273a80c256f11d9098a00ba2c041939e233Mark Andrews An IP port <code class="varname">number</code>.
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User The <code class="varname">number</code> is limited to 0
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User through 65535, with values
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews below 1024 typically restricted to use by processes running
bac4435d473c9a0281507524f084480c34aa942aTinderbox User In some cases, an asterisk (`*') character can be used as a
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews placeholder to
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User select a random high-numbered port.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews An IP network specified as an <code class="varname">ip_addr</code>,
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User followed by a slash (`/') and then the number of bits in the
8292deab031e7599cd7622aa7675fbe139ca6095Mark Andrews Trailing zeros in a <code class="varname">ip_addr</code>
c1e2310a3725eeed45e5e7c86750c64c5a02e993Francis Dupont For example, <span class="command"><strong>127/8</strong></span> is the
c1e2310a3725eeed45e5e7c86750c64c5a02e993Francis Dupont network <span class="command"><strong>127.0.0.0</strong></span> with
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews netmask <span class="command"><strong>255.0.0.0</strong></span> and <span class="command"><strong>1.2.3.0/28</strong></span> is
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont network <span class="command"><strong>1.2.3.0</strong></span> with netmask <span class="command"><strong>255.255.255.240</strong></span>.
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews When specifying a prefix involving a IPv6 scoped address
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont the scope may be omitted. In that case the prefix will
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews match packets from any scope.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews A <code class="varname">domain_name</code> representing
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews the name of a shared key, to be used for transaction
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User A list of one or more
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews separated by semicolons and ending with a semicolon.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews A non-negative 32-bit integer
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews (i.e., a number between 0 and 4294967295, inclusive).
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews Its acceptable value might further
e64202536ea72d8f371dd0df9fc763f8d70bf886Tinderbox User be limited by the context in which it is used.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont A quoted string which will be used as
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater a pathname, such as <code class="filename">zones/master/my.test.domain</code>.
3a988722ad9e209ba4064604d482dc4efe0e19ebTinderbox User A list of an <code class="varname">ip_port</code> or a port
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington A port range is specified in the form of
a3ffa9ab0644ae2b52f2e13a00b5e85b879f612fTinderbox User <strong class="userinput"><code>range</code></strong> followed by
1bf507ca635310b340aea42d6c3e567819974a99Tinderbox User <code class="varname">port_high</code>, which represents
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews port numbers from <code class="varname">port_low</code> through
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <code class="varname">port_high</code>, inclusive.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <code class="varname">port_low</code> must not be larger than
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <strong class="userinput"><code>range 1024 65535</code></strong> represents
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User ports from 1024 through 65535.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User In either case an asterisk (`*') character is not
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont allowed as a valid <code class="varname">ip_port</code>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington A 64-bit unsigned integer, or the keywords
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>unlimited</code></strong> or
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>default</code></strong>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Integers may take values
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington 0 <= value <= 18446744073709551615, though
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington certain parameters
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington (such as <span class="command"><strong>max-journal-size</strong></span>) may
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington use a more limited range within these extremes.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington In most cases, setting a value to 0 does not
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington literally mean zero; it means "undefined" or
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington "as big as possible", depending on the context.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington See the explanations of particular parameters
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington that use <code class="varname">size_spec</code>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington for details on how they interpret its use.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Numeric values can optionally be followed by a
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington scaling factor:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>K</code></strong> or <strong class="userinput"><code>k</code></strong>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington for kilobytes,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>M</code></strong> or <strong class="userinput"><code>m</code></strong>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington for megabytes, and
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <strong class="userinput"><code>G</code></strong> or <strong class="userinput"><code>g</code></strong>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington for gigabytes, which scale by 1024, 1024*1024, and
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington 1024*1024*1024 respectively.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <code class="varname">unlimited</code> generally means
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington "as big as possible", and is usually the best
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington way to safely set a very large number.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington uses the limit that was in force when the server was started.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <code class="varname">size_or_percent</code>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <code class="varname">size_spec</code> or integer value
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews followed by '%' to represent percents.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews The behavior is exactly the same as
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User <code class="varname">size_or_percent</code> allows also
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews to specify a positive integer value followed by
646fed0d28be4387e3e32fb0f5732a1f58b572baTinderbox User '%' sign to represent percents.
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater Either <strong class="userinput"><code>yes</code></strong> or <strong class="userinput"><code>no</code></strong>.
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater The words <strong class="userinput"><code>true</code></strong> and <strong class="userinput"><code>false</code></strong> are
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater also accepted, as are the numbers <strong class="userinput"><code>1</code></strong>
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater and <strong class="userinput"><code>0</code></strong>.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews One of <strong class="userinput"><code>yes</code></strong>,
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <strong class="userinput"><code>no</code></strong>, <strong class="userinput"><code>notify</code></strong>,
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont <strong class="userinput"><code>notify-passive</code></strong>, <strong class="userinput"><code>refresh</code></strong> or
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews <strong class="userinput"><code>passive</code></strong>.
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User When used in a zone, <strong class="userinput"><code>notify-passive</code></strong>,
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User <strong class="userinput"><code>refresh</code></strong>, and <strong class="userinput"><code>passive</code></strong>
c11c7b47726c02eb05e29ff7be56a3343146e396Tinderbox User are restricted to slave and stub zones.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<div class="titlepage"><div><div><h3 class="title">
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User<a name="address_match_lists"></a>Address Match Lists</h3></div></div></div>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<div class="titlepage"><div><div><h4 class="title">
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<a name="id-1.7.4.4.2"></a>Syntax</h4></div></div></div>
a3ffa9ab0644ae2b52f2e13a00b5e85b879f612fTinderbox User<pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ;
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont [<span class="optional"> address_match_list_element; ... </span>]
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] |
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont key key_id | acl_name | { address_match_list } )
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<div class="titlepage"><div><div><h4 class="title">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<a name="id-1.7.4.4.3"></a>Definition and Usage</h4></div></div></div>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews Address match lists are primarily used to determine access
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User control for various server operations. They are also used in
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews the <span class="command"><strong>listen-on</strong></span> and <span class="command"><strong>sortlist</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User statements. The elements which constitute an address match
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont list can be any of the following:
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<li class="listitem">an IP address (IPv4 or IPv6)</li>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<li class="listitem">an IP prefix (in `/' notation)</li>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont a key ID, as defined by the <span class="command"><strong>key</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<li class="listitem">the name of an address match list defined with
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the <span class="command"><strong>acl</strong></span> statement
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<li class="listitem">a nested address match list enclosed in braces</li>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Elements can be negated with a leading exclamation mark (`!'),
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington and the match list names "any", "none", "localhost", and
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington "localnets" are predefined. More information on those names
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington can be found in the description of the acl statement.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The addition of the key clause made the name of this syntactic
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington element something of a misnomer, since security keys can be used
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington to validate access without regard to a host or network address.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Nonetheless, the term "address match list" is still used
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington throughout the documentation.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews When a given IP address or prefix is compared to an address
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington match list, the comparison takes place in approximately O(1)
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington time. However, key comparisons require that the list of keys
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews be traversed until a matching key is found, and therefore may
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews be somewhat slower.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews The interpretation of a match depends on whether the list is being
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User used for access control, defining <span class="command"><strong>listen-on</strong></span> ports, or in a
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span class="command"><strong>sortlist</strong></span>, and whether the element was negated.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews When used as an access control list, a non-negated match
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews allows access and a negated match denies access. If
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews there is no match, access is denied. The clauses
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span class="command"><strong>allow-notify</strong></span>,
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <span class="command"><strong>allow-recursion</strong></span>,
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User <span class="command"><strong>allow-recursion-on</strong></span>,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span class="command"><strong>allow-query</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="command"><strong>allow-query-on</strong></span>,
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont <span class="command"><strong>allow-query-cache</strong></span>,
bac4435d473c9a0281507524f084480c34aa942aTinderbox User <span class="command"><strong>allow-query-cache-on</strong></span>,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span class="command"><strong>allow-transfer</strong></span>,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span class="command"><strong>allow-update</strong></span>,
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews <span class="command"><strong>allow-update-forwarding</strong></span>,
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews <span class="command"><strong>blackhole</strong></span>, and
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span class="command"><strong>keep-response-order</strong></span> all use address match
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington lists. Similarly, the <span class="command"><strong>listen-on</strong></span> option will cause the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington server to refuse queries on any of the machine's
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington addresses which do not match the list.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Order of insertion is significant. If more than one element
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington in an ACL is found to match a given IP address or prefix,
b7aab05edae933e169d5f83c653935b17c7f0a8bMark Andrews preference will be given to the one that came
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span class="emphasis"><em>first</em></span> in the ACL definition.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Because of this first-match behavior, an element that
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington defines a subset of another element in the list should
409ba95e573b40cf36acf97dd62ee7e9c7775851Tinderbox User come before the broader element, regardless of whether
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews either is negated. For example, in
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <span class="command"><strong>1.2.3/24; ! 1.2.3.13;</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the 1.2.3.13 element is completely useless because the
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews algorithm will match any lookup for 1.2.3.13 to the 1.2.3/24
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington element. Using <span class="command"><strong>! 1.2.3.13; 1.2.3/24</strong></span> fixes
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington that problem by having 1.2.3.13 blocked by the negation, but
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington all other 1.2.3.* hosts fall through.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<div class="titlepage"><div><div><h3 class="title">
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User<a name="comment_syntax"></a>Comment Syntax</h3></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington comments to appear
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington file. To appeal to programmers of all kinds, they can be written
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="titlepage"><div><div><h4 class="title">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a name="id-1.7.4.5.3"></a>Syntax</h4></div></div></div>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<pre class="programlisting">// This is a <acronym class="acronym">BIND</acronym> comment as in C++</pre>
6d114a4c5cddb176ae5199eee154c0273d652ba4Tinderbox User<pre class="programlisting"># This is a <acronym class="acronym">BIND</acronym> comment as in common UNIX shells
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User# and perl</pre>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<div class="titlepage"><div><div><h4 class="title">
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<a name="id-1.7.4.5.4"></a>Definition and Usage</h4></div></div></div>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Comments may appear anywhere that whitespace may appear in
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews a <acronym class="acronym">BIND</acronym> configuration file.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont C-style comments start with the two characters /* (slash,
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont star) and end with */ (star, slash). Because they are completely
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont delimited with these characters, they can be used to comment only
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont a portion of a line or to span multiple lines.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews C-style comments cannot be nested. For example, the following
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington is not valid because the entire comment ends with the first */:
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews<pre class="programlisting">/* This is the start of a comment.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews This is still part of the comment.
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews/* This is an incorrect attempt at nesting a comment. */
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews This is no longer in any comment. */
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington C++-style comments start with the two characters // (slash,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington slash) and continue to the end of the physical line. They cannot
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington be continued across multiple physical lines; to have one logical
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington comment span multiple lines, each line must use the // pair.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<pre class="programlisting">// This is the start of a comment. The next line
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews// is a new comment, even though it is logically
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews// part of the previous comment.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Shell-style (or perl-style, if you prefer) comments start
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont with the character <code class="literal">#</code> (number sign)
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User and continue to the end of the
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews physical line, as in C++ comments.
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User<pre class="programlisting"># This is the start of a comment. The next line
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews# is a new comment, even though it is logically
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews# part of the previous comment.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews You cannot use the semicolon (`;') character
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews to start a comment such as you would in a zone file. The
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews semicolon indicates the end of a configuration
cc5a9ce75af9870f2cb9e2bf00548c2f7e6398d6Automatic Updater<div class="titlepage"><div><div><h2 class="title" style="clear: both">
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<a name="Configuration_File_Grammar"></a>Configuration File Grammar</h2></div></div></div>
bac4435d473c9a0281507524f084480c34aa942aTinderbox User A <acronym class="acronym">BIND</acronym> 9 configuration consists of
ba8b771c371967dd1254c7fa82ebe4158ee04b24Tinderbox User statements and comments.
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User Statements end with a semicolon. Statements and comments are the
532d27b39244fadfcf8d8b4593f4c65434c9c664Automatic Updater only elements that can appear without enclosing braces. Many
532d27b39244fadfcf8d8b4593f4c65434c9c664Automatic Updater statements contain a block of sub-statements, which are also
532d27b39244fadfcf8d8b4593f4c65434c9c664Automatic Updater terminated with a semicolon.
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews The following statements are supported:
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews <p><span class="command"><strong>acl</strong></span></p>
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews defines a named IP address
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User matching list, for access control and other uses.
665ba746c0585088d0c314dcfc4671aa2c7b2dc1Automatic Updater <p><span class="command"><strong>controls</strong></span></p>
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User declares control channels to be used
933799f3641f4f78445d015008bad0038900a82aTinderbox User by the <span class="command"><strong>rndc</strong></span> utility.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span class="command"><strong>include</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater includes a file.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span class="command"><strong>key</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater specifies key information for use in
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater authentication and authorization using TSIG.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span class="command"><strong>logging</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater specifies what the server logs, and where
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater the log messages are sent.
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater <p><span class="command"><strong>lwres</strong></span></p>
44e3b272904bfd85556771d30cf1bc6fa539dd03Automatic Updater configures <span class="command"><strong>named</strong></span> to
bbc0e1c4f47f101c4a64db3469352c49a49e734fTinderbox User also act as a light-weight resolver daemon (<span class="command"><strong>lwresd</strong></span>).
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User <p><span class="command"><strong>masters</strong></span></p>
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater defines a named masters list for
bf8c3776f1bf1a1270e5e0443ae5a8df022632a8Mark Andrews inclusion in stub and slave zones'
bf8c3776f1bf1a1270e5e0443ae5a8df022632a8Mark Andrews <span class="command"><strong>masters</strong></span> or
bf8c3776f1bf1a1270e5e0443ae5a8df022632a8Mark Andrews <span class="command"><strong>also-notify</strong></span> lists.
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater <p><span class="command"><strong>options</strong></span></p>
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater controls global server configuration
ec8755f605d7dcb2de1076040e77bc2d7ec33b4aTinderbox User options and sets defaults for other statements.
1404d301dd9e7e487a247b803f63909cd10cdf72Tinderbox User <p><span class="command"><strong>server</strong></span></p>
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater sets certain configuration options on
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater a per-server basis.
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater <p><span class="command"><strong>statistics-channels</strong></span></p>
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater declares communication channels to get access to
31a540386a9abaf681d8952f1b2cdf5c75a0ba6cAutomatic Updater <span class="command"><strong>named</strong></span> statistics.
a308b69ac66fadf66863484f301314d6e6a3f1d2Automatic Updater <p><span class="command"><strong>trusted-keys</strong></span></p>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews defines trusted DNSSEC keys.
7dd02af3c9350553e1d52d980a7812425b3f1295Automatic Updater <p><span class="command"><strong>managed-keys</strong></span></p>
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User lists DNSSEC keys to be kept up to date
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington using RFC 5011 trust anchor maintenance.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <p><span class="command"><strong>view</strong></span></p>
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews defines a view.
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews <p><span class="command"><strong>zone</strong></span></p>
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User defines a zone.
54890cfd30f01bdd33b7fb997f9b89fb084c3438Tinderbox User The <span class="command"><strong>logging</strong></span> and
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews <span class="command"><strong>options</strong></span> statements may only occur once
11b6b0d74bb8dd6bd1ce0b60ba7f9b66323f06d4Tinderbox User configuration.
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews<div class="titlepage"><div><div><h3 class="title">
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User<a name="acl_grammar"></a><span class="command"><strong>acl</strong></span> Statement Grammar</h3></div></div></div>
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews<pre class="programlisting"><span class="command"><strong>acl</strong></span> acl-name {
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews address_match_list
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews<div class="titlepage"><div><div><h3 class="title">
05d81eae94425a5124e07626af4bcc178960bd0eMark Andrews<a name="acl"></a><span class="command"><strong>acl</strong></span> Statement Definition and
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews The <span class="command"><strong>acl</strong></span> statement assigns a symbolic
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User name to an address match list. It gets its name from a primary
789875a1bd6d50c00d3bd883cad17ead1d3c21cdMark Andrews use of address match lists: Access Control Lists (ACLs).
c0cc232ba92b92c1c5a48d49449ef56f7ca05b56Tinderbox User The following ACLs are built-in:
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews <p><span class="command"><strong>any</strong></span></p>
1efe84be7849c5327001ad7dbad93d92c66c1389Mark Andrews Matches all hosts.
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews <p><span class="command"><strong>none</strong></span></p>
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt Matches no hosts.
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt <p><span class="command"><strong>localhost</strong></span></p>
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt Matches the IPv4 and IPv6 addresses of all network
b123be91958e0bc58a10c165be64d47661199e3bEvan Hunt interfaces on the system. When addresses are
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User added or removed, the <span class="command"><strong>localhost</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater ACL element is updated to reflect the changes.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span class="command"><strong>localnets</strong></span></p>
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater Matches any host on an IPv4 or IPv6 network
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater for which the system has an interface.
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews When addresses are added or removed,
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews the <span class="command"><strong>localnets</strong></span>
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews ACL element is updated to reflect the changes.
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews Some systems do not provide a way to determine the prefix
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews local IPv6 addresses.
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews In such a case, <span class="command"><strong>localnets</strong></span>
9f8051ea406dc3d98bb205df82cfc4d668a25d6eTinderbox User only matches the local
8f3657636521817d2971ae29aa3fb66e33709753Mark Andrews IPv6 addresses, just like <span class="command"><strong>localhost</strong></span>.
f525041ae26958385b697cf82a30f108577024b6Tinderbox User<div class="titlepage"><div><div><h3 class="title">
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews<a name="controls_grammar"></a><span class="command"><strong>controls</strong></span> Statement Grammar</h3></div></div></div>
5b56652059e2c22185a0b2bb1f5e58eb89a44426Tinderbox User<pre class="programlisting"><span class="command"><strong>controls</strong></span> {
c78c39caab4cf8b5daefc9c65878f7f5ed3eb7a0Tinderbox User [ inet ( ip_addr | * ) [ port ip_port ]
c78c39caab4cf8b5daefc9c65878f7f5ed3eb7a0Tinderbox User allow { <em class="replaceable"><code> address_match_list </code></em> }
8e86e8a779f37378fdb85a92c4ba77e394013729Tinderbox User [ keys { <em class="replaceable"><code>key_list</code></em> } ]
c19bf21885cdf78b52eee017dc1189a300657995Tinderbox User [ read-only <em class="replaceable"><code>yes_or_no</code></em> ] ; ]
9f8051ea406dc3d98bb205df82cfc4d668a25d6eTinderbox User [ inet ...; ]
f525041ae26958385b697cf82a30f108577024b6Tinderbox User [ unix <em class="replaceable"><code>path</code></em> perm <em class="replaceable"><code>number</code></em> owner <em class="replaceable"><code>number</code></em> group <em class="replaceable"><code>number</code></em>
be0d1ec971748020cb0382e02b4642b493ea1e7bTinderbox User [ keys { <em class="replaceable"><code>key_list</code></em> } ]
ff62ab3c2e6274f19190ded15548c723d38bbbe3Automatic Updater [ read-only <em class="replaceable"><code>yes_or_no</code></em> ] ; ]
ee23b913b6acccad68cf5af480b9e289a3d00510Tinderbox User [ unix ...; ]
ee23b913b6acccad68cf5af480b9e289a3d00510Tinderbox User<div class="titlepage"><div><div><h3 class="title">
ee23b913b6acccad68cf5af480b9e289a3d00510Tinderbox User<a name="controls_statement_definition_and_usage"></a><span class="command"><strong>controls</strong></span> Statement Definition and
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews The <span class="command"><strong>controls</strong></span> statement declares control
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User channels to be used by system administrators to control the
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User operation of the name server. These control channels are
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User used by the <span class="command"><strong>rndc</strong></span> utility to send
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater commands to and retrieve non-DNS results from a name server.
21b353c36cb484d022a0df8cb39c602649a46ae6Tinderbox User An <span class="command"><strong>inet</strong></span> control channel is a TCP socket
21b353c36cb484d022a0df8cb39c602649a46ae6Tinderbox User listening at the specified <span class="command"><strong>ip_port</strong></span> on the
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews specified <span class="command"><strong>ip_addr</strong></span>, which can be an IPv4 or IPv6
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews address. An <span class="command"><strong>ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews interpreted as the IPv4 wildcard address; connections will be
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews accepted on any of the system's IPv4 addresses.
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews To listen on the IPv6 wildcard address,
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews use an <span class="command"><strong>ip_addr</strong></span> of <code class="literal">::</code>.
c0cc232ba92b92c1c5a48d49449ef56f7ca05b56Tinderbox User If you will only use <span class="command"><strong>rndc</strong></span> on the local host,
c0cc232ba92b92c1c5a48d49449ef56f7ca05b56Tinderbox User using the loopback address (<code class="literal">127.0.0.1</code>
ce67023ae3ad39a77da5361d0187ab6f3f0219cbMark Andrews or <code class="literal">::1</code>) is recommended for maximum security.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews If no port is specified, port 953 is used. The asterisk
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews "<code class="literal">*</code>" cannot be used for <span class="command"><strong>ip_port</strong></span>.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews The ability to issue commands over the control channel is
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews restricted by the <span class="command"><strong>allow</strong></span> and
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews <span class="command"><strong>keys</strong></span> clauses.
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews Connections to the control channel are permitted based on the
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews <span class="command"><strong>address_match_list</strong></span>. This is for simple
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews IP address based filtering only; any <span class="command"><strong>key_id</strong></span>
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews elements of the <span class="command"><strong>address_match_list</strong></span>
b30ec46fec40a1b246f7965fbcd341fc6cfd1cc1Mark Andrews are ignored.
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews A <span class="command"><strong>unix</strong></span> control channel is a UNIX domain
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews socket listening at the specified path in the file system.
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews Access to the socket is specified by the <span class="command"><strong>perm</strong></span>,
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews <span class="command"><strong>owner</strong></span> and <span class="command"><strong>group</strong></span> clauses.
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews Note on some platforms (SunOS and Solaris) the permissions
95c3a5e116c1da135f669c3f15398172fac6279dMark Andrews (<span class="command"><strong>perm</strong></span>) are applied to the parent directory
3040b455151b1e1173193933664b2891b6159f24Mark Andrews as the permissions on the socket itself are ignored.
d585233c52e283d9a8849f16f04f452419a2484eTinderbox User The primary authorization mechanism of the command
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews channel is the <span class="command"><strong>key_list</strong></span>, which
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User contains a list of <span class="command"><strong>key_id</strong></span>s.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User Each <span class="command"><strong>key_id</strong></span> in the <span class="command"><strong>key_list</strong></span>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User is authorized to execute commands over the control channel.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User See <a class="xref" href="Bv9ARM.ch03.html#rndc">Remote Name Daemon Control application</a> in <a class="xref" href="Bv9ARM.ch03.html#admin_tools" title="Administrative Tools">the section called “Administrative Tools”</a>)
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater for information about configuring keys in <span class="command"><strong>rndc</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If the <span class="command"><strong>read-only</strong></span> clause is enabled, the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater control channel is limited to the following set of read-only
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater commands: <span class="command"><strong>nta -dump</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="command"><strong>null</strong></span>, <span class="command"><strong>status</strong></span>,
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span class="command"><strong>showzone</strong></span>, <span class="command"><strong>testgen</strong></span>, and
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span class="command"><strong>zonestatus</strong></span>. By default,
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User <span class="command"><strong>read-only</strong></span> is not enabled and the control
fca737c98d2be3ef944cc96320c040fdb5f160e3Tinderbox User channel allows read-write access.
fca737c98d2be3ef944cc96320c040fdb5f160e3Tinderbox User If no <span class="command"><strong>controls</strong></span> statement is present,
fca737c98d2be3ef944cc96320c040fdb5f160e3Tinderbox User <span class="command"><strong>named</strong></span> will set up a default
fca737c98d2be3ef944cc96320c040fdb5f160e3Tinderbox User control channel listening on the loopback address 127.0.0.1
fca737c98d2be3ef944cc96320c040fdb5f160e3Tinderbox User and its IPv6 counterpart ::1.
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User In this case, and also when the <span class="command"><strong>controls</strong></span> statement
3040b455151b1e1173193933664b2891b6159f24Mark Andrews is present but does not have a <span class="command"><strong>keys</strong></span> clause,
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater <span class="command"><strong>named</strong></span> will attempt to load the command channel key
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater from the file <code class="filename">rndc.key</code> in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <code class="filename">/etc</code> (or whatever <code class="varname">sysconfdir</code>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews was specified as when <acronym class="acronym">BIND</acronym> was built).
88d58d79c5bc7ce3c20a42461a5070116c736836Automatic Updater To create a <code class="filename">rndc.key</code> file, run
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <strong class="userinput"><code>rndc-confgen -a</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <code class="filename">rndc.key</code> feature was created to
48b36fa08b2b5bc0d552dc2a4425b3f7007b3d59Automatic Updater ease the transition of systems from <acronym class="acronym">BIND</acronym> 8,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater which did not have digital signatures on its command channel
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater messages and thus did not have a <span class="command"><strong>keys</strong></span> clause.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews It makes it possible to use an existing <acronym class="acronym">BIND</acronym> 8
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater configuration file in <acronym class="acronym">BIND</acronym> 9 unchanged,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater and still have <span class="command"><strong>rndc</strong></span> work the same way
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="command"><strong>ndc</strong></span> worked in BIND 8, simply by executing the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater command <strong class="userinput"><code>rndc-confgen -a</code></strong> after BIND 9 is
9fa39c73fc1d8bc44fdbbb79a1d26b837e7dd555Mark Andrews Since the <code class="filename">rndc.key</code> feature
7f814b8b164ae04916a8487cdc5e88ee3ff51a58Automatic Updater is only intended to allow the backward-compatible usage of
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <acronym class="acronym">BIND</acronym> 8 configuration files, this
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt feature does not
3040b455151b1e1173193933664b2891b6159f24Mark Andrews have a high degree of configurability. You cannot easily change
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User the key name or the size of the secret, so you should make a
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <code class="filename">rndc.conf</code> with your own key if you
1959fd489a8832e4e3d311670f64ae18e5d08156Automatic Updater wish to change
1959fd489a8832e4e3d311670f64ae18e5d08156Automatic Updater those things. The <code class="filename">rndc.key</code> file
3040b455151b1e1173193933664b2891b6159f24Mark Andrews permissions set such that only the owner of the file (the user that
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <span class="command"><strong>named</strong></span> is running as) can access it.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews desire greater flexibility in allowing other users to access
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <span class="command"><strong>rndc</strong></span> commands, then you need to create
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews <code class="filename">rndc.conf</code> file and make it group
d2247b4740cc5f740bf7d89ef9ce67fef015c95cMark Andrews readable by a group
d2247b4740cc5f740bf7d89ef9ce67fef015c95cMark Andrews that contains the users who should have access.
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews To disable the command channel, use an empty
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews <span class="command"><strong>controls</strong></span> statement:
8bc194b266a17f89e6c54469d4dfbb408070f39eMark Andrews <span class="command"><strong>controls { };</strong></span>.
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User<div class="titlepage"><div><div><h3 class="title">
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User<a name="include_grammar"></a><span class="command"><strong>include</strong></span> Statement Grammar</h3></div></div></div>
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater<pre class="programlisting"><span class="command"><strong>include</strong></span> <em class="replaceable"><code>filename</code></em>;</pre>
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User<div class="titlepage"><div><div><h3 class="title">
8d8f9f7f86a33a155dd74b9b2c1317afca555d54Evan Hunt<a name="include_statement"></a><span class="command"><strong>include</strong></span> Statement Definition and Usage</h3></div></div></div>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews The <span class="command"><strong>include</strong></span> statement inserts the
3040b455151b1e1173193933664b2891b6159f24Mark Andrews specified file at the point where the <span class="command"><strong>include</strong></span>
213dd665a9f45c3acb5f6c5f853bbbd5fd1598a2Tinderbox User statement is encountered. The <span class="command"><strong>include</strong></span>
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User statement facilitates the administration of configuration
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont by permitting the reading or writing of some things but not
e5bf83fe0bbca838a0749e9071bd76d9ee0fb59bFrancis Dupont others. For example, the statement could include private keys
4dca64bb8991502db368028aeeba2f832d3b971dAutomatic Updater that are readable only by the name server.
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater<a name="key_grammar"></a><span class="command"><strong>key</strong></span> Statement Grammar</h3></div></div></div>
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater<pre class="programlisting"><span class="command"><strong>key</strong></span> <em class="replaceable"><code>key_id</code></em> {
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater algorithm <em class="replaceable"><code>algorithm_id</code></em>;
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater secret <em class="replaceable"><code>secret_string</code></em>;
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater<a name="key_statement"></a><span class="command"><strong>key</strong></span> Statement Definition and Usage</h3></div></div></div>
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater The <span class="command"><strong>key</strong></span> statement defines a shared
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater secret key for use with TSIG (see <a class="xref" href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User or the command channel
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater (see <a class="xref" href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and Usage">the section called “<span class="command"><strong>controls</strong></span> Statement Definition and
ead8aa3182c5805fccb6c7c1636cede6a24a5fc1Automatic Updater Usage”</a>).
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User The <span class="command"><strong>key</strong></span> statement can occur at the
3040b455151b1e1173193933664b2891b6159f24Mark Andrews of the configuration file or inside a <span class="command"><strong>view</strong></span>
536da846f6cc03ad8abbb8bb9d5d8a6f607b8c33Mark Andrews statement. Keys defined in top-level <span class="command"><strong>key</strong></span>
229ea4644b3a7d9c7fdaa43888e7f55ba01e2ee3Automatic Updater statements can be used in all views. Keys intended for use in
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User a <span class="command"><strong>controls</strong></span> statement
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User (see <a class="xref" href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and Usage">the section called “<span class="command"><strong>controls</strong></span> Statement Definition and
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Usage”</a>)
8eb631bc4a219650906a6dc6ca51af3034b6ba54Tinderbox User must be defined at the top level.
665ba746c0585088d0c314dcfc4671aa2c7b2dc1Automatic Updater The <em class="replaceable"><code>key_id</code></em>, also known as the
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews key name, is a domain name uniquely identifying the key. It can
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews be used in a <span class="command"><strong>server</strong></span>
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews statement to cause requests sent to that
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews server to be signed with this key, or in address match lists to
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews verify that incoming requests have been signed with a key
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews matching this name, algorithm, and secret.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <em class="replaceable"><code>algorithm_id</code></em> is a string
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that specifies a security/authentication algorithm. The
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User <span class="command"><strong>named</strong></span> server supports <code class="literal">hmac-md5</code>,
8eb631bc4a219650906a6dc6ca51af3034b6ba54Tinderbox User <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
50fa300826799727204b93cbe63bebc341c5eadeTinderbox User <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews and <code class="literal">hmac-sha512</code> TSIG authentication.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Truncated hashes are supported by appending the minimum
2da2220fe7af2c45724b50b0187523b1fab0cf08Rob Austein number of required bits preceded by a dash, e.g.
e171a4137c6ba348957e61b7c4c3541493c0da02Automatic Updater <em class="replaceable"><code>secret_string</code></em> is the secret
c53a6f37deaa396660adb6a4ca600c4a58adfd3fAutomatic Updater to be used by the algorithm, and is treated as a base-64
c53a6f37deaa396660adb6a4ca600c4a58adfd3fAutomatic Updater encoded string.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h3 class="title">
19ad308d84cbf446a144e5a91f2032389a9d65c1Tinderbox User<a name="logging_grammar"></a><span class="command"><strong>logging</strong></span> Statement Grammar</h3></div></div></div>
19ad308d84cbf446a144e5a91f2032389a9d65c1Tinderbox User<pre class="programlisting"><span class="command"><strong>logging</strong></span> {
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User [ <span class="command"><strong>channel</strong></span> <em class="replaceable"><code>channel_name</code></em> {
b3386fba31414344f38f0c30849c056dceb22dceTinderbox User ( <span class="command"><strong>file</strong></span> <em class="replaceable"><code>path_name</code></em>
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater [ <span class="command"><strong>versions</strong></span> ( <em class="replaceable"><code>number</code></em> | <span class="command"><strong>unlimited</strong></span> ) ]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [ <span class="command"><strong>size</strong></span> <em class="replaceable"><code>size_spec</code></em> ]
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater | <span class="command"><strong>syslog</strong></span> <em class="replaceable"><code>syslog_facility</code></em>
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater | <span class="command"><strong>stderr</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater | <span class="command"><strong>null</strong></span> );
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater [ <span class="command"><strong>severity</strong></span> (<code class="option">critical</code> | <code class="option">error</code> | <code class="option">warning</code> | <code class="option">notice</code> |
af9cf290cea6ada6ce27b51c724ab77ad5d73fa0Tinderbox User <code class="option">info</code> | <code class="option">debug</code> [ <em class="replaceable"><code>level</code></em> ] | <code class="option">dynamic</code> ); ]
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater [ <span class="command"><strong>print-category</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User [ <span class="command"><strong>print-severity</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
6671e343b8c7e44ac10a7900fde59555fbc71571Automatic Updater [ <span class="command"><strong>print-time</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater [ <span class="command"><strong>buffered</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater [ <span class="command"><strong>category</strong></span> <em class="replaceable"><code>category_name</code></em> {
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater <em class="replaceable"><code>channel_name</code></em> ; [ <em class="replaceable"><code>channel_name</code></em> ; ... ]
4104e236f71eb5108fcfda6711878a97f6f4a8e7Automatic Updater<div class="titlepage"><div><div><h3 class="title">
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater<a name="logging_statement"></a><span class="command"><strong>logging</strong></span> Statement Definition and Usage</h3></div></div></div>
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater The <span class="command"><strong>logging</strong></span> statement configures a
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews variety of logging options for the name server. Its <span class="command"><strong>channel</strong></span> phrase
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews associates output methods, format options and severity levels with
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews a name that can then be used with the <span class="command"><strong>category</strong></span> phrase
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User to select how various classes of messages are logged.
664917bedafa65dee4349c84324a31731aa1e228Francis Dupont Only one <span class="command"><strong>logging</strong></span> statement is used to
af9cf290cea6ada6ce27b51c724ab77ad5d73fa0Tinderbox User as many channels and categories as are wanted. If there is no <span class="command"><strong>logging</strong></span> statement,
7fdbd6fc9df8728852ccaecb2d66241ab96a4084Tinderbox User the logging configuration will be:
50fa300826799727204b93cbe63bebc341c5eadeTinderbox User category default { default_syslog; default_debug; };
82b96702f09ed6bc5cd0f1aa5e54198c04cc192bTinderbox User category unmatched { null; };
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <span class="command"><strong>named</strong></span> is started with the
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews <code class="option">-L</code> option, it logs to the specified file
e20309353e6246485c521278131d3fced73d7957Tinderbox User at startup, instead of using syslog. In this case the logging
e20309353e6246485c521278131d3fced73d7957Tinderbox User configuration will be:
f8a9a38ee40c139a8d145ac76ecbff3a0f986453Mark Andrews category default { default_logfile; default_debug; };
e628576d3b3d91c8954679077f4c208f1e43b433Automatic Updater category unmatched { null; };
76fbdc591b3d46df28878a6ff844798622b85265Tinderbox User In <acronym class="acronym">BIND</acronym> 9, the logging configuration
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User is only established when
9d80d23172c30fd63e5046a7e69b8445e564ff31Automatic Updater the entire configuration file has been parsed. In <acronym class="acronym">BIND</acronym> 8, it was
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User established as soon as the <span class="command"><strong>logging</strong></span>
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt was parsed. When the server is starting up, all logging messages
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt regarding syntax errors in the configuration file go to the default
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt channels, or to standard error if the <code class="option">-g</code> option
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt was specified.
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User<div class="titlepage"><div><div><h4 class="title">
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews<a name="channel"></a>The <span class="command"><strong>channel</strong></span> Phrase</h4></div></div></div>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews All log output goes to one or more <span class="emphasis"><em>channels</em></span>;
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews you can make as many of them as you want.
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews Every channel definition must include a destination clause that
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews says whether messages selected for the channel go to a file, to a
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews particular syslog facility, to the standard error stream, or are
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews discarded. It can optionally also limit the message severity level
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews that will be accepted by the channel (the default is
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews <span class="command"><strong>info</strong></span>), and whether to include a
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews <span class="command"><strong>named</strong></span>-generated time stamp, the
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews category name
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews and/or severity level (the default is not to include any).
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews The <span class="command"><strong>null</strong></span> destination clause
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews causes all messages sent to the channel to be discarded;
3040b455151b1e1173193933664b2891b6159f24Mark Andrews in that case, other options for the channel are meaningless.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews The <span class="command"><strong>file</strong></span> destination clause directs
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User to a disk file. It can include limitations
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User both on how large the file is allowed to become, and how many
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User of the file will be saved each time the file is opened.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews If you use the <span class="command"><strong>versions</strong></span> log file
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews <span class="command"><strong>named</strong></span> will retain that many backup
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews versions of the file by
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews renaming them when opening. For example, if you choose to keep
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews three old versions
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews of the file <code class="filename">lamers.log</code>, then just
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews before it is opened
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews <code class="filename">lamers.log.1</code> is renamed to
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews <code class="filename">lamers.log.2</code>, <code class="filename">lamers.log.0</code> is renamed
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews to <code class="filename">lamers.log.1</code>, and <code class="filename">lamers.log</code> is
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews renamed to <code class="filename">lamers.log.0</code>.
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews You can say <span class="command"><strong>versions unlimited</strong></span> to
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews the number of versions.
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews If a <span class="command"><strong>size</strong></span> option is associated with
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews the log file,
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews then renaming is only done when the file being opened exceeds the
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews indicated size. No backup versions are kept by default; any
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews log file is simply appended.
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews The <span class="command"><strong>size</strong></span> option for files is used
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews to limit log
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews growth. If the file ever exceeds the size, then <span class="command"><strong>named</strong></span> will
3040b455151b1e1173193933664b2891b6159f24Mark Andrews stop writing to the file unless it has a <span class="command"><strong>versions</strong></span> option
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User associated with it. If backup versions are kept, the files are
3040b455151b1e1173193933664b2891b6159f24Mark Andrews described above and a new one begun. If there is no
3349f0044fda807e1fd6681c833d3593a22dad86Tinderbox User <span class="command"><strong>versions</strong></span> option, no more data will
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt be written to the log
3040b455151b1e1173193933664b2891b6159f24Mark Andrews until some out-of-band mechanism removes or truncates the log to
0a2ff769ecd0b5a6bda54b62bc1ec5fa6fd198a0Tinderbox User less than the
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User maximum size. The default behavior is not to limit the size of
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews Example usage of the <span class="command"><strong>size</strong></span> and
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews <span class="command"><strong>versions</strong></span> options:
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews<pre class="programlisting">channel an_example_channel {
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews file "example.log" versions 3 size 20m;
08190bd4d89153cee463b34f9233ad6dd88965fcMark Andrews print-time yes;
af60449fe472b8bea5ad04bf538c777c6b151112Tinderbox User print-category yes;
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User The <span class="command"><strong>syslog</strong></span> destination clause
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User channel to the system log. Its argument is a
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User syslog facility as described in the <span class="command"><strong>syslog</strong></span> man
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User page. Known facilities are <span class="command"><strong>kern</strong></span>, <span class="command"><strong>user</strong></span>,
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User <span class="command"><strong>mail</strong></span>, <span class="command"><strong>daemon</strong></span>, <span class="command"><strong>auth</strong></span>,
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User <span class="command"><strong>syslog</strong></span>, <span class="command"><strong>lpr</strong></span>, <span class="command"><strong>news</strong></span>,
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User <span class="command"><strong>uucp</strong></span>, <span class="command"><strong>cron</strong></span>, <span class="command"><strong>authpriv</strong></span>,
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User <span class="command"><strong>ftp</strong></span>, <span class="command"><strong>local0</strong></span>, <span class="command"><strong>local1</strong></span>,
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User <span class="command"><strong>local2</strong></span>, <span class="command"><strong>local3</strong></span>, <span class="command"><strong>local4</strong></span>,
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User <span class="command"><strong>local5</strong></span>, <span class="command"><strong>local6</strong></span> and
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User <span class="command"><strong>local7</strong></span>, however not all facilities
3040b455151b1e1173193933664b2891b6159f24Mark Andrews are supported on
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews all operating systems.
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews How <span class="command"><strong>syslog</strong></span> will handle messages
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews this facility is described in the <span class="command"><strong>syslog.conf</strong></span> man
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews page. If you have a system which uses a very old version of <span class="command"><strong>syslog</strong></span> that
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews only uses two arguments to the <span class="command"><strong>openlog()</strong></span> function,
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews then this clause is silently ignored.
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews On Windows machines syslog messages are directed to the EventViewer.
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews The <span class="command"><strong>severity</strong></span> clause works like <span class="command"><strong>syslog</strong></span>'s
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews "priorities", except that they can also be used if you are writing
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User straight to a file rather than using <span class="command"><strong>syslog</strong></span>.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User Messages which are not at least of the severity level given will
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User not be selected for the channel; messages of higher severity
3040b455151b1e1173193933664b2891b6159f24Mark Andrews will be accepted.
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater If you are using <span class="command"><strong>syslog</strong></span>, then the <span class="command"><strong>syslog.conf</strong></span> priorities
48dfee71508886d86fe8fb12f91961b5daf3141dMark Andrews will also determine what eventually passes through. For example,
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User defining a channel facility and severity as <span class="command"><strong>daemon</strong></span> and <span class="command"><strong>debug</strong></span> but
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User only logging <span class="command"><strong>daemon.warning</strong></span> via <span class="command"><strong>syslog.conf</strong></span> will
8c9c79e5fea0cb698026a74821695907c8312a46Mark Andrews cause messages of severity <span class="command"><strong>info</strong></span> and
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User <span class="command"><strong>notice</strong></span> to
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User be dropped. If the situation were reversed, with <span class="command"><strong>named</strong></span> writing
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User messages of only <span class="command"><strong>warning</strong></span> or higher,
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User then <span class="command"><strong>syslogd</strong></span> would
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater print all messages it received from the channel.
f09f1bf18e3ad40a0e8a6cc3dabf1c11f04992cbMark Andrews The <span class="command"><strong>stderr</strong></span> destination clause
3040b455151b1e1173193933664b2891b6159f24Mark Andrews channel to the server's standard error stream. This is intended
4c6bae917bec70e1fc4d1b761a9765075af78441Tinderbox User use when the server is running as a foreground process, for
6025cbbe8408f4b09d53d5ec1e95cb6da97e0a8dTinderbox User when debugging a configuration.
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews The server can supply extensive debugging information when
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews it is in debugging mode. If the server's global debug level is
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews than zero, then debugging mode will be active. The global debug
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User level is set either by starting the <span class="command"><strong>named</strong></span> server
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington with the <code class="option">-d</code> flag followed by a positive integer,
7cc0a5d21ef046bfd630c4769943d896a7d7472cTinderbox User or by running <span class="command"><strong>rndc trace</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The global debug level
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington can be set to zero, and debugging mode turned off, by running <span class="command"><strong>rndc
169f44b082b340b952e26c0fdb930c102a957752Mark Andrewsnotrace</strong></span>. All debugging messages in the server have a debug
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater level, and higher debug levels give more detailed output. Channels
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater that specify a specific debug severity, for example:
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews<pre class="programlisting">channel specific_debug_level {
e007e3e5b0316c6c05698a71101885743aca22bdAutomatic Updater severity debug 3;
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews will get debugging output of level 3 or less any time the
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User server is in debugging mode, regardless of the global debugging
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User level. Channels with <span class="command"><strong>dynamic</strong></span>
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews severity use the
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews server's global debug level to determine what messages to print.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews If <span class="command"><strong>print-time</strong></span> has been turned on,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews the date and time will be logged. <span class="command"><strong>print-time</strong></span> may
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews be specified for a <span class="command"><strong>syslog</strong></span> channel,
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews but is usually
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews pointless since <span class="command"><strong>syslog</strong></span> also logs
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews the date and
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews time. If <span class="command"><strong>print-category</strong></span> is
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews requested, then the
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews category of the message will be logged as well. Finally, if <span class="command"><strong>print-severity</strong></span> is
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews on, then the severity level of the message will be logged. The <span class="command"><strong>print-</strong></span> options may
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews be used in any combination, and will always be printed in the
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews order: time, category, severity. Here is an example where all
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews three <span class="command"><strong>print-</strong></span> options
3a26bfc09c833a8dc4d4c12b7cd271ed6d0843cbTinderbox User <code class="computeroutput">28-Feb-2000 15:05:32.863 general: notice: running</code>
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews If <span class="command"><strong>buffered</strong></span> has been turned on the output
180319f572fb6c1ca7000d22ea79a8dd77ae3f91Evan Hunt to files will not be flushed after each log entry. By default
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews all log messages are flushed.
180319f572fb6c1ca7000d22ea79a8dd77ae3f91Evan Hunt There are four predefined channels that are used for
2a3eef7f65270e3f9a954573d866b368b7857584Tinderbox User <span class="command"><strong>named</strong></span>'s default logging as follows.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews If <span class="command"><strong>named</strong></span> is started with the
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews fifth channel <span class="command"><strong>default_logfile</strong></span> is added.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews How they are
2a3eef7f65270e3f9a954573d866b368b7857584Tinderbox User used is described in <a class="xref" href="Bv9ARM.ch06.html#the_category_phrase" title="The category Phrase">the section called “The <span class="command"><strong>category</strong></span> Phrase”</a>.
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews<pre class="programlisting">channel default_syslog {
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews // send to syslog's daemon facility
0bb05fe2c2fa40c635ddc5fa38ff65e523b11d8eEvan Hunt syslog daemon;
95de440e8d2b07bb130505b4146059e5734e2eeaTinderbox User // only send priority info and higher
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User severity info;
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox Userchannel default_debug {
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington // write to named.run in the working directory
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington // Note: stderr is used instead of "named.run" if
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater // the server is started with the '-g' option.
bbf7c3fd96ae5e02cb84743c581862e35327032aAutomatic Updater // log at the server's current debug level
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater severity dynamic;
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox Userchannel default_stderr {
fa0326cc2cf428f67575b6ba3b97b528a31b0010Tinderbox User // writes to stderr
7adcb4de92bf4383a4c5624c4ed256736d02bc6dMark Andrews // only send priority info and higher
3040b455151b1e1173193933664b2891b6159f24Mark Andrews severity info;
3040b455151b1e1173193933664b2891b6159f24Mark Andrewschannel null {
95cfad51a3f71246d263af79a7861a6821f7a0beAutomatic Updater // toss anything sent to this channel
e135e3c4b1f4f986f00997f5ad5866effb203139Tinderbox Userchannel default_logfile {
bec9d04b657e1582d2531bdc02503bebde2aa978Tinderbox User // this channel is only present if named is
0e91f17da8a29086876a88962e0a3482094b6057Evan Hunt // started with the -L option, whose argument
28e0061dbcc2ae45d34541267a00d8b4de5b4a41Tinderbox User // provides the file name
99c231a3bd27893583204cd0a3e3103dc78dbc28Tinderbox User // log at the server's current debug level
3040b455151b1e1173193933664b2891b6159f24Mark Andrews severity dynamic;
08d53af7d51409036462fa80fb1bde7a8c2ac123Automatic Updater The <span class="command"><strong>default_debug</strong></span> channel has the
ec7751119a08c6a7250f3187beed69a8b836d349Tinderbox User property that it only produces output when the server's debug
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews nonzero. It normally writes to a file called <code class="filename">named.run</code>
5ecad47f69b3fd945472ab2900a9ff826a7ce2f6Automatic Updater in the server's working directory.
07d9d0dbcc0c79deb3c34f4a8af05ac68a6800e4Mark Andrews For security reasons, when the <code class="option">-u</code>
a66012b52c20200f118781463db4e4ee44454298Automatic Updater command line option is used, the <code class="filename">named.run</code> file
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt is created only after <span class="command"><strong>named</strong></span> has
3040b455151b1e1173193933664b2891b6159f24Mark Andrews changed to the
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews new UID, and any debug output generated while <span class="command"><strong>named</strong></span> is
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater starting up and still running as root is discarded. If you need
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User to capture this output, you must run the server with the <code class="option">-L</code>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User option to specify a default logfile, or the <code class="option">-g</code>
e135e3c4b1f4f986f00997f5ad5866effb203139Tinderbox User option to log to standard error which you can redirect to a file.
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater Once a channel is defined, it cannot be redefined. Thus you
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User cannot alter the built-in channels directly, but you can modify
2fd1e3918971180155c10d09454a277f015daecaAutomatic Updater the default logging by pointing categories at channels you have
18920d790825d96ca3943aa2dcb6eb80dc611c5fTinderbox User<div class="titlepage"><div><div><h4 class="title">
fdd0516065be2316409d0cc7dfb4e4f54eadc5afMark Andrews<a name="the_category_phrase"></a>The <span class="command"><strong>category</strong></span> Phrase</h4></div></div></div>
f0877b0237674d0519006ca7f8436e5f92250d30Mark Andrews There are many categories, so you can send the logs you want
f0877b0237674d0519006ca7f8436e5f92250d30Mark Andrews to see wherever you want, without seeing logs you don't want. If
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User you don't specify a list of channels for a category, then log
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User in that category will be sent to the <span class="command"><strong>default</strong></span> category
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User instead. If you don't specify a default category, the following
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User "default default" is used:
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User<pre class="programlisting">category default { default_syslog; default_debug; };
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User If you start <span class="command"><strong>named</strong></span> with the
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User <code class="option">-L</code> option then the default category is:
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User<pre class="programlisting">category default { default_logfile; default_debug; };
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User As an example, let's say you want to log security events to
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User a file, but you also want keep the default logging behavior. You'd
fdd0516065be2316409d0cc7dfb4e4f54eadc5afMark Andrews specify the following:
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User<pre class="programlisting">channel my_security_channel {
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User file "my_security_file";
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User severity info;
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox Usercategory security {
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User my_security_channel;
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User default_syslog;
c849f7acb025c73f56a8e28902a473f2aeaba39fTinderbox User default_debug;
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User To discard all messages in a category, specify the <span class="command"><strong>null</strong></span> channel:
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<pre class="programlisting">category xfer-out { null; };
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellingtoncategory notify { null; };
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Following are the available categories and brief descriptions
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater of the types of log information they contain. More
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater categories may be added in future <acronym class="acronym">BIND</acronym> releases.
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User <p><span class="command"><strong>client</strong></span></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Processing of client requests.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span class="command"><strong>cname</strong></span></p>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Logs nameservers that are skipped due to them being
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User a CNAME rather than A / AAAA records.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><span class="command"><strong>config</strong></span></p>
2cdbfcdad94eba75f3f8e77343a0eefabf553b8eAutomatic Updater Configuration file parsing and processing.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <p><span class="command"><strong>database</strong></span></p>
5f7586ddbd3edd11272cdd30ed613d936129328bTinderbox User Messages relating to the databases used
24e0e8d17df315d5d494ca933874e545eadce773Automatic Updater internally by the name server to store zone and cache
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <p><span class="command"><strong>default</strong></span></p>
3040b455151b1e1173193933664b2891b6159f24Mark Andrews The default category defines the logging
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User options for those categories where no specific
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User configuration has been
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User <p><span class="command"><strong>delegation-only</strong></span></p>
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User Delegation only. Logs queries that have been
1404d301dd9e7e487a247b803f63909cd10cdf72Tinderbox User forced to NXDOMAIN as the result of a
1404d301dd9e7e487a247b803f63909cd10cdf72Tinderbox User delegation-only zone or a
1404d301dd9e7e487a247b803f63909cd10cdf72Tinderbox User <span class="command"><strong>delegation-only</strong></span> in a
1404d301dd9e7e487a247b803f63909cd10cdf72Tinderbox User forward, hint or stub zone declaration.
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater <p><span class="command"><strong>dispatch</strong></span></p>
11b6b0d74bb8dd6bd1ce0b60ba7f9b66323f06d4Tinderbox User Dispatching of incoming packets to the
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater server modules where they are to be processed.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User <p><span class="command"><strong>dnssec</strong></span></p>
ac2ad7b4e4e41e7e788dbe103c581f1605209d3bTinderbox User DNSSEC and TSIG protocol processing.
601c1908d06375f5dea00ab98671a6c934d8a840Automatic Updater <p><span class="command"><strong>dnstap</strong></span></p>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews The "dnstap" DNS traffic capture system.
76fbdc591b3d46df28878a6ff844798622b85265Tinderbox User <p><span class="command"><strong>edns-disabled</strong></span></p>
d642d3857129678797a01adee14fbd70335b05a9Mark Andrews Log queries that have been forced to use plain
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews DNS due to timeouts. This is often due to
fd8fb4df8499e292daeac765f599ac7c507d9ca3Mark Andrews the remote servers not being RFC 1034 compliant
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User (not always returning FORMERR or similar to
3040b455151b1e1173193933664b2891b6159f24Mark Andrews EDNS queries and other extensions to the DNS
c95f536d78842fbc8ebcef653d88e1f2270054f8Automatic Updater when they are not understood). In other words, this is
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater targeted at servers that fail to respond to
3040b455151b1e1173193933664b2891b6159f24Mark Andrews DNS queries that they don't understand.
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater Note: the log message can also be due to
f9119ad8f6114b2255e7545bf5cd187f4db0a89bAutomatic Updater packet loss. Before reporting servers for
3040b455151b1e1173193933664b2891b6159f24Mark Andrews non-RFC 1034 compliance they should be re-tested
c95f536d78842fbc8ebcef653d88e1f2270054f8Automatic Updater to determine the nature of the non-compliance.
c95f536d78842fbc8ebcef653d88e1f2270054f8Automatic Updater This testing should prevent or reduce the
c95f536d78842fbc8ebcef653d88e1f2270054f8Automatic Updater number of false-positive reports.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews Note: eventually <span class="command"><strong>named</strong></span> will have to stop
cb40461f8744c5aeb369b84d5f48395a13a221a0Mark Andrews treating such timeouts as due to RFC 1034 non
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User compliance and start treating it as plain
bac4435d473c9a0281507524f084480c34aa942aTinderbox User packet loss. Falsely classifying packet
bac4435d473c9a0281507524f084480c34aa942aTinderbox User loss as due to RFC 1034 non compliance impacts
bac4435d473c9a0281507524f084480c34aa942aTinderbox User on DNSSEC validation which requires EDNS for
bac4435d473c9a0281507524f084480c34aa942aTinderbox User the DNSSEC records to be returned.
bac4435d473c9a0281507524f084480c34aa942aTinderbox User <p><span class="command"><strong>general</strong></span></p>
bac4435d473c9a0281507524f084480c34aa942aTinderbox User The catch-all. Many things still aren't
bac4435d473c9a0281507524f084480c34aa942aTinderbox User classified into categories, and they all end up here.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <p><span class="command"><strong>lame-servers</strong></span></p>
bf8c3776f1bf1a1270e5e0443ae5a8df022632a8Mark Andrews Lame servers. These are misconfigurations
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews in remote servers, discovered by BIND 9 when trying to
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews query those servers during resolution.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <p><span class="command"><strong>network</strong></span></p>
9692d283bb43c9eab49a7fadfc1b74a6e20e6151Tinderbox User Network operations.
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User <p><span class="command"><strong>notify</strong></span></p>
3a28155fe228cd6d59b15f1ca0b568be6620a9d2Tinderbox User The NOTIFY protocol.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater <p><span class="command"><strong>queries</strong></span></p>
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater Specify where queries should be logged to.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater At startup, specifying the category <span class="command"><strong>queries</strong></span> will also
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater enable query logging unless <span class="command"><strong>querylog</strong></span> option has been
c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User The query log entry reports the client's IP
c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User address and port number, and the query name,
c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User class and type. Next it reports whether the
c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User Recursion Desired flag was set (+ if set, -
c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User if not set), if the query was signed (S),
c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User EDNS was in used along with the EDNS version
c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User number (E(#)), if TCP was used (T), if DO
c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User (DNSSEC Ok) was set (D), if CD (Checking
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt Disabled) was set (C), if a valid DNS Server
c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User COOKIE was received (V), or if a DNS COOKIE
c218e22e3e6cbd409b61a14f1480b5ce5c70bfc1Tinderbox User option without a valid Server COOKIE was
2c1632c71e2f4d8afa35efce3080b31602a6608cTinderbox User present (K). After this the destination
1f471f3b06fae27f4b42ee4f0d6dac0cc7e5bc81Tinderbox User address the query was sent to is reported.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont <code class="computeroutput">client 127.0.0.1#62536 (www.example.com): query: www.example.com IN AAAA +SE</code>
e0bf4fc289705375be65c05a8fb085d514a98c97Tinderbox User <code class="computeroutput">client ::1#62537 (www.example.net): query: www.example.net IN AAAA -SE</code>
3a28155fe228cd6d59b15f1ca0b568be6620a9d2Tinderbox User (The first part of this log message, showing the
9e295ad801d5c986eb6c7745637b5dc0efb28711Tinderbox User repeated in all subsequent log messages related
d7d105151a78d35afb4233d2a6dbd47b7ec0d9a5Tinderbox User to the same query.)
e0bf4fc289705375be65c05a8fb085d514a98c97Tinderbox User <p><span class="command"><strong>query-errors</strong></span></p>
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater Information about queries that resulted in some
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews <p><span class="command"><strong>rate-limit</strong></span></p>
f42fc714eda962112e45b904d1f846c61a080114Automatic Updater The start, periodic, and final notices of the
3040b455151b1e1173193933664b2891b6159f24Mark Andrews rate limiting of a stream of responses are logged at
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <span class="command"><strong>info</strong></span> severity in this category.
cb40461f8744c5aeb369b84d5f48395a13a221a0Mark Andrews These messages include a hash value of the domain name
7c112f7d8f632412901d9f3c4445eb0db6db95feTinderbox User of the response and the name itself,
850cfa4e86da9f63c1b97ec8c743c091ffd3546bFrancis Dupont except when there is insufficient memory to record
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User the name for the final notice
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont The final notice is normally delayed until about one
d98b4b724343547314bde32a54966c8f124a5f03Mark Andrews minute after rate limit stops.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User A lack of memory can hurry the final notice,
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User in which case it starts with an asterisk (*).
862cad747c24bc3e608f31cde1d7eddb2409a316Tinderbox User Various internal events are logged at debug 1 level
f0c5e918974bf778af6cd1e25309ad13e30a79a6Tinderbox User Rate limiting of individual requests
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User is logged in the <span class="command"><strong>query-errors</strong></span> category.
e8e87ede5c36b95806c77bcd34894ad9c4b39a78Tinderbox User <p><span class="command"><strong>resolver</strong></span></p>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews DNS resolution, such as the recursive
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews lookups performed on behalf of clients by a caching name
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <p><span class="command"><strong>rpz</strong></span></p>
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews Information about errors in response policy zone files,
eac5382be368b43df62e4ac32075131fb4997f03Tinderbox User rewritten responses, and at the highest
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <span class="command"><strong>debug</strong></span> levels, mere rewriting
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <p><span class="command"><strong>security</strong></span></p>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews Approval and denial of requests.
d56349eff4a1ebb8f4370df5a8a507f1a8ecd0dfMark Andrews <p><span class="command"><strong>spill</strong></span></p>
d56349eff4a1ebb8f4370df5a8a507f1a8ecd0dfMark Andrews Logs queries that have been terminated, either by dropping
cb40461f8744c5aeb369b84d5f48395a13a221a0Mark Andrews or responding with SERVFAIL, as a result of a fetchlimit
d56349eff4a1ebb8f4370df5a8a507f1a8ecd0dfMark Andrews quota being exceeded.
0d13a9584b9f97693ab22d54322f1c484d578701Mark Andrews <p><span class="command"><strong>unmatched</strong></span></p>
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews Messages that <span class="command"><strong>named</strong></span> was unable to determine the
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews class of or for which there was no matching <span class="command"><strong>view</strong></span>.
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews A one line summary is also logged to the <span class="command"><strong>client</strong></span> category.
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews This category is best sent to a file or stderr, by
0d13a9584b9f97693ab22d54322f1c484d578701Mark Andrews default it is sent to
d56349eff4a1ebb8f4370df5a8a507f1a8ecd0dfMark Andrews the <span class="command"><strong>null</strong></span> channel.
d56349eff4a1ebb8f4370df5a8a507f1a8ecd0dfMark Andrews <p><span class="command"><strong>update</strong></span></p>
d56349eff4a1ebb8f4370df5a8a507f1a8ecd0dfMark Andrews Dynamic updates.
bec9d04b657e1582d2531bdc02503bebde2aa978Tinderbox User <p><span class="command"><strong>update-security</strong></span></p>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews Approval and denial of update requests.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews <p><span class="command"><strong>xfer-in</strong></span></p>
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews Zone transfers the server is receiving.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews <p><span class="command"><strong>xfer-out</strong></span></p>
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews Zone transfers the server is sending.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews<div class="titlepage"><div><div><h4 class="title">
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews<a name="query_errors"></a>The <span class="command"><strong>query-errors</strong></span> Category</h4></div></div></div>
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews The <span class="command"><strong>query-errors</strong></span> category is
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews specifically intended for debugging purposes: To identify
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews why and how specific queries result in responses which
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews indicate an error.
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews Messages of this category are therefore only logged
7e1a8f402e3881388db37152f71c698cb1f1c426Mark Andrews with <span class="command"><strong>debug</strong></span> levels.
7a2a1b8b14fc804ac80612d7b98064095e445be5Automatic Updater At the debug levels of 1 or higher, each response with the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater rcode of SERVFAIL is logged as follows:
213dd665a9f45c3acb5f6c5f853bbbd5fd1598a2Tinderbox User <code class="computeroutput">client 127.0.0.1#61502: query failed (SERVFAIL) for www.example.com/IN/AAAA at query.c:3880</code>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont This means an error resulting in SERVFAIL was
3040b455151b1e1173193933664b2891b6159f24Mark Andrews detected at line 3880 of source file
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews Log messages of this level will particularly
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews help identify the cause of SERVFAIL for an
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews authoritative server.
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews At the debug levels of 2 or higher, detailed context
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews information of recursive resolutions that resulted in
3040b455151b1e1173193933664b2891b6159f24Mark Andrews SERVFAIL is logged.
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrews The log message will look like as follows:
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrewsfetch completed at resolver.c:2970 for www.example.com/A
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrewsin 30.000183: timed out/success [domain:example.com,
3040b455151b1e1173193933664b2891b6159f24Mark Andrewsreferral:2,restart:7,qrysent:8,timeout:5,lame:0,neterr:0,
351eca011cf38fd3272b325029afce144a9a1ebaMark Andrewsbadresp:1,adberr:0,findfail:0,valfail:0]
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User The first part before the colon shows that a recursive
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews resolution for AAAA records of www.example.com completed
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews in 30.000183 seconds and the final result that led to the
4ba21f60009e18c5950d18546a127e70be537effMark Andrews SERVFAIL was determined at line 2970 of source file
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews The following part shows the detected final result and the
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews latest result of DNSSEC validation.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User The latter is always success when no validation attempt
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews In this example, this query resulted in SERVFAIL probably
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User because all name servers are down or unreachable, leading
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews to a timeout in 30 seconds.
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews DNSSEC validation was probably not attempted.
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews The last part enclosed in square brackets shows statistics
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews information collected for this particular resolution
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews The <code class="varname">domain</code> field shows the deepest zone
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews that the resolver reached;
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews it is the zone where the error was finally detected.
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews The meaning of the other fields is summarized in the
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater following table.
ff8ec39ce4afc2d774ce99f2386474d2c8539cd4Automatic Updater<div class="informaltable"><table border="1">
9c2cf9e2017e6dd196e3b866808f32c6206eeedcMark Andrews The number of referrals the resolver received
ba8b771c371967dd1254c7fa82ebe4158ee04b24Tinderbox User throughout the resolution process.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User In the above example this is 2, which are most
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews likely com and example.com.
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater <p><code class="varname">restart</code></p>
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater The number of cycles that the resolver tried
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater remote servers at the <code class="varname">domain</code>
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater In each cycle the resolver sends one query
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater (possibly resending it, depending on the response)
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater to each known name server of
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater the <code class="varname">domain</code> zone.
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater <p><code class="varname">qrysent</code></p>
8aa53dcb1d26277e8e805464bfff7bb7136f60cbAutomatic Updater The number of queries the resolver sent at the
1368e4b34cef64604c874fcc40201c78e548714cTinderbox User The number of timeouts since the resolver
4c6bae917bec70e1fc4d1b761a9765075af78441Tinderbox User received the last response.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews The number of lame servers the resolver detected
4c6bae917bec70e1fc4d1b761a9765075af78441Tinderbox User at the <code class="varname">domain</code> zone.
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews A server is detected to be lame either by an
70d987def5a58ebeb8243017c0ec2e9b2c326cf4Evan Hunt invalid response or as a result of lookup in
3d015b2a0aeaa8d763fc783c23f895125ca1e0b8Tinderbox User BIND9's address database (ADB), where lame
70d987def5a58ebeb8243017c0ec2e9b2c326cf4Evan Hunt servers are cached.
70d987def5a58ebeb8243017c0ec2e9b2c326cf4Evan Hunt The number of erroneous results that the
2706fce75f04398595d9648122c6b67164e94fccTinderbox User resolver encountered in sending queries
2706fce75f04398595d9648122c6b67164e94fccTinderbox User at the <code class="varname">domain</code> zone.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User One common case is the remote server is
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User unreachable and the resolver receives an ICMP
ae454ec746d1d4db8d04e107d4d25ff13158c37fMark Andrews unreachable error message.
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User The number of unexpected responses (other than
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington <code class="varname">lame</code>) to queries sent by the
a5636b773fa05a272b6876afd99309c0b3090e2fMark Andrews resolver at the <code class="varname">domain</code> zone.
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater <p><code class="varname">adberr</code></p>
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont Failures in finding remote server addresses
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont of the <code class="varname">domain</code> zone in the ADB.
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont One common case of this is that the remote
5c5c6d289db78e41f714007426a387498e15963cFrancis Dupont server's name does not have any address records.
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews Failures of resolving remote server addresses.
3040b455151b1e1173193933664b2891b6159f24Mark Andrews This is a total number of failures throughout
3040b455151b1e1173193933664b2891b6159f24Mark Andrews the resolution process.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <p><code class="varname">valfail</code></p>
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User Failures of DNSSEC validation.
879391501ee0ffba072433120bf1baa4087f8899Automatic Updater Validation failures are counted throughout
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater the resolution process (not limited to
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater the <code class="varname">domain</code> zone), but should
8f536463f9fdfa7da6a8310e4f4895373beb2961Mark Andrews only happen in <code class="varname">domain</code>.
dcd42a39d311b44877161ffd1e27fa62700c0171Mark Andrews At the debug levels of 3 or higher, the same messages
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater as those at the debug 1 level are logged for other errors
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater than SERVFAIL.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Note that negative responses such as NXDOMAIN are not
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater regarded as errors here.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater At the debug levels of 4 or higher, the same messages
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User as those at the debug 2 level are logged for other errors
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User than SERVFAIL.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Unlike the above case of level 3, messages are logged for
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User negative responses.
3f68e9c0e5a6ce475d15eef04bfed9b08a22afa9Tinderbox User This is because any unexpected results can be difficult to
3040b455151b1e1173193933664b2891b6159f24Mark Andrews debug in the recursion case.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<div class="titlepage"><div><div><h3 class="title">
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User<a name="lwres_grammar"></a><span class="command"><strong>lwres</strong></span> Statement Grammar</h3></div></div></div>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington This is the grammar of the <span class="command"><strong>lwres</strong></span>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington statement in the <code class="filename">named.conf</code> file:
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<pre class="programlisting"><span class="command"><strong>lwres</strong></span> {
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User [<span class="optional"> listen-on { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ;
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; ... </span>] }; </span>]
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User [<span class="optional"> view <em class="replaceable"><code>view_name</code></em>; </span>]
63654fea53d6a58a65112234bc8d0c322e0c81b5Automatic Updater [<span class="optional"> search { <em class="replaceable"><code>domain_name</code></em> ; [<span class="optional"> <em class="replaceable"><code>domain_name</code></em> ; ... </span>] }; </span>]
3040b455151b1e1173193933664b2891b6159f24Mark Andrews [<span class="optional"> ndots <em class="replaceable"><code>number</code></em>; </span>]
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User [<span class="optional"> lwres-tasks <em class="replaceable"><code>number</code></em>; </span>]
22bed5c0fa8aa33ebca97235c0509db335440811Tinderbox User [<span class="optional"> lwres-clients <em class="replaceable"><code>number</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h3 class="title">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="lwres_statement"></a><span class="command"><strong>lwres</strong></span> Statement Definition and Usage</h3></div></div></div>
fd7c65dce9c2b1a3d12ca4df9074cd38019fdb5fAutomatic Updater The <span class="command"><strong>lwres</strong></span> statement configures the
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews server to also act as a lightweight resolver server. (See
3040b455151b1e1173193933664b2891b6159f24Mark Andrews <a class="xref" href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be multiple
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt <span class="command"><strong>lwres</strong></span> statements configuring
3040b455151b1e1173193933664b2891b6159f24Mark Andrews lightweight resolver servers with different properties.
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews The <span class="command"><strong>listen-on</strong></span> statement specifies a
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater IPv4 addresses (and ports) that this instance of a lightweight
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater resolver daemon
b6561016dc8a813bfd91cef5b876b3dfc3f08ffaTinderbox User should accept requests on. If no port is specified, port 921 is
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews If this statement is omitted, requests will be accepted on
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User The <span class="command"><strong>view</strong></span> statement binds this
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews instance of a
63d024b4a80b39753d7b2976d46b1478913cc6a1Tinderbox User lightweight resolver daemon to a view in the DNS namespace, so that
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews response will be constructed in the same manner as a normal DNS
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User matching this view. If this statement is omitted, the default view
80f05de86cd3cd8e4a4215c4501643891b942dafTinderbox User used, and if there is no default view, an error is triggered.
ab496cc3df1648e9ad992a87c35c2c0870fdc69dTinderbox User The <span class="command"><strong>search</strong></span> statement is equivalent to
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews <span class="command"><strong>search</strong></span> statement in
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews <code class="filename">/etc/resolv.conf</code>. It provides a
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User list of domains
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User which are appended to relative names in queries.
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User The <span class="command"><strong>ndots</strong></span> statement is equivalent to
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews <span class="command"><strong>ndots</strong></span> statement in
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews <code class="filename">/etc/resolv.conf</code>. It indicates the
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews number of dots in a relative domain name that should result in an
cc17f4a672fc4ce67327902dd797c4465f12c4c9Mark Andrews exact match lookup before search path elements are appended.
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt The <code class="option">lwres-tasks</code> statement specifies the number
3040b455151b1e1173193933664b2891b6159f24Mark Andrews of worker threads the lightweight resolver will dedicate to serving
5b4ef313da4283079786e516b4b07a1691e1dc50Mark Andrews clients. By default the number is the same as the number of CPUs on
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater the system; this can be overridden using the <code class="option">-n</code>
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater command line option when starting the server.
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater The <code class="option">lwres-clients</code> specifies
82447d835d3ff5c658749b4e9b4f66166407b3eaAutomatic Updater the number of client objects per thread the lightweight
50cfe402e61ba8d816d845a9f297e3de18f4fc15Tinderbox User resolver should create to serve client queries.
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User By default, if the lightweight resolver runs as a part
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User of <span class="command"><strong>named</strong></span>, 256 client objects are
9563f388c8ca1bb9ebb04db54e122815b0008c8aTinderbox User created for each task; if it runs as <span class="command"><strong>lwresd</strong></span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater 1024 client objects are created for each thread. The maximum
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User value is 32768; higher values will be silently ignored and
551271d8198ae06e37edf5da519d8ee153eeac0fTinderbox User the maximum will be used instead.
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User Note that setting too high a value may overconsume
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User system resources.
9563f388c8ca1bb9ebb04db54e122815b0008c8aTinderbox User The maximum number of client queries that the lightweight
50cfe402e61ba8d816d845a9f297e3de18f4fc15Tinderbox User resolver can handle at any one time equals
50cfe402e61ba8d816d845a9f297e3de18f4fc15Tinderbox User <code class="option">lwres-tasks</code> times <code class="option">lwres-clients</code>.
735e1ed9685077e25f744d692acf77c5bf5d4490Tinderbox User<div class="titlepage"><div><div><h3 class="title">
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User<a name="masters_grammar"></a><span class="command"><strong>masters</strong></span> Statement Grammar</h3></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<span class="command"><strong>masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> |
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] };
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<div class="titlepage"><div><div><h3 class="title">
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<a name="masters_statement"></a><span class="command"><strong>masters</strong></span> Statement Definition and
2beefc22e6debdb72d7b2a069787ff565fc79ec4Tinderbox User<p><span class="command"><strong>masters</strong></span>
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User lists allow for a common set of masters to be easily used by
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User multiple stub and slave zones in their <span class="command"><strong>masters</strong></span>
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User or <span class="command"><strong>also-notify</strong></span> lists.
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User<div class="titlepage"><div><div><h3 class="title">
f46621af221784fd08339c6fe9509d9e48334561Tinderbox User<a name="options_grammar"></a><span class="command"><strong>options</strong></span> Statement Grammar</h3></div></div></div>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This is the grammar of the <span class="command"><strong>options</strong></span>
dd53726b246db5cc63c1c87ca86dae39568eeaa3Tinderbox User statement in the <code class="filename">named.conf</code> file:
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<pre class="programlisting"><span class="command"><strong>options</strong></span> {
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> attach-cache <em class="replaceable"><code>cache_name</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> version <em class="replaceable"><code>version_string</code></em>; </span>]
dd53726b246db5cc63c1c87ca86dae39568eeaa3Tinderbox User [<span class="optional"> hostname <em class="replaceable"><code>hostname_string</code></em>; </span>]
e9e4257668ff6c4e583b0c0db2508650b0b677b8Tinderbox User [<span class="optional"> server-id <em class="replaceable"><code>server_id_string</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> directory <em class="replaceable"><code>path_name</code></em>; </span>]
d58e33bfabfee19a035031dac633d36659738d56Evan Hunt [<span class="optional"> dnstap { <em class="replaceable"><code>message_type</code></em>; ... }; </span>]
dd53726b246db5cc63c1c87ca86dae39568eeaa3Tinderbox User [<span class="optional"> dnstap-output ( <code class="literal">file</code> | <code class="literal">unix</code> ) <em class="replaceable"><code>path_name</code></em>; </span>]
dd53726b246db5cc63c1c87ca86dae39568eeaa3Tinderbox User [<span class="optional"> dnstap-identity ( <em class="replaceable"><code>string</code></em> | <code class="literal">hostname</code> | <code class="literal">none</code> ); </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> dnstap-version ( <em class="replaceable"><code>string</code></em> | <code class="literal">none</code> ); </span>]
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont [<span class="optional"> geoip-directory <em class="replaceable"><code>path_name</code></em>; </span>]
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews [<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews [<span class="optional"> managed-keys-directory <em class="replaceable"><code>path_name</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> named-xfer <em class="replaceable"><code>path_name</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> tkey-gssapi-keytab <em class="replaceable"><code>path_name</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> tkey-gssapi-credential <em class="replaceable"><code>principal</code></em>; </span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> tkey-domain <em class="replaceable"><code>domainname</code></em>; </span>]
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> tkey-dhkey <em class="replaceable"><code>key_name</code></em> <em class="replaceable"><code>key_tag</code></em>; </span>]
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont [<span class="optional"> cache-file <em class="replaceable"><code>path_name</code></em>; </span>]
33d1cff1dd63494ffa00fac695a793f00c4ebf0bTinderbox User [<span class="optional"> dump-file <em class="replaceable"><code>path_name</code></em>; </span>]
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews [<span class="optional"> bindkeys-file <em class="replaceable"><code>path_name</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> lock-file <em class="replaceable"><code>path_name</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> secroots-file <em class="replaceable"><code>path_name</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> session-keyfile <em class="replaceable"><code>path_name</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> session-keyname <em class="replaceable"><code>key_name</code></em>; </span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> session-keyalg <em class="replaceable"><code>algorithm_id</code></em>; </span>]
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> memstatistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> memstatistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> pid-file <em class="replaceable"><code>path_name</code></em>; </span>]
17198e77b87667f796e910d31a4f47a80e256d09Mark Andrews [<span class="optional"> recursing-file <em class="replaceable"><code>path_name</code></em>; </span>]
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User [<span class="optional"> statistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> zone-statistics <em class="replaceable"><code>full</code></em> | <em class="replaceable"><code>terse</code></em> | <em class="replaceable"><code>none</code></em>; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> auth-nxdomain <em class="replaceable"><code>yes_or_no</code></em>; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> nxdomain-redirect <em class="replaceable"><code>string</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> deallocate-on-exit <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> fake-iquery <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> fetch-glue <em class="replaceable"><code>yes_or_no</code></em>; </span>]
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User [<span class="optional"> flush-zones-on-shutdown <em class="replaceable"><code>yes_or_no</code></em>; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> has-old-clients <em class="replaceable"><code>yes_or_no</code></em>; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> host-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
c07cdac6cf5bf3e9affc1aed25f8350087691f1eAutomatic Updater [<span class="optional"> host-statistics-max <em class="replaceable"><code>number</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> minimal-any <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> minimal-responses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> multiple-cnames <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> recursion <em class="replaceable"><code>yes_or_no</code></em>; </span>]
de73ef7ecdb9e009155993a6fa8dee5cd1bde319Mark Andrews [<span class="optional"> send-cookie <em class="replaceable"><code>yes_or_no</code></em>; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> require-server-cookie <em class="replaceable"><code>yes_or_no</code></em>; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> cookie-algorithm <em class="replaceable"><code>secret_string</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> cookie-secret <em class="replaceable"><code>secret_string</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> nocookie-udp-size <em class="replaceable"><code>number</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> request-nsid <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> rfc2308-type1 <em class="replaceable"><code>yes_or_no</code></em>; </span>]
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User [<span class="optional"> use-id-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em>; </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> ixfr-from-differences (<em class="replaceable"><code>yes_or_no</code></em> | <code class="constant">master</code> | <code class="constant">slave</code>); </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> auto-dnssec <code class="constant">allow</code>|<code class="constant">maintain</code>|<code class="constant">off</code>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> dnssec-enable <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> dnssec-validation (<em class="replaceable"><code>yes_or_no</code></em> | <code class="constant">auto</code>); </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> dnssec-lookaside ( <em class="replaceable"><code>auto</code></em> |
0e98665878103743dac92b6e8e1556d927e5bc30Tinderbox User <em class="replaceable"><code>no</code></em> |
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em> ); </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> dnssec-must-be-secure <em class="replaceable"><code>domain yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> dnssec-accept-expired <em class="replaceable"><code>yes_or_no</code></em>; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> forward ( <em class="replaceable"><code>only</code></em> | <em class="replaceable"><code>first</code></em> ); </span>]
7c899ff8af55a6855100e7fb4f5dd9a0a04b48a0Automatic Updater [<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; ... </span>] }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> dual-stack-servers [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] {
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews ( <em class="replaceable"><code>domain_name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] |
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>]) ;
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews ... }; </span>]
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> check-names ( <em class="replaceable"><code>master</code></em> | <em class="replaceable"><code>slave</code></em> | <em class="replaceable"><code>response</code></em> )
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> check-dup-records ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> check-mx ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em>; </span>]
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> check-mx-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> check-srv-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> check-sibling <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> check-spf ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> allow-new-zones { <em class="replaceable"><code>yes_or_no</code></em> }; </span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> allow-query-cache { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> allow-query-cache-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> allow-recursion { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> allow-recursion-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> automatic-interface-scan { <em class="replaceable"><code>yes_or_no</code></em> }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> geoip-use-ecs <em class="replaceable"><code>yes_or_no</code></em>;</span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> dnssec-update-mode ( <em class="replaceable"><code>maintain</code></em> | <em class="replaceable"><code>no-resign</code></em> ); </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> dnssec-loadkeys-interval <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> dnssec-secure-to-insecure <em class="replaceable"><code>yes_or_no</code></em> ;</span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> allow-v6-synthesis { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> blackhole { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> keep-response-order { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> no-case-compress { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> message-compression <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> use-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> avoid-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> use-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> avoid-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont [<span class="optional"> listen-on [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> listen-on-v6 [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington{ <em class="replaceable"><code>address_match_list</code></em> }; </span>]
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> query-source ( ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> )
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont [<span class="optional"> dscp <em class="replaceable"><code>ip_dscp</code></em></span>] |
7c8e44a2dc1121dbe3b615c9c934f37fb1741bb9Tinderbox User [<span class="optional"> address ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] )
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont [<span class="optional"> query-source-v6 ( ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> )
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> dscp <em class="replaceable"><code>ip_dscp</code></em></span>] |
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt [<span class="optional"> address ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] )
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt [<span class="optional"> dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt [<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
0accdb26ead1fe520a9820b52efbea64bdf564e3Tinderbox User [<span class="optional"> queryport-pool-updateinterval <em class="replaceable"><code>number</code></em>; </span>]
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews [<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em>; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em>; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em>; </span>]
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em>; </span>]
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews [<span class="optional"> reserved-sockets <em class="replaceable"><code>number</code></em>; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> recursive-clients <em class="replaceable"><code>number</code></em>; </span>]
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont [<span class="optional"> tcp-clients <em class="replaceable"><code>number</code></em>; </span>]
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User [<span class="optional"> clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont [<span class="optional"> max-clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont [<span class="optional"> fetches-per-server <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>(drop | fail)</code></em></span>]; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> fetch-quota-params <em class="replaceable"><code>number fixedpoint fixedpoint fixedpoint</code></em> ; </span>]
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont [<span class="optional"> fetches-per-zone <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>(drop | fail)</code></em></span>]; </span>]
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews [<span class="optional"> notify-rate <em class="replaceable"><code>number</code></em>; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> startup-notify-rate <em class="replaceable"><code>number</code></em>; </span>]
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews [<span class="optional"> serial-query-rate <em class="replaceable"><code>number</code></em>; </span>]
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont [<span class="optional"> serial-queries <em class="replaceable"><code>number</code></em>; </span>]
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews [<span class="optional"> tcp-listen-queue <em class="replaceable"><code>number</code></em>; </span>]
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews [<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em>; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> transfer-message-size <em class="replaceable"><code>number</code></em>; </span>]
757ff043760e4743dda1a10e7d58349275934902Tinderbox User [<span class="optional"> transfers-in <em class="replaceable"><code>number</code></em>; </span>]
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews [<span class="optional"> transfers-out <em class="replaceable"><code>number</code></em>; </span>]
78f3ed4bc2fcd3d270bfd599804f3b27a1db4d91Mark Andrews [<span class="optional"> transfers-per-ns <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater [<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> also-notify [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ip_addr</code></em>
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ) [<span class="optional">key <em class="replaceable"><code>keyname</code></em></span>] ; ... }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em>; </span>]
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User [<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
56334ccb2d4b5a04fc12b70b5852049db5d24088Evan Hunt [<span class="optional"> coresize <em class="replaceable"><code>size_spec</code></em> ; </span>]
9ecb5d33470ebfb3719a1b8d56bcefdf4b27f7b2Tinderbox User [<span class="optional"> datasize <em class="replaceable"><code>size_spec</code></em> ; </span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> files <em class="replaceable"><code>size_spec</code></em> ; </span>]
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> stacksize <em class="replaceable"><code>size_spec</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> heartbeat-interval <em class="replaceable"><code>number</code></em>; </span>]
979e02d122cddf1624cca8a4dab8d084c900fa48Automatic Updater [<span class="optional"> interface-interval <em class="replaceable"><code>number</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> statistics-interval <em class="replaceable"><code>number</code></em>; </span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> topology { <em class="replaceable"><code>address_match_list</code></em> }</span>];
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> sortlist { <em class="replaceable"><code>address_match_list</code></em> }</span>];
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> rrset-order { <em class="replaceable"><code>order_spec</code></em> ; [<span class="optional"> <em class="replaceable"><code>order_spec</code></em> ; ... </span>] </span>] };
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont [<span class="optional"> lame-ttl <em class="replaceable"><code>number</code></em>; </span>]
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont [<span class="optional"> max-ncache-ttl <em class="replaceable"><code>number</code></em>; </span>]
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont [<span class="optional"> max-cache-ttl <em class="replaceable"><code>number</code></em>; </span>]
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont [<span class="optional"> max-zone-ttl ( <code class="constant">unlimited</code> | <em class="replaceable"><code>number</code></em> ; </span>]
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont [<span class="optional"> serial-update-method <code class="constant">increment</code>|<code class="constant">unixtime</code>|<code class="constant">date</code>; </span>]
088a5ec3df14e7af67b4602b143869a09f7eefb3Francis Dupont [<span class="optional"> servfail-ttl <em class="replaceable"><code>number</code></em>; </span>]
c7f686829f05e44169d46746cfb25cadcf078585Tinderbox User [<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
c7f686829f05e44169d46746cfb25cadcf078585Tinderbox User [<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
c7f686829f05e44169d46746cfb25cadcf078585Tinderbox User [<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> min-roots <em class="replaceable"><code>number</code></em>; </span>]
c7f686829f05e44169d46746cfb25cadcf078585Tinderbox User [<span class="optional"> use-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
51901858be9d4632c1d0bed28cfa8f29932c1967Tinderbox User [<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> request-expire <em class="replaceable"><code>yes_or_no</code></em>; </span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> treat-cr-as-space <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> min-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater [<span class="optional"> nta-lifetime <em class="replaceable"><code>duration</code></em> ; </span>]
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews [<span class="optional"> nta-recheck <em class="replaceable"><code>duration</code></em> ; </span>]
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em>; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ;
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews [<span class="optional"> additional-from-auth <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
4fe0411487e8e4401477684c0a2bac041ca7c2d5Tinderbox User [<span class="optional"> additional-from-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews [<span class="optional"> random-device <em class="replaceable"><code>path_name</code></em> ; </span>]
280a8a0544b4aeb52414d20e8c6e6c5b1108562eTinderbox User [<span class="optional"> max-cache-size <em class="replaceable"><code>size_or_percent</code></em> ; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> match-mapped-addresses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User [<span class="optional"> filter-aaaa-on-v4 ( <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>break-dnssec</code></em> ); </span>]
6284b9b877d2205240dce1cf7f88d4dca888e44aTinderbox User [<span class="optional"> filter-aaaa-on-v6 ( <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>break-dnssec</code></em> ); </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> filter-aaaa { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> dns64 <em class="replaceable"><code>ipv6-prefix</code></em> {
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson [<span class="optional"> clients { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews [<span class="optional"> mapped { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User [<span class="optional"> exclude { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson [<span class="optional"> suffix <em class="replaceable"><code>IPv6-address</code></em>; </span>]
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson [<span class="optional"> recursive-only <em class="replaceable"><code>yes_or_no</code></em>; </span>]
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson [<span class="optional"> break-dnssec <em class="replaceable"><code>yes_or_no</code></em>; </span>]
229ea4644b3a7d9c7fdaa43888e7f55ba01e2ee3Automatic Updater [<span class="optional"> dns64-server <em class="replaceable"><code>name</code></em> </span>]
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews [<span class="optional"> dns64-contact <em class="replaceable"><code>name</code></em> </span>]
8bc3d252395842452a6d2c775cf8445f6349e331Tinderbox User [<span class="optional"> preferred-glue ( <em class="replaceable"><code>A</code></em> | <em class="replaceable"><code>AAAA</code></em> | <em class="replaceable"><code>NONE</code></em> ); </span>]
e64202536ea72d8f371dd0df9fc763f8d70bf886Tinderbox User [<span class="optional"> edns-udp-size <em class="replaceable"><code>number</code></em>; </span>]
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User [<span class="optional"> max-udp-size <em class="replaceable"><code>number</code></em>; </span>]
8bc3d252395842452a6d2c775cf8445f6349e331Tinderbox User [<span class="optional"> max-rsa-exponent-size <em class="replaceable"><code>number</code></em>; </span>]
de7b9a1dac0c293b39994c91d4376883da25554fTinderbox User [<span class="optional"> root-delegation-only [<span class="optional"> exclude { <em class="replaceable"><code>namelist</code></em> } </span>] ; </span>]
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User [<span class="optional"> querylog <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User [<span class="optional"> disable-algorithms <em class="replaceable"><code>domain</code></em> { <em class="replaceable"><code>algorithm</code></em>;
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> <em class="replaceable"><code>algorithm</code></em>; </span>] }; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> disable-ds-digests <em class="replaceable"><code>domain</code></em> { <em class="replaceable"><code>digest_type</code></em>;
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> <em class="replaceable"><code>digest_type</code></em>; </span>] }; </span>]
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater [<span class="optional"> acache-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User [<span class="optional"> acache-cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
ab103cf2caf211985be8c4296d379e43d26268c4Tinderbox User [<span class="optional"> max-acache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
467a823e57af687ebd486dfd73ea32f9d2a145beTinderbox User [<span class="optional"> max-recursion-depth <em class="replaceable"><code>number</code></em> ; </span>]
467a823e57af687ebd486dfd73ea32f9d2a145beTinderbox User [<span class="optional"> max-recursion-queries <em class="replaceable"><code>number</code></em> ; </span>]
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">map</code>) ; </span>]
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews (<code class="constant">relative</code>|<code class="constant">full</code>) ; </span>]
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User [<span class="optional"> empty-server <em class="replaceable"><code>name</code></em> ; </span>]
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User [<span class="optional"> empty-contact <em class="replaceable"><code>name</code></em> ; </span>]
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews [<span class="optional"> empty-zones-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
e6fc17ec5ad5ba1c4bf5730b2b97c82d1f2b8f3cMark Andrews [<span class="optional"> disable-empty-zone <em class="replaceable"><code>zone_name</code></em> ; </span>]
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater [<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater [<span class="optional"> zero-no-soa-ttl-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User [<span class="optional"> resolver-query-timeout <em class="replaceable"><code>number</code></em> ; </span>]
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User [<span class="optional"> deny-answer-addresses { <em class="replaceable"><code>address_match_list</code></em> } [<span class="optional"> except-from { <em class="replaceable"><code>namelist</code></em> } </span>];</span>]
a80993946f29ff39df38818ee9b2e58a4e46cb7eTinderbox User [<span class="optional"> deny-answer-aliases { <em class="replaceable"><code>namelist</code></em> } [<span class="optional"> except-from { <em class="replaceable"><code>namelist</code></em> } </span>];</span>]
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User [<span class="optional"> prefetch <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews [<span class="optional"> responses-per-second <em class="replaceable"><code>number</code></em> ; </span>]
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews [<span class="optional"> referrals-per-second <em class="replaceable"><code>number</code></em> ; </span>]
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater [<span class="optional"> nodata-per-second <em class="replaceable"><code>number</code></em> ; </span>]
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews [<span class="optional"> nxdomains-per-second <em class="replaceable"><code>number</code></em> ; </span>]
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews [<span class="optional"> errors-per-second <em class="replaceable"><code>number</code></em> ; </span>]
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews [<span class="optional"> all-per-second <em class="replaceable"><code>number</code></em> ; </span>]
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews [<span class="optional"> window <em class="replaceable"><code>number</code></em> ; </span>]
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews [<span class="optional"> log-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews [<span class="optional"> qps-scale <em class="replaceable"><code>number</code></em> ; </span>]
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews [<span class="optional"> ipv4-prefix-length <em class="replaceable"><code>number</code></em> ; </span>]
821d2613356f81e5bb5c107288d6d5cf35c2a1e8Mark Andrews [<span class="optional"> ipv6-prefix-length <em class="replaceable"><code>number</code></em> ; </span>]
f7a71eef29bcbf892270460269c79664f600cffdAutomatic Updater [<span class="optional"> slip <em class="replaceable"><code>number</code></em> ; </span>]
409ba95e573b40cf36acf97dd62ee7e9c7775851Tinderbox User [<span class="optional"> exempt-clients { <em class="replaceable"><code>address_match_list</code></em> } ; </span>]
f751b1576ee6fef4023bf7101d10167e4fe520f3Tinderbox User [<span class="optional"> max-table-size <em class="replaceable"><code>number</code></em> ; </span>]
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User [<span class="optional"> min-table-size <em class="replaceable"><code>number</code></em> ; </span>]
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater zone <em class="replaceable"><code>zone_name</code></em>
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater [<span class="optional"> policy <em class="replaceable"><code>(given | disabled | passthru | drop |
8711e5c73ca872d59810760af0332194cbdd619bAutomatic Updater tcp-only | nxdomain | nodata | cname domain</code></em>) </span>]
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User [<span class="optional"> recursive-only <em class="replaceable"><code>yes_or_no</code></em> </span>]
22870a9f8df95488abe2b17ab92b7cb6a9fe6f14Tinderbox User [<span class="optional"> log <em class="replaceable"><code>yes_or_no</code></em> </span>]
22870a9f8df95488abe2b17ab92b7cb6a9fe6f14Tinderbox User [<span class="optional"> max-policy-ttl <em class="replaceable"><code>number</code></em> </span>]
261ef37955c3468cbcb55d54b83c9a3b14e114dfTinderbox User } [<span class="optional"> recursive-only <em class="replaceable"><code>yes_or_no</code></em> </span>]
22870a9f8df95488abe2b17ab92b7cb6a9fe6f14Tinderbox User [<span class="optional"> max-policy-ttl <em class="replaceable"><code>number</code></em> </span>]
22870a9f8df95488abe2b17ab92b7cb6a9fe6f14Tinderbox User [<span class="optional"> break-dnssec <em class="replaceable"><code>yes_or_no</code></em> </span>]
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User [<span class="optional"> min-ns-dots <em class="replaceable"><code>number</code></em> </span>]
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User [<span class="optional"> nsip-wait-recurse <em class="replaceable"><code>yes_or_no</code></em> </span>]
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User [<span class="optional"> qname-wait-recurse <em class="replaceable"><code>yes_or_no</code></em> </span>]
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User [<span class="optional"> automatic-interface-scan <em class="replaceable"><code>yes_or_no</code></em> </span>]
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User zone <em class="replaceable"><code>quoted_string</code></em>
6d114a4c5cddb176ae5199eee154c0273d652ba4Tinderbox User [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>]
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>]
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }</span>]
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User [<span class="optional">in-memory <em class="replaceable"><code>yes_or_no</code></em></span>]
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User [<span class="optional">min-update-interval <em class="replaceable"><code>interval</code></em></span>]
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User [<span class="optional">v6-bias <em class="replaceable"><code>number</code></em> ; </span>]
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User<div class="titlepage"><div><div><h3 class="title">
87d422bb38fa1c8f0fb29c2a1b8c044870a7df46Tinderbox User<a name="options"></a><span class="command"><strong>options</strong></span> Statement Definition and
9e295ad801d5c986eb6c7745637b5dc0efb28711Tinderbox User The <span class="command"><strong>options</strong></span> statement sets up global
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User to be used by <acronym class="acronym">BIND</acronym>. This statement
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User may appear only
955ee8b865d70d02ad1fdc959382e6f8a07c1d14Tinderbox User once in a configuration file. If there is no <span class="command"><strong>options</strong></span>
b8cc0c5d896c361525708a2be2e5af7df76c96d7Tinderbox User statement, an options block with each option set to its default will
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User<div class="variablelist"><dl class="variablelist">
0a2ff769ecd0b5a6bda54b62bc1ec5fa6fd198a0Tinderbox User<dt><span class="term"><span class="command"><strong>attach-cache</strong></span></span></dt>
959e5da49a2cff7dfd8fdb885cd11c5d7d94a292Tinderbox User Allows multiple views to share a single cache
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User Each view has its own cache database by default, but
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User if multiple views have the same operational policy
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User for name resolution and caching, those views can
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User share a single cache to save memory and possibly
7a6494cfb6cc7d3f67af07359561e05e6bb8c0edTinderbox User improve resolution efficiency by using this option.
43c88753060df6335a789cd9bef2994d724d8be5Tinderbox User The <span class="command"><strong>attach-cache</strong></span> option
02d20c5d79600704d617d248642c477e9b5e6a2aTinderbox User may also be specified in <span class="command"><strong>view</strong></span>
2ec4ab21838e218863d052ebfa3e106e04f50820Evan Hunt statements, in which case it overrides the
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User global <span class="command"><strong>attach-cache</strong></span> option.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The <em class="replaceable"><code>cache_name</code></em> specifies
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the cache to be shared.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews When the <span class="command"><strong>named</strong></span> server configures
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews views which are supposed to share a cache, it
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews creates a cache with the specified name for the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews first view of these sharing views.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The rest of the views will simply refer to the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews already created cache.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews One common configuration to share a cache would be to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews allow all views to share a single cache.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews This can be done by specifying
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the <span class="command"><strong>attach-cache</strong></span> as a global
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews option with an arbitrary name.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Another possible operation is to allow a subset of
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews all views to share a cache while the others to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews retain their own caches.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews For example, if there are three views A, B, and C,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews and only A and B should share a cache, specify the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>attach-cache</strong></span> option as a view A (or
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews B)'s option, referring to the other view name:
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews // this view has its own cache
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews // this view refers to A's cache
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews attach-cache "A";
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews // this view has its own cache
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Views that share a cache must have the same policy
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews on configurable parameters that may affect caching.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The current implementation requires the following
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews configurable options be consistent among these
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>check-names</strong></span>,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>cleaning-interval</strong></span>,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>dnssec-accept-expired</strong></span>,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>dnssec-validation</strong></span>,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>max-cache-ttl</strong></span>,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>max-ncache-ttl</strong></span>,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>max-cache-size</strong></span>, and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>zero-no-soa-ttl</strong></span>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Note that there may be other parameters that may
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews cause confusion if they are inconsistent for
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews different views that share a single cache.
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews For example, if these views define different sets of
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews forwarders that can return different answers for the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews same question, sharing the answer does not make
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews sense or could even be harmful.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews It is administrator's responsibility to ensure
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews configuration differences in different views do
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews not cause disruption with a shared cache.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span class="command"><strong>directory</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The working directory of the server.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Any non-absolute pathnames in the configuration file will be
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews as relative to this directory. The default location for most
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews output files (e.g. <code class="filename">named.run</code>)
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews is this directory.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews If a directory is not specified, the working directory
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews defaults to `<code class="filename">.</code>', the directory from
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews which the server
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews was started. The directory specified should be an absolute
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span class="command"><strong>dnstap</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>dnstap</strong></span> is a fast, flexible method
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews for capturing and logging DNS traffic. Developed by
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Robert Edmonds at Farsight Security, Inc., and supported
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews by multiple DNS implementations, <span class="command"><strong>dnstap</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>libfstrm</strong></span> (a lightweight high-speed
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews framing library, see
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <a class="link" href="https://github.com/farsightsec/fstrm" target="_top">https://github.com/farsightsec/fstrm</a>) to send
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews event payloads which are encoded using Protocol Buffers
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews (<span class="command"><strong>libprotobuf-c</strong></span>, a mechanism for
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews serializing structured data developed
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews by Google, Inc.; see
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <a class="link" href="https://developers.google.com/protocol-buffers/" target="_top">https://developers.google.com/protocol-buffers</a>).
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews To enable <span class="command"><strong>dnstap</strong></span> at compile time,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the <span class="command"><strong>fstrm</strong></span> and <span class="command"><strong>protobuf-c</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews libraries must be available, and BIND must be configured with
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The <span class="command"><strong>dnstap</strong></span> option is a bracketed list
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews of message types to be logged. These may be set differently
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews for each view. Supported types are <code class="literal">client</code>,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="literal">auth</code>, <code class="literal">resolver</code>, and
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="literal">forwarder</code>. Specifying type
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="literal">all</code> will cause all <span class="command"><strong>dnstap</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews messages to be logged, regardless of type.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Each type may take an additional argument to indicate whether
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews to log <code class="literal">query</code> messages or
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="literal">response</code> messages; if not specified,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews both queries and responses are logged.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Example: To log all authoritative queries and responses,
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews recursive client responses, and upstream queries sent by
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the resolver, use:
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews client response;
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews resolver query;
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Logged <span class="command"><strong>dnstap</strong></span> messages can be parsed
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews using the <span class="command"><strong>dnstap-read</strong></span> utility (see
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <a class="xref" href="man.dnstap-read.html" title="dnstap-read"><span class="refentrytitle"><span class="application">dnstap-read</span></span>(1)</a> for details).
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews For more information on <span class="command"><strong>dnstap</strong></span>, see
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <a class="link" href="http://dnstap.info" target="_top">http://dnstap.info</a>.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater<dt><span class="term"><span class="command"><strong>dnstap-output</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Configures the path to which the <span class="command"><strong>dnstap</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews frame stream will be sent if <span class="command"><strong>dnstap</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews is enabled at compile time and active.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews The first argument is either <code class="literal">file</code> or
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="literal">unix</code>, indicating whether the destination
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews is a file or a UNIX domain socket. The second argument
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews is the path of the file or socket. (Note: when using a
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User socket, <span class="command"><strong>dnstap</strong></span> messages will
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews only be sent if another process such as
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>fstrm_capture</strong></span>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews (provided with <span class="command"><strong>libfstrm</strong></span>) is listening on
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews the socket.)
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>dnstap-output</strong></span> can only be set globally
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews in <span class="command"><strong>options</strong></span>. Currently, it can only be
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews set once while <span class="command"><strong>named</strong></span> is running;
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews once set, it cannot be changed by
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>rndc reload</strong></span> or
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>rndc reconfig</strong></span>.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span class="command"><strong>dnstap-identity</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Specifies an <span class="command"><strong>identity</strong></span> string to send in
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>dnstap</strong></span> messages. If set to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="literal">hostname</code>, which is the default, the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews server's hostname will be sent. If set to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="literal">none</code>, no identity string will be sent.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span class="command"><strong>dnstap-version</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Specifies a <span class="command"><strong>version</strong></span> string to send in
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <span class="command"><strong>dnstap</strong></span> messages. The default is the
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews version number of the BIND release. If set to
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="literal">none</code>, no version string will be sent.
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews<dt><span class="term"><span class="command"><strong>geoip-directory</strong></span></span></dt>
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews Specifies the directory containing GeoIP
4f087942583014b241adca1bc78c6db89ed96e94Mark Andrews <code class="filename">.dat</code> database files for GeoIP
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User initialization. By default, this option is unset
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt and the GeoIP support will use libGeoIP's
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt built-in directory.
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt (For details, see <a class="xref" href="Bv9ARM.ch06.html#acl" title="acl Statement Definition and Usage">the section called “<span class="command"><strong>acl</strong></span> Statement Definition and
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt Usage”</a> about the
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt <span class="command"><strong>geoip</strong></span> ACL.)
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt<dt><span class="term"><span class="command"><strong>key-directory</strong></span></span></dt>
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt When performing dynamic update of secure zones, the
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt directory where the public and private DNSSEC key files
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt should be found, if different than the current working
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt directory. (Note that this option has no effect on the
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt paths for files containing non-DNSSEC keys such as
e2d635d630f6f61fefd3d4475c45b097b16b8a2aEvan Hunt<dt><span class="term"><span class="command"><strong>managed-keys-directory</strong></span></span></dt>
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User Specifies the directory in which to store the files that
ab272d2204a075b5ed0798d04733a9028782b8daEvan Hunt track managed DNSSEC keys. By default, this is the working
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater If <span class="command"><strong>named</strong></span> is not configured to use views,
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater then managed keys for the server will be tracked in a single
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater file called <code class="filename">managed-keys.bind</code>.
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater Otherwise, managed keys will be tracked in separate files,
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater one file per view; each file name will be the view name
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater (or, if it contains characters that are incompatible with
9e295ad801d5c986eb6c7745637b5dc0efb28711Tinderbox User use as a file name, the SHA256 hash of the view name),
9e295ad801d5c986eb6c7745637b5dc0efb28711Tinderbox User followed by the extension
9e295ad801d5c986eb6c7745637b5dc0efb28711Tinderbox User (Note: in previous releases, file names for views
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User always used the SHA256 hash of the view name. To ensure
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater compatibility after upgrade, if a file using the old
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater name format is found to exist, it will be used instead
97669cab1f7e6f953dbf39ef1b2c4206ecb50d9eAutomatic Updater of the new format.)
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson<dt><span class="term"><span class="command"><strong>named-xfer</strong></span></span></dt>
66d24a46538c7c2d29fdb5611ab1173e83685b1dTinderbox User <span class="emphasis"><em>This option is obsolete.</em></span> It
66d24a46538c7c2d29fdb5611ab1173e83685b1dTinderbox User was used in <acronym class="acronym">BIND</acronym> 8 to specify
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson the pathname to the <span class="command"><strong>named-xfer</strong></span>
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson program. In <acronym class="acronym">BIND</acronym> 9, no separate
754ebd37e782356aedbb2987e3c1a8ab4f29574eMark Andrews <span class="command"><strong>named-xfer</strong></span> program is needed;
754ebd37e782356aedbb2987e3c1a8ab4f29574eMark Andrews its functionality is built into the name server.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews<dt><span class="term"><span class="command"><strong>tkey-gssapi-keytab</strong></span></span></dt>
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User The KRB5 keytab file to use for GSS-TSIG updates. If
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User this option is set and tkey-gssapi-credential is not
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User set, then updates will be allowed with any key
089d5091b781af7dfef225fbc828eb4e6d04bf4fTinderbox User matching a principal in the specified keytab.
776a8e3ff8889711a1f61a9362607c42716563f4Tinderbox User<dt><span class="term"><span class="command"><strong>tkey-gssapi-credential</strong></span></span></dt>
5c679dbb66df92766f6a7e7bb93c18d61275d1feMark Andrews The security credential with which the server should
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User authenticate keys requested by the GSS-TSIG protocol.
5c679dbb66df92766f6a7e7bb93c18d61275d1feMark Andrews Currently only Kerberos 5 authentication is available
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater and the credential is a Kerberos principal which the
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User server can acquire through the default system key
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater file, normally <code class="filename">/etc/krb5.keytab</code>.
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews The location keytab file can be overridden using the
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews tkey-gssapi-keytab option. Normally this principal is
9e295ad801d5c986eb6c7745637b5dc0efb28711Tinderbox User of the form "<strong class="userinput"><code>DNS/</code></strong><code class="varname">server.domain</code>".
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User To use GSS-TSIG, <span class="command"><strong>tkey-domain</strong></span> must
da93950363b307b718d156514b95b9df93a63776Mark Andrews also be set if a specific keytab is not set with
da93950363b307b718d156514b95b9df93a63776Mark Andrews tkey-gssapi-keytab.
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User<dt><span class="term"><span class="command"><strong>tkey-domain</strong></span></span></dt>
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User The domain appended to the names of all shared keys
f6056ad06781c95198505ae3a361e6dd98df4b91Automatic Updater generated with <span class="command"><strong>TKEY</strong></span>. When a
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User client requests a <span class="command"><strong>TKEY</strong></span> exchange,
f6056ad06781c95198505ae3a361e6dd98df4b91Automatic Updater it may or may not specify the desired name for the
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User key. If present, the name of the shared key will
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User be <code class="varname">client specified part</code> +
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User <code class="varname">tkey-domain</code>. Otherwise, the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater name of the shared key will be <code class="varname">random hex
9a9ca3c4f120971b7091b28a5530e5eaf362f7e6Tinderbox User digits</code> + <code class="varname">tkey-domain</code>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater In most cases, the <span class="command"><strong>domainname</strong></span>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User should be the server's domain name, or an otherwise
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User non-existent subdomain like
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User "_tkey.<code class="varname">domainname</code>". If you are
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User using GSS-TSIG, this variable must be defined, unless
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User you specify a specific keytab using tkey-gssapi-keytab.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span class="command"><strong>tkey-dhkey</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The Diffie-Hellman key used by the server
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User to generate shared keys with clients using the Diffie-Hellman
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User of <span class="command"><strong>TKEY</strong></span>. The server must be
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User able to load the
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User public and private keys from files in the working directory.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User most cases, the keyname should be the server's host name.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span class="command"><strong>cache-file</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User This is for testing only. Do not use.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span class="command"><strong>dump-file</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The pathname of the file the server dumps
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User the database to when instructed to do so with
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <span class="command"><strong>rndc dumpdb</strong></span>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User If not specified, the default is <code class="filename">named_dump.db</code>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span class="command"><strong>memstatistics-file</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The pathname of the file the server writes memory
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User usage statistics to on exit. If not specified,
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User the default is <code class="filename">named.memstats</code>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span class="command"><strong>lock-file</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The pathname of a file on which <span class="command"><strong>named</strong></span> will
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User attempt to acquire a file lock when starting up for
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User the first time; if unsuccessful, the server will
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User will terminate, under the assumption that another
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User server is already running. If not specified, the default is
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <code class="filename">/var/run/named/named.lock</code>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Specifying <span class="command"><strong>lock-file none</strong></span> disables the
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User use of a lock file. <span class="command"><strong>lock-file</strong></span> is
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User ignored if <span class="command"><strong>named</strong></span> was run using the <code class="option">-X</code>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User option, which overrides it. Changes to
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <span class="command"><strong>lock-file</strong></span> are ignored if
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <span class="command"><strong>named</strong></span> is being reloaded or
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User reconfigured; it is only effective when the server is
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User first started up.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span class="command"><strong>pid-file</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The pathname of the file the server writes its process ID
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User in. If not specified, the default is
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <code class="filename">/var/run/named/named.pid</code>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The PID file is used by programs that want to send signals to
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User name server. Specifying <span class="command"><strong>pid-file none</strong></span> disables the
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User use of a PID file — no file will be written and any
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User existing one will be removed. Note that <span class="command"><strong>none</strong></span>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User is a keyword, not a filename, and therefore is not enclosed
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User double quotes.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span class="command"><strong>recursing-file</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The pathname of the file the server dumps
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User the queries that are currently recursing when instructed
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User to do so with <span class="command"><strong>rndc recursing</strong></span>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User If not specified, the default is <code class="filename">named.recursing</code>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span class="command"><strong>statistics-file</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The pathname of the file the server appends statistics
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User to when instructed to do so using <span class="command"><strong>rndc stats</strong></span>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User If not specified, the default is <code class="filename">named.stats</code> in the
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User server's current directory. The format of the file is
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User in <a class="xref" href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span class="command"><strong>bindkeys-file</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The pathname of a file to override the built-in trusted
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User keys provided by <span class="command"><strong>named</strong></span>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User See the discussion of <span class="command"><strong>dnssec-lookaside</strong></span>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User and <span class="command"><strong>dnssec-validation</strong></span> for details.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User If not specified, the default is
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <code class="filename">/etc/bind.keys</code>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span class="command"><strong>secroots-file</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The pathname of the file the server dumps
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User security roots to when instructed to do so with
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <span class="command"><strong>rndc secroots</strong></span>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User If not specified, the default is
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <code class="filename">named.secroots</code>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span class="command"><strong>session-keyfile</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The pathname of the file into which to write a TSIG
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User session key generated by <span class="command"><strong>named</strong></span> for use by
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <span class="command"><strong>nsupdate -l</strong></span>. If not specified, the
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User default is <code class="filename">/var/run/named/session.key</code>.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User (See <a class="xref" href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>, and in
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User particular the discussion of the
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <span class="command"><strong>update-policy</strong></span> statement's
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User <strong class="userinput"><code>local</code></strong> option for more
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User information about this feature.)
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span class="command"><strong>session-keyname</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The key name to use for the TSIG session key.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User If not specified, the default is "local-ddns".
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span class="command"><strong>session-keyalg</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User The algorithm to use for the TSIG session key.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User Valid values are hmac-sha1, hmac-sha224, hmac-sha256,
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User hmac-sha384, hmac-sha512 and hmac-md5. If not
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User specified, the default is hmac-sha256.
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User<dt><span class="term"><span class="command"><strong>port</strong></span></span></dt>
05c0db3923b93c36afa488bffc7862e0ae554698Tinderbox User receiving and sending DNS protocol traffic.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews The default is 53. This option is mainly intended for server
933799f3641f4f78445d015008bad0038900a82aTinderbox User a server using a port other than 53 will not be able to
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User communicate with
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User the global DNS.
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User<dt><span class="term"><span class="command"><strong>dscp</strong></span></span></dt>
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User The global Differentiated Services Code Point (DSCP)
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User value to classify outgoing DNS traffic on operating
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User systems that support DSCP. Valid values are 0 through 63.
19558a04decde0e7261d489d92d04ad88104217bTinderbox User It is not configured by default.
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User<dt><span class="term"><span class="command"><strong>random-device</strong></span></span></dt>
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User The source of entropy to be used by the server. Entropy is
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews primarily needed
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User for DNSSEC operations, such as TKEY transactions and dynamic
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews update of signed
39a3b65090ccfc86b66e416c949c6a938c7f1d4aTinderbox User zones. This options specifies the device (or file) from which
d5637bdbb931ff79fced3d4858d83212ea58ed15Tinderbox User entropy. If this is a file, operations requiring entropy will
5747235bf35e7398984fd6b4632743396895ea7aTinderbox User fail when the
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews file has been exhausted. If not specified, the default value
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews (or equivalent) when present, and none otherwise. The
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews <span class="command"><strong>random-device</strong></span> option takes
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User effect during
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User the initial configuration load at server startup time and
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User is ignored on subsequent reloads.
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User<dt><span class="term"><span class="command"><strong>preferred-glue</strong></span></span></dt>
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User If specified, the listed type (A or AAAA) will be emitted
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User before other glue
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User in the additional section of a query response.
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User The default is to prefer A records when responding
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User to queries that arrived via IPv4 and AAAA when
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User responding to queries that arrived via IPv6.
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt<a name="root_delegation_only"></a><span class="term"><span class="command"><strong>root-delegation-only</strong></span></span>
ff8d6ca9d58a398b66cee8079cbbd6bfe2c80f0dTinderbox User Turn on enforcement of delegation-only in TLDs
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User (top level domains) and root zones with an optional
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User exclude list.
ff8d6ca9d58a398b66cee8079cbbd6bfe2c80f0dTinderbox User DS queries are expected to be made to and be answered by
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User delegation only zones. Such queries and responses are
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User treated as an exception to delegation-only processing
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User and are not converted to NXDOMAIN responses provided
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User a CNAME is not discovered at the query name.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews If a delegation only zone server also serves a child
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User zone it is not always possible to determine whether
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews an answer comes from the delegation only zone or the
19558a04decde0e7261d489d92d04ad88104217bTinderbox User child zone. SOA NS and DNSKEY records are apex
e98d2156a997b64b61475539dceb4c1f3fbcd26dTinderbox User only records and a matching response that contains
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User these records or DS is treated as coming from a
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User child zone. RRSIG records are also examined to see
af60449fe472b8bea5ad04bf538c777c6b151112Tinderbox User if they are signed by a child zone or not. The
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User authority section is also examined to see if there
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User is evidence that the answer is from the child zone.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Answers that are determined to be from a child zone
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews are not converted to NXDOMAIN responses. Despite
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews all these checks there is still a possibility of
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews false negatives when a child zone is being served.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Similarly false positives can arise from empty nodes
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews (no records at the name) in the delegation only zone
90863a6f9bfb06062c7fdf269bb675e7b674fc31Mark Andrews when the query type is not ANY.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Note some TLDs are not delegation only (e.g. "DE", "LV",
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews "US" and "MUSEUM"). This list is not exhaustive.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<dt><span class="term"><span class="command"><strong>disable-algorithms</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Disable the specified DNSSEC algorithms at and below the
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews specified name.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews Multiple <span class="command"><strong>disable-algorithms</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater statements are allowed.
8de3f14f1c300c3e1ed99084cc03485b42c92bf1Tinderbox User Only the best match <span class="command"><strong>disable-algorithms</strong></span>
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews clause will be used to determine which algorithms are used.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User If all supported algorithms are disabled, the zones covered
45eca3a5d46ed15aee14d81f6cb6c9fb6f365344Mark Andrews by the <span class="command"><strong>disable-algorithms</strong></span> will be treated
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span class="command"><strong>disable-ds-digests</strong></span></span></dt>
6306dd073e0eba562491222821c4d3b39f440718Evan Hunt Disable the specified DS/DLV digest types at and below the
6634faa55bb26d8e995dd5ad4755060f1bedc2f0Tinderbox User specified name.
6306dd073e0eba562491222821c4d3b39f440718Evan Hunt Multiple <span class="command"><strong>disable-ds-digests</strong></span>
6306dd073e0eba562491222821c4d3b39f440718Evan Hunt statements are allowed.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Only the best match <span class="command"><strong>disable-ds-digests</strong></span>
f4193c2021ab0aeaad33fe0b3d1d49c80db5c725Mark Andrews clause will be used to determine which digest types are used.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews If all supported digest types are disabled, the zones covered
872a5b83f68b8058945298715b0fa53442aad52fAutomatic Updater by the <span class="command"><strong>disable-ds-digests</strong></span> will be treated
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews as insecure.
068a66979695c77359e7a9181bb3f831c965b21cMark Andrews<dt><span class="term"><span class="command"><strong>dnssec-lookaside</strong></span></span></dt>
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews When set, <span class="command"><strong>dnssec-lookaside</strong></span> provides the
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews validator with an alternate method to validate DNSKEY
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews records at the top of a zone. When a DNSKEY is at or
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews below a domain specified by the deepest
5de1cdae8a44312ca0dbb2a0fd0388fa35676a84Tinderbox User <span class="command"><strong>dnssec-lookaside</strong></span>, and the normal DNSSEC
5de1cdae8a44312ca0dbb2a0fd0388fa35676a84Tinderbox User validation has left the key untrusted, the trust-anchor
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews will be appended to the key name and a DLV record will be
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews looked up to see if it can validate the key. If the DLV
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews record validates a DNSKEY (similarly to the way a DS
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews record does) the DNSKEY RRset is deemed to be trusted.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews If <span class="command"><strong>dnssec-lookaside</strong></span> is set to
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews <strong class="userinput"><code>auto</code></strong>, then built-in default
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews values for the DLV domain and trust anchor will be
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews used, along with a built-in key for validation.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews If <span class="command"><strong>dnssec-lookaside</strong></span> is set to
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews <strong class="userinput"><code>no</code></strong>, then dnssec-lookaside
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews is not used.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews The default DLV key is stored in the file
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews <span class="command"><strong>named</strong></span> will load that key at
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews startup if <span class="command"><strong>dnssec-lookaside</strong></span> is set to
5f7e0eb1cb917b788906d3e2aa01bfc4885dcae4Mark Andrews <code class="constant">auto</code>. A copy of the file is
bf1263835e8e35421960f65088c043f42aacef13Mark Andrews installed along with <acronym class="acronym">BIND</acronym> 9, and is
15ae68f3db8261770fc33b8e0f83f5d8c7021e84Mark Andrews current as of the release date. If the DLV key expires, a
ac4e70ff8955669341f435bc0a734a17c01af124Mark Andrews new copy of <code class="filename">bind.keys</code> can be downloaded
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews from <a class="link" href="https://www.isc.org/solutions/dlv/" target="_top">https://www.isc.org/solutions/dlv/</a>.
cb40461f8744c5aeb369b84d5f48395a13a221a0Mark Andrews (To prevent problems if <code class="filename">bind.keys</code> is
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User not found, the current key is also compiled in to
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews <span class="command"><strong>named</strong></span>. Relying on this is not
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews recommended, however, as it requires <span class="command"><strong>named</strong></span>
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User to be recompiled with a new key when the DLV key expires.)
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User NOTE: <span class="command"><strong>named</strong></span> only loads certain specific
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User keys from <code class="filename">bind.keys</code>: those for the
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User DLV zone and for the DNS root zone. The file cannot be
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater used to store keys for other zones.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span class="command"><strong>dnssec-must-be-secure</strong></span></span></dt>
10640b2e3efc7bc8034108136d7487f7407fbf37Andreas Gustafsson Specify hierarchies which must be or may not be secure
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User (signed and validated). If <strong class="userinput"><code>yes</code></strong>,
10640b2e3efc7bc8034108136d7487f7407fbf37Andreas Gustafsson then <span class="command"><strong>named</strong></span> will only accept answers if
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User they are secure. If <strong class="userinput"><code>no</code></strong>, then normal
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User DNSSEC validation applies allowing for insecure answers to
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User be accepted. The specified domain must be under a
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span class="command"><strong>trusted-keys</strong></span> or
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="command"><strong>managed-keys</strong></span> statement, or
436aad11e01e916f75e68a2e9cb89ac217a990d3Tinderbox User <span class="command"><strong>dnssec-lookaside</strong></span> must be active.
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews<dt><span class="term"><span class="command"><strong>dns64</strong></span></span></dt>
d97783f18169fc9c5220a0b91fe53653efcd6b10Tinderbox User This directive instructs <span class="command"><strong>named</strong></span> to
76fbdc591b3d46df28878a6ff844798622b85265Tinderbox User return mapped IPv4 addresses to AAAA queries when
af682c183e3448c34da1145018a085ac45b1b660Tinderbox User there are no AAAA records. It is intended to be
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User used in conjunction with a NAT64. Each
e97aa53515cec97b9a4bb5f24a89cdc5c7d4c5e0Tinderbox User <span class="command"><strong>dns64</strong></span> defines one DNS64 prefix.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont Multiple DNS64 prefixes can be defined.
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews Compatible IPv6 prefixes have lengths of 32, 40, 48, 56,
09ee43766e232bd04066445db114c2703dd02bf8Tinderbox User 64 and 96 as per RFC 6052.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User Additionally a reverse IP6.ARPA zone will be created for
bac4435d473c9a0281507524f084480c34aa942aTinderbox User the prefix to provide a mapping from the IP6.ARPA names
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews to the corresponding IN-ADDR.ARPA names using synthesized
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User CNAMEs. <span class="command"><strong>dns64-server</strong></span> and
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews <span class="command"><strong>dns64-contact</strong></span> can be used to specify
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt the name of the server and contact for the zones. These
6715db6593ce9a271ac3131cd7a886feaa386a2eEvan Hunt are settable at the view / options level. These are
6715db6593ce9a271ac3131cd7a886feaa386a2eEvan Hunt not settable on a per-prefix basis.
aef6cf0f147a5014d4891c9689b9f463399e16e7Tinderbox User Each <span class="command"><strong>dns64</strong></span> supports an optional
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span class="command"><strong>clients</strong></span> ACL that determines which
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews clients are affected by this directive. If not defined,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater it defaults to <strong class="userinput"><code>any;</code></strong>.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Each <span class="command"><strong>dns64</strong></span> supports an optional
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span class="command"><strong>mapped</strong></span> ACL that selects which
f0c5e918974bf778af6cd1e25309ad13e30a79a6Tinderbox User IPv4 addresses are to be mapped in the corresponding
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User A RRset. If not defined it defaults to
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews <strong class="userinput"><code>any;</code></strong>.
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User Normally, DNS64 won't apply to a domain name that
8f1a00cf8b3d9dc8d419a797b7ff4fb6ddba428eTinderbox User owns one or more AAAA records; these records will
2846972c703e9c588e88726c10caf62c7cdbefd0Tinderbox User simply be returned. The optional
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont <span class="command"><strong>exclude</strong></span> ACL allows specification
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews of a list of IPv6 addresses that will be ignored
d6487e3c0a981bd8ac1e155d3a2d590c078d6c85Tinderbox User if they appear in a domain name's AAAA records, and
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User DNS64 will be applied to any A records the domain
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews name owns. If not defined, <span class="command"><strong>exclude</strong></span>
8aa098c6334de11c8fd117d30851cc457813c410Mark Andrews A optional <span class="command"><strong>suffix</strong></span> can also
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater be defined to set the bits trailing the mapped
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater IPv4 address bits. By default these bits are
8e5fce1f9ceba17dd7e3ff0eb287e1e999c14249Mark Andrews set to <strong class="userinput"><code>::</code></strong>. The bits
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews matching the prefix and mapped IPv4 address
1404d301dd9e7e487a247b803f63909cd10cdf72Tinderbox User If <span class="command"><strong>recursive-only</strong></span> is set to
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews <span class="command"><strong>yes</strong></span> the DNS64 synthesis will
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater only happen for recursive queries. The default
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is <span class="command"><strong>no</strong></span>.
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews If <span class="command"><strong>break-dnssec</strong></span> is set to
dc5552b4df5e3821783821c8d4e734c1608c446eTinderbox User <span class="command"><strong>yes</strong></span> the DNS64 synthesis will
e23761df2059ed612c8fb7cc248d93bb2c4f62dbTinderbox User happen even if the result, if validated, would
1404d301dd9e7e487a247b803f63909cd10cdf72Tinderbox User cause a DNSSEC validation failure. If this option
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt is set to <span class="command"><strong>no</strong></span> (the default), the DO
6715db6593ce9a271ac3131cd7a886feaa386a2eEvan Hunt is set on the incoming query, and there are RRSIGs on
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews the applicable records, then synthesis will not happen.
02b3e44a996e9753d86306b6a1b6b579a73787fcTinderbox User acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
616c05f95f9a9683d73c108df2eda56bf70b77ccTinderbox User dns64 64:FF9B::/96 {
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater clients { any; };
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt mapped { !rfc1918; any; };
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews exclude { 64:FF9B::/96; ::ffff:0000:0000/96; };
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User<dt><span class="term"><span class="command"><strong>dnssec-loadkeys-interval</strong></span></span></dt>
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater When a zone is configured with <span class="command"><strong>auto-dnssec
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User maintain;</strong></span> its key repository must be checked
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater periodically to see if any new keys have been added
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews or any existing keys' timing metadata has been updated
1921b850640ae984448e8b87870c8527fa9cddb6Evan Hunt (see <a class="xref" href="man.dnssec-keygen.html" title="dnssec-keygen"><span class="refentrytitle"><span class="application">dnssec-keygen</span></span>(8)</a> and
e5be5a9f94d7db1c4eceac028749084c042420ebTinderbox User <a class="xref" href="man.dnssec-settime.html" title="dnssec-settime"><span class="refentrytitle"><span class="application">dnssec-settime</span></span>(8)</a>). The
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews <span class="command"><strong>dnssec-loadkeys-interval</strong></span> option
e20309353e6246485c521278131d3fced73d7957Tinderbox User sets the frequency of automatic repository checks, in
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews minutes. The default is <code class="literal">60</code> (1 hour),
c74518d655c1c563060f49569dce71e4a00f5f4eTinderbox User the minimum is <code class="literal">1</code> (1 minute), and the
d2f313886122eeb989e5c58cd9a70373222210c4Tinderbox User maximum is <code class="literal">1440</code> (24 hours); any higher
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater value is silently reduced.
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews<dt><span class="term"><span class="command"><strong>dnssec-update-mode</strong></span></span></dt>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User If this option is set to its default value of
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater <code class="literal">maintain</code> in a zone of type
28a5dd720187fddb16055a0f64b63a7b66f29f64Mark Andrews <code class="literal">master</code> which is DNSSEC-signed
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater and configured to allow dynamic updates (see
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews <a class="xref" href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>), and
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews if <span class="command"><strong>named</strong></span> has access to the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater private signing key(s) for the zone, then
713a5e3080f112b3efde9235e9c92035056ff966Automatic Updater <span class="command"><strong>named</strong></span> will automatically sign all new
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater or changed records and maintain signatures for the zone
bac4435d473c9a0281507524f084480c34aa942aTinderbox User by regenerating RRSIG records whenever they approach
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User their expiration date.
cb40461f8744c5aeb369b84d5f48395a13a221a0Mark Andrews If the option is changed to <code class="literal">no-resign</code>,
f8b9948a4116226ac41b5509cca152849006c66cAutomatic Updater then <span class="command"><strong>named</strong></span> will sign all new or
8add7cdaa81ec881fe17df02ed8833722dc9e690Tinderbox User changed records, but scheduled maintenance of
be46cb4bee9253ee4832340c719920642e00c41aTinderbox User signatures is disabled.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater With either of these settings, <span class="command"><strong>named</strong></span>
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater will reject updates to a DNSSEC-signed zone when the
099b86fb8136a7dff81df85cf395978c16eb254cAutomatic Updater signing keys are inactive or unavailable to
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews <span class="command"><strong>named</strong></span>. (A planned third option,
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont <code class="literal">external</code>, will disable all automatic
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater signing and allow DNSSEC data to be submitted into a zone
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater via dynamic update; this is not yet implemented.)
3e5340279d8875d136a4dd815cccad0044aa2644Automatic Updater<dt><span class="term"><span class="command"><strong>nta-lifetime</strong></span></span></dt>
28e0061dbcc2ae45d34541267a00d8b4de5b4a41Tinderbox User Species the default lifetime, in seconds,
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User that will be used for negative trust anchors added
27c3c21f41520e8d6336d80a8094389e321cb6d2Mark Andrews via <span class="command"><strong>rndc nta</strong></span>.
87d570d3531d3d0eef29c4f2007cef1dbd6aed2cTinderbox User A negative trust anchor selectively disables
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater DNSSEC validation for zones that are known to be
d630ef2ff74445949a482660938e9fa9da52ca14Automatic Updater failing because of misconfiguration rather than
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User an attack. When data to be validated is
d6487e3c0a981bd8ac1e155d3a2d590c078d6c85Tinderbox User at or below an active NTA (and above any other
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews configured trust anchors), <span class="command"><strong>named</strong></span> will
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater abort the DNSSEC validation process and treat the data as
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User insecure rather than bogus. This continues until the
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews NTA's lifetime is elapsed. NTAs persist
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews across <span class="command"><strong>named</strong></span> restarts.
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User For convenience, TTL-style time unit suffixes can be
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews used to specify the NTA lifetime in seconds, minutes
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User or hours. <code class="option">nta-lifetime</code> defaults to
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User one hour. It cannot exceed one week.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<dt><span class="term"><span class="command"><strong>nta-recheck</strong></span></span></dt>
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews Species how often to check whether negative
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews trust anchors added via <span class="command"><strong>rndc nta</strong></span>
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User are still necessary.
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews A negative trust anchor is normally used when a
0197efed438a96881ebd8d165f8479a89f1ba62fTinderbox User domain has stopped validating due to operator error;
d6487e3c0a981bd8ac1e155d3a2d590c078d6c85Tinderbox User it temporarily disables DNSSEC validation for that
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews domain. In the interest of ensuring that DNSSEC
bcb68be0a8f3c3eca58d6a6a869267e5c1841de2Francis Dupont validation is turned back on as soon as possible,
c19bf21885cdf78b52eee017dc1189a300657995Tinderbox User <span class="command"><strong>named</strong></span> will periodically send a
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews query to the domain, ignoring negative trust anchors,
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews to find out whether it can now be validated. If so,
d6487e3c0a981bd8ac1e155d3a2d590c078d6c85Tinderbox User the negative trust anchor is allowed to expire early.
5a6d22a5b3b014f6dd0b36999864bd2c3e0d8465Mark Andrews Validity checks can be disabled for an individual
bcb68be0a8f3c3eca58d6a6a869267e5c1841de2Francis Dupont NTA by using <span class="command"><strong>rndc nta -f</strong></span>, or
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User for all NTAs by setting <code class="option">nta-recheck</code>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User For convenience, TTL-style time unit suffixes can be
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater used to specify the NTA recheck interval in seconds,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater minutes or hours. The default is five minutes. It
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews cannot be longer than <code class="option">nta-lifetime</code>
c505effec1da6664c37f0e4dbfc1c4f6b0e73367Tinderbox User (which cannot be longer than a week).
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User<dt><span class="term"><span class="command"><strong>max-zone-ttl</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Specifies a maximum permissible TTL value in seconds.
66458d12f373fb75e8543d36fd76864a7567057bTinderbox User For convenience, TTL-style time unit suffixes may be
ee36de8388ec31d28244d62a24050eaa2bbc8d44Tinderbox User used to specify the maximum value.
00ce5d1add91ba5664de4da3cda8c3a5017ba6a7Tinderbox User When loading a zone file using a
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User <code class="option">masterfile-format</code> of
00ce5d1add91ba5664de4da3cda8c3a5017ba6a7Tinderbox User <code class="constant">text</code> or <code class="constant">raw</code>,
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User any record encountered with a TTL higher than
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User <code class="option">max-zone-ttl</code> will cause the zone to
8f1a00cf8b3d9dc8d419a797b7ff4fb6ddba428eTinderbox User This is useful in DNSSEC-signed zones because when
8f1a00cf8b3d9dc8d419a797b7ff4fb6ddba428eTinderbox User rolling to a new DNSKEY, the old key needs to remain
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User available until RRSIG records have expired from
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User caches. The <code class="option">max-zone-ttl</code> option guarantees
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User that the largest TTL in the zone will be no higher
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater than the set value.
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User (NOTE: Because <code class="constant">map</code>-format files
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater load directly into memory, this option cannot be
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User used with them.)
a61158fed2e0281a40e3e97e0b7c3f9789a07b4eTinderbox User The default value is <code class="constant">unlimited</code>.
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User A <code class="option">max-zone-ttl</code> of zero is treated as
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User<dt><span class="term"><span class="command"><strong>serial-update-method</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Zones configured for dynamic DNS may use this
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User option to set the update method that will be used for
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the zone serial number in the SOA record.
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User With the default setting of
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater <span class="command"><strong>serial-update-method increment;</strong></span>, the
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User SOA serial number will be incremented by one each time
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews the zone is updated.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="command"><strong>serial-update-method unixtime;</strong></span>, the
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User SOA serial number will be set to the number of seconds
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews since the UNIX epoch, unless the serial number is
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User already greater than or equal to that value, in which
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater case it is simply incremented by one.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="command"><strong>serial-update-method date;</strong></span>, the
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User new SOA serial number will be the current date
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in the form "YYYYMMDD", followed by two zeroes,
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User unless the existing serial number is already greater
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater than or equal to that value, in which case it is
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User incremented by one.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span class="command"><strong>zone-statistics</strong></span></span></dt>
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User If <strong class="userinput"><code>full</code></strong>, the server will collect
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews statistical data on all zones (unless specifically
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User turned off on a per-zone basis by specifying
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User <span class="command"><strong>zone-statistics terse</strong></span> or
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User <span class="command"><strong>zone-statistics none</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in the <span class="command"><strong>zone</strong></span> statement).
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User The default is <strong class="userinput"><code>terse</code></strong>, providing
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User minimal statistics on zones (including name and
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User current serial number, but not query type
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User These statistics may be accessed via the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="command"><strong>statistics-channel</strong></span> or
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User using <span class="command"><strong>rndc stats</strong></span>, which
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater will dump them to the file listed
c0cc232ba92b92c1c5a48d49449ef56f7ca05b56Tinderbox User in the <span class="command"><strong>statistics-file</strong></span>. See
316cd2460aa66e157f72890974ca5c21d65e70e6Tinderbox User also <a class="xref" href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called “The Statistics File”</a>.
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User For backward compatibility with earlier versions
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater of BIND 9, the <span class="command"><strong>zone-statistics</strong></span>
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User option can also accept <strong class="userinput"><code>yes</code></strong>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater or <strong class="userinput"><code>no</code></strong>; <strong class="userinput"><code>yes</code></strong>
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User has the same meaning as <strong class="userinput"><code>full</code></strong>.
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User As of <acronym class="acronym">BIND</acronym> 9.10,
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User <strong class="userinput"><code>no</code></strong> has the same meaning
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater as <strong class="userinput"><code>none</code></strong>; previously, it
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User was the same as <strong class="userinput"><code>terse</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<div class="titlepage"><div><div><h4 class="title">
6284b9b877d2205240dce1cf7f88d4dca888e44aTinderbox User<a name="boolean_options"></a>Boolean Options</h4></div></div></div>
6284b9b877d2205240dce1cf7f88d4dca888e44aTinderbox User<div class="variablelist"><dl class="variablelist">
36c0c1405d4dd31afaf614668f4512e69637e159Tinderbox User<dt><span class="term"><span class="command"><strong>automatic-interface-scan</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <strong class="userinput"><code>yes</code></strong> and supported by the OS,
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User automatically rescan network interfaces when the interface
6ee455a915d0e5cab50865da23152efe59ea1decTinderbox User addresses are added or removed. The default is
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User <strong class="userinput"><code>yes</code></strong>.
e5a6871cd0635ecdb2bf792316a2d8c53206f4b2Tinderbox User Currently the OS needs to support routing sockets for
0a2ff769ecd0b5a6bda54b62bc1ec5fa6fd198a0Tinderbox User <span class="command"><strong>automatic-interface-scan</strong></span> to be
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User<dt><span class="term"><span class="command"><strong>allow-new-zones</strong></span></span></dt>
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User If <strong class="userinput"><code>yes</code></strong>, then zones can be
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater added at runtime via <span class="command"><strong>rndc addzone</strong></span>.
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User The default is <strong class="userinput"><code>no</code></strong>.
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User<dt><span class="term"><span class="command"><strong>auth-nxdomain</strong></span></span></dt>
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User If <strong class="userinput"><code>yes</code></strong>, then the <span class="command"><strong>AA</strong></span> bit
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is always set on NXDOMAIN responses, even if the server is
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater authoritative. The default is <strong class="userinput"><code>no</code></strong>;
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater a change from <acronym class="acronym">BIND</acronym> 8. If you
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User are using very old DNS software, you
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater may need to set it to <strong class="userinput"><code>yes</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span class="command"><strong>deallocate-on-exit</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater This option was used in <acronym class="acronym">BIND</acronym>
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User 8 to enable checking
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater for memory leaks on exit. <acronym class="acronym">BIND</acronym> 9 ignores the option and always performs
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User<dt><span class="term"><span class="command"><strong>memstatistics</strong></span></span></dt>
f525041ae26958385b697cf82a30f108577024b6Tinderbox User Write memory statistics to the file specified by
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="command"><strong>memstatistics-file</strong></span> at exit.
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User The default is <strong class="userinput"><code>no</code></strong> unless
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater '-m record' is specified on the command line in
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User which case it is <strong class="userinput"><code>yes</code></strong>.
a05244bb01d5a5f71b2ac9abe1601589cde79570Tinderbox User<dt><span class="term"><span class="command"><strong>dialup</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <strong class="userinput"><code>yes</code></strong>, then the
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews server treats all zones as if they are doing zone transfers
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User a dial-on-demand dialup link, which can be brought up by
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews originating from this server. This has different effects
aef6cf0f147a5014d4891c9689b9f463399e16e7Tinderbox User to zone type and concentrates the zone maintenance so that
a9d14bf051644716b5db9209c453d2c5eb83f174Tinderbox User happens in a short interval, once every <span class="command"><strong>heartbeat-interval</strong></span> and
5a23eb8cb48cee59999acc9af33f643dbcd76feaTinderbox User hopefully during the one call. It also suppresses some of
a450977e98155f6e828fe6f8d52cf24674231831Mark Andrews zone maintenance traffic. The default is <strong class="userinput"><code>no</code></strong>.
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater The <span class="command"><strong>dialup</strong></span> option
0d3490f93bb980fde704055e74c1b508987a5fe4Mark Andrews may also be specified in the <span class="command"><strong>view</strong></span> and
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews <span class="command"><strong>zone</strong></span> statements,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater in which case it overrides the global <span class="command"><strong>dialup</strong></span>
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews If the zone is a master zone, then the server will send out a
33d1cff1dd63494ffa00fac695a793f00c4ebf0bTinderbox User request to all the slaves (default). This should trigger the
169f44b082b340b952e26c0fdb930c102a957752Mark Andrews number check in the slave (providing it supports NOTIFY)
8f1a00cf8b3d9dc8d419a797b7ff4fb6ddba428eTinderbox User allowing the slave
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User to verify the zone while the connection is active.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User The set of servers to which NOTIFY is sent can be controlled
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User <span class="command"><strong>notify</strong></span> and <span class="command"><strong>also-notify</strong></span>.
e64202536ea72d8f371dd0df9fc763f8d70bf886Tinderbox User zone is a slave or stub zone, then the server will suppress
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont "zone up to date" (refresh) queries and only perform them
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User <span class="command"><strong>heartbeat-interval</strong></span> expires in
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User addition to sending
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User NOTIFY requests.
904890e38b74005395451501400718d759bfc064Tinderbox User Finer control can be achieved by using
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <strong class="userinput"><code>notify</code></strong> which only sends NOTIFY
646fed0d28be4387e3e32fb0f5732a1f58b572baTinderbox User <strong class="userinput"><code>notify-passive</code></strong> which sends NOTIFY
ecbc7ebb243a1f8a5dc6f28185ffe9e61d3b2102Mark Andrews messages and
19ad308d84cbf446a144e5a91f2032389a9d65c1Tinderbox User suppresses the normal refresh queries, <strong class="userinput"><code>refresh</code></strong>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont which suppresses normal refresh processing and sends refresh
42c81cf2de732ec6d00e73fc755a399ca037e543Mark Andrews when the <span class="command"><strong>heartbeat-interval</strong></span>
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <strong class="userinput"><code>passive</code></strong> which just disables normal
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater normal refresh
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater heart-beat refresh
66cf4a406525db9c42977d8034a60e0a8e2a9290Automatic Updater heart-beat notify
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User <p><span class="command"><strong>no</strong></span> (default)</p>
5e82fe9a56d17bfbd120817d00d28c5952ab4ddcTinderbox User <p><span class="command"><strong>yes</strong></span></p>
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater <p><span class="command"><strong>notify</strong></span></p>
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt <p><span class="command"><strong>refresh</strong></span></p>
7711228a135a2fe85765ba13a67b8e397ed73489Mark Andrews <p><span class="command"><strong>passive</strong></span></p>
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews <p><span class="command"><strong>notify-passive</strong></span></p>
b871c7156eb037d41f53828c6fcb9cc876128962Mark Andrews Note that normal NOTIFY processing is not affected by
7af91d15b2ce1ce32f7320f6d5cc3b83621c241aAutomatic Updater <span class="command"><strong>dialup</strong></span>.
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews<dt><span class="term"><span class="command"><strong>fake-iquery</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater In <acronym class="acronym">BIND</acronym> 8, this option
0accdb26ead1fe520a9820b52efbea64bdf564e3Tinderbox User enabled simulating the obsolete DNS query type
8b8e37f252b0411e00a0a2775d570562aedce439Tinderbox User IQUERY. <acronym class="acronym">BIND</acronym> 9 never does
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater IQUERY simulation.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span class="command"><strong>fetch-glue</strong></span></span></dt>
2ba8f584b97cbab864570e38fd26b8cb90961428Tinderbox User This option is obsolete.
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User In BIND 8, <strong class="userinput"><code>fetch-glue yes</code></strong>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater caused the server to attempt to fetch glue resource records
ba8b771c371967dd1254c7fa82ebe4158ee04b24Tinderbox User didn't have when constructing the additional
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews data section of a response. This is now considered a bad
098097efb95046a4a5285b6dae95dea3e3b70853Automatic Updater and BIND 9 never does it.
2964b1f272bab3e7ed3fbb4a0811da5e93646d34Tinderbox User<dt><span class="term"><span class="command"><strong>flush-zones-on-shutdown</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater When the nameserver exits due receiving SIGTERM,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater flush or do not flush any pending zone writes. The default
0d13a9584b9f97693ab22d54322f1c484d578701Mark Andrews <span class="command"><strong>flush-zones-on-shutdown</strong></span> <strong class="userinput"><code>no</code></strong>.
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater<dt><span class="term"><span class="command"><strong>geoip-use-ecs</strong></span></span></dt>
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User When BIND is compiled with GeoIP support and configured
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater with "geoip" ACL elements, this option indicates whether
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User the EDNS Client Subnet option, if present in a request,
1fff4d36fb18ccdca15acb0bae20c2aa8e833ceeTinderbox User should be used for matching against the GeoIP database.
11b6b0d74bb8dd6bd1ce0b60ba7f9b66323f06d4Tinderbox User The default is
7f79131f9a8e804b93c57f3c679065cce878b726Automatic Updater <span class="command"><strong>geoip-use-ecs</strong></span> <strong class="userinput"><code>yes</code></strong>.
609b8d08176469485edce25f3c2f50365bbd3819Mark Andrews<dt><span class="term"><span class="command"><strong>has-old-clients</strong></span></span></dt>
f0c5e918974bf778af6cd1e25309ad13e30a79a6Tinderbox User This option was incorrectly implemented
a8677ecad546c955406b341eb8344ed06768b11eTinderbox User in <acronym class="acronym">BIND</acronym> 8, and is ignored by <acronym class="acronym">BIND</acronym> 9.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater To achieve the intended effect
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater <span class="command"><strong>has-old-clients</strong></span> <strong class="userinput"><code>yes</code></strong>, specify
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews the two separate options <span class="command"><strong>auth-nxdomain</strong></span> <strong class="userinput"><code>yes</code></strong>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews and <span class="command"><strong>rfc2308-type1</strong></span> <strong class="userinput"><code>no</code></strong> instead.
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User<dt><span class="term"><span class="command"><strong>host-statistics</strong></span></span></dt>
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox User In BIND 8, this enables keeping of
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater statistics for every host that the name server interacts
fedd407a76adfdd745eb7d2461673693c6f9fea9Mark Andrews Not implemented in BIND 9.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span class="command"><strong>maintain-ixfr-base</strong></span></span></dt>
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span class="emphasis"><em>This option is obsolete</em></span>.
a7c412f37cc73d0332887a746e81220cbf09dd00Mark Andrews It was used in <acronym class="acronym">BIND</acronym> 8 to
51374c645c0e6dd77c369c13834c751785f96f14Tinderbox User determine whether a transaction log was
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater kept for Incremental Zone Transfer. <acronym class="acronym">BIND</acronym> 9 maintains a transaction
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater log whenever possible. If you need to disable outgoing
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User incremental zone
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt transfers, use <span class="command"><strong>provide-ixfr</strong></span> <strong class="userinput"><code>no</code></strong>.
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt<dt><span class="term"><span class="command"><strong>message-compression</strong></span></span></dt>
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User If <strong class="userinput"><code>yes</code></strong>, DNS name compression is
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt used in responses to regular queries (not including
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt AXFR or IXFR, which always uses compression). Setting
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt this option to <strong class="userinput"><code>no</code></strong> reduces CPU
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User usage on servers and may improve throughput. However,
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater it increases response size, which may cause more queries
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User to be processed using TCP; a server with compression
2bb3422dc683c013db7042f5736240de6b86f182Automatic Updater disabled is out of compliance with RFC 1123 Section
c855e7170a7ddb5d4ebab69a771f35dc93e95e43Mark Andrews 6.1.3.2. The default is <strong class="userinput"><code>yes</code></strong>.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont<dt><span class="term"><span class="command"><strong>minimal-responses</strong></span></span></dt>
a907c61823c4715248b259c4d495fc0c9d1b9889Tinderbox User If <strong class="userinput"><code>yes</code></strong>, then when generating
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User responses the server will only add records to the authority
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User and additional data sections when they are required (e.g.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User delegations, negative responses). This may improve the
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User performance of the server.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <strong class="userinput"><code>no</code></strong>.
2964b1f272bab3e7ed3fbb4a0811da5e93646d34Tinderbox User<dt><span class="term"><span class="command"><strong>minimal-any</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User If set to <strong class="userinput"><code>yes</code></strong>, then when
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater generating a positive response to a query of type
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User ANY over UDP, the server will reply with only one
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User of the RRsets for the query name, and its covering
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User RRSIGs if any, instead of replying with all known
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater RRsets for the name. Similarly, a query for type
137fdbc214e99c4cbe57551e9e14f2015c2e42aeTinderbox User RRSIG will be answered with the RRSIG records covering
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater only one type. This can reduce the impact of some kinds
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User of attack traffic, without harming legitimate
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User clients. (Note, however, that the RRset returned is the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater first one found in the database; it is not necessarily
e64202536ea72d8f371dd0df9fc763f8d70bf886Tinderbox User the smallest available RRset.)
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Additionally, <code class="option">minimal-responses</code> is
4cde88fbf4c5e78a785d40f364cdcf60f3575f0cTinderbox User turned on for these queries, so no unnecessary records
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater will be added to the authority or additional sections.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is <strong class="userinput"><code>no</code></strong>.
1ac49378a458420bc685293d12e567d7222d17b6Tinderbox User<dt><span class="term"><span class="command"><strong>multiple-cnames</strong></span></span></dt>
f0c5e918974bf778af6cd1e25309ad13e30a79a6Tinderbox User This option was used in <acronym class="acronym">BIND</acronym> 8 to allow
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews a domain name to have multiple CNAME records in violation of
681beefc668253b3e469a1de282fbc33a3752422Automatic Updater the DNS standards. <acronym class="acronym">BIND</acronym> 9.2 onwards
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User always strictly enforces the CNAME rules both in master
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User files and dynamic updates.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span class="command"><strong>notify</strong></span></span></dt>
b3386fba31414344f38f0c30849c056dceb22dceTinderbox User If <strong class="userinput"><code>yes</code></strong> (the default),
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User DNS NOTIFY messages are sent when a zone the server is
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User authoritative for
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater changes, see <a class="xref" href="Bv9ARM.ch04.html#notify" title="Notify">the section called “Notify”</a>. The messages are
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater servers listed in the zone's NS records (except the master
4cde88fbf4c5e78a785d40f364cdcf60f3575f0cTinderbox User server identified
572048aa7bf7b449d60dfb2dbebf861454626f96Tinderbox User in the SOA MNAME field), and to any servers listed in the
83e281baf1b4149dc637d24dd41141129ae712c6Tinderbox User <span class="command"><strong>also-notify</strong></span> option.
9e898948ed76bf5f175bf178866c90c449843c3eTinderbox User If <strong class="userinput"><code>master-only</code></strong>, notifies are only
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater for master zones.
33d1cff1dd63494ffa00fac695a793f00c4ebf0bTinderbox User If <strong class="userinput"><code>explicit</code></strong>, notifies are sent only
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User servers explicitly listed using <span class="command"><strong>also-notify</strong></span>.
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont If <strong class="userinput"><code>no</code></strong>, no notifies are sent.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User The <span class="command"><strong>notify</strong></span> option may also be
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User specified in the <span class="command"><strong>zone</strong></span>
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews in which case it overrides the <span class="command"><strong>options notify</strong></span> statement.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User It would only be necessary to turn off this option if it
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User caused slaves
6d114a4c5cddb176ae5199eee154c0273d652ba4Tinderbox User<dt><span class="term"><span class="command"><strong>notify-to-soa</strong></span></span></dt>
ca5ba35827e475a824ec79d489dbcdb3341a35ccTinderbox User If <strong class="userinput"><code>yes</code></strong> do not check the nameservers
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews in the NS RRset against the SOA MNAME. Normally a NOTIFY
71fa3534bfaf174f6a938dc1ba3522f66606c4e1Mark Andrews message is not sent to the SOA MNAME (SOA ORIGIN) as it is
ca5ba35827e475a824ec79d489dbcdb3341a35ccTinderbox User supposed to contain the name of the ultimate master.
1fdd58445074579ee3b65c871137a7a1740eb542Mark Andrews Sometimes, however, a slave is listed as the SOA MNAME in
e08cdffb3ae4ad409f37e3e5a218fe4b7e0e3904Tinderbox User hidden master configurations and in that case you would
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews want the ultimate master to still send NOTIFY messages to
9e295ad801d5c986eb6c7745637b5dc0efb28711Tinderbox User all the nameservers listed in the NS RRset.
5ee9f7f23852d92772c08ca6e4b46c549beaf660Mark Andrews<dt><span class="term"><span class="command"><strong>recursion</strong></span></span></dt>
757ff043760e4743dda1a10e7d58349275934902Tinderbox User If <strong class="userinput"><code>yes</code></strong>, and a
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User DNS query requests recursion, then the server will attempt
e08cdffb3ae4ad409f37e3e5a218fe4b7e0e3904Tinderbox User all the work required to answer the query. If recursion is
fe600c3ad88c0bb078283a953d048087d227c0e5Tinderbox User and the server does not already know the answer, it will
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User referral response. The default is
316cd2460aa66e157f72890974ca5c21d65e70e6Tinderbox User <strong class="userinput"><code>yes</code></strong>.
646fed0d28be4387e3e32fb0f5732a1f58b572baTinderbox User Note that setting <span class="command"><strong>recursion no</strong></span> does not prevent
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont clients from getting data from the server's cache; it only
f0c5e918974bf778af6cd1e25309ad13e30a79a6Tinderbox User prevents new data from being cached as an effect of client
2964b1f272bab3e7ed3fbb4a0811da5e93646d34Tinderbox User Caching may still occur as an effect the server's internal
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont operation, such as NOTIFY address lookups.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span class="command"><strong>request-nsid</strong></span></span></dt>
5ee9f7f23852d92772c08ca6e4b46c549beaf660Mark Andrews If <strong class="userinput"><code>yes</code></strong>, then an empty EDNS(0)
4aec4843241dca64de7eb6363944df0b09cb83ecTinderbox User NSID (Name Server Identifier) option is sent with all
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont queries to authoritative name servers during iterative
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater resolution. If the authoritative server returns an NSID
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews option in its response, then its contents are logged in
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews the <span class="command"><strong>resolver</strong></span> category at level
af60449fe472b8bea5ad04bf538c777c6b151112Tinderbox User <span class="command"><strong>info</strong></span>.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User The default is <strong class="userinput"><code>no</code></strong>.
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox User<dt><span class="term"><span class="command"><strong>request-sit</strong></span></span></dt>
4f538e852f20912e629338e911e46ce26de3e965Tinderbox User This experimental option is obsolete.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User<dt><span class="term"><span class="command"><strong>require-server-cookie</strong></span></span></dt>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont Require a valid server cookie before sending a full
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User response to a UDP request from a cookie aware client.
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User BADCOOKIE is sent if there is a bad or no existent
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater server cookie.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span class="command"><strong>send-cookie</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If <strong class="userinput"><code>yes</code></strong>, then a COOKIE EDNS
90ff38a0d8deaf5f9c2aa5916d99b2e572d28738Automatic Updater option is sent along with the query. If the
c288e47fb7d4baa1ed887156b1c5e5db394d4f52Tinderbox User resolver has previously talked to the server, the
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User COOKIE returned in the previous transaction is sent.
90ff38a0d8deaf5f9c2aa5916d99b2e572d28738Automatic Updater This is used by the server to determine whether
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the resolver has talked to it before. A resolver
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt sending the correct COOKIE is assumed not to be an
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt off-path attacker sending a spoofed-source query;
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt the query is therefore unlikely to be part of a
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User reflection/amplification attack, so resolvers
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater sending a correct COOKIE option are not subject to
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater response rate limiting (RRL). Resolvers which
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews do not send a correct COOKIE option may be limited
39ae0eafed076ef769fef5c18b22a8051df5c93aTinderbox User to receiving smaller responses via the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="command"><strong>nocookie-udp-size</strong></span> option.
ce0fd07045292942bfa3e755d9ce596941528a63Automatic Updater<dt><span class="term"><span class="command"><strong>nocookie-udp-size</strong></span></span></dt>
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater Sets the maximum size of UDP responses that will be
6ee455a915d0e5cab50865da23152efe59ea1decTinderbox User sent to queries without a valid server COOKIE. A value
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater below 128 will be silently raised to 128. The default
96713299d08c0735c18ebe8772dd2cc1ecd4356aAutomatic Updater value is 4096, but the <span class="command"><strong>max-udp-size</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater option may further limit the response size.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span class="command"><strong>sit-secret</strong></span></span></dt>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews This experimental option is obsolete.
c6517a807173827b8f638d31303805ee4c1d8054Automatic Updater<dt><span class="term"><span class="command"><strong>cookie-algorithm</strong></span></span></dt>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews Set the algorithm to be used when generating the
04bc14c887243e624469fdbd336c1d3cb8ed7cc7Tinderbox User server cookie. One of "aes", "sha1" or "sha256".
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default is "aes" if supported by the cryptographic
4f538e852f20912e629338e911e46ce26de3e965Tinderbox User library or otherwise "sha256".
27739dd25026283c24645c8a1044b95ef9eb5ac6Tinderbox User<dt><span class="term"><span class="command"><strong>cookie-secret</strong></span></span></dt>
1bf507ca635310b340aea42d6c3e567819974a99Tinderbox User If set, this is a shared secret used for generating
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater and verifying Source Identity Token EDNS options
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater within an anycast cluster. If not set, the system
c6517a807173827b8f638d31303805ee4c1d8054Automatic Updater will generate a random secret at startup. The
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater shared secret is encoded as a hex string and needs
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater to be 128 bits for AES128, 160 bits for SHA1 and
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User 256 bits for SHA256.
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater<dt><span class="term"><span class="command"><strong>rfc2308-type1</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Setting this to <strong class="userinput"><code>yes</code></strong> will
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews cause the server to send NS records along with the SOA
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater record for negative
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater answers. The default is <strong class="userinput"><code>no</code></strong>.
0ead2ac0a4b59c3e4a731027f0f66fbe602b1289Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Not yet implemented in <acronym class="acronym">BIND</acronym>
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt<dt><span class="term"><span class="command"><strong>use-id-pool</strong></span></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="emphasis"><em>This option is obsolete</em></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <acronym class="acronym">BIND</acronym> 9 always allocates query
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater IDs from a pool.
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User<dt><span class="term"><span class="command"><strong>use-ixfr</strong></span></span></dt>
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson <span class="emphasis"><em>This option is obsolete</em></span>.
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User If you need to disable IXFR to a particular server or
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User the information on the <span class="command"><strong>provide-ixfr</strong></span> option
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews in <a class="xref" href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and Usage">the section called “<span class="command"><strong>server</strong></span> Statement Definition and
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews Usage”</a>.
cd6e9010079a4e58f7e30063df3dec0ff154ad59Tinderbox User <a class="xref" href="Bv9ARM.ch04.html#incremental_zone_transfers" title="Incremental Zone Transfers (IXFR)">the section called “Incremental Zone Transfers (IXFR)”</a>.
f520803b46dc189fdaf84adc87ef327d3587b435Mark Andrews<dt><span class="term"><span class="command"><strong>provide-ixfr</strong></span></span></dt>
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews See the description of
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt <span class="command"><strong>provide-ixfr</strong></span> in
e705db6d5d886dc14f4a75a2046a075c0750e7eeAutomatic Updater <a class="xref" href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and Usage">the section called “<span class="command"><strong>server</strong></span> Statement Definition and
bac4435d473c9a0281507524f084480c34aa942aTinderbox User Usage”</a>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span class="command"><strong>request-ixfr</strong></span></span></dt>
757ff043760e4743dda1a10e7d58349275934902Tinderbox User See the description of
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="command"><strong>request-ixfr</strong></span> in
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <a class="xref" href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and Usage">the section called “<span class="command"><strong>server</strong></span> Statement Definition and
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt Usage”</a>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span class="command"><strong>request-expire</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User See the description of
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <span class="command"><strong>request-expire</strong></span> in
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User <a class="xref" href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and Usage">the section called “<span class="command"><strong>server</strong></span> Statement Definition and
1bf507ca635310b340aea42d6c3e567819974a99Tinderbox User Usage”</a>.
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User<dt><span class="term"><span class="command"><strong>treat-cr-as-space</strong></span></span></dt>
1bf507ca635310b340aea42d6c3e567819974a99Tinderbox User This option was used in <acronym class="acronym">BIND</acronym>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont the server treat carriage return ("<span class="command"><strong>\r</strong></span>") characters the same way
76fbdc591b3d46df28878a6ff844798622b85265Tinderbox User as a space or tab character,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews to facilitate loading of zone files on a UNIX system that
bcb68be0a8f3c3eca58d6a6a869267e5c1841de2Francis Dupont were generated
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater on an NT or DOS machine. In <acronym class="acronym">BIND</acronym> 9, both UNIX "<span class="command"><strong>\n</strong></span>"
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User and NT/DOS "<span class="command"><strong>\r\n</strong></span>" newlines
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User are always accepted,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater and the option is ignored.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<span class="term"><span class="command"><strong>additional-from-auth</strong></span>, </span><span class="term"><span class="command"><strong>additional-from-cache</strong></span></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater These options control the behavior of an authoritative
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater answering queries which have additional data, or when
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater following CNAME
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User and DNAME chains.
f0c5e918974bf778af6cd1e25309ad13e30a79a6Tinderbox User When both of these options are set to <strong class="userinput"><code>yes</code></strong>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont (the default) and a
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater query is being answered from authoritative data (a zone
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater configured into the server), the additional data section of
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson reply will be filled in using data from other authoritative
e4757e3dafe50ae59f693eec828f68c42c197a70Andreas Gustafsson and from the cache. In some situations this is undesirable,
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User as when there is concern over the correctness of the cache,
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews in servers where slave zones may be added and modified by
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater untrusted third parties. Also, avoiding
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User the search for this additional data will speed up server
76fbdc591b3d46df28878a6ff844798622b85265Tinderbox User at the possible expense of additional queries to resolve
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User otherwise be provided in the additional section.
933799f3641f4f78445d015008bad0038900a82aTinderbox User For example, if a query asks for an MX record for host <code class="literal">foo.example.com</code>,
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater and the record found is "<code class="literal">MX 10 mail.example.net</code>", normally the address
fca737c98d2be3ef944cc96320c040fdb5f160e3Tinderbox User records (A and AAAA) for <code class="literal">mail.example.net</code> will be provided as well,
faa406d25d1d73b04a1351d1e62ab55557ed61ebAutomatic Updater if known, even though they are not in the example.com zone.
1a63fb1d1448ed3f8fd7227ae57be67c2e71279eMark Andrews Setting these options to <span class="command"><strong>no</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater disables this behavior and makes
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the server only search for additional data in the zone it
933799f3641f4f78445d015008bad0038900a82aTinderbox User answers from.
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater These options are intended for use in authoritative-only
933799f3641f4f78445d015008bad0038900a82aTinderbox User servers, or in authoritative-only views. Attempts to set
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User them to <span class="command"><strong>no</strong></span> without also
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews <span class="command"><strong>recursion no</strong></span> will cause the
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User ignore the options and log a warning message.
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews Specifying <span class="command"><strong>additional-from-cache no</strong></span> actually
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User disables the use of the cache not only for additional data
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User but also when looking up the answer. This is usually the
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User behavior in an authoritative-only server where the
a900e4f99ff134b567b6df5ac2c841c7d0c551d3Automatic Updater correctness of
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User the cached data is an issue.
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User When a name server is non-recursively queried for a name
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User below the apex of any served zone, it normally answers with
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User "upwards referral" to the root servers or the servers of
a900e4f99ff134b567b6df5ac2c841c7d0c551d3Automatic Updater known parent of the query name. Since the data in an
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater upwards referral
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater comes from the cache, the server will not be able to provide
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater referrals when <span class="command"><strong>additional-from-cache no</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater has been specified. Instead, it will respond to such
4fda24d843edac463c98785ec0c850d912592dc1Tinderbox User with REFUSED. This should not cause any problems since
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User upwards referrals are not required for the resolution
9563f388c8ca1bb9ebb04db54e122815b0008c8aTinderbox User<dt><span class="term"><span class="command"><strong>match-mapped-addresses</strong></span></span></dt>
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User If <strong class="userinput"><code>yes</code></strong>, then an
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User IPv4-mapped IPv6 address will match any address match
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater list entries that match the corresponding IPv4 address.
bcb68be0a8f3c3eca58d6a6a869267e5c1841de2Francis Dupont This option was introduced to work around a kernel quirk
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews in some operating systems that causes IPv4 TCP
bcb68be0a8f3c3eca58d6a6a869267e5c1841de2Francis Dupont connections, such as zone transfers, to be accepted on an
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews IPv6 socket using mapped addresses. This caused address
dc238a06bffa79de141ee7655765e2df91498a8aTinderbox User match lists designed for IPv4 to fail to match. However,
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User <span class="command"><strong>named</strong></span> now solves this problem
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews internally. The use of this option is discouraged.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term"><span class="command"><strong>filter-aaaa-on-v4</strong></span></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews This option is only available when
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews <acronym class="acronym">BIND</acronym> 9 is compiled with the
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <strong class="userinput"><code>--enable-filter-aaaa</code></strong> option on the
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews "configure" command line. It is intended to help the
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews transition from IPv4 to IPv6 by not giving IPv6 addresses
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews to DNS clients unless they have connections to the IPv6
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Internet. This is not recommended unless absolutely
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews necessary. The default is <strong class="userinput"><code>no</code></strong>.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews The <span class="command"><strong>filter-aaaa-on-v4</strong></span> option
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews may also be specified in <span class="command"><strong>view</strong></span> statements
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews to override the global <span class="command"><strong>filter-aaaa-on-v4</strong></span>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews If <strong class="userinput"><code>yes</code></strong>,
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews the DNS client is at an IPv4 address, in <span class="command"><strong>filter-aaaa</strong></span>,
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews and if the response does not include DNSSEC signatures,
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews then all AAAA records are deleted from the response.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews This filtering applies to all responses and not only
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews authoritative responses.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews If <strong class="userinput"><code>break-dnssec</code></strong>,
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews then AAAA records are deleted even when DNSSEC is enabled.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews As suggested by the name, this makes the response not verify,
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews because the DNSSEC protocol is designed detect deletions.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews This mechanism can erroneously cause other servers to
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews not give AAAA records to their clients.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews A recursing server with both IPv6 and IPv4 network connections
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews that queries an authoritative server using this mechanism
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews via IPv4 will be denied AAAA records even if its client is
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews This mechanism is applied to authoritative as well as
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews non-authoritative records.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews A client using IPv4 that is not allowed recursion can
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews erroneously be given AAAA records because the server is not
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews allowed to check for A records.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews Some AAAA records are given to IPv4 clients in glue records.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews IPv4 clients that are servers can then erroneously
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater answer requests for AAAA records received via IPv4.
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews<dt><span class="term"><span class="command"><strong>filter-aaaa-on-v6</strong></span></span></dt>
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews Identical to <span class="command"><strong>filter-aaaa-on-v4</strong></span>,
a04588e781b513ae3b30e061ac98035802b5e8e8Mark Andrews except it filters AAAA responses to queries from IPv6
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User clients instead of IPv4 clients. To filter all
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User responses, set both options to <strong class="userinput"><code>yes</code></strong>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term"><span class="command"><strong>ixfr-from-differences</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User When <strong class="userinput"><code>yes</code></strong> and the server loads a new
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User version of a master zone from its zone file or receives a
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User new version of a slave file via zone transfer, it will
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User compare the new version to the previous one and calculate
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater a set of differences. The differences are then logged in
cd6e9010079a4e58f7e30063df3dec0ff154ad59Tinderbox User the zone's journal file such that the changes can be
cd6e9010079a4e58f7e30063df3dec0ff154ad59Tinderbox User transmitted to downstream slaves as an incremental zone
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson By allowing incremental zone transfers to be used for
b7f4a6fd8ac70ebf889179ee84c1dd35647bfc73Evan Hunt non-dynamic zones, this option saves bandwidth at the
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User expense of increased CPU and memory consumption at the
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews In particular, if the new version of a zone is completely
91d187ce035f39073f0732ff2a401a45c3c955fbMark Andrews different from the previous one, the set of differences
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont will be of a size comparable to the combined size of the
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater old and new zone version, and the server will need to
950d203b64f512b85fcc093ee1e9e3e531a1aea3Tinderbox User temporarily allocate memory to hold this complete
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews difference set.
e40c4e4c17d4df338e2a7db0f84d8dbb3858964cTinderbox User<p><span class="command"><strong>ixfr-from-differences</strong></span>
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont also accepts <span class="command"><strong>master</strong></span> and
22d32791e5daa0bc80335a0f10ab2de95f41ccdbTinderbox User <span class="command"><strong>slave</strong></span> at the view and options
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont levels which causes
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont <span class="command"><strong>ixfr-from-differences</strong></span> to be enabled for
3759f10fc543747668b1ca4b4671f35b0dea8445Francis Dupont all <span class="command"><strong>master</strong></span> or
a03cb08d0c4f1ca5fbc121d2f02bdffa7eb52286Mark Andrews <span class="command"><strong>slave</strong></span> zones respectively.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt It is off by default.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews<dt><span class="term"><span class="command"><strong>multi-master</strong></span></span></dt>
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt This should be set when you have multiple masters for a zone
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt addresses refer to different machines. If <strong class="userinput"><code>yes</code></strong>, <span class="command"><strong>named</strong></span> will
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews when the serial number on the master is less than what <span class="command"><strong>named</strong></span>
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt has. The default is <strong class="userinput"><code>no</code></strong>.
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt<dt><span class="term"><span class="command"><strong>auto-dnssec</strong></span></span></dt>
f190095cae5e5a8734e0ff16055488d471569499Tinderbox User Zones configured for dynamic DNS may use this
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt option to allow varying levels of automatic DNSSEC key
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt management. There are three possible settings:
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <span class="command"><strong>auto-dnssec allow;</strong></span> permits
f190095cae5e5a8734e0ff16055488d471569499Tinderbox User keys to be updated and the zone fully re-signed
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt whenever the user issues the command <span class="command"><strong>rndc sign
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt <em class="replaceable"><code>zonename</code></em></strong></span>.
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <span class="command"><strong>auto-dnssec maintain;</strong></span> includes the
f190095cae5e5a8734e0ff16055488d471569499Tinderbox User above, but also automatically adjusts the zone's DNSSEC
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt keys on schedule, according to the keys' timing metadata
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt (see <a class="xref" href="man.dnssec-keygen.html" title="dnssec-keygen"><span class="refentrytitle"><span class="application">dnssec-keygen</span></span>(8)</a> and
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt <a class="xref" href="man.dnssec-settime.html" title="dnssec-settime"><span class="refentrytitle"><span class="application">dnssec-settime</span></span>(8)</a>). The command
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <em class="replaceable"><code>zonename</code></em></strong></span> causes
f190095cae5e5a8734e0ff16055488d471569499Tinderbox User <span class="command"><strong>named</strong></span> to load keys from the key
98922b2b2b024dcca25be7c220cf3b16b1e6c4b5Evan Hunt repository and sign the zone with all keys that are
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User <em class="replaceable"><code>zonename</code></em></strong></span> causes
03ebc228ee3725738b067b6bd7082a9a731822a1Tinderbox User <span class="command"><strong>named</strong></span> to load keys from the key
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User repository and schedule key maintenance events to occur
37d8e0a4455876fe1e4cca511076cc2c5ab9eedeTinderbox User in the future, but it does not sign the full zone
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews immediately. Note: once keys have been loaded for a
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews zone the first time, the repository will be searched
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews for changes periodically, regardless of whether
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews <span class="command"><strong>rndc loadkeys</strong></span> is used. The recheck
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews interval is defined by
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews <span class="command"><strong>dnssec-loadkeys-interval</strong></span>.)
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The default setting is <span class="command"><strong>auto-dnssec off</strong></span>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews<dt><span class="term"><span class="command"><strong>dnssec-enable</strong></span></span></dt>
e813f036c8251b6d9d2a72fa84f80c2c9d2795afMark Andrews This indicates whether DNSSEC-related resource
f190095cae5e5a8734e0ff16055488d471569499Tinderbox User records are to be returned by <span class="command"><strong>named</strong></span>.
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews If set to <strong class="userinput"><code>no</code></strong>,
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews <span class="command"><strong>named</strong></span> will not return DNSSEC-related
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews resource records unless specifically queried for.
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews The default is <strong class="userinput"><code>yes</code></strong>.
bed0874e1a09e810575328c4bfc346a47514b69fMark Andrews<dt><span class="term"><span class="command"><strong>dnssec-validation</strong></span></span></dt>
710bce1a85c96e85ca1a90471382055acd29d51fTinderbox User Enable DNSSEC validation in <span class="command"><strong>named</strong></span>.
dedefc0bdbb4e6e39eeb98aa2fc6883efec2ddb0Mark Andrews Note <span class="command"><strong>dnssec-enable</strong></span> also needs to be
77932ac533c711eca5cd86de4e7eca8d91102b43Tinderbox User set to <strong class="userinput"><code>yes</code></strong> to be effective.
827f8cccb5280f4da66c46186e792d1cb9d73503Mark Andrews If set to <strong class="userinput"><code>no</code></strong>, DNSSEC validation
922e6a3c2ac4ef900dd9dc99f0cc137f18372583Andreas Gustafsson is disabled. If set to <strong class="userinput"><code>auto</code></strong>,
015055b6e23f5c08f6a5b34726f90b62597e9e45Tinderbox User DNSSEC validation is enabled, and a default
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User trust-anchor for the DNS root zone is used. If set to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <strong class="userinput"><code>yes</code></strong>, DNSSEC validation is enabled,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User but a trust anchor must be manually configured using
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User a <span class="command"><strong>trusted-keys</strong></span> or
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span class="command"><strong>managed-keys</strong></span> statement. The default
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is <strong class="userinput"><code>yes</code></strong>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Whenever the resolver sends out queries to an
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User EDNS-compliant server, it always sets the DO bit
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User indicating it can support DNSSEC responses even if
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span class="command"><strong>dnssec-validation</strong></span> is off.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>dnssec-accept-expired</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Accept expired signatures when verifying DNSSEC signatures.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default is <strong class="userinput"><code>no</code></strong>.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Setting this option to <strong class="userinput"><code>yes</code></strong>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews leaves <span class="command"><strong>named</strong></span> vulnerable to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User replay attacks.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>querylog</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specify whether query logging should be started when <span class="command"><strong>named</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If <span class="command"><strong>querylog</strong></span> is not specified,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User then the query logging
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is determined by the presence of the logging category <span class="command"><strong>queries</strong></span>.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<dt><span class="term"><span class="command"><strong>check-names</strong></span></span></dt>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews This option is used to restrict the character set and syntax
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User certain domain names in master files and/or DNS responses
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User from the network. The default varies according to usage
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span class="command"><strong>master</strong></span> zones the default is <span class="command"><strong>fail</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User For <span class="command"><strong>slave</strong></span> zones the default
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User is <span class="command"><strong>warn</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User For answers received from the network (<span class="command"><strong>response</strong></span>)
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the default is <span class="command"><strong>ignore</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The rules for legal hostnames and mail domains are derived
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User from RFC 952 and RFC 821 as modified by RFC 1123.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<p><span class="command"><strong>check-names</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User applies to the owner names of A, AAAA and MX records.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User It also applies to the domain names in the RDATA of NS, SOA,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User MX, and SRV records.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User It also applies to the RDATA of PTR records where the owner
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User name indicated that it is a reverse lookup of a hostname
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>check-dup-records</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Check master zones for records that are treated as different
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User by DNSSEC but are semantically equal in plain DNS. The
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User default is to <span class="command"><strong>warn</strong></span>. Other possible
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User values are <span class="command"><strong>fail</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span class="command"><strong>ignore</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>check-mx</strong></span></span></dt>
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater Check whether the MX record appears to refer to a IP address.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default is to <span class="command"><strong>warn</strong></span>. Other possible
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User values are <span class="command"><strong>fail</strong></span> and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span class="command"><strong>ignore</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>check-wildcard</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User This option is used to check for non-terminal wildcards.
6fe48fb46e53ffc37542853a1edb74cb481b7d94Automatic Updater The use of non-terminal wildcards is almost always as a
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User result of a failure
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to understand the wildcard matching algorithm (RFC 1034).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User affects master zones. The default (<span class="command"><strong>yes</strong></span>) is to check
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User for non-terminal wildcards and issue a warning.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>check-integrity</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Perform post load zone integrity checks on master
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User zones. This checks that MX and SRV records refer
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to address (A or AAAA) records and that glue
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User address records exist for delegated zones. For
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User MX and SRV records only in-zone hostnames are
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User checked (for out-of-zone hostnames use
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span class="command"><strong>named-checkzone</strong></span>).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User For NS records only names below top of zone are
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User checked (for out-of-zone names and glue consistency
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews checks use <span class="command"><strong>named-checkzone</strong></span>).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default is <span class="command"><strong>yes</strong></span>.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews The use of the SPF record for publishing Sender
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Policy Framework is deprecated as the migration
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User from using TXT records to SPF records was abandoned.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Enabling this option also checks that a TXT Sender
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Policy Framework record exists (starts with "v=spf1")
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User if there is an SPF record. Warnings are emitted if the
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews TXT record does not exist and can be suppressed with
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span class="command"><strong>check-spf</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>check-mx-cname</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If <span class="command"><strong>check-integrity</strong></span> is set then
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User fail, warn or ignore MX records that refer
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to CNAMES. The default is to <span class="command"><strong>warn</strong></span>.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<dt><span class="term"><span class="command"><strong>check-srv-cname</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If <span class="command"><strong>check-integrity</strong></span> is set then
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User fail, warn or ignore SRV records that refer
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to CNAMES. The default is to <span class="command"><strong>warn</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>check-sibling</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User When performing integrity checks, also check that
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User sibling glue exists. The default is <span class="command"><strong>yes</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>check-spf</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If <span class="command"><strong>check-integrity</strong></span> is set then
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User check that there is a TXT Sender Policy Framework
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews record present (starts with "v=spf1") if there is an
d3be47a4a841ca6fc07e8f18004cf72174e2d117Tinderbox User SPF record present. The default is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span class="command"><strong>warn</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>zero-no-soa-ttl</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User When returning authoritative negative responses to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User SOA queries set the TTL of the SOA record returned in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the authority section to zero.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default is <span class="command"><strong>yes</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>zero-no-soa-ttl-cache</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User When caching a negative response to a SOA query
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews set the TTL to zero.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default is <span class="command"><strong>no</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>update-check-ksk</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User When set to the default value of <code class="literal">yes</code>,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User check the KSK bit in each key to determine how the key
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User should be used when generating RRSIGs for a secure zone.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Ordinarily, zone-signing keys (that is, keys without the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User KSK bit set) are used to sign the entire zone, while
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User key-signing keys (keys with the KSK bit set) are only
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User used to sign the DNSKEY RRset at the zone apex.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User However, if this option is set to <code class="literal">no</code>,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User then the KSK bit is ignored; KSKs are treated as if they
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews were ZSKs and are used to sign the entire zone. This is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User similar to the <span class="command"><strong>dnssec-signzone -z</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User command line option.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User When this option is set to <code class="literal">yes</code>, there
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews must be at least two active keys for every algorithm
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User represented in the DNSKEY RRset: at least one KSK and one
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User ZSK per algorithm. If there is any algorithm for which
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User this requirement is not met, this option will be ignored
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User for that algorithm.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>dnssec-dnskey-kskonly</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User When this option and <span class="command"><strong>update-check-ksk</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User are both set to <code class="literal">yes</code>, only key-signing
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User keys (that is, keys with the KSK bit set) will be used
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to sign the DNSKEY RRset at the zone apex. Zone-signing
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User keys (keys without the KSK bit set) will be used to sign
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews the remainder of the zone, but not the DNSKEY RRset.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User This is similar to the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span class="command"><strong>dnssec-signzone -x</strong></span> command line option.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The default is <span class="command"><strong>no</strong></span>. If
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span class="command"><strong>update-check-ksk</strong></span> is set to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <code class="literal">no</code>, this option is ignored.
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<dt><span class="term"><span class="command"><strong>try-tcp-refresh</strong></span></span></dt>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Try to refresh the zone using TCP if UDP queries fail.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User For BIND 8 compatibility, the default is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span class="command"><strong>yes</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>dnssec-secure-to-insecure</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Allow a dynamic zone to transition from secure to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User insecure (i.e., signed to unsigned) by deleting all
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of the DNSKEY records. The default is <span class="command"><strong>no</strong></span>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If set to <span class="command"><strong>yes</strong></span>, and if the DNSKEY RRset
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews at the zone apex is deleted, all RRSIG and NSEC records
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User will be removed from the zone as well.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User If the zone uses NSEC3, then it is also necessary to
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User delete the NSEC3PARAM RRset from the zone apex; this will
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User cause the removal of all corresponding NSEC3 records.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (It is expected that this requirement will be eliminated
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User in a future release.)
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Note that if a zone has been configured with
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User <span class="command"><strong>auto-dnssec maintain</strong></span> and the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User private keys remain accessible in the key repository,
10702d681eb650391bcaa0e2704aa3cf2dbf0e98Mark Andrews then the zone will be automatically signed again the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User next time <span class="command"><strong>named</strong></span> is started.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="forwarding"></a>Forwarding</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User The forwarding facility can be used to create a large site-wide
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User cache on a few servers, reducing traffic over links to external
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews name servers. It can also be used to allow queries by servers that
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User do not have direct access to the Internet, but wish to look up
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User names anyway. Forwarding occurs only on those queries for which
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the server is not authoritative and does not have the answer in
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="variablelist"><dl class="variablelist">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>forward</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User This option is only meaningful if the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User forwarders list is not empty. A value of <code class="varname">first</code>,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User the default, causes the server to query the forwarders
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User first — and
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User if that doesn't answer the question, the server will then
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews the answer itself. If <code class="varname">only</code> is
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User specified, the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User server will only query the forwarders.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>forwarders</strong></span></span></dt>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Specifies the IP addresses to be used
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User for forwarding. The default is the empty list (no
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews forwarding).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Forwarding can also be configured on a per-domain basis, allowing
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User for the global forwarding options to be overridden in a variety
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of ways. You can set particular domains to use different
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User or have a different <span class="command"><strong>forward only/first</strong></span> behavior,
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User or not forward at all, see <a class="xref" href="Bv9ARM.ch06.html#zone_statement_grammar" title="zone Statement Grammar">the section called “<span class="command"><strong>zone</strong></span>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Statement Grammar”</a>.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="dual_stack"></a>Dual-stack Servers</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Dual-stack servers are used as servers of last resort to work
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User problems in reachability due the lack of support for either IPv4
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User on the host machine.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="variablelist"><dl class="variablelist">
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews<dt><span class="term"><span class="command"><strong>dual-stack-servers</strong></span></span></dt>
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews Specifies host names or addresses of machines with access to
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews both IPv4 and IPv6 transports. If a hostname is used, the
e9ab17d95e4288ab5ddedb7c89a9588c13c74bddMark Andrews server must be able
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User to resolve the name using only the transport it has. If the
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User machine is dual
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User stacked, then the <span class="command"><strong>dual-stack-servers</strong></span> have no effect unless
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User access to a transport has been disabled on the command line
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User (e.g. <span class="command"><strong>named -4</strong></span>).
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="titlepage"><div><div><h4 class="title">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<a name="access_control"></a>Access Control</h4></div></div></div>
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User Access to the server can be restricted based on the IP address
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User of the requesting system. See <a class="xref" href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called “Address Match Lists”</a> for
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User details on how to specify IP address lists.
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<div class="variablelist"><dl class="variablelist">
9f6827a4afb75224214ea96452e787e7f710b8b6Tinderbox User<dt><span class="term"><span class="command"><strong>allow-notify</strong></span></span></dt>
5ca309a0fb9a75162852653f881d1e6290e28c2aTinderbox User Specifies which hosts are allowed to
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater notify this server, a slave, of zone changes in addition
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews to the zone masters.
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater <span class="command"><strong>allow-notify</strong></span> may also be
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater specified in the
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater <span class="command"><strong>zone</strong></span> statement, in which case
2f60dbd3787caa91e8ab1d7ae39ea312ad5ba31fAutomatic Updater it overrides the
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span class="command"><strong>options allow-notify</strong></span>
e676a596869d8a80a644c99a848afb53d1c5975eMark Andrews statement. It is only meaningful
081a44bd3019b18aec03c5c0746538fdc901da48Evan Hunt for a slave zone. If not specified, the default is to
ac2e2800b4ac9cbe4cb756d967f4583c611eb75eMark Andrews process notify messages
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User only from a zone's master.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span class="command"><strong>allow-query</strong></span></span></dt>
200a9e7da827b67d99193bf793aea9f3e3fa1b43Tinderbox User Specifies which hosts are allowed to ask ordinary
5f76877508748558eeb2e07254b0edbcbf2f2e43Tinderbox User DNS questions. <span class="command"><strong>allow-query</strong></span> may
af9dbf1ccdd53933aaae9300d13ce0965d39b067Evan Hunt also be specified in the <span class="command"><strong>zone</strong></span>
f32d9699320a279df50fae9ff48dbadef13f619fTinderbox User statement, in which case it overrides the
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span class="command"><strong>options allow-query</strong></span> statement.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User If not specified, the default is to allow queries
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User from all hosts.
8f2c45a35dd8c40bcc9caba8f7d40ce64fc27bcdAutomatic Updater<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User <span class="command"><strong>allow-query-cache</strong></span> is now
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User used to specify access to the cache.
b886b04d8d2b085cbf3e1bf4442dee87f43ba5e4Tinderbox User<dt><span class="term"><span class="command"><strong>allow-query-on</strong></span></span></dt>
82a986aaa5d3384a541b5a7d6dae8cf0726d6513Tinderbox User Specifies which local addresses can accept ordinary
3e9c07abfd4ad76b1f8085f0f96f5646f2d9e219Tinderbox User DNS questions. This makes it possible, for instance,
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User to allow queries on internal-facing interfaces but
0eb371ca0dab50ae3462e98794a6126198c52f4bMark Andrews disallow them on external-facing ones, without
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User necessarily knowing the internal network's addresses.
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User Note that <span class="command"><strong>allow-query-on</strong></span> is only
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User checked for queries that are permitted by
16f6050f29b6b0422cee858e609f65e474e70ef2Tinderbox User <span class="command"><strong>allow-query</strong></span>. A query must be
5affecff6e148a8e124d03f5dbac0da11e30dcc5Tinderbox User allowed by both ACLs, or it will be refused.
ee11dfc481f2ef6a032a715454f6290961a722d2Tinderbox User <span class="command"><strong>allow-query-on</strong></span> may
<dt><span class="term"><span class="command"><strong>allow-query-cache-on</strong></span></span></dt>
<a class="xref" href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a> for details.
<dt><span class="term"><span class="command"><strong>allow-update-forwarding</strong></span></span></dt>
access control to attacks; see <a class="xref" href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called “Dynamic Update Security”</a>
receive zone transfers from the server. <span class="command"><strong>allow-transfer</strong></span> may
case it overrides the <span class="command"><strong>options allow-transfer</strong></span> statement.
<dt><span class="term"><span class="command"><strong>keep-response-order</strong></span></span></dt>
a response contains the names "example.com" and
(i.e., records of type NS, MX, CNAME, etc) will always
<dt><span class="term"><span class="command"><strong>resolver-query-timeout</strong></span></span></dt>
from may be specified using the <span class="command"><strong>listen-on</strong></span> option. <span class="command"><strong>listen-on</strong></span> takes
If <span class="command"><strong>address</strong></span> is <span class="command"><strong>*</strong></span> (asterisk) or is omitted,
If <span class="command"><strong>port</strong></span> is <span class="command"><strong>*</strong></span> or is omitted,
<dt><span class="term"><span class="command"><strong>queryport-pool-ports</strong></span></span></dt>
<dt><span class="term"><span class="command"><strong>queryport-pool-updateinterval</strong></span></span></dt>
<dt><span class="term"><span class="command"><strong>max-transfer-time-in</strong></span></span></dt>
<dt><span class="term"><span class="command"><strong>max-transfer-idle-in</strong></span></span></dt>
<dt><span class="term"><span class="command"><strong>max-transfer-time-out</strong></span></span></dt>
<dt><span class="term"><span class="command"><strong>max-transfer-idle-out</strong></span></span></dt>
<dt><span class="term"><span class="command"><strong>startup-notify-rate</strong></span></span></dt>
<dt><span class="term"><span class="command"><strong>transfer-message-size</strong></span></span></dt>
the load on the remote name server. <span class="command"><strong>transfers-per-ns</strong></span> may
be overridden on a per-server basis by using the <span class="command"><strong>transfers</strong></span> phrase
<dt><span class="term"><span class="command"><strong>alt-transfer-source</strong></span></span></dt>
<dt><span class="term"><span class="command"><strong>alt-transfer-source-v6</strong></span></span></dt>
<dt><span class="term"><span class="command"><strong>use-alt-transfer-source</strong></span></span></dt>
See <a class="xref" href="Bv9ARM.ch06.html#query_address" title="Query Address">the section called “Query Address”</a> about how the
to prevent <span class="command"><strong>named</strong></span> from choosing as its random source port a
of <span class="command"><strong>size_spec</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#configuration_file_elements" title="Configuration File Elements">the section called “Configuration File Elements”</a>.
(see <a class="xref" href="Bv9ARM.ch04.html#journal" title="The journal file">the section called “The journal file”</a>). When the journal file
<dt><span class="term"><span class="command"><strong>host-statistics-max</strong></span></span></dt>
<a name="clients-per-query"></a><span class="term"><a name="cpq_term"></a><span class="command"><strong>clients-per-query</strong></span>, </span><span class="term"><span class="command"><strong>max-clients-per-query</strong></span></span>
before dropping additional clients. <span class="command"><strong>named</strong></span> will attempt to
If the number of queries exceed this value, <span class="command"><strong>named</strong></span> will
<a name="fetches-per-zone"></a><span class="term"><span class="command"><strong>fetches-per-zone</strong></span></span>
<a name="fetches-per-server"></a><span class="term"><span class="command"><strong>fetches-per-server</strong></span></span>
interfaces <span class="command"><strong>named</strong></span> listens on, <span class="command"><strong>tcp-clients</strong></span> as well as
<dt><span class="term"><span class="command"><strong>statistics-interval</strong></span></span></dt>
topologically closest to itself. The <span class="command"><strong>topology</strong></span> statement
<a name="the_sortlist_statement"></a>The <span class="command"><strong>sortlist</strong></span> Statement</h4></div></div></div>
statement in <a class="xref" href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>).
does (<a class="xref" href="Bv9ARM.ch06.html#topology" title="Topology">the section called “Topology”</a>).
an IP prefix, an ACL name or a nested <span class="command"><strong>address_match_list</strong></span>)
to the behavior of the address sort in <acronym class="acronym">BIND</acronym> 4.9.x. Responses sent
<a class="xref" href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span class="command"><strong>sortlist</strong></span> Statement”</a>.
If no name is specified, the default is "<span class="command"><strong>*</strong></span>" (asterisk).
class IN type A name "host.example.com" order random;
<span class="command"><strong>max-ncache-ttl</strong></span> is <code class="literal">10800</code> seconds (3 hours).
<dt><span class="term"><span class="command"><strong>sig-validity-interval</strong></span></span></dt>
result of dynamic updates (<a class="xref" href="Bv9ARM.ch04.html#dynamic_update" title="Dynamic Update">the section called “Dynamic Update”</a>) will expire. There
<dt><span class="term"><span class="command"><strong>sig-signing-signatures</strong></span></span></dt>
a zone-signing process, i.e., whether it is still active
<span class="command"><strong>rndc signing -list <em class="replaceable"><code>zone</code></em></strong></span>.
<span class="command"><strong>rndc signing -clear <em class="replaceable"><code>keyid/algorithm</code></em> <em class="replaceable"><code>zone</code></em></strong></span>.
<span class="command"><strong>rndc signing -clear all <em class="replaceable"><code>zone</code></em></strong></span>.
<span class="term"><span class="command"><strong>min-refresh-time</strong></span>, </span><span class="term"><span class="command"><strong>max-refresh-time</strong></span>, </span><span class="term"><span class="command"><strong>min-retry-time</strong></span>, </span><span class="term"><span class="command"><strong>max-retry-time</strong></span></span>
<a class="xref" href="Bv9ARM.ch06.html#zonefile_format" title="Additional File Formats">the section called “Additional File Formats”</a>).
<a name="max-recursion-depth"></a><span class="term"><span class="command"><strong>max-recursion-depth</strong></span></span>
<a name="max-recursion-queries"></a><span class="term"><span class="command"><strong>max-recursion-queries</strong></span></span>
<dt><span class="term"><span class="command"><strong>max-rsa-exponent-size</strong></span></span></dt>
built-in view (see <a class="xref" href="Bv9ARM.ch06.html#view_statement_grammar" title="view Statement Grammar">the section called “<span class="command"><strong>view</strong></span> Statement Grammar”</a>) of
with type <span class="command"><strong>TXT</strong></span>, class <span class="command"><strong>CHAOS</strong></span>.
with type <span class="command"><strong>TXT</strong></span>, class <span class="command"><strong>CHAOS</strong></span>.
<span class="command"><strong>TXT</strong></span>, class <span class="command"><strong>CHAOS</strong></span>.
Specifying <span class="command"><strong>server-id hostname;</strong></span> will cause <span class="command"><strong>named</strong></span> to
The default <span class="command"><strong>server-id</strong></span> is <span class="command"><strong>none</strong></span>.
<dt><span class="term"><span class="command"><strong>acache-cleaning-interval</strong></span></span></dt>
name (i.e., the CNAME alias or the substituted query name
for example, even if "example.com" is specified for
returned by an "example.com" server will be accepted.
For example, if you own a domain named "example.net" and
deny-answer-aliases { "example.net"; };
network look up an IPv4 address of "attacker.example.com",
internal web server "www.example.net" and the
it will be accepted since the owner name "www.example.net"
"example.net".
IPv4 address as in IN-ADDR.ARPA.
IP6.ARPA. (Note that this representation of IPv6
address is different from IP6.ARPA where each hex
wildcard such as *.example.com.
<span class="term"><span class="command"><strong>PASSTHRU</strong></span>, </span><span class="term"><span class="command"><strong>DROP</strong></span>, </span><span class="term"><span class="command"><strong>TCP-Only</strong></span>, </span><span class="term"><span class="command"><strong>NXDOMAIN</strong></span>, </span><span class="term"><span class="command"><strong>NODATA</strong></span></span>
<pre class="programlisting"> zone "badlist" {type master; file "master/badlist"; allow-query {none;}; };</pre>
@ SOA LOCALHOST. named-mgr.example.com (1 1h 15m 30d 2h)
nxdomain.domain.com CNAME . ; NXDOMAIN policy
*.nxdomain.domain.com CNAME . ; NXDOMAIN policy
nodata.domain.com CNAME *. ; NODATA policy
*.nodata.domain.com CNAME *. ; NODATA policy
bad.domain.com A 10.0.0.1 ; redirect to a walled garden
; do not rewrite (PASSTHRU) OK.DOMAIN.COM
ok.domain.com CNAME rpz-passthru.
8.0.0.0.127.rpz-ip CNAME .
32.1.0.0.127.rpz-ip CNAME rpz-passthru.
ns.domain.com.rpz-nsdname CNAME .
48.zz.2.2001.rpz-nsip CNAME .
112.zz.2001.rpz-client-ip CNAME rpz-drop.
8.0.0.0.127.rpz-client-ip CNAME rpz-drop.
; force some DNS clients and responses in the example.com zone to TCP
16.0.0.1.10.rpz-client-ip CNAME rpz-tcp-only.
example.com CNAME rpz-tcp-only.
*.example.com CNAME rpz-tcp-only.
<span class="command"><strong>options</strong></span> or <span class="command"><strong>view</strong></span> statement.
This controls flooding using random.wild.example.com.
<span class="command"><strong>rate-limit</strong></span> statements in <span class="command"><strong>view</strong></span>
<span class="command"><strong>RateDropped</strong></span> and <span class="command"><strong>QryDropped</strong></span>
<span class="command"><strong>RateSlipped</strong></span> and <span class="command"><strong>RespTruncated</strong></span>.
<li class="listitem">Redirect zone <a class="xref" href="Bv9ARM.ch06.html#zone_statement_grammar" title="zone Statement Grammar">the section called “<span class="command"><strong>zone</strong></span>
With a redirect zone (<span class="command"><strong>zone "." { type redirect; };</strong></span>), the
<a name="server_statement_grammar"></a><span class="command"><strong>server</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span class="command"><strong>server</strong></span> <em class="replaceable"><code>ip_addr[/prefixlen]</code></em> {
[<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> request-expire <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> request-nsid <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em> ; ]</span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> query-source [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
[<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> query-source-v6 [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
[<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> queryport-pool-updateinterval <em class="replaceable"><code>number</code></em>; </span>]
<a name="server_statement_definition_and_usage"></a><span class="command"><strong>server</strong></span> Statement Definition and
value of <span class="command"><strong>bogus</strong></span> is <span class="command"><strong>no</strong></span>.
<span class="command"><strong>edns-udp-size</strong></span> in <span class="command"><strong>options</strong></span>
The server supports two zone transfer methods. The first, <span class="command"><strong>one-answer</strong></span>,
uses one DNS message per resource record transferred. <span class="command"><strong>many-answers</strong></span> packs
as many resource records as possible into a message. <span class="command"><strong>many-answers</strong></span> is
more efficient, but is only known to be understood by <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
<span class="command"><strong>key_id</strong></span> defined by the <span class="command"><strong>key</strong></span> statement,
to be used for transaction security (TSIG, <a class="xref" href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called “TSIG”</a>)
<a class="xref" href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<a name="statschannels"></a><span class="command"><strong>statistics-channels</strong></span> Statement Grammar</h3></div></div></div>
<a name="statistics_channels"></a><span class="command"><strong>statistics-channels</strong></span> Statement Definition and
<a class="link" href="http://127.0.0.1:8888/xml" target="_top">http://127.0.0.1:8888/xml</a>. A CSS file is
<a class="link" href="http://127.0.0.1:8888/xml/v2" target="_top">http://127.0.0.1:8888/xml/v2</a> for version 2
<a class="link" href="http://127.0.0.1:8888/xml/v3" target="_top">http://127.0.0.1:8888/xml/v3</a> for version 3.
<a class="link" href="http://127.0.0.1:8888/xml/v3/status" target="_top">http://127.0.0.1:8888/xml/v3/status</a>
<a class="link" href="http://127.0.0.1:8888/xml/v3/server" target="_top">http://127.0.0.1:8888/xml/v3/server</a>
<a class="link" href="http://127.0.0.1:8888/xml/v3/zones" target="_top">http://127.0.0.1:8888/xml/v3/zones</a>
<a class="link" href="http://127.0.0.1:8888/xml/v3/net" target="_top">http://127.0.0.1:8888/xml/v3/net</a>
<a class="link" href="http://127.0.0.1:8888/xml/v3/mem" target="_top">http://127.0.0.1:8888/xml/v3/mem</a>
<a class="link" href="http://127.0.0.1:8888/xml/v3/tasks" target="_top">http://127.0.0.1:8888/xml/v3/tasks</a>
<a class="link" href="http://127.0.0.1:8888/xml/v3/traffic" target="_top">http://127.0.0.1:8888/xml/v3/traffic</a>
<a class="link" href="http://127.0.0.1:8888/json/v1/status" target="_top">http://127.0.0.1:8888/json/v1/status</a>
<a class="link" href="http://127.0.0.1:8888/json/v1/server" target="_top">http://127.0.0.1:8888/json/v1/server</a>
<a class="link" href="http://127.0.0.1:8888/json/v1/zones" target="_top">http://127.0.0.1:8888/json/v1/zones</a>
<a class="link" href="http://127.0.0.1:8888/json/v1/net" target="_top">http://127.0.0.1:8888/json/v1/net</a>
<a class="link" href="http://127.0.0.1:8888/json/v1/mem" target="_top">http://127.0.0.1:8888/json/v1/mem</a>
<a class="link" href="http://127.0.0.1:8888/json/v1/tasks" target="_top">http://127.0.0.1:8888/json/v1/tasks</a>
<a class="link" href="http://127.0.0.1:8888/json/v1/traffic" target="_top">http://127.0.0.1:8888/json/v1/traffic</a>
<a name="trusted-keys"></a><span class="command"><strong>trusted-keys</strong></span> Statement Grammar</h3></div></div></div>
<em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
[<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
<a name="trusted_keys"></a><span class="command"><strong>trusted-keys</strong></span> Statement Definition
DNSSEC security roots. DNSSEC is described in <a class="xref" href="Bv9ARM.ch04.html#DNSSEC" title="DNSSEC">the section called “DNSSEC”</a>. A security root is defined when the
<a name="managed_keys"></a><span class="command"><strong>managed-keys</strong></span> Statement Grammar</h3></div></div></div>
<em class="replaceable"><code>name</code></em> initial-key <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key-data</code></em> ;
[<span class="optional"> <em class="replaceable"><code>name</code></em> initial-key <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key-data</code></em> ; [<span class="optional">...</span>]</span>]
<a name="managed-keys"></a><span class="command"><strong>managed-keys</strong></span> Statement Definition
set to <strong class="userinput"><code>auto</code></strong>, <span class="command"><strong>named</strong></span>
<a name="view_statement_grammar"></a><span class="command"><strong>view</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting"><span class="command"><strong>view</strong></span> <em class="replaceable"><code>view_name</code></em>
<a name="view_statement"></a><span class="command"><strong>view</strong></span> Statement Definition and Usage</h3></div></div></div>
<span class="command"><strong>match-clients</strong></span> and <span class="command"><strong>match-destinations</strong></span>
<span class="command"><strong>match-clients</strong></span> and <span class="command"><strong>match-destinations</strong></span>
// Provide a complete view of the example.com
zone "example.com" {
file "example-internal.db";
// Provide a restricted view of the example.com
zone "example.com" {
file "example-external.db";
<pre class="programlisting"><span class="command"><strong>zone</strong></span> <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> dnssec-loadkeys-interval <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> update-policy <em class="replaceable"><code>local</code></em> | { <em class="replaceable"><code>update_policy_rule</code></em> [<span class="optional">...</span>] }; </span>]
[<span class="optional"> also-notify [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-mx (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> check-spf ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
[<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">map</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>full</code></em> | <em class="replaceable"><code>terse</code></em> | <em class="replaceable"><code>none</code></em>; </span>]
[<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
[<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> auto-dnssec <code class="constant">allow</code>|<code class="constant">maintain</code>|<code class="constant">off</code>; </span>]
[<span class="optional"> inline-signing <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> serial-update-method <code class="constant">increment</code>|<code class="constant">unixtime</code>|<code class="constant">date</code>; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> dnssec-update-mode ( <em class="replaceable"><code>maintain</code></em> | <em class="replaceable"><code>no-resign</code></em> ); </span>]
[<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> dnssec-loadkeys-interval <em class="replaceable"><code>number</code></em>; </span>]
[<span class="optional"> dnssec-secure-to-insecure <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> also-notify [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">map</code>) ; </span>]
[<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
[<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>full</code></em> | <em class="replaceable"><code>terse</code></em> | <em class="replaceable"><code>none</code></em>; </span>]
[<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
[<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> auto-dnssec <code class="constant">allow</code>|<code class="constant">maintain</code>|<code class="constant">off</code>; </span>]
[<span class="optional"> inline-signing <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>] // Not Implemented.
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">map</code>) ; </span>]
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
[<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
[<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
[<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
[<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; </span>]
[<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>full</code></em> | <em class="replaceable"><code>terse</code></em> | <em class="replaceable"><code>none</code></em>; </span>]
[<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
[<span class="optional"> server-addresses { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> ; ... </span>] }; </span>]
[<span class="optional"> server-names { [<span class="optional"> <em class="replaceable"><code>namelist</code></em> </span>] }; </span>]
[<span class="optional"> zone-statistics <em class="replaceable"><code>full</code></em> | <em class="replaceable"><code>terse</code></em> | <em class="replaceable"><code>none</code></em>; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
[<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">dscp <em class="replaceable"><code>ip_dscp</code></em></span>] ; ... </span>] }; </span>]
[<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
zone <em class="replaceable"><code>"."</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
[<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>|<code class="constant">map</code>) ; </span>]
[<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
<a name="zone_statement"></a><span class="command"><strong>zone</strong></span> Statement Definition and Usage</h3></div></div></div>
Non recursive queries (i.e., those with the RD
commercial Spanish names (under COM.ES) one
would use wildcard entries called "*.COM.ES.".
status of infrastructure zones (e.g. COM,
See caveats in <a class="xref" href="Bv9ARM.ch06.html#root_delegation_only"><span class="command"><strong>root-delegation-only</strong></span></a>.
a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>),
in the mid-1970s. Zone data for it can be specified with the <code class="literal">CHAOS</code> class.
<span class="command"><strong>allow-notify</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span class="command"><strong>allow-query</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<span class="command"><strong>allow-query-on</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a class="xref" href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
in <a class="xref" href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
<a class="xref" href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called “Dynamic Update Policies”</a>.
<dt><span class="term"><span class="command"><strong>allow-update-forwarding</strong></span></span></dt>
in <a class="xref" href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called “Access Control”</a>.
network. The default varies according to zone type. For <span class="command"><strong>master</strong></span> zones the default is <span class="command"><strong>fail</strong></span>. For <span class="command"><strong>slave</strong></span>
<span class="command"><strong>check-mx</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span class="command"><strong>check-spf</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span class="command"><strong>check-wildcard</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span class="command"><strong>check-integrity</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span class="command"><strong>check-sibling</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span class="command"><strong>zero-no-soa-ttl</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span class="command"><strong>update-check-ksk</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<dt><span class="term"><span class="command"><strong>dnssec-loadkeys-interval</strong></span></span></dt>
<span class="command"><strong>dnssec-loadkeys-interval</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#options" title="options Statement Definition and Usage">the section called “<span class="command"><strong>options</strong></span> Statement Definition and
<span class="command"><strong>dnssec-update-mode</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#options" title="options Statement Definition and Usage">the section called “<span class="command"><strong>options</strong></span> Statement Definition and
<dt><span class="term"><span class="command"><strong>dnssec-dnskey-kskonly</strong></span></span></dt>
<span class="command"><strong>dnssec-dnskey-kskonly</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span class="command"><strong>try-tcp-refresh</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span class="command"><strong>dialup</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
See caveats in <a class="xref" href="Bv9ARM.ch06.html#root_delegation_only"><span class="command"><strong>root-delegation-only</strong></span></a>.
after trying the forwarders and getting no answer, while <span class="command"><strong>first</strong></span> would
This is applicable to <span class="command"><strong>master</strong></span> and <span class="command"><strong>slave</strong></span> zones.
<span class="command"><strong>max-journal-size</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#server_resource_limits" title="Server Resource Limits">the section called “Server Resource Limits”</a>.
<dt><span class="term"><span class="command"><strong>max-transfer-time-in</strong></span></span></dt>
<span class="command"><strong>max-transfer-time-in</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span class="command"><strong>max-transfer-idle-in</strong></span></span></dt>
<span class="command"><strong>max-transfer-idle-in</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span class="command"><strong>max-transfer-time-out</strong></span></span></dt>
<span class="command"><strong>max-transfer-time-out</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span class="command"><strong>max-transfer-idle-out</strong></span></span></dt>
<span class="command"><strong>max-transfer-idle-out</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span class="command"><strong>notify</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span class="command"><strong>notify-delay</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
zones when they are loaded from disk. <acronym class="acronym">BIND</acronym> 9 does not verify signatures
<a class="xref" href="Bv9ARM.ch06.html#options" title="options Statement Definition and Usage">the section called “<span class="command"><strong>options</strong></span> Statement Definition and
For example, if "example.com" is configured as a
example.com. A 192.0.2.1
"www.example.com" with the RD bit on, the server
That is, when "example.net" is the origin of a
static-stub zone, "ns.example" and
"master.example.com" can be specified in the
"ns.example.net" cannot, and will be rejected by
For example, if "example.com" is configured as a
static-stub zone with "ns1.example.net" and
"www.example.com" with the RD bit on, the server
"ns2.example.net" to IP addresses, and then send
<dt><span class="term"><span class="command"><strong>sig-validity-interval</strong></span></span></dt>
<span class="command"><strong>sig-validity-interval</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span class="command"><strong>sig-signing-nodes</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span class="command"><strong>sig-signing-signatures</strong></span></span></dt>
<span class="command"><strong>sig-signing-signatures</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span class="command"><strong>sig-signing-type</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<span class="command"><strong>transfer-source</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span class="command"><strong>transfer-source-v6</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span class="command"><strong>alt-transfer-source</strong></span></span></dt>
<span class="command"><strong>alt-transfer-source</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span class="command"><strong>alt-transfer-source-v6</strong></span></span></dt>
<span class="command"><strong>alt-transfer-source-v6</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<dt><span class="term"><span class="command"><strong>use-alt-transfer-source</strong></span></span></dt>
<span class="command"><strong>use-alt-transfer-source</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span class="command"><strong>notify-source</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span class="command"><strong>notify-source-v6</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.
<span class="term"><span class="command"><strong>min-refresh-time</strong></span>, </span><span class="term"><span class="command"><strong>max-refresh-time</strong></span>, </span><span class="term"><span class="command"><strong>min-retry-time</strong></span>, </span><span class="term"><span class="command"><strong>max-retry-time</strong></span></span>
See the description in <a class="xref" href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
<dt><span class="term"><span class="command"><strong>ixfr-from-differences</strong></span></span></dt>
<span class="command"><strong>ixfr-from-differences</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
<span class="command"><strong>key-directory</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#options" title="options Statement Definition and Usage">the section called “<span class="command"><strong>options</strong></span> Statement Definition and
<a class="xref" href="Bv9ARM.ch06.html#options" title="options Statement Definition and Usage">the section called “<span class="command"><strong>options</strong></span> Statement Definition and
<dt><span class="term"><span class="command"><strong>serial-update-method</strong></span></span></dt>
<a class="xref" href="Bv9ARM.ch06.html#options" title="options Statement Definition and Usage">the section called “<span class="command"><strong>options</strong></span> Statement Definition and
<a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
in <a class="xref" href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called “Tuning”</a>.
in <a class="xref" href="Bv9ARM.ch06.html#options" title="options Statement Definition and Usage">the section called “<span class="command"><strong>options</strong></span> Statement Definition and
<dt><span class="term"><span class="command"><strong>dnssec-secure-to-insecure</strong></span></span></dt>
<span class="command"><strong>dnssec-secure-to-insecure</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.
( <span class="command"><strong>grant</strong></span> | <span class="command"><strong>deny</strong></span> ) <em class="replaceable"><code>identity</code></em> <em class="replaceable"><code>nametype</code></em> [<span class="optional"> <em class="replaceable"><code>name</code></em> </span>] [<span class="optional"> <em class="replaceable"><code>types</code></em> </span>]
and converts it machine.realm allowing the machine
to update machine.realm. The REALM to be matched
converts it to machine.realm allowing the machine
to update subdomains of machine.realm. The REALM
and converts it machine.realm allowing the machine
to update machine.realm. The REALM to be matched
converts it to machine.realm allowing the machine
to update subdomains of machine.realm. The REALM
zone example.com {
file "example-external.db";
zone example.com {
Zone level acls (e.g. allow-query, allow-transfer) and
<a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div>
that a particular nearby server be tried first. See <a class="xref" href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called “The <span class="command"><strong>sortlist</strong></span> Statement”</a> and <a class="xref" href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called “RRset Ordering”</a>.
built-in server information zones, e.g.,
any order), and if neither of those succeed, delivery to <code class="literal">mail.backup.org</code> will
and PTR records. Entries in the in-addr.arpa domain are made in
in-addr.arpa name of
3.2.1.10.in-addr.arpa. This name should have a PTR resource record
Master File Directives include <span class="command"><strong>$ORIGIN</strong></span>, <span class="command"><strong>$INCLUDE</strong></span>,
<a name="atsign"></a>The <span class="command"><strong>@</strong></span> (at-sign)</h4></div></div></div>
<a name="origin_directive"></a>The <span class="command"><strong>$ORIGIN</strong></span> Directive</h4></div></div></div>
$ORIGIN example.com.
<a name="include_directive"></a>The <span class="command"><strong>$INCLUDE</strong></span> Directive</h4></div></div></div>
if it were included into the file at this point. If <span class="command"><strong>origin</strong></span> is
revert to the values they had prior to the <span class="command"><strong>$INCLUDE</strong></span> once
<a name="ttl_directive"></a>The <span class="command"><strong>$TTL</strong></span> Directive</h4></div></div></div>
<a name="generate_directive"></a><acronym class="acronym">BIND</acronym> Master File Extension: the <span class="command"><strong>$GENERATE</strong></span> Directive</h3></div></div></div>
Classless IN-ADDR.ARPA delegation.
HOST-1.EXAMPLE. MX 0 .
HOST-2.EXAMPLE. A 1.2.3.2
HOST-2.EXAMPLE. MX 0 .
HOST-3.EXAMPLE. A 1.2.3.3
HOST-3.EXAMPLE. MX 0 .
HOST-127.EXAMPLE. A 1.2.3.127
HOST-127.EXAMPLE. MX 0 .
(<span class="command"><strong>n</strong></span> or <span class="command"><strong>N</strong></span>\
The <span class="command"><strong>$GENERATE</strong></span> directive is a <acronym class="acronym">BIND</acronym> extension
<strong class="userinput"><code>full</code></strong> (or <strong class="userinput"><code>yes</code></strong>
<span class="command"><strong>zone-statistics</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#options" title="options Statement Definition and Usage">the section called “<span class="command"><strong>options</strong></span> Statement Definition and
(see <a class="xref" href="Bv9ARM.ch06.html#statschannels" title="statistics-channels Statement Grammar">the section called “<span class="command"><strong>statistics-channels</strong></span> Statement Grammar”</a>.)
<a class="xref" href="Bv9ARM.ch06.html#clients-per-query"><span class="command"><strong>clients-per-query</strong></span></a>.)
<a name="bind8_compatibility"></a>Compatibility with <span class="emphasis"><em>BIND</em></span> 8 Counters</h4></div></div></div>
<td width="40%" align="left" valign="top">Chapter�5.�The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver�</td>