<programlisting>

<command>zone</command> <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {

<command>type</command> ( master | primary );

<command>allow-query</command> { <replaceable>address_match_element</replaceable>; ... };

<command>allow-query-on</command> { <replaceable>address_match_element</replaceable>; ... };

<command>allow-transfer</command> { <replaceable>address_match_element</replaceable>; ... };

<command>allow-update</command> { <replaceable>address_match_element</replaceable>; ... };

<command>also-notify</command> [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key <replaceable>string</replaceable> ]; ... };

<command>alt-transfer-source</command> ( <replaceable>ipv4_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];

<command>alt-transfer-source-v6</command> ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];

<command>auto-dnssec</command> ( allow | maintain | off );

<command>check-dup-records</command> ( fail | warn | ignore );

<command>check-integrity</command> <replaceable>boolean</replaceable>;

<command>check-mx</command> ( fail | warn | ignore );

<command>check-mx-cname</command> ( fail | warn | ignore );

<command>check-names</command> ( fail | warn | ignore );

<command>check-sibling</command> <replaceable>boolean</replaceable>;

<command>check-spf</command> ( warn | ignore );

<command>check-srv-cname</command> ( fail | warn | ignore );

<command>check-wildcard</command> <replaceable>boolean</replaceable>;

<command>database</command> <replaceable>string</replaceable>;

<command>dialup</command> ( notify | notify-passive | passive | refresh | <replaceable>boolean</replaceable> );

<command>dlz</command> <replaceable>string</replaceable>;

<command>dnssec-dnskey-kskonly</command> <replaceable>boolean</replaceable>;

<command>dnssec-loadkeys-interval</command> <replaceable>integer</replaceable>;

<command>dnssec-secure-to-insecure</command> <replaceable>boolean</replaceable>;

<command>dnssec-update-mode</command> ( maintain | no-resign );

<command>file</command> <replaceable>quoted_string</replaceable>;

<command>forward</command> ( first | only );

<command>forwarders</command> [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ]; ... };

<command>inline-signing</command> <replaceable>boolean</replaceable>;

<command>ixfr-from-differences</command> <replaceable>boolean</replaceable>;

<command>journal</command> <replaceable>quoted_string</replaceable>;

<command>key-directory</command> <replaceable>quoted_string</replaceable>;

<command>masterfile-format</command> ( map | raw | text );

<command>masterfile-style</command> ( full | relative );

<command>max-journal-size</command> ( unlimited | <replaceable>sizeval</replaceable> );

<command>max-records</command> <replaceable>integer</replaceable>;

<command>max-transfer-idle-out</command> <replaceable>integer</replaceable>;

<command>max-transfer-time-out</command> <replaceable>integer</replaceable>;

<command>max-zone-ttl</command> ( unlimited | <replaceable>ttlval</replaceable> );

<command>notify</command> ( explicit | master-only | <replaceable>boolean</replaceable> );

<command>notify-delay</command> <replaceable>integer</replaceable>;

<command>notify-source</command> ( <replaceable>ipv4_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];

<command>notify-source-v6</command> ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];

<command>notify-to-soa</command> <replaceable>boolean</replaceable>;

<command>serial-update-method</command> ( date | increment | unixtime );

<command>sig-signing-nodes</command> <replaceable>integer</replaceable>;

<command>sig-signing-signatures</command> <replaceable>integer</replaceable>;

<command>sig-signing-type</command> <replaceable>integer</replaceable>;

<command>sig-validity-interval</command> <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];

<command>update-check-ksk</command> <replaceable>boolean</replaceable>;

<command>update-policy</command> ( local | { ( deny | grant ) <replaceable>string</replaceable> ( 6to4-self | external | krb5-self | krb5-subdomain | ms-self | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };

<command>zero-no-soa-ttl</command> <replaceable>boolean</replaceable>;

<command>zone-statistics</command> ( full | terse | none | <replaceable>boolean</replaceable> );

};

</programlisting>