<programlisting>

<command>options</command> {

<command>acache-cleaning-interval</command> <replaceable>integer</replaceable>;

<command>acache-enable</command> <replaceable>boolean</replaceable>;

<command>additional-from-auth</command> <replaceable>boolean</replaceable>;

<command>additional-from-cache</command> <replaceable>boolean</replaceable>;

<command>allow-new-zones</command> <replaceable>boolean</replaceable>;

<command>allow-notify</command> { <replaceable>address_match_element</replaceable>; ... };

<command>allow-query</command> { <replaceable>address_match_element</replaceable>; ... };

<command>allow-query-cache</command> { <replaceable>address_match_element</replaceable>; ... };

<command>allow-query-cache-on</command> { <replaceable>address_match_element</replaceable>; ... };

<command>allow-query-on</command> { <replaceable>address_match_element</replaceable>; ... };

<command>allow-recursion</command> { <replaceable>address_match_element</replaceable>; ... };

<command>allow-recursion-on</command> { <replaceable>address_match_element</replaceable>; ... };

<command>allow-transfer</command> { <replaceable>address_match_element</replaceable>; ... };

<command>allow-update</command> { <replaceable>address_match_element</replaceable>; ... };

<command>allow-update-forwarding</command> { <replaceable>address_match_element</replaceable>; ... };

<command>also-notify</command> [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> |

<replaceable>ipv4_address</replaceable> [ port <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port

<replaceable>integer</replaceable> ] ) [ key <replaceable>string</replaceable> ]; ... };

<command>alt-transfer-source</command> ( <replaceable>ipv4_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * )

] [ dscp <replaceable>integer</replaceable> ];

<command>alt-transfer-source-v6</command> ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> |

* ) ] [ dscp <replaceable>integer</replaceable> ];

<command>attach-cache</command> <replaceable>string</replaceable>;

<command>auth-nxdomain</command> <replaceable>boolean</replaceable>; // default changed

<command>auto-dnssec</command> ( allow | maintain | off );

<command>automatic-interface-scan</command> <replaceable>boolean</replaceable>;

<command>avoid-v4-udp-ports</command> { <replaceable>portrange</replaceable>; ... };

<command>avoid-v6-udp-ports</command> { <replaceable>portrange</replaceable>; ... };

<command>bindkeys-file</command> <replaceable>quoted_string</replaceable>;

<command>blackhole</command> { <replaceable>address_match_element</replaceable>; ... };

<command>cache-file</command> <replaceable>quoted_string</replaceable>;

<command>catalog-zones</command> { zone <replaceable>quoted_string</replaceable> [ default-masters [ port

<replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [

<command>port</command> <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key

<replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [

<command>in-memory</command> <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>integer</replaceable> ]; ... };

<command>check-dup-records</command> ( fail | warn | ignore );

<command>check-integrity</command> <replaceable>boolean</replaceable>;

<command>check-mx</command> ( fail | warn | ignore );

<command>check-mx-cname</command> ( fail | warn | ignore );

<command>check-names</command> ( master | slave | response

) ( fail | warn | ignore );

<command>check-sibling</command> <replaceable>boolean</replaceable>;

<command>check-spf</command> ( warn | ignore );

<command>check-srv-cname</command> ( fail | warn | ignore );

<command>check-wildcard</command> <replaceable>boolean</replaceable>;

<command>cleaning-interval</command> <replaceable>integer</replaceable>;

<command>clients-per-query</command> <replaceable>integer</replaceable>;

<command>cookie-algorithm</command> ( aes | sha1 | sha256 );

<command>cookie-secret</command> <replaceable>string</replaceable>;

<command>coresize</command> ( default | unlimited | <replaceable>sizeval</replaceable> );

<command>datasize</command> ( default | unlimited | <replaceable>sizeval</replaceable> );

<command>deny-answer-addresses</command> { <replaceable>address_match_element</replaceable>; ... } [

<command>except-from</command> { <replaceable>quoted_string</replaceable>; ... } ];

<command>deny-answer-aliases</command> { <replaceable>quoted_string</replaceable>; ... } [ except-from {

<replaceable>quoted_string</replaceable>; ... } ];

<command>dialup</command> ( notify | notify-passive | passive | refresh | <replaceable>boolean</replaceable> );

<command>directory</command> <replaceable>quoted_string</replaceable>;

<command>disable-algorithms</command> <replaceable>string</replaceable> { <replaceable>string</replaceable>;

... };

<command>disable-ds-digests</command> <replaceable>string</replaceable> { <replaceable>string</replaceable>;

... };

<command>disable-empty-zone</command> <replaceable>string</replaceable>;

<command>dns64</command> <replaceable>netprefix</replaceable> {

<command>break-dnssec</command> <replaceable>boolean</replaceable>;

<command>clients</command> { <replaceable>address_match_element</replaceable>; ... };

<command>exclude</command> { <replaceable>address_match_element</replaceable>; ... };

<command>mapped</command> { <replaceable>address_match_element</replaceable>; ... };

<command>recursive-only</command> <replaceable>boolean</replaceable>;

<command>suffix</command> <replaceable>ipv6_address</replaceable>;

};

<command>dns64-contact</command> <replaceable>string</replaceable>;

<command>dns64-server</command> <replaceable>string</replaceable>;

<command>dnssec-accept-expired</command> <replaceable>boolean</replaceable>;

<command>dnssec-dnskey-kskonly</command> <replaceable>boolean</replaceable>;

<command>dnssec-enable</command> <replaceable>boolean</replaceable>;

<command>dnssec-loadkeys-interval</command> <replaceable>integer</replaceable>;

<command>dnssec-lookaside</command> ( <replaceable>string</replaceable> trust-anchor

<replaceable>string</replaceable> | auto | no );

<command>dnssec-must-be-secure</command> <replaceable>string</replaceable> <replaceable>boolean</replaceable>;

<command>dnssec-secure-to-insecure</command> <replaceable>boolean</replaceable>;

<command>dnssec-update-mode</command> ( maintain | no-resign );

<command>dnssec-validation</command> ( yes | no | auto );

<command>dnstap</command> { ( all | auth | client | forwarder |

<command>resolver</command> ) [ ( query | response ) ]; ... };

<command>dnstap-identity</command> ( <replaceable>quoted_string</replaceable> | none |

<command>hostname</command> );

<command>dnstap-output</command> ( file | unix ) <replaceable>quoted_string</replaceable>;

<command>dnstap-version</command> ( <replaceable>quoted_string</replaceable> | none );

<command>dscp</command> <replaceable>integer</replaceable>;

<command>dual-stack-servers</command> [ port <replaceable>integer</replaceable> ] { ( <replaceable>quoted_string</replaceable> [ port

<replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] | <replaceable>ipv4_address</replaceable> [ port

<replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port

<replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] ); ... };

<command>dump-file</command> <replaceable>quoted_string</replaceable>;

<command>edns-udp-size</command> <replaceable>integer</replaceable>;

<command>empty-contact</command> <replaceable>string</replaceable>;

<command>empty-server</command> <replaceable>string</replaceable>;

<command>empty-zones-enable</command> <replaceable>boolean</replaceable>;

<command>fetch-quota-params</command> <replaceable>integer</replaceable> <replaceable>fixedpoint</replaceable> <replaceable>fixedpoint</replaceable> <replaceable>fixedpoint</replaceable>;

<command>fetches-per-server</command> <replaceable>integer</replaceable> [ ( drop | fail ) ];

<command>fetches-per-zone</command> <replaceable>integer</replaceable> [ ( drop | fail ) ];

<command>files</command> ( default | unlimited | <replaceable>sizeval</replaceable> );

<command>filter-aaaa</command> { <replaceable>address_match_element</replaceable>; ... };

<command>filter-aaaa-on-v4</command> ( break-dnssec | <replaceable>boolean</replaceable> );

<command>filter-aaaa-on-v6</command> ( break-dnssec | <replaceable>boolean</replaceable> );

<command>flush-zones-on-shutdown</command> <replaceable>boolean</replaceable>;

<command>forward</command> ( first | only );

<command>forwarders</command> [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>ipv4_address</replaceable>

| <replaceable>ipv6_address</replaceable> ) [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ]; ... };

<command>fstrm-set-buffer-hint</command> <replaceable>integer</replaceable>;

<command>fstrm-set-flush-timeout</command> <replaceable>integer</replaceable>;

<command>fstrm-set-input-queue-size</command> <replaceable>integer</replaceable>;

<command>fstrm-set-output-notify-threshold</command> <replaceable>integer</replaceable>;

<command>fstrm-set-output-queue-model</command> ( mpsc | spsc );

<command>fstrm-set-output-queue-size</command> <replaceable>integer</replaceable>;

<command>fstrm-set-reopen-interval</command> <replaceable>integer</replaceable>;

<command>geoip-directory</command> ( <replaceable>quoted_string</replaceable> | none );

<command>geoip-use-ecs</command> <replaceable>boolean</replaceable>;

<command>heartbeat-interval</command> <replaceable>integer</replaceable>;

<command>hostname</command> ( <replaceable>quoted_string</replaceable> | none );

<command>inline-signing</command> <replaceable>boolean</replaceable>;

<command>interface-interval</command> <replaceable>integer</replaceable>;

<command>ixfr-from-differences</command> ( master | slave | <replaceable>boolean</replaceable> );

<command>keep-response-order</command> { <replaceable>address_match_element</replaceable>; ... };

<command>key-directory</command> <replaceable>quoted_string</replaceable>;

<command>lame-ttl</command> <replaceable>ttlval</replaceable>;

<command>listen-on</command> [ port <replaceable>integer</replaceable> ] [ dscp

<replaceable>integer</replaceable> ] {

<replaceable>address_match_element</replaceable>; ... };

<command>listen-on-v6</command> [ port <replaceable>integer</replaceable> ] [ dscp

<replaceable>integer</replaceable> ] {

<replaceable>address_match_element</replaceable>; ... };

<command>lmdb-mapsize</command> <replaceable>sizeval</replaceable>;

<command>lock-file</command> ( <replaceable>quoted_string</replaceable> | none );

<command>managed-keys-directory</command> <replaceable>quoted_string</replaceable>;

<command>masterfile-format</command> ( map | raw | text );

<command>masterfile-style</command> ( full | relative );

<command>match-mapped-addresses</command> <replaceable>boolean</replaceable>;

<command>max-acache-size</command> ( unlimited | <replaceable>sizeval</replaceable> );

<command>max-cache-size</command> ( default | unlimited | <replaceable>sizeval</replaceable> | <replaceable>percentage</replaceable> );

<command>max-cache-ttl</command> <replaceable>integer</replaceable>;

<command>max-clients-per-query</command> <replaceable>integer</replaceable>;

<command>max-journal-size</command> ( unlimited | <replaceable>sizeval</replaceable> );

<command>max-ncache-ttl</command> <replaceable>integer</replaceable>;

<command>max-records</command> <replaceable>integer</replaceable>;

<command>max-recursion-depth</command> <replaceable>integer</replaceable>;

<command>max-recursion-queries</command> <replaceable>integer</replaceable>;

<command>max-refresh-time</command> <replaceable>integer</replaceable>;

<command>max-retry-time</command> <replaceable>integer</replaceable>;

<command>max-rsa-exponent-size</command> <replaceable>integer</replaceable>;

<command>max-transfer-idle-in</command> <replaceable>integer</replaceable>;

<command>max-transfer-idle-out</command> <replaceable>integer</replaceable>;

<command>max-transfer-time-in</command> <replaceable>integer</replaceable>;

<command>max-transfer-time-out</command> <replaceable>integer</replaceable>;

<command>max-udp-size</command> <replaceable>integer</replaceable>;

<command>max-zone-ttl</command> ( unlimited | <replaceable>ttlval</replaceable> );

<command>memstatistics</command> <replaceable>boolean</replaceable>;

<command>memstatistics-file</command> <replaceable>quoted_string</replaceable>;

<command>message-compression</command> <replaceable>boolean</replaceable>;

<command>min-refresh-time</command> <replaceable>integer</replaceable>;

<command>min-retry-time</command> <replaceable>integer</replaceable>;

<command>minimal-any</command> <replaceable>boolean</replaceable>;

<command>minimal-responses</command> ( no-auth | no-auth-recursive | <replaceable>boolean</replaceable> );

<command>multi-master</command> <replaceable>boolean</replaceable>;

<command>no-case-compress</command> { <replaceable>address_match_element</replaceable>; ... };

<command>nocookie-udp-size</command> <replaceable>integer</replaceable>;

<command>notify</command> ( explicit | master-only | <replaceable>boolean</replaceable> );

<command>notify-delay</command> <replaceable>integer</replaceable>;

<command>notify-rate</command> <replaceable>integer</replaceable>;

<command>notify-source</command> ( <replaceable>ipv4_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [

<command>dscp</command> <replaceable>integer</replaceable> ];

<command>notify-source-v6</command> ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ]

[ dscp <replaceable>integer</replaceable> ];

<command>notify-to-soa</command> <replaceable>boolean</replaceable>;

<command>nta-lifetime</command> <replaceable>ttlval</replaceable>;

<command>nta-recheck</command> <replaceable>ttlval</replaceable>;

<command>nxdomain-redirect</command> <replaceable>string</replaceable>;

<command>pid-file</command> ( <replaceable>quoted_string</replaceable> | none );

<command>port</command> <replaceable>integer</replaceable>;

<command>preferred-glue</command> <replaceable>string</replaceable>;

<command>prefetch</command> <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];

<command>provide-ixfr</command> <replaceable>boolean</replaceable>;

<command>query-source</command> ( ( [ address ] ( <replaceable>ipv4_address</replaceable> | * ) [ port (

<replaceable>integer</replaceable> | * ) ] ) | ( [ [ address ] ( <replaceable>ipv4_address</replaceable> | * ) ]

<command>port</command> ( <replaceable>integer</replaceable> | * ) ) ) [ dscp <replaceable>integer</replaceable> ];

<command>query-source-v6</command> ( ( [ address ] ( <replaceable>ipv6_address</replaceable> | * ) [ port (

<replaceable>integer</replaceable> | * ) ] ) | ( [ [ address ] ( <replaceable>ipv6_address</replaceable> | * ) ]

<command>port</command> ( <replaceable>integer</replaceable> | * ) ) ) [ dscp <replaceable>integer</replaceable> ];

<command>querylog</command> <replaceable>boolean</replaceable>;

<command>random-device</command> <replaceable>quoted_string</replaceable>;

<command>rate-limit</command> {

<command>all-per-second</command> <replaceable>integer</replaceable>;

<command>errors-per-second</command> <replaceable>integer</replaceable>;

<command>exempt-clients</command> { <replaceable>address_match_element</replaceable>; ... };

<command>ipv4-prefix-length</command> <replaceable>integer</replaceable>;

<command>ipv6-prefix-length</command> <replaceable>integer</replaceable>;

<command>log-only</command> <replaceable>boolean</replaceable>;

<command>max-table-size</command> <replaceable>integer</replaceable>;

<command>min-table-size</command> <replaceable>integer</replaceable>;

<command>nodata-per-second</command> <replaceable>integer</replaceable>;

<command>nxdomains-per-second</command> <replaceable>integer</replaceable>;

<command>qps-scale</command> <replaceable>integer</replaceable>;

<command>referrals-per-second</command> <replaceable>integer</replaceable>;

<command>responses-per-second</command> <replaceable>integer</replaceable>;

<command>slip</command> <replaceable>integer</replaceable>;

<command>window</command> <replaceable>integer</replaceable>;

};

<command>recursing-file</command> <replaceable>quoted_string</replaceable>;

<command>recursion</command> <replaceable>boolean</replaceable>;

<command>recursive-clients</command> <replaceable>integer</replaceable>;

<command>request-expire</command> <replaceable>boolean</replaceable>;

<command>request-ixfr</command> <replaceable>boolean</replaceable>;

<command>request-nsid</command> <replaceable>boolean</replaceable>;

<command>require-server-cookie</command> <replaceable>boolean</replaceable>;

<command>reserved-sockets</command> <replaceable>integer</replaceable>;

<command>resolver-query-timeout</command> <replaceable>integer</replaceable>;

<command>response-policy</command> { zone <replaceable>quoted_string</replaceable> [ log <replaceable>boolean</replaceable> ] [

<command>max-policy-ttl</command> <replaceable>integer</replaceable> ] [ policy ( cname | disabled | drop |

<command>given</command> | no-op | nodata | nxdomain | passthru | tcp-only

<replaceable>quoted_string</replaceable> ) ] [ recursive-only <replaceable>boolean</replaceable> ]; ... } [

<command>break-dnssec</command> <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>integer</replaceable> ] [

<command>min-ns-dots</command> <replaceable>integer</replaceable> ] [ nsip-wait-recurse <replaceable>boolean</replaceable> ] [

<command>qname-wait-recurse</command> <replaceable>boolean</replaceable> ] [ recursive-only <replaceable>boolean</replaceable> ];

<command>root-delegation-only</command> [ exclude { <replaceable>quoted_string</replaceable>; ... } ];

<command>rrset-order</command> { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name

<replaceable>quoted_string</replaceable> ] <replaceable>string</replaceable> <replaceable>string</replaceable>; ... };

<command>secroots-file</command> <replaceable>quoted_string</replaceable>;

<command>send-cookie</command> <replaceable>boolean</replaceable>;

<command>serial-query-rate</command> <replaceable>integer</replaceable>;

<command>serial-update-method</command> ( date | increment | unixtime );

<command>server-id</command> ( <replaceable>quoted_string</replaceable> | none | hostname );

<command>servfail-ttl</command> <replaceable>ttlval</replaceable>;

<command>session-keyalg</command> <replaceable>string</replaceable>;

<command>session-keyfile</command> ( <replaceable>quoted_string</replaceable> | none );

<command>session-keyname</command> <replaceable>string</replaceable>;

<command>sig-signing-nodes</command> <replaceable>integer</replaceable>;

<command>sig-signing-signatures</command> <replaceable>integer</replaceable>;

<command>sig-signing-type</command> <replaceable>integer</replaceable>;

<command>sig-validity-interval</command> <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];

<command>sortlist</command> { <replaceable>address_match_element</replaceable>; ... };

<command>stacksize</command> ( default | unlimited | <replaceable>sizeval</replaceable> );

<command>startup-notify-rate</command> <replaceable>integer</replaceable>;

<command>statistics-file</command> <replaceable>quoted_string</replaceable>;

<command>tcp-clients</command> <replaceable>integer</replaceable>;

<command>tcp-listen-queue</command> <replaceable>integer</replaceable>;

<command>tkey-dhkey</command> <replaceable>quoted_string</replaceable> <replaceable>integer</replaceable>;

<command>tkey-domain</command> <replaceable>quoted_string</replaceable>;

<command>tkey-gssapi-credential</command> <replaceable>quoted_string</replaceable>;

<command>tkey-gssapi-keytab</command> <replaceable>quoted_string</replaceable>;

<command>transfer-format</command> ( many-answers | one-answer );

<command>transfer-message-size</command> <replaceable>integer</replaceable>;

<command>transfer-source</command> ( <replaceable>ipv4_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [

<command>dscp</command> <replaceable>integer</replaceable> ];

<command>transfer-source-v6</command> ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * )

] [ dscp <replaceable>integer</replaceable> ];

<command>transfers-in</command> <replaceable>integer</replaceable>;

<command>transfers-out</command> <replaceable>integer</replaceable>;

<command>transfers-per-ns</command> <replaceable>integer</replaceable>;

<command>trust-anchor-telemetry</command> <replaceable>boolean</replaceable>; // experimental

<command>try-tcp-refresh</command> <replaceable>boolean</replaceable>;

<command>update-check-ksk</command> <replaceable>boolean</replaceable>;

<command>use-alt-transfer-source</command> <replaceable>boolean</replaceable>;

<command>use-v4-udp-ports</command> { <replaceable>portrange</replaceable>; ... };

<command>use-v6-udp-ports</command> { <replaceable>portrange</replaceable>; ... };

<command>v6-bias</command> <replaceable>integer</replaceable>;

<command>version</command> ( <replaceable>quoted_string</replaceable> | none );

<command>zero-no-soa-ttl</command> <replaceable>boolean</replaceable>;

<command>zero-no-soa-ttl-cache</command> <replaceable>boolean</replaceable>;

<command>zone-statistics</command> ( full | terse | none | <replaceable>boolean</replaceable> );

};

</programlisting>