PageRenderTime 105ms CodeModel.GetById 21ms RepoModel.GetById 0ms app.codeStats 1ms

/contrib/bind9/doc/arm/Bv9ARM.ch06.html

https://bitbucket.org/freebsd/freebsd-head/
HTML | 10075 lines | 10019 code | 39 blank | 17 comment | 0 complexity | 23bebf82675bbeb8b00207a8416d590f MD5 | raw file
Possible License(s): MPL-2.0-no-copyleft-exception, BSD-3-Clause, LGPL-2.0, LGPL-2.1, BSD-2-Clause, 0BSD, JSON, AGPL-1.0, GPL-2.0 
    

  1. <!--
    2. 

  2.  - Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC")
    3. 

  3.  - Copyright (C) 2000-2003 Internet Software Consortium.
    4. 

  4.  - 
    5. 

  5.  - Permission to use, copy, modify, and/or distribute this software for any
    6. 

  6.  - purpose with or without fee is hereby granted, provided that the above
    7. 

  7.  - copyright notice and this permission notice appear in all copies.
    8. 

  8.  - 
    9. 

  9.  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
    10. 

  10.  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
    11. 

  11.  - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
    12. 

  12.  - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
    13. 

  13.  - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
    14. 

  14.  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
    15. 

  15.  - PERFORMANCE OF THIS SOFTWARE.
    16. 

  16. -->
    17. 

  17. <!-- $Id$ -->
    18. 

  18. <html>
    19. 

  19. <head>
    20. 

  20. <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
    21. 

  21. <title>Chapter 6. BIND 9 Configuration Reference</title>
    22. 

  22. <meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
    23. 

  23. <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
    24. 

  24. <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
    25. 

  25. <link rel="prev" href="Bv9ARM.ch05.html" title="Chapter 5. The BIND 9 Lightweight Resolver">
    26. 

  26. <link rel="next" href="Bv9ARM.ch07.html" title="Chapter 7. BIND 9 Security Considerations">
    27. 

  27. </head>
    28. 

  28. <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
    29. 

  29. <div class="navheader">
    30. 

  30. <table width="100%" summary="Navigation header">
    31. 

  31. <tr><th colspan="3" align="center">Chapter 6. <acronym class="acronym">BIND</acronym> 9 Configuration Reference</th></tr>
    32. 

  32. <tr>
    33. 

  33. <td width="20%" align="left">
    34. 

  34. <a accesskey="p" href="Bv9ARM.ch05.html">Prev</a> </td>
    35. 

  35. <th width="60%" align="center"> </th>
    36. 

  36. <td width="20%" align="right"> <a accesskey="n" href="Bv9ARM.ch07.html">Next</a>
    37. 

  37. </td>
    38. 

  38. </tr>
    39. 

  39. </table>
    40. 

  40. <hr>
    41. 

  41. </div>
    42. 

  42. <div class="chapter" lang="en">
    43. 

  43. <div class="titlepage"><div><div><h2 class="title">
    44. 

  44. <a name="Bv9ARM.ch06"></a>Chapter 6. <acronym class="acronym">BIND</acronym> 9 Configuration Reference</h2></div></div></div>
    45. 

  45. <div class="toc">
    46. 

  46. <p><b>Table of Contents</b></p>
    47. 

  47. <dl>
    48. 

  48. <dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt>
    49. 

  49. <dd><dl>
    50. 

  50. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt>
    51. 

  51. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574332">Comment Syntax</a></span></dt>
    52. 

  52. </dl></dd>
    53. 

  53. <dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt>
    54. 

  54. <dd><dl>
    55. 

  55. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574986"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
    56. 

  56. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and
    57. 

  57.           Usage</a></span></dt>
    58. 

  58. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575176"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
    59. 

  59. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and
    60. 

  60.           Usage</a></span></dt>
    61. 

  61. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575467"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
    62. 

  62. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575484"><span><strong class="command">include</strong></span> Statement Definition and
    63. 

  63.           Usage</a></span></dt>
    64. 

  64. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575576"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
    65. 

  65. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575600"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
    66. 

  66. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575758"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
    67. 

  67. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575884"><span><strong class="command">logging</strong></span> Statement Definition and
    68. 

  68.           Usage</a></span></dt>
    69. 

  69. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577910"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
    70. 

  70. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577984"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
    71. 

  71. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578116"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
    72. 

  72. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578160"><span><strong class="command">masters</strong></span> Statement Definition and
    73. 

  73.           Usage</a></span></dt>
    74. 

  74. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578174"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
    75. 

  75. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and
    76. 

  76.           Usage</a></span></dt>
    77. 

  77. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt>
    78. 

  78. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and
    79. 

  79.             Usage</a></span></dt>
    80. 

  80. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#statschannels"><span><strong class="command">statistics-channels</strong></span> Statement Grammar</a></span></dt>
    81. 

  81. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2589481"><span><strong class="command">statistics-channels</strong></span> Statement Definition and
    82. 

  82.             Usage</a></span></dt>
    83. 

  83. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#trusted-keys"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
    84. 

  84. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2589689"><span><strong class="command">trusted-keys</strong></span> Statement Definition
    85. 

  85.             and Usage</a></span></dt>
    86. 

  86. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2589736"><span><strong class="command">managed-keys</strong></span> Statement Grammar</a></span></dt>
    87. 

  87. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#managed-keys"><span><strong class="command">managed-keys</strong></span> Statement Definition
    88. 

  88.             and Usage</a></span></dt>
    89. 

  89. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt>
    90. 

  90. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590162"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
    91. 

  91. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span>
    92. 

  92.             Statement Grammar</a></span></dt>
    93. 

  93. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591713"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
    94. 

  94. </dl></dd>
    95. 

  95. <dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2595116">Zone File</a></span></dt>
    96. 

  96. <dd><dl>
    97. 

  97. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt>
    98. 

  98. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2597415">Discussion of MX Records</a></span></dt>
    99. 

  99. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt>
    100. 

  100. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2597962">Inverse Mapping in IPv4</a></span></dt>
    101. 

  101. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2598157">Other Zone File Directives</a></span></dt>
    102. 

  102. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2598430"><acronym class="acronym">BIND</acronym> Master File Extension: the  <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
    103. 

  103. <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt>
    104. 

  104. </dl></dd>
    105. 

  105. <dt><span class="sect1"><a href="Bv9ARM.ch06.html#statistics">BIND9 Statistics</a></span></dt>
    106. 

  106. <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch06.html#statistics_counters">Statistics Counters</a></span></dt></dl></dd>
    107. 

  107. </dl>
    108. 

  108. </div>
    109. 

  109. <p>
    110. 

  110.       <acronym class="acronym">BIND</acronym> 9 configuration is broadly similar
    111. 

  111.       to <acronym class="acronym">BIND</acronym> 8; however, there are a few new
    112. 

  112.       areas
    113. 

  113.       of configuration, such as views. <acronym class="acronym">BIND</acronym>
    114. 

  114.       8 configuration files should work with few alterations in <acronym class="acronym">BIND</acronym>
    115. 

  115.       9, although more complex configurations should be reviewed to check
    116. 

  116.       if they can be more efficiently implemented using the new features
    117. 

  117.       found in <acronym class="acronym">BIND</acronym> 9.
    118. 

  118.     </p>
    119. 

  119. <p>
    120. 

  120.       <acronym class="acronym">BIND</acronym> 4 configuration files can be
    121. 

  121.       converted to the new format
    122. 

  122.       using the shell script
    123. 

  123.       <code class="filename">contrib/named-bootconf/named-bootconf.sh</code>.
    124. 

  124.     </p>
    125. 

  125. <div class="sect1" lang="en">
    126. 

  126. <div class="titlepage"><div><div><h2 class="title" style="clear: both">
    127. 

  127. <a name="configuration_file_elements"></a>Configuration File Elements</h2></div></div></div>
    128. 

  128. <p>
    129. 

  129.         Following is a list of elements used throughout the <acronym class="acronym">BIND</acronym> configuration
    130. 

  130.         file documentation:
    131. 

  131.       </p>
    132. 

  132. <div class="informaltable"><table border="1">
    133. 

  133. <colgroup>
    134. 

  134. <col>
    135. 

  135. <col>
    136. 

  136. </colgroup>
    137. 

  137. <tbody>
    138. 

  138. <tr>
    139. 

  139. <td>
    140. 

  140.                 <p>
    141. 

  141.                   <code class="varname">acl_name</code>
    142. 

  142.                 </p>
    143. 

  143.               </td>
    144. 

  144. <td>
    145. 

  145.                 <p>
    146. 

  146.                   The name of an <code class="varname">address_match_list</code> as
    147. 

  147.                   defined by the <span><strong class="command">acl</strong></span> statement.
    148. 

  148.                 </p>
    149. 

  149.               </td>
    150. 

  150. </tr>
    151. 

  151. <tr>
    152. 

  152. <td>
    153. 

  153.                 <p>
    154. 

  154.                   <code class="varname">address_match_list</code>
    155. 

  155.                 </p>
    156. 

  156.               </td>
    157. 

  157. <td>
    158. 

  158.                 <p>
    159. 

  159.                   A list of one or more
    160. 

  160.                   <code class="varname">ip_addr</code>,
    161. 

  161.                   <code class="varname">ip_prefix</code>, <code class="varname">key_id</code>,
    162. 

  162.                   or <code class="varname">acl_name</code> elements, see
    163. 

  163.                   <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called &#8220;Address Match Lists&#8221;</a>.
    164. 

  164.                 </p>
    165. 

  165.               </td>
    166. 

  166. </tr>
    167. 

  167. <tr>
    168. 

  168. <td>
    169. 

  169.                 <p>
    170. 

  170.                   <code class="varname">masters_list</code>
    171. 

  171.                 </p>
    172. 

  172.               </td>
    173. 

  173. <td>
    174. 

  174.                 <p>
    175. 

  175.                   A named list of one or more <code class="varname">ip_addr</code>
    176. 

  176.                   with optional <code class="varname">key_id</code> and/or
    177. 

  177.                   <code class="varname">ip_port</code>.
    178. 

  178.                   A <code class="varname">masters_list</code> may include other
    179. 

  179.                   <code class="varname">masters_lists</code>.
    180. 

  180.                 </p>
    181. 

  181.               </td>
    182. 

  182. </tr>
    183. 

  183. <tr>
    184. 

  184. <td>
    185. 

  185.                 <p>
    186. 

  186.                   <code class="varname">domain_name</code>
    187. 

  187.                 </p>
    188. 

  188.               </td>
    189. 

  189. <td>
    190. 

  190.                 <p>
    191. 

  191.                   A quoted string which will be used as
    192. 

  192.                   a DNS name, for example "<code class="literal">my.test.domain</code>".
    193. 

  193.                 </p>
    194. 

  194.               </td>
    195. 

  195. </tr>
    196. 

  196. <tr>
    197. 

  197. <td>
    198. 

  198.                 <p>
    199. 

  199.                   <code class="varname">namelist</code>
    200. 

  200.                 </p>
    201. 

  201.               </td>
    202. 

  202. <td>
    203. 

  203.                 <p>
    204. 

  204.                   A list of one or more <code class="varname">domain_name</code>
    205. 

  205.                   elements.
    206. 

  206.                 </p>
    207. 

  207.               </td>
    208. 

  208. </tr>
    209. 

  209. <tr>
    210. 

  210. <td>
    211. 

  211.                 <p>
    212. 

  212.                   <code class="varname">dotted_decimal</code>
    213. 

  213.                 </p>
    214. 

  214.               </td>
    215. 

  215. <td>
    216. 

  216.                 <p>
    217. 

  217.                   One to four integers valued 0 through
    218. 

  218.                   255 separated by dots (`.'), such as <span><strong class="command">123</strong></span>,
    219. 

  219.                   <span><strong class="command">45.67</strong></span> or <span><strong class="command">89.123.45.67</strong></span>.
    220. 

  220.                 </p>
    221. 

  221.               </td>
    222. 

  222. </tr>
    223. 

  223. <tr>
    224. 

  224. <td>
    225. 

  225.                 <p>
    226. 

  226.                   <code class="varname">ip4_addr</code>
    227. 

  227.                 </p>
    228. 

  228.               </td>
    229. 

  229. <td>
    230. 

  230.                 <p>
    231. 

  231.                   An IPv4 address with exactly four elements
    232. 

  232.                   in <code class="varname">dotted_decimal</code> notation.
    233. 

  233.                 </p>
    234. 

  234.               </td>
    235. 

  235. </tr>
    236. 

  236. <tr>
    237. 

  237. <td>
    238. 

  238.                 <p>
    239. 

  239.                   <code class="varname">ip6_addr</code>
    240. 

  240.                 </p>
    241. 

  241.               </td>
    242. 

  242. <td>
    243. 

  243.                 <p>
    244. 

  244.                   An IPv6 address, such as <span><strong class="command">2001:db8::1234</strong></span>.
    245. 

  245.                   IPv6 scoped addresses that have ambiguity on their
    246. 

  246.                   scope zones must be disambiguated by an appropriate
    247. 

  247.                   zone ID with the percent character (`%') as
    248. 

  248.                   delimiter.  It is strongly recommended to use
    249. 

  249.                   string zone names rather than numeric identifiers,
    250. 

  250.                   in order to be robust against system configuration
    251. 

  251.                   changes.  However, since there is no standard
    252. 

  252.                   mapping for such names and identifier values,
    253. 

  253.                   currently only interface names as link identifiers
    254. 

  254.                   are supported, assuming one-to-one mapping between
    255. 

  255.                   interfaces and links.  For example, a link-local
    256. 

  256.                   address <span><strong class="command">fe80::1</strong></span> on the link
    257. 

  257.                   attached to the interface <span><strong class="command">ne0</strong></span>
    258. 

  258.                   can be specified as <span><strong class="command">fe80::1%ne0</strong></span>.
    259. 

  259.                   Note that on most systems link-local addresses
    260. 

  260.                   always have the ambiguity, and need to be
    261. 

  261.                   disambiguated.
    262. 

  262.                 </p>
    263. 

  263.               </td>
    264. 

  264. </tr>
    265. 

  265. <tr>
    266. 

  266. <td>
    267. 

  267.                 <p>
    268. 

  268.                   <code class="varname">ip_addr</code>
    269. 

  269.                 </p>
    270. 

  270.               </td>
    271. 

  271. <td>
    272. 

  272.                 <p>
    273. 

  273.                   An <code class="varname">ip4_addr</code> or <code class="varname">ip6_addr</code>.
    274. 

  274.                 </p>
    275. 

  275.               </td>
    276. 

  276. </tr>
    277. 

  277. <tr>
    278. 

  278. <td>
    279. 

  279.                 <p>
    280. 

  280.                   <code class="varname">ip_port</code>
    281. 

  281.                 </p>
    282. 

  282.               </td>
    283. 

  283. <td>
    284. 

  284.                 <p>
    285. 

  285.                   An IP port <code class="varname">number</code>.
    286. 

  286.                   The <code class="varname">number</code> is limited to 0
    287. 

  287.                   through 65535, with values
    288. 

  288.                   below 1024 typically restricted to use by processes running
    289. 

  289.                   as root.
    290. 

  290.                   In some cases, an asterisk (`*') character can be used as a
    291. 

  291.                   placeholder to
    292. 

  292.                   select a random high-numbered port.
    293. 

  293.                 </p>
    294. 

  294.               </td>
    295. 

  295. </tr>
    296. 

  296. <tr>
    297. 

  297. <td>
    298. 

  298.                 <p>
    299. 

  299.                   <code class="varname">ip_prefix</code>
    300. 

  300.                 </p>
    301. 

  301.               </td>
    302. 

  302. <td>
    303. 

  303.                 <p>
    304. 

  304.                   An IP network specified as an <code class="varname">ip_addr</code>,
    305. 

  305.                   followed by a slash (`/') and then the number of bits in the
    306. 

  306.                   netmask.
    307. 

  307.                   Trailing zeros in a <code class="varname">ip_addr</code>
    308. 

  308.                   may omitted.
    309. 

  309.                   For example, <span><strong class="command">127/8</strong></span> is the
    310. 

  310.                   network <span><strong class="command">127.0.0.0</strong></span> with
    311. 

  311.                   netmask <span><strong class="command">255.0.0.0</strong></span> and <span><strong class="command">1.2.3.0/28</strong></span> is
    312. 

  312.                   network <span><strong class="command">1.2.3.0</strong></span> with netmask <span><strong class="command">255.255.255.240</strong></span>.
    313. 

  313.                 </p>
    314. 

  314.                 <p>
    315. 

  315.                   When specifying a prefix involving a IPv6 scoped address
    316. 

  316.                   the scope may be omitted.  In that case the prefix will
    317. 

  317.                   match packets from any scope.
    318. 

  318.                 </p>
    319. 

  319.               </td>
    320. 

  320. </tr>
    321. 

  321. <tr>
    322. 

  322. <td>
    323. 

  323.                 <p>
    324. 

  324.                   <code class="varname">key_id</code>
    325. 

  325.                 </p>
    326. 

  326.               </td>
    327. 

  327. <td>
    328. 

  328.                 <p>
    329. 

  329.                   A <code class="varname">domain_name</code> representing
    330. 

  330.                   the name of a shared key, to be used for transaction
    331. 

  331.                   security.
    332. 

  332.                 </p>
    333. 

  333.               </td>
    334. 

  334. </tr>
    335. 

  335. <tr>
    336. 

  336. <td>
    337. 

  337.                 <p>
    338. 

  338.                   <code class="varname">key_list</code>
    339. 

  339.                 </p>
    340. 

  340.               </td>
    341. 

  341. <td>
    342. 

  342.                 <p>
    343. 

  343.                   A list of one or more
    344. 

  344.                   <code class="varname">key_id</code>s,
    345. 

  345.                   separated by semicolons and ending with a semicolon.
    346. 

  346.                 </p>
    347. 

  347.               </td>
    348. 

  348. </tr>
    349. 

  349. <tr>
    350. 

  350. <td>
    351. 

  351.                 <p>
    352. 

  352.                   <code class="varname">number</code>
    353. 

  353.                 </p>
    354. 

  354.               </td>
    355. 

  355. <td>
    356. 

  356.                 <p>
    357. 

  357.                   A non-negative 32-bit integer
    358. 

  358.                   (i.e., a number between 0 and 4294967295, inclusive).
    359. 

  359.                   Its acceptable value might further
    360. 

  360.                   be limited by the context in which it is used.
    361. 

  361.                 </p>
    362. 

  362.               </td>
    363. 

  363. </tr>
    364. 

  364. <tr>
    365. 

  365. <td>
    366. 

  366.                 <p>
    367. 

  367.                   <code class="varname">path_name</code>
    368. 

  368.                 </p>
    369. 

  369.               </td>
    370. 

  370. <td>
    371. 

  371.                 <p>
    372. 

  372.                   A quoted string which will be used as
    373. 

  373.                   a pathname, such as <code class="filename">zones/master/my.test.domain</code>.
    374. 

  374.                 </p>
    375. 

  375.               </td>
    376. 

  376. </tr>
    377. 

  377. <tr>
    378. 

  378. <td>
    379. 

  379.                 <p>
    380. 

  380.                   <code class="varname">port_list</code>
    381. 

  381.                 </p>
    382. 

  382.               </td>
    383. 

  383. <td>
    384. 

  384.                 <p>
    385. 

  385.                   A list of an <code class="varname">ip_port</code> or a port
    386. 

  386.                   range.
    387. 

  387.                   A port range is specified in the form of
    388. 

  388.                   <strong class="userinput"><code>range</code></strong> followed by
    389. 

  389.                   two <code class="varname">ip_port</code>s,
    390. 

  390.                   <code class="varname">port_low</code> and
    391. 

  391.                   <code class="varname">port_high</code>, which represents
    392. 

  392.                   port numbers from <code class="varname">port_low</code> through
    393. 

  393.                   <code class="varname">port_high</code>, inclusive.
    394. 

  394.                   <code class="varname">port_low</code> must not be larger than
    395. 

  395.                   <code class="varname">port_high</code>.
    396. 

  396.                   For example,
    397. 

  397.                   <strong class="userinput"><code>range 1024 65535</code></strong> represents
    398. 

  398.                   ports from 1024 through 65535.
    399. 

  399.                   In either case an asterisk (`*') character is not
    400. 

  400.                   allowed as a valid <code class="varname">ip_port</code>.
    401. 

  401.                 </p>
    402. 

  402.               </td>
    403. 

  403. </tr>
    404. 

  404. <tr>
    405. 

  405. <td>
    406. 

  406.                 <p>
    407. 

  407.                   <code class="varname">size_spec</code>
    408. 

  408.                 </p>
    409. 

  409.               </td>
    410. 

  410. <td>
    411. 

  411.                 <p>
    412. 

  412.                   A number, the word <strong class="userinput"><code>unlimited</code></strong>,
    413. 

  413.                   or the word <strong class="userinput"><code>default</code></strong>.
    414. 

  414.                 </p>
    415. 

  415.                 <p>
    416. 

  416.                   An <code class="varname">unlimited</code> <code class="varname">size_spec</code> requests unlimited
    417. 

  417.                   use, or the maximum available amount. A <code class="varname">default size_spec</code> uses
    418. 

  418.                   the limit that was in force when the server was started.
    419. 

  419.                 </p>
    420. 

  420.                 <p>
    421. 

  421.                   A <code class="varname">number</code> can optionally be
    422. 

  422.                   followed by a scaling factor:
    423. 

  423.                   <strong class="userinput"><code>K</code></strong> or <strong class="userinput"><code>k</code></strong>
    424. 

  424.                   for kilobytes,
    425. 

  425.                   <strong class="userinput"><code>M</code></strong> or <strong class="userinput"><code>m</code></strong>
    426. 

  426.                   for megabytes, and
    427. 

  427.                   <strong class="userinput"><code>G</code></strong> or <strong class="userinput"><code>g</code></strong> for gigabytes,
    428. 

  428.                   which scale by 1024, 1024*1024, and 1024*1024*1024
    429. 

  429.                   respectively.
    430. 

  430.                 </p>
    431. 

  431.                 <p>
    432. 

  432.                   The value must be representable as a 64-bit unsigned integer
    433. 

  433.                   (0 to 18446744073709551615, inclusive).
    434. 

  434.                   Using <code class="varname">unlimited</code> is the best
    435. 

  435.                   way
    436. 

  436.                   to safely set a really large number.
    437. 

  437.                 </p>
    438. 

  438.               </td>
    439. 

  439. </tr>
    440. 

  440. <tr>
    441. 

  441. <td>
    442. 

  442.                 <p>
    443. 

  443.                   <code class="varname">yes_or_no</code>
    444. 

  444.                 </p>
    445. 

  445.               </td>
    446. 

  446. <td>
    447. 

  447.                 <p>
    448. 

  448.                   Either <strong class="userinput"><code>yes</code></strong> or <strong class="userinput"><code>no</code></strong>.
    449. 

  449.                   The words <strong class="userinput"><code>true</code></strong> and <strong class="userinput"><code>false</code></strong> are
    450. 

  450.                   also accepted, as are the numbers <strong class="userinput"><code>1</code></strong>
    451. 

  451.                   and <strong class="userinput"><code>0</code></strong>.
    452. 

  452.                 </p>
    453. 

  453.               </td>
    454. 

  454. </tr>
    455. 

  455. <tr>
    456. 

  456. <td>
    457. 

  457.                 <p>
    458. 

  458.                   <code class="varname">dialup_option</code>
    459. 

  459.                 </p>
    460. 

  460.               </td>
    461. 

  461. <td>
    462. 

  462.                 <p>
    463. 

  463.                   One of <strong class="userinput"><code>yes</code></strong>,
    464. 

  464.                   <strong class="userinput"><code>no</code></strong>, <strong class="userinput"><code>notify</code></strong>,
    465. 

  465.                   <strong class="userinput"><code>notify-passive</code></strong>, <strong class="userinput"><code>refresh</code></strong> or
    466. 

  466.                   <strong class="userinput"><code>passive</code></strong>.
    467. 

  467.                   When used in a zone, <strong class="userinput"><code>notify-passive</code></strong>,
    468. 

  468.                   <strong class="userinput"><code>refresh</code></strong>, and <strong class="userinput"><code>passive</code></strong>
    469. 

  469.                   are restricted to slave and stub zones.
    470. 

  470.                 </p>
    471. 

  471.               </td>
    472. 

  472. </tr>
    473. 

  473. </tbody>
    474. 

  474. </table></div>
    475. 

  475. <div class="sect2" lang="en">
    476. 

  476. <div class="titlepage"><div><div><h3 class="title">
    477. 

  477. <a name="address_match_lists"></a>Address Match Lists</h3></div></div></div>
    478. 

  478. <div class="sect3" lang="en">
    479. 

  479. <div class="titlepage"><div><div><h4 class="title">
    480. 

  480. <a name="id2574099"></a>Syntax</h4></div></div></div>
    481. 

  481. <pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ;
    482. 

  482.   [<span class="optional"> address_match_list_element; ... </span>]
    483. 

  483. <code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] |
    484. 

  484.    key key_id | acl_name | { address_match_list } )
    485. 

  485. </pre>
    486. 

  486. </div>
    487. 

  487. <div class="sect3" lang="en">
    488. 

  488. <div class="titlepage"><div><div><h4 class="title">
    489. 

  489. <a name="id2574126"></a>Definition and Usage</h4></div></div></div>
    490. 

  490. <p>
    491. 

  491.             Address match lists are primarily used to determine access
    492. 

  492.             control for various server operations. They are also used in
    493. 

  493.             the <span><strong class="command">listen-on</strong></span> and <span><strong class="command">sortlist</strong></span>
    494. 

  494.             statements. The elements which constitute an address match
    495. 

  495.             list can be any of the following:
    496. 

  496.           </p>
    497. 

  497. <div class="itemizedlist"><ul type="disc">
    498. 

  498. <li>an IP address (IPv4 or IPv6)</li>
    499. 

  499. <li>an IP prefix (in `/' notation)</li>
    500. 

  500. <li>
    501. 

  501.                 a key ID, as defined by the <span><strong class="command">key</strong></span>
    502. 

  502.                 statement
    503. 

  503.               </li>
    504. 

  504. <li>the name of an address match list defined with
    505. 

  505.                 the <span><strong class="command">acl</strong></span> statement
    506. 

  506.               </li>
    507. 

  507. <li>a nested address match list enclosed in braces</li>
    508. 

  508. </ul></div>
    509. 

  509. <p>
    510. 

  510.             Elements can be negated with a leading exclamation mark (`!'),
    511. 

  511.             and the match list names "any", "none", "localhost", and
    512. 

  512.             "localnets" are predefined. More information on those names
    513. 

  513.             can be found in the description of the acl statement.
    514. 

  514.           </p>
    515. 

  515. <p>
    516. 

  516.             The addition of the key clause made the name of this syntactic
    517. 

  517.             element something of a misnomer, since security keys can be used
    518. 

  518.             to validate access without regard to a host or network address.
    519. 

  519.             Nonetheless, the term "address match list" is still used
    520. 

  520.             throughout the documentation.
    521. 

  521.           </p>
    522. 

  522. <p>
    523. 

  523.             When a given IP address or prefix is compared to an address
    524. 

  524.             match list, the comparison takes place in approximately O(1)
    525. 

  525.             time.  However, key comparisons require that the list of keys
    526. 

  526.             be traversed until a matching key is found, and therefore may
    527. 

  527.             be somewhat slower.
    528. 

  528.           </p>
    529. 

  529. <p>
    530. 

  530.             The interpretation of a match depends on whether the list is being
    531. 

  531.             used for access control, defining <span><strong class="command">listen-on</strong></span> ports, or in a
    532. 

  532.             <span><strong class="command">sortlist</strong></span>, and whether the element was negated.
    533. 

  533.           </p>
    534. 

  534. <p>
    535. 

  535.             When used as an access control list, a non-negated match
    536. 

  536.             allows access and a negated match denies access. If
    537. 

  537.             there is no match, access is denied. The clauses
    538. 

  538.             <span><strong class="command">allow-notify</strong></span>,
    539. 

  539.             <span><strong class="command">allow-recursion</strong></span>,
    540. 

  540.             <span><strong class="command">allow-recursion-on</strong></span>,
    541. 

  541.             <span><strong class="command">allow-query</strong></span>,
    542. 

  542.             <span><strong class="command">allow-query-on</strong></span>,
    543. 

  543.             <span><strong class="command">allow-query-cache</strong></span>,
    544. 

  544.             <span><strong class="command">allow-query-cache-on</strong></span>,
    545. 

  545.             <span><strong class="command">allow-transfer</strong></span>,
    546. 

  546.             <span><strong class="command">allow-update</strong></span>,
    547. 

  547.             <span><strong class="command">allow-update-forwarding</strong></span>, and
    548. 

  548.             <span><strong class="command">blackhole</strong></span> all use address match
    549. 

  549.             lists.  Similarly, the <span><strong class="command">listen-on</strong></span> option will cause the
    550. 

  550.             server to refuse queries on any of the machine's
    551. 

  551.             addresses which do not match the list.
    552. 

  552.           </p>
    553. 

  553. <p>
    554. 

  554.             Order of insertion is significant.  If more than one element
    555. 

  555.             in an ACL is found to match a given IP address or prefix,
    556. 

  556.             preference will be given to the one that came
    557. 

  557.             <span class="emphasis"><em>first</em></span> in the ACL definition.
    558. 

  558.             Because of this first-match behavior, an element that
    559. 

  559.             defines a subset of another element in the list should
    560. 

  560.             come before the broader element, regardless of whether
    561. 

  561.             either is negated. For example, in
    562. 

  562.             <span><strong class="command">1.2.3/24; ! 1.2.3.13;</strong></span>
    563. 

  563.             the 1.2.3.13 element is completely useless because the
    564. 

  564.             algorithm will match any lookup for 1.2.3.13 to the 1.2.3/24
    565. 

  565.             element.  Using <span><strong class="command">! 1.2.3.13; 1.2.3/24</strong></span> fixes
    566. 

  566.             that problem by having 1.2.3.13 blocked by the negation, but
    567. 

  567.             all other 1.2.3.* hosts fall through.
    568. 

  568.           </p>
    569. 

  569. </div>
    570. 

  570. </div>
    571. 

  571. <div class="sect2" lang="en">
    572. 

  572. <div class="titlepage"><div><div><h3 class="title">
    573. 

  573. <a name="id2574332"></a>Comment Syntax</h3></div></div></div>
    574. 

  574. <p>
    575. 

  575.           The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for
    576. 

  576.           comments to appear
    577. 

  577.           anywhere that whitespace may appear in a <acronym class="acronym">BIND</acronym> configuration
    578. 

  578.           file. To appeal to programmers of all kinds, they can be written
    579. 

  579.           in the C, C++, or shell/perl style.
    580. 

  580.         </p>
    581. 

  581. <div class="sect3" lang="en">
    582. 

  582. <div class="titlepage"><div><div><h4 class="title">
    583. 

  583. <a name="id2574347"></a>Syntax</h4></div></div></div>
    584. 

  584. <p>
    585. 

  585.             </p>
    586. 

  586. <pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre>
    587. 

  587. <p>
    588. 

  588.             </p>
    589. 

  589. <pre class="programlisting">// This is a <acronym class="acronym">BIND</acronym> comment as in C++</pre>
    590. 

  590. <p>
    591. 

  591.             </p>
    592. 

  592. <pre class="programlisting"># This is a <acronym class="acronym">BIND</acronym> comment as in common UNIX shells
    593. 

  593. # and perl</pre>
    594. 

  594. <p>
    595. 

  595.           </p>
    596. 

  596. </div>
    597. 

  597. <div class="sect3" lang="en">
    598. 

  598. <div class="titlepage"><div><div><h4 class="title">
    599. 

  599. <a name="id2574377"></a>Definition and Usage</h4></div></div></div>
    600. 

  600. <p>
    601. 

  601.             Comments may appear anywhere that whitespace may appear in
    602. 

  602.             a <acronym class="acronym">BIND</acronym> configuration file.
    603. 

  603.           </p>
    604. 

  604. <p>
    605. 

  605.             C-style comments start with the two characters /* (slash,
    606. 

  606.             star) and end with */ (star, slash). Because they are completely
    607. 

  607.             delimited with these characters, they can be used to comment only
    608. 

  608.             a portion of a line or to span multiple lines.
    609. 

  609.           </p>
    610. 

  610. <p>
    611. 

  611.             C-style comments cannot be nested. For example, the following
    612. 

  612.             is not valid because the entire comment ends with the first */:
    613. 

  613.           </p>
    614. 

  614. <p>
    615. 

    616. 

  616. </p>
    617. 

  617. <pre class="programlisting">/* This is the start of a comment.
    618. 

  618.    This is still part of the comment.
    619. 

  619. /* This is an incorrect attempt at nesting a comment. */
    620. 

  620.    This is no longer in any comment. */
    621. 

  621. </pre>
    622. 

  622. <p>
    623. 

    624. 

  624.           </p>
    625. 

  625. <p>
    626. 

  626.             C++-style comments start with the two characters // (slash,
    627. 

  627.             slash) and continue to the end of the physical line. They cannot
    628. 

  628.             be continued across multiple physical lines; to have one logical
    629. 

  629.             comment span multiple lines, each line must use the // pair.
    630. 

  630.             For example:
    631. 

  631.           </p>
    632. 

  632. <p>
    633. 

    634. 

  634. </p>
    635. 

  635. <pre class="programlisting">// This is the start of a comment.  The next line
    636. 

  636. // is a new comment, even though it is logically
    637. 

  637. // part of the previous comment.
    638. 

  638. </pre>
    639. 

  639. <p>
    640. 

    641. 

  641.           </p>
    642. 

  642. <p>
    643. 

  643.             Shell-style (or perl-style, if you prefer) comments start
    644. 

  644.             with the character <code class="literal">#</code> (number sign)
    645. 

  645.             and continue to the end of the
    646. 

  646.             physical line, as in C++ comments.
    647. 

  647.             For example:
    648. 

  648.           </p>
    649. 

  649. <p>
    650. 

    651. 

  651. </p>
    652. 

  652. <pre class="programlisting"># This is the start of a comment.  The next line
    653. 

  653. # is a new comment, even though it is logically
    654. 

  654. # part of the previous comment.
    655. 

  655. </pre>
    656. 

  656. <p>
    657. 

    658. 

  658.           </p>
    659. 

  659. <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
    660. 

  660. <h3 class="title">Warning</h3>
    661. 

  661. <p>
    662. 

  662.               You cannot use the semicolon (`;') character
    663. 

  663.               to start a comment such as you would in a zone file. The
    664. 

  664.               semicolon indicates the end of a configuration
    665. 

  665.               statement.
    666. 

  666.             </p>
    667. 

  667. </div>
    668. 

  668. </div>
    669. 

  669. </div>
    670. 

  670. </div>
    671. 

  671. <div class="sect1" lang="en">
    672. 

  672. <div class="titlepage"><div><div><h2 class="title" style="clear: both">
    673. 

  673. <a name="Configuration_File_Grammar"></a>Configuration File Grammar</h2></div></div></div>
    674. 

  674. <p>
    675. 

  675.         A <acronym class="acronym">BIND</acronym> 9 configuration consists of
    676. 

  676.         statements and comments.
    677. 

  677.         Statements end with a semicolon. Statements and comments are the
    678. 

  678.         only elements that can appear without enclosing braces. Many
    679. 

  679.         statements contain a block of sub-statements, which are also
    680. 

  680.         terminated with a semicolon.
    681. 

  681.       </p>
    682. 

  682. <p>
    683. 

  683.         The following statements are supported:
    684. 

  684.       </p>
    685. 

  685. <div class="informaltable"><table border="1">
    686. 

  686. <colgroup>
    687. 

  687. <col>
    688. 

  688. <col>
    689. 

  689. </colgroup>
    690. 

  690. <tbody>
    691. 

  691. <tr>
    692. 

  692. <td>
    693. 

  693.                 <p><span><strong class="command">acl</strong></span></p>
    694. 

  694.               </td>
    695. 

  695. <td>
    696. 

  696.                 <p>
    697. 

  697.                   defines a named IP address
    698. 

  698.                   matching list, for access control and other uses.
    699. 

  699.                 </p>
    700. 

  700.               </td>
    701. 

  701. </tr>
    702. 

  702. <tr>
    703. 

  703. <td>
    704. 

  704.                 <p><span><strong class="command">controls</strong></span></p>
    705. 

  705.               </td>
    706. 

  706. <td>
    707. 

  707.                 <p>
    708. 

  708.                   declares control channels to be used
    709. 

  709.                   by the <span><strong class="command">rndc</strong></span> utility.
    710. 

  710.                 </p>
    711. 

  711.               </td>
    712. 

  712. </tr>
    713. 

  713. <tr>
    714. 

  714. <td>
    715. 

  715.                 <p><span><strong class="command">include</strong></span></p>
    716. 

  716.               </td>
    717. 

  717. <td>
    718. 

  718.                 <p>
    719. 

  719.                   includes a file.
    720. 

  720.                 </p>
    721. 

  721.               </td>
    722. 

  722. </tr>
    723. 

  723. <tr>
    724. 

  724. <td>
    725. 

  725.                 <p><span><strong class="command">key</strong></span></p>
    726. 

  726.               </td>
    727. 

  727. <td>
    728. 

  728.                 <p>
    729. 

  729.                   specifies key information for use in
    730. 

  730.                   authentication and authorization using TSIG.
    731. 

  731.                 </p>
    732. 

  732.               </td>
    733. 

  733. </tr>
    734. 

  734. <tr>
    735. 

  735. <td>
    736. 

  736.                 <p><span><strong class="command">logging</strong></span></p>
    737. 

  737.               </td>
    738. 

  738. <td>
    739. 

  739.                 <p>
    740. 

  740.                   specifies what the server logs, and where
    741. 

  741.                   the log messages are sent.
    742. 

  742.                 </p>
    743. 

  743.               </td>
    744. 

  744. </tr>
    745. 

  745. <tr>
    746. 

  746. <td>
    747. 

  747.                 <p><span><strong class="command">lwres</strong></span></p>
    748. 

  748.               </td>
    749. 

  749. <td>
    750. 

  750.                 <p>
    751. 

  751.                   configures <span><strong class="command">named</strong></span> to
    752. 

  752.                   also act as a light-weight resolver daemon (<span><strong class="command">lwresd</strong></span>).
    753. 

  753.                 </p>
    754. 

  754.               </td>
    755. 

  755. </tr>
    756. 

  756. <tr>
    757. 

  757. <td>
    758. 

  758.                 <p><span><strong class="command">masters</strong></span></p>
    759. 

  759.               </td>
    760. 

  760. <td>
    761. 

  761.                 <p>
    762. 

  762.                   defines a named masters list for
    763. 

  763.                   inclusion in stub and slave zone masters clauses.
    764. 

  764.                 </p>
    765. 

  765.               </td>
    766. 

  766. </tr>
    767. 

  767. <tr>
    768. 

  768. <td>
    769. 

  769.                 <p><span><strong class="command">options</strong></span></p>
    770. 

  770.               </td>
    771. 

  771. <td>
    772. 

  772.                 <p>
    773. 

  773.                   controls global server configuration
    774. 

  774.                   options and sets defaults for other statements.
    775. 

  775.                 </p>
    776. 

  776.               </td>
    777. 

  777. </tr>
    778. 

  778. <tr>
    779. 

  779. <td>
    780. 

  780.                 <p><span><strong class="command">server</strong></span></p>
    781. 

  781.               </td>
    782. 

  782. <td>
    783. 

  783.                 <p>
    784. 

  784.                   sets certain configuration options on
    785. 

  785.                   a per-server basis.
    786. 

  786.                 </p>
    787. 

  787.               </td>
    788. 

  788. </tr>
    789. 

  789. <tr>
    790. 

  790. <td>
    791. 

  791.                 <p><span><strong class="command">statistics-channels</strong></span></p>
    792. 

  792.               </td>
    793. 

  793. <td>
    794. 

  794.                 <p>
    795. 

  795.                   declares communication channels to get access to
    796. 

  796.                   <span><strong class="command">named</strong></span> statistics.
    797. 

  797.                 </p>
    798. 

  798.               </td>
    799. 

  799. </tr>
    800. 

  800. <tr>
    801. 

  801. <td>
    802. 

  802.                 <p><span><strong class="command">trusted-keys</strong></span></p>
    803. 

  803.               </td>
    804. 

  804. <td>
    805. 

  805.                 <p>
    806. 

  806.                   defines trusted DNSSEC keys.
    807. 

  807.                 </p>
    808. 

  808.               </td>
    809. 

  809. </tr>
    810. 

  810. <tr>
    811. 

  811. <td>
    812. 

  812.                 <p><span><strong class="command">managed-keys</strong></span></p>
    813. 

  813.               </td>
    814. 

  814. <td>
    815. 

  815.                 <p>
    816. 

  816.                   lists DNSSEC keys to be kept up to date
    817. 

  817.                   using RFC 5011 trust anchor maintenance.
    818. 

  818.                 </p>
    819. 

  819.               </td>
    820. 

  820. </tr>
    821. 

  821. <tr>
    822. 

  822. <td>
    823. 

  823.                 <p><span><strong class="command">view</strong></span></p>
    824. 

  824.               </td>
    825. 

  825. <td>
    826. 

  826.                 <p>
    827. 

  827.                   defines a view.
    828. 

  828.                 </p>
    829. 

  829.               </td>
    830. 

  830. </tr>
    831. 

  831. <tr>
    832. 

  832. <td>
    833. 

  833.                 <p><span><strong class="command">zone</strong></span></p>
    834. 

  834.               </td>
    835. 

  835. <td>
    836. 

  836.                 <p>
    837. 

  837.                   defines a zone.
    838. 

  838.                 </p>
    839. 

  839.               </td>
    840. 

  840. </tr>
    841. 

  841. </tbody>
    842. 

  842. </table></div>
    843. 

  843. <p>
    844. 

  844.         The <span><strong class="command">logging</strong></span> and
    845. 

  845.         <span><strong class="command">options</strong></span> statements may only occur once
    846. 

  846.         per
    847. 

  847.         configuration.
    848. 

  848.       </p>
    849. 

  849. <div class="sect2" lang="en">
    850. 

  850. <div class="titlepage"><div><div><h3 class="title">
    851. 

  851. <a name="id2574986"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div>
    852. 

  852. <pre class="programlisting"><span><strong class="command">acl</strong></span> acl-name {
    853. 

  853.     address_match_list
    854. 

  854. };
    855. 

  855. </pre>
    856. 

  856. </div>
    857. 

  857. <div class="sect2" lang="en">
    858. 

  858. <div class="titlepage"><div><div><h3 class="title">
    859. 

  859. <a name="acl"></a><span><strong class="command">acl</strong></span> Statement Definition and
    860. 

  860.           Usage</h3></div></div></div>
    861. 

  861. <p>
    862. 

  862.           The <span><strong class="command">acl</strong></span> statement assigns a symbolic
    863. 

  863.           name to an address match list. It gets its name from a primary
    864. 

  864.           use of address match lists: Access Control Lists (ACLs).
    865. 

  865.         </p>
    866. 

  866. <p>
    867. 

  867.           Note that an address match list's name must be defined
    868. 

  868.           with <span><strong class="command">acl</strong></span> before it can be used
    869. 

  869.           elsewhere; no forward references are allowed.
    870. 

  870.         </p>
    871. 

  871. <p>
    872. 

  872.           The following ACLs are built-in:
    873. 

  873.         </p>
    874. 

  874. <div class="informaltable"><table border="1">
    875. 

  875. <colgroup>
    876. 

  876. <col>
    877. 

  877. <col>
    878. 

  878. </colgroup>
    879. 

  879. <tbody>
    880. 

  880. <tr>
    881. 

  881. <td>
    882. 

  882.                   <p><span><strong class="command">any</strong></span></p>
    883. 

  883.                 </td>
    884. 

  884. <td>
    885. 

  885.                   <p>
    886. 

  886.                     Matches all hosts.
    887. 

  887.                   </p>
    888. 

  888.                 </td>
    889. 

  889. </tr>
    890. 

  890. <tr>
    891. 

  891. <td>
    892. 

  892.                   <p><span><strong class="command">none</strong></span></p>
    893. 

  893.                 </td>
    894. 

  894. <td>
    895. 

  895.                   <p>
    896. 

  896.                     Matches no hosts.
    897. 

  897.                   </p>
    898. 

  898.                 </td>
    899. 

  899. </tr>
    900. 

  900. <tr>
    901. 

  901. <td>
    902. 

  902.                   <p><span><strong class="command">localhost</strong></span></p>
    903. 

  903.                 </td>
    904. 

  904. <td>
    905. 

  905.                   <p>
    906. 

  906.                     Matches the IPv4 and IPv6 addresses of all network
    907. 

  907.                     interfaces on the system.
    908. 

  908.                   </p>
    909. 

  909.                 </td>
    910. 

  910. </tr>
    911. 

  911. <tr>
    912. 

  912. <td>
    913. 

  913.                   <p><span><strong class="command">localnets</strong></span></p>
    914. 

  914.                 </td>
    915. 

  915. <td>
    916. 

  916.                   <p>
    917. 

  917.                     Matches any host on an IPv4 or IPv6 network
    918. 

  918.                     for which the system has an interface.
    919. 

  919.                     Some systems do not provide a way to determine the prefix
    920. 

  920.                     lengths of
    921. 

  921.                     local IPv6 addresses.
    922. 

  922.                     In such a case, <span><strong class="command">localnets</strong></span>
    923. 

  923.                     only matches the local
    924. 

  924.                     IPv6 addresses, just like <span><strong class="command">localhost</strong></span>.
    925. 

  925.                   </p>
    926. 

  926.                 </td>
    927. 

  927. </tr>
    928. 

  928. </tbody>
    929. 

  929. </table></div>
    930. 

  930. </div>
    931. 

  931. <div class="sect2" lang="en">
    932. 

  932. <div class="titlepage"><div><div><h3 class="title">
    933. 

  933. <a name="id2575176"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div>
    934. 

  934. <pre class="programlisting"><span><strong class="command">controls</strong></span> {
    935. 

  935.    [ inet ( ip_addr | * ) [ port ip_port ]
    936. 

  936.                 allow { <em class="replaceable"><code> address_match_list </code></em> }
    937. 

  937.                 keys { <em class="replaceable"><code>key_list</code></em> }; ]
    938. 

  938.    [ inet ...; ]
    939. 

  939.    [ unix <em class="replaceable"><code>path</code></em> perm <em class="replaceable"><code>number</code></em> owner <em class="replaceable"><code>number</code></em> group <em class="replaceable"><code>number</code></em>
    940. 

  940.      keys { <em class="replaceable"><code>key_list</code></em> }; ]
    941. 

  941.    [ unix ...; ]
    942. 

  942. };
    943. 

  943. </pre>
    944. 

  944. </div>
    945. 

  945. <div class="sect2" lang="en">
    946. 

  946. <div class="titlepage"><div><div><h3 class="title">
    947. 

  947. <a name="controls_statement_definition_and_usage"></a><span><strong class="command">controls</strong></span> Statement Definition and
    948. 

  948.           Usage</h3></div></div></div>
    949. 

  949. <p>
    950. 

  950.           The <span><strong class="command">controls</strong></span> statement declares control
    951. 

  951.           channels to be used by system administrators to control the
    952. 

  952.           operation of the name server. These control channels are
    953. 

  953.           used by the <span><strong class="command">rndc</strong></span> utility to send
    954. 

  954.           commands to and retrieve non-DNS results from a name server.
    955. 

  955.         </p>
    956. 

  956. <p>
    957. 

  957.           An <span><strong class="command">inet</strong></span> control channel is a TCP socket
    958. 

  958.           listening at the specified <span><strong class="command">ip_port</strong></span> on the
    959. 

  959.           specified <span><strong class="command">ip_addr</strong></span>, which can be an IPv4 or IPv6
    960. 

  960.           address.  An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
    961. 

  961.           interpreted as the IPv4 wildcard address; connections will be
    962. 

  962.           accepted on any of the system's IPv4 addresses.
    963. 

  963.           To listen on the IPv6 wildcard address,
    964. 

  964.           use an <span><strong class="command">ip_addr</strong></span> of <code class="literal">::</code>.
    965. 

  965.           If you will only use <span><strong class="command">rndc</strong></span> on the local host,
    966. 

  966.           using the loopback address (<code class="literal">127.0.0.1</code>
    967. 

  967.           or <code class="literal">::1</code>) is recommended for maximum security.
    968. 

  968.         </p>
    969. 

  969. <p>
    970. 

  970.           If no port is specified, port 953 is used. The asterisk
    971. 

  971.           "<code class="literal">*</code>" cannot be used for <span><strong class="command">ip_port</strong></span>.
    972. 

  972.         </p>
    973. 

  973. <p>
    974. 

  974.           The ability to issue commands over the control channel is
    975. 

  975.           restricted by the <span><strong class="command">allow</strong></span> and
    976. 

  976.           <span><strong class="command">keys</strong></span> clauses.
    977. 

  977.           Connections to the control channel are permitted based on the
    978. 

  978.           <span><strong class="command">address_match_list</strong></span>.  This is for simple
    979. 

  979.           IP address based filtering only; any <span><strong class="command">key_id</strong></span>
    980. 

  980.           elements of the <span><strong class="command">address_match_list</strong></span>
    981. 

  981.           are ignored.
    982. 

  982.         </p>
    983. 

  983. <p>
    984. 

  984.           A <span><strong class="command">unix</strong></span> control channel is a UNIX domain
    985. 

  985.           socket listening at the specified path in the file system.
    986. 

  986.           Access to the socket is specified by the <span><strong class="command">perm</strong></span>,
    987. 

  987.           <span><strong class="command">owner</strong></span> and <span><strong class="command">group</strong></span> clauses.
    988. 

  988.           Note on some platforms (SunOS and Solaris) the permissions
    989. 

  989.           (<span><strong class="command">perm</strong></span>) are applied to the parent directory
    990. 

  990.           as the permissions on the socket itself are ignored.
    991. 

  991.         </p>
    992. 

  992. <p>
    993. 

  993.           The primary authorization mechanism of the command
    994. 

  994.           channel is the <span><strong class="command">key_list</strong></span>, which
    995. 

  995.           contains a list of <span><strong class="command">key_id</strong></span>s.
    996. 

  996.           Each <span><strong class="command">key_id</strong></span> in the <span><strong class="command">key_list</strong></span>
    997. 

  997.           is authorized to execute commands over the control channel.
    998. 

  998.           See <a href="Bv9ARM.ch03.html#rndc">Remote Name Daemon Control application</a> in <a href="Bv9ARM.ch03.html#admin_tools" title="Administrative Tools">the section called &#8220;Administrative Tools&#8221;</a>)
    999. 

  999.           for information about configuring keys in <span><strong class="command">rndc</strong></span>.
    1000. 

  1000.         </p>
    1001. 

  1001. <p>
    1002. 

  1002.           If no <span><strong class="command">controls</strong></span> statement is present,
    1003. 

  1003.           <span><strong class="command">named</strong></span> will set up a default
    1004. 

  1004.           control channel listening on the loopback address 127.0.0.1
    1005. 

  1005.           and its IPv6 counterpart ::1.
    1006. 

  1006.           In this case, and also when the <span><strong class="command">controls</strong></span> statement
    1007. 

  1007.           is present but does not have a <span><strong class="command">keys</strong></span> clause,
    1008. 

  1008.           <span><strong class="command">named</strong></span> will attempt to load the command channel key
    1009. 

  1009.           from the file <code class="filename">rndc.key</code> in
    1010. 

  1010.           <code class="filename">/etc</code> (or whatever <code class="varname">sysconfdir</code>
    1011. 

  1011.           was specified as when <acronym class="acronym">BIND</acronym> was built).
    1012. 

  1012.           To create a <code class="filename">rndc.key</code> file, run
    1013. 

  1013.           <strong class="userinput"><code>rndc-confgen -a</code></strong>.
    1014. 

  1014.         </p>
    1015. 

  1015. <p>
    1016. 

  1016.           The <code class="filename">rndc.key</code> feature was created to
    1017. 

  1017.           ease the transition of systems from <acronym class="acronym">BIND</acronym> 8,
    1018. 

  1018.           which did not have digital signatures on its command channel
    1019. 

  1019.           messages and thus did not have a <span><strong class="command">keys</strong></span> clause.
    1020. 

  1020. 

  1021.           It makes it possible to use an existing <acronym class="acronym">BIND</acronym> 8
    1022. 

  1022.           configuration file in <acronym class="acronym">BIND</acronym> 9 unchanged,
    1023. 

  1023.           and still have <span><strong class="command">rndc</strong></span> work the same way
    1024. 

  1024.           <span><strong class="command">ndc</strong></span> worked in BIND 8, simply by executing the
    1025. 

  1025.           command <strong class="userinput"><code>rndc-confgen -a</code></strong> after BIND 9 is
    1026. 

  1026.           installed.
    1027. 

  1027.         </p>
    1028. 

  1028. <p>
    1029. 

  1029.           Since the <code class="filename">rndc.key</code> feature
    1030. 

  1030.           is only intended to allow the backward-compatible usage of
    1031. 

  1031.           <acronym class="acronym">BIND</acronym> 8 configuration files, this
    1032. 

  1032.           feature does not
    1033. 

  1033.           have a high degree of configurability.  You cannot easily change
    1034. 

  1034.           the key name or the size of the secret, so you should make a
    1035. 

  1035.           <code class="filename">rndc.conf</code> with your own key if you
    1036. 

  1036.           wish to change
    1037. 

  1037.           those things.  The <code class="filename">rndc.key</code> file
    1038. 

  1038.           also has its
    1039. 

  1039.           permissions set such that only the owner of the file (the user that
    1040. 

  1040.           <span><strong class="command">named</strong></span> is running as) can access it.
    1041. 

  1041.           If you
    1042. 

  1042.           desire greater flexibility in allowing other users to access
    1043. 

  1043.           <span><strong class="command">rndc</strong></span> commands, then you need to create
    1044. 

  1044.           a
    1045. 

  1045.           <code class="filename">rndc.conf</code> file and make it group
    1046. 

  1046.           readable by a group
    1047. 

  1047.           that contains the users who should have access.
    1048. 

  1048.         </p>
    1049. 

  1049. <p>
    1050. 

  1050.           To disable the command channel, use an empty
    1051. 

  1051.           <span><strong class="command">controls</strong></span> statement:
    1052. 

  1052.           <span><strong class="command">controls { };</strong></span>.
    1053. 

  1053.         </p>
    1054. 

  1054. </div>
    1055. 

  1055. <div class="sect2" lang="en">
    1056. 

  1056. <div class="titlepage"><div><div><h3 class="title">
    1057. 

  1057. <a name="id2575467"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div>
    1058. 

  1058. <pre class="programlisting"><span><strong class="command">include</strong></span> <em class="replaceable"><code>filename</code></em>;</pre>
    1059. 

  1059. </div>
    1060. 

  1060. <div class="sect2" lang="en">
    1061. 

  1061. <div class="titlepage"><div><div><h3 class="title">
    1062. 

  1062. <a name="id2575484"></a><span><strong class="command">include</strong></span> Statement Definition and
    1063. 

  1063.           Usage</h3></div></div></div>
    1064. 

  1064. <p>
    1065. 

  1065.           The <span><strong class="command">include</strong></span> statement inserts the
    1066. 

  1066.           specified file at the point where the <span><strong class="command">include</strong></span>
    1067. 

  1067.           statement is encountered. The <span><strong class="command">include</strong></span>
    1068. 

  1068.                 statement facilitates the administration of configuration
    1069. 

  1069.           files
    1070. 

  1070.           by permitting the reading or writing of some things but not
    1071. 

  1071.           others. For example, the statement could include private keys
    1072. 

  1072.           that are readable only by the name server.
    1073. 

  1073.         </p>
    1074. 

  1074. </div>
    1075. 

  1075. <div class="sect2" lang="en">
    1076. 

  1076. <div class="titlepage"><div><div><h3 class="title">
    1077. 

  1077. <a name="id2575576"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div>
    1078. 

  1078. <pre class="programlisting"><span><strong class="command">key</strong></span> <em class="replaceable"><code>key_id</code></em> {
    1079. 

  1079.     algorithm <em class="replaceable"><code>string</code></em>;
    1080. 

  1080.     secret <em class="replaceable"><code>string</code></em>;
    1081. 

  1081. };
    1082. 

  1082. </pre>
    1083. 

  1083. </div>
    1084. 

  1084. <div class="sect2" lang="en">
    1085. 

  1085. <div class="titlepage"><div><div><h3 class="title">
    1086. 

  1086. <a name="id2575600"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div>
    1087. 

  1087. <p>
    1088. 

  1088.           The <span><strong class="command">key</strong></span> statement defines a shared
    1089. 

  1089.           secret key for use with TSIG (see <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called &#8220;TSIG&#8221;</a>)
    1090. 

  1090.           or the command channel
    1091. 

  1091.           (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
    1092. 

  1092.           Usage">the section called &#8220;<span><strong class="command">controls</strong></span> Statement Definition and
    1093. 

  1093.           Usage&#8221;</a>).
    1094. 

  1094.         </p>
    1095. 

  1095. <p>
    1096. 

  1096.           The <span><strong class="command">key</strong></span> statement can occur at the
    1097. 

  1097.           top level
    1098. 

  1098.           of the configuration file or inside a <span><strong class="command">view</strong></span>
    1099. 

  1099.           statement.  Keys defined in top-level <span><strong class="command">key</strong></span>
    1100. 

  1100.           statements can be used in all views.  Keys intended for use in
    1101. 

  1101.           a <span><strong class="command">controls</strong></span> statement
    1102. 

  1102.           (see <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and
    1103. 

  1103.           Usage">the section called &#8220;<span><strong class="command">controls</strong></span> Statement Definition and
    1104. 

  1104.           Usage&#8221;</a>)
    1105. 

  1105.           must be defined at the top level.
    1106. 

  1106.         </p>
    1107. 

  1107. <p>
    1108. 

  1108.           The <em class="replaceable"><code>key_id</code></em>, also known as the
    1109. 

  1109.           key name, is a domain name uniquely identifying the key. It can
    1110. 

  1110.           be used in a <span><strong class="command">server</strong></span>
    1111. 

  1111.           statement to cause requests sent to that
    1112. 

  1112.           server to be signed with this key, or in address match lists to
    1113. 

  1113.           verify that incoming requests have been signed with a key
    1114. 

  1114.           matching this name, algorithm, and secret.
    1115. 

  1115.         </p>
    1116. 

  1116. <p>
    1117. 

  1117.           The <em class="replaceable"><code>algorithm_id</code></em> is a string
    1118. 

  1118.           that specifies a security/authentication algorithm.  Named
    1119. 

  1119.           supports <code class="literal">hmac-md5</code>,
    1120. 

  1120.           <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
    1121. 

  1121.           <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>
    1122. 

  1122.           and <code class="literal">hmac-sha512</code> TSIG authentication.
    1123. 

  1123.           Truncated hashes are supported by appending the minimum
    1124. 

  1124.           number of required bits preceded by a dash, e.g.
    1125. 

  1125.           <code class="literal">hmac-sha1-80</code>.  The
    1126. 

  1126.           <em class="replaceable"><code>secret_string</code></em> is the secret
    1127. 

  1127.           to be used by the algorithm, and is treated as a base-64
    1128. 

  1128.           encoded string.
    1129. 

  1129.         </p>
    1130. 

  1130. </div>
    1131. 

  1131. <div class="sect2" lang="en">
    1132. 

  1132. <div class="titlepage"><div><div><h3 class="title">
    1133. 

  1133. <a name="id2575758"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div>
    1134. 

  1134. <pre class="programlisting"><span><strong class="command">logging</strong></span> {
    1135. 

  1135.    [ <span><strong class="command">channel</strong></span> <em class="replaceable"><code>channel_name</code></em> {
    1136. 

  1136.      ( <span><strong class="command">file</strong></span> <em class="replaceable"><code>path_name</code></em>
    1137. 

  1137.          [ <span><strong class="command">versions</strong></span> ( <em class="replaceable"><code>number</code></em> | <span><strong class="command">unlimited</strong></span> ) ]
    1138. 

  1138.          [ <span><strong class="command">size</strong></span> <em class="replaceable"><code>size spec</code></em> ]
    1139. 

  1139.        | <span><strong class="command">syslog</strong></span> <em class="replaceable"><code>syslog_facility</code></em>
    1140. 

  1140.        | <span><strong class="command">stderr</strong></span>
    1141. 

  1141.        | <span><strong class="command">null</strong></span> );
    1142. 

  1142.      [ <span><strong class="command">severity</strong></span> (<code class="option">critical</code> | <code class="option">error</code> | <code class="option">warning</code> | <code class="option">notice</code> |
    1143. 

  1143.                  <code class="option">info</code> | <code class="option">debug</code> [ <em class="replaceable"><code>level</code></em> ] | <code class="option">dynamic</code> ); ]
    1144. 

  1144.      [ <span><strong class="command">print-category</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
    1145. 

  1145.      [ <span><strong class="command">print-severity</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
    1146. 

  1146.      [ <span><strong class="command">print-time</strong></span> <code class="option">yes</code> or <code class="option">no</code>; ]
    1147. 

  1147.    }; ]
    1148. 

  1148.    [ <span><strong class="command">category</strong></span> <em class="replaceable"><code>category_name</code></em> {
    1149. 

  1149.      <em class="replaceable"><code>channel_name</code></em> ; [ <em class="replaceable"><code>channel_name</code></em> ; ... ]
    1150. 

  1150.    }; ]
    1151. 

  1151.    ...
    1152. 

  1152. };
    1153. 

  1153. </pre>
    1154. 

  1154. </div>
    1155. 

  1155. <div class="sect2" lang="en">
    1156. 

  1156. <div class="titlepage"><div><div><h3 class="title">
    1157. 

  1157. <a name="id2575884"></a><span><strong class="command">logging</strong></span> Statement Definition and
    1158. 

  1158.           Usage</h3></div></div></div>
    1159. 

  1159. <p>
    1160. 

  1160.           The <span><strong class="command">logging</strong></span> statement configures a
    1161. 

  1161.           wide
    1162. 

  1162.           variety of logging options for the name server. Its <span><strong class="command">channel</strong></span> phrase
    1163. 

  1163.           associates output methods, format options and severity levels with
    1164. 

  1164.           a name that can then be used with the <span><strong class="command">category</strong></span> phrase
    1165. 

  1165.           to select how various classes of messages are logged.
    1166. 

  1166.         </p>
    1167. 

  1167. <p>
    1168. 

  1168.           Only one <span><strong class="command">logging</strong></span> statement is used to
    1169. 

  1169.           define
    1170. 

  1170.           as many channels and categories as are wanted. If there is no <span><strong class="command">logging</strong></span> statement,
    1171. 

  1171.           the logging configuration will be:
    1172. 

  1172.         </p>
    1173. 

  1173. <pre class="programlisting">logging {
    1174. 

  1174.      category default { default_syslog; default_debug; };
    1175. 

  1175.      category unmatched { null; };
    1176. 

  1176. };
    1177. 

  1177. </pre>
    1178. 

  1178. <p>
    1179. 

  1179.           In <acronym class="acronym">BIND</acronym> 9, the logging configuration
    1180. 

  1180.           is only established when
    1181. 

  1181.           the entire configuration file has been parsed.  In <acronym class="acronym">BIND</acronym> 8, it was
    1182. 

  1182.           established as soon as the <span><strong class="command">logging</strong></span>
    1183. 

  1183.           statement
    1184. 

  1184.           was parsed. When the server is starting up, all logging messages
    1185. 

  1185.           regarding syntax errors in the configuration file go to the default
    1186. 

  1186.           channels, or to standard error if the "<code class="option">-g</code>" option
    1187. 

  1187.           was specified.
    1188. 

  1188.         </p>
    1189. 

  1189. <div class="sect3" lang="en">
    1190. 

  1190. <div class="titlepage"><div><div><h4 class="title">
    1191. 

  1191. <a name="id2576005"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div>
    1192. 

  1192. <p>
    1193. 

  1193.             All log output goes to one or more <span class="emphasis"><em>channels</em></span>;
    1194. 

  1194.             you can make as many of them as you want.
    1195. 

  1195.           </p>
    1196. 

  1196. <p>
    1197. 

  1197.             Every channel definition must include a destination clause that
    1198. 

  1198.             says whether messages selected for the channel go to a file, to a
    1199. 

  1199.             particular syslog facility, to the standard error stream, or are
    1200. 

  1200.             discarded. It can optionally also limit the message severity level
    1201. 

  1201.             that will be accepted by the channel (the default is
    1202. 

  1202.             <span><strong class="command">info</strong></span>), and whether to include a
    1203. 

  1203.             <span><strong class="command">named</strong></span>-generated time stamp, the
    1204. 

  1204.             category name
    1205. 

  1205.             and/or severity level (the default is not to include any).
    1206. 

  1206.           </p>
    1207. 

  1207. <p>
    1208. 

  1208.             The <span><strong class="command">null</strong></span> destination clause
    1209. 

  1209.             causes all messages sent to the channel to be discarded;
    1210. 

  1210.             in that case, other options for the channel are meaningless.
    1211. 

  1211.           </p>
    1212. 

  1212. <p>
    1213. 

  1213.             The <span><strong class="command">file</strong></span> destination clause directs
    1214. 

  1214.             the channel
    1215. 

  1215.             to a disk file.  It can include limitations
    1216. 

  1216.             both on how large the file is allowed to become, and how many
    1217. 

  1217.             versions
    1218. 

  1218.             of the file will be saved each time the file is opened.
    1219. 

  1219.           </p>
    1220. 

  1220. <p>
    1221. 

  1221.             If you use the <span><strong class="command">versions</strong></span> log file
    1222. 

  1222.             option, then
    1223. 

  1223.             <span><strong class="command">named</strong></span> will retain that many backup
    1224. 

  1224.             versions of the file by
    1225. 

  1225.             renaming them when opening.  For example, if you choose to keep
    1226. 

  1226.             three old versions
    1227. 

  1227.             of the file <code class="filename">lamers.log</code>, then just
    1228. 

  1228.             before it is opened
    1229. 

  1229.             <code class="filename">lamers.log.1</code> is renamed to
    1230. 

  1230.             <code class="filename">lamers.log.2</code>, <code class="filename">lamers.log.0</code> is renamed
    1231. 

  1231.             to <code class="filename">lamers.log.1</code>, and <code class="filename">lamers.log</code> is
    1232. 

  1232.             renamed to <code class="filename">lamers.log.0</code>.
    1233. 

  1233.             You can say <span><strong class="command">versions unlimited</strong></span> to
    1234. 

  1234.             not limit
    1235. 

  1235.             the number of versions.
    1236. 

  1236.             If a <span><strong class="command">size</strong></span> option is associated with
    1237. 

  1237.             the log file,
    1238. 

  1238.             then renaming is only done when the file being opened exceeds the
    1239. 

  1239.             indicated size.  No backup versions are kept by default; any
    1240. 

  1240.             existing
    1241. 

  1241.             log file is simply appended.
    1242. 

  1242.           </p>
    1243. 

  1243. <p>
    1244. 

  1244.             The <span><strong class="command">size</strong></span> option for files is used
    1245. 

  1245.             to limit log
    1246. 

  1246.             growth. If the file ever exceeds the size, then <span><strong class="command">named</strong></span> will
    1247. 

  1247.             stop writing to the file unless it has a <span><strong class="command">versions</strong></span> option
    1248. 

  1248.             associated with it.  If backup versions are kept, the files are
    1249. 

  1249.             rolled as
    1250. 

  1250.             described above and a new one begun.  If there is no
    1251. 

  1251.             <span><strong class="command">versions</strong></span> option, no more data will
    1252. 

  1252.             be written to the log
    1253. 

  1253.             until some out-of-band mechanism removes or truncates the log to
    1254. 

  1254.             less than the
    1255. 

  1255.             maximum size.  The default behavior is not to limit the size of
    1256. 

  1256.             the
    1257. 

  1257.             file.
    1258. 

  1258.           </p>
    1259. 

  1259. <p>
    1260. 

  1260.             Example usage of the <span><strong class="command">size</strong></span> and
    1261. 

  1261.             <span><strong class="command">versions</strong></span> options:
    1262. 

  1262.           </p>
    1263. 

  1263. <pre class="programlisting">channel an_example_channel {
    1264. 

  1264.     file "example.log" versions 3 size 20m;
    1265. 

  1265.     print-time yes;
    1266. 

  1266.     print-category yes;
    1267. 

  1267. };
    1268. 

  1268. </pre>
    1269. 

  1269. <p>
    1270. 

  1270.             The <span><strong class="command">syslog</strong></span> destination clause
    1271. 

  1271.             directs the
    1272. 

  1272.             channel to the system log.  Its argument is a
    1273. 

  1273.             syslog facility as described in the <span><strong class="command">syslog</strong></span> man
    1274. 

  1274.             page. Known facilities are <span><strong class="command">kern</strong></span>, <span><strong class="command">user</strong></span>,
    1275. 

  1275.             <span><strong class="command">mail</strong></span>, <span><strong class="command">daemon</strong></span>, <span><strong class="command">auth</strong></span>,
    1276. 

  1276.             <span><strong class="command">syslog</strong></span>, <span><strong class="command">lpr</strong></span>, <span><strong class="command">news</strong></span>,
    1277. 

  1277.             <span><strong class="command">uucp</strong></span>, <span><strong class="command">cron</strong></span>, <span><strong class="command">authpriv</strong></span>,
    1278. 

  1278.             <span><strong class="command">ftp</strong></span>, <span><strong class="command">local0</strong></span>, <span><strong class="command">local1</strong></span>,
    1279. 

  1279.             <span><strong class="command">local2</strong></span>, <span><strong class="command">local3</strong></span>, <span><strong class="command">local4</strong></span>,
    1280. 

  1280.             <span><strong class="command">local5</strong></span>, <span><strong class="command">local6</strong></span> and
    1281. 

  1281.             <span><strong class="command">local7</strong></span>, however not all facilities
    1282. 

  1282.             are supported on
    1283. 

  1283.             all operating systems.
    1284. 

  1284.             How <span><strong class="command">syslog</strong></span> will handle messages
    1285. 

  1285.             sent to
    1286. 

  1286.             this facility is described in the <span><strong class="command">syslog.conf</strong></span> man
    1287. 

  1287.             page. If you have a system which uses a very old version of <span><strong class="command">syslog</strong></span> that
    1288. 

  1288.             only uses two arguments to the <span><strong class="command">openlog()</strong></span> function,
    1289. 

  1289.             then this clause is silently ignored.
    1290. 

  1290.           </p>
    1291. 

  1291. <p>
    1292. 

  1292.             The <span><strong class="command">severity</strong></span> clause works like <span><strong class="command">syslog</strong></span>'s
    1293. 

  1293.             "priorities", except that they can also be used if you are writing
    1294. 

  1294.             straight to a file rather than using <span><strong class="command">syslog</strong></span>.
    1295. 

  1295.             Messages which are not at least of the severity level given will
    1296. 

  1296.             not be selected for the channel; messages of higher severity
    1297. 

  1297.             levels
    1298. 

  1298.             will be accepted.
    1299. 

  1299.           </p>
    1300. 

  1300. <p>
    1301. 

  1301.             If you are using <span><strong class="command">syslog</strong></span>, then the <span><strong class="command">syslog.conf</strong></span> priorities
    1302. 

  1302.             will also determine what eventually passes through. For example,
    1303. 

  1303.             defining a channel facility and severity as <span><strong class="command">daemon</strong></span> and <span><strong class="command">debug</strong></span> but
    1304. 

  1304.             only logging <span><strong class="command">daemon.warning</strong></span> via <span><strong class="command">syslog.conf</strong></span> will
    1305. 

  1305.             cause messages of severity <span><strong class="command">info</strong></span> and
    1306. 

  1306.             <span><strong class="command">notice</strong></span> to
    1307. 

  1307.             be dropped. If the situation were reversed, with <span><strong class="command">named</strong></span> writing
    1308. 

  1308.             messages of only <span><strong class="command">warning</strong></span> or higher,
    1309. 

  1309.             then <span><strong class="command">syslogd</strong></span> would
    1310. 

  1310.             print all messages it received from the channel.
    1311. 

  1311.           </p>
    1312. 

  1312. <p>
    1313. 

  1313.             The <span><strong class="command">stderr</strong></span> destination clause
    1314. 

  1314.             directs the
    1315. 

  1315.             channel to the server's standard error stream.  This is intended
    1316. 

  1316.             for
    1317. 

  1317.             use when the server is running as a foreground process, for
    1318. 

  1318.             example
    1319. 

  1319.             when debugging a configuration.
    1320. 

  1320.           </p>
    1321. 

  1321. <p>
    1322. 

  1322.             The server can supply extensive debugging information when
    1323. 

  1323.             it is in debugging mode. If the server's global debug level is
    1324. 

  1324.             greater
    1325. 

  1325.             than zero, then debugging mode will be active. The global debug
    1326. 

  1326.             level is set either by starting the <span><strong class="command">named</strong></span> server
    1327. 

  1327.             with the <code class="option">-d</code> flag followed by a positive integer,
    1328. 

  1328.             or by running <span><strong class="command">rndc trace</strong></span>.
    1329. 

  1329.             The global debug level
    1330. 

  1330.             can be set to zero, and debugging mode turned off, by running <span><strong class="command">rndc
    1331. 

  1331. notrace</strong></span>. All debugging messages in the server have a debug
    1332. 

  1332.             level, and higher debug levels give more detailed output. Channels
    1333. 

  1333.             that specify a specific debug severity, for example:
    1334. 

  1334.           </p>
    1335. 

  1335. <pre class="programlisting">channel specific_debug_level {
    1336. 

  1336.     file "foo";
    1337. 

  1337.     severity debug 3;
    1338. 

  1338. };
    1339. 

  1339. </pre>
    1340. 

  1340. <p>
    1341. 

  1341.             will get debugging output of level 3 or less any time the
    1342. 

  1342.             server is in debugging mode, regardless of the global debugging
    1343. 

  1343.             level. Channels with <span><strong class="command">dynamic</strong></span>
    1344. 

  1344.             severity use the
    1345. 

  1345.             server's global debug level to determine what messages to print.
    1346. 

  1346.           </p>
    1347. 

  1347. <p>
    1348. 

  1348.             If <span><strong class="command">print-time</strong></span> has been turned on,
    1349. 

  1349.             then
    1350. 

  1350.             the date and time will be logged. <span><strong class="command">print-time</strong></span> may
    1351. 

  1351.             be specified for a <span><strong class="command">syslog</strong></span> channel,
    1352. 

  1352.             but is usually
    1353. 

  1353.             pointless since <span><strong class="command">syslog</strong></span> also logs
    1354. 

  1354.             the date and
    1355. 

  1355.             time. If <span><strong class="command">print-category</strong></span> is
    1356. 

  1356.             requested, then the
    1357. 

  1357.             category of the message will be logged as well. Finally, if <span><strong class="command">print-severity</strong></span> is
    1358. 

  1358.             on, then the severity level of the message will be logged. The <span><strong class="command">print-</strong></span> options may
    1359. 

  1359.             be used in any combination, and will always be printed in the
    1360. 

  1360.             following
    1361. 

  1361.             order: time, category, severity. Here is an example where all
    1362. 

  1362.             three <span><strong class="command">print-</strong></span> options
    1363. 

  1363.             are on:
    1364. 

  1364.           </p>
    1365. 

  1365. <p>
    1366. 

  1366.             <code class="computeroutput">28-Feb-2000 15:05:32.863 general: notice: running</code>
    1367. 

  1367.           </p>
    1368. 

  1368. <p>
    1369. 

  1369.             There are four predefined channels that are used for
    1370. 

  1370.             <span><strong class="command">named</strong></span>'s default logging as follows.
    1371. 

  1371.             How they are
    1372. 

  1372.             used is described in <a href="Bv9ARM.ch06.html#the_category_phrase" title="The category Phrase">the section called &#8220;The <span><strong class="command">category</strong></span> Phrase&#8221;</a>.
    1373. 

  1373.           </p>
    1374. 

  1374. <pre class="programlisting">channel default_syslog {
    1375. 

  1375.     // send to syslog's daemon facility
    1376. 

  1376.     syslog daemon;
    1377. 

  1377.     // only send priority info and higher
    1378. 

  1378.     severity info;
    1379. 

  1379. 

  1380. channel default_debug {
    1381. 

  1381.     // write to named.run in the working directory
    1382. 

  1382.     // Note: stderr is used instead of "named.run" if
    1383. 

  1383.     // the server is started with the '-f' option.
    1384. 

  1384.     file "named.run";
    1385. 

  1385.     // log at the server's current debug level
    1386. 

  1386.     severity dynamic;
    1387. 

  1387. };
    1388. 

  1388. 

  1389. channel default_stderr {
    1390. 

  1390.     // writes to stderr
    1391. 

  1391.     stderr;
    1392. 

  1392.     // only send priority info and higher
    1393. 

  1393.     severity info;
    1394. 

  1394. };
    1395. 

  1395. 

  1396. channel null {
    1397. 

  1397.    // toss anything sent to this channel
    1398. 

  1398.    null;
    1399. 

  1399. };
    1400. 

  1400. </pre>
    1401. 

  1401. <p>
    1402. 

  1402.             The <span><strong class="command">default_debug</strong></span> channel has the
    1403. 

  1403.             special
    1404. 

  1404.             property that it only produces output when the server's debug
    1405. 

  1405.             level is
    1406. 

  1406.             nonzero.  It normally writes to a file called <code class="filename">named.run</code>
    1407. 

  1407.             in the server's working directory.
    1408. 

  1408.           </p>
    1409. 

  1409. <p>
    1410. 

  1410.             For security reasons, when the "<code class="option">-u</code>"
    1411. 

  1411.             command line option is used, the <code class="filename">named.run</code> file
    1412. 

  1412.             is created only after <span><strong class="command">named</strong></span> has
    1413. 

  1413.             changed to the
    1414. 

  1414.             new UID, and any debug output generated while <span><strong class="command">named</strong></span> is
    1415. 

  1415.             starting up and still running as root is discarded.  If you need
    1416. 

  1416.             to capture this output, you must run the server with the "<code class="option">-g</code>"
    1417. 

  1417.             option and redirect standard error to a file.
    1418. 

  1418.           </p>
    1419. 

  1419. <p>
    1420. 

  1420.             Once a channel is defined, it cannot be redefined. Thus you
    1421. 

  1421.             cannot alter the built-in channels directly, but you can modify
    1422. 

  1422.             the default logging by pointing categories at channels you have
    1423. 

  1423.             defined.
    1424. 

  1424.           </p>
    1425. 

  1425. </div>
    1426. 

  1426. <div class="sect3" lang="en">
    1427. 

  1427. <div class="titlepage"><div><div><h4 class="title">
    1428. 

  1428. <a name="the_category_phrase"></a>The <span><strong class="command">category</strong></span> Phrase</h4></div></div></div>
    1429. 

  1429. <p>
    1430. 

  1430.             There are many categories, so you can send the logs you want
    1431. 

  1431.             to see wherever you want, without seeing logs you don't want. If
    1432. 

  1432.             you don't specify a list of channels for a category, then log
    1433. 

  1433.             messages
    1434. 

  1434.             in that category will be sent to the <span><strong class="command">default</strong></span> category
    1435. 

  1435.             instead. If you don't specify a default category, the following
    1436. 

  1436.             "default default" is used:
    1437. 

  1437.           </p>
    1438. 

  1438. <pre class="programlisting">category default { default_syslog; default_debug; };
    1439. 

  1439. </pre>
    1440. 

  1440. <p>
    1441. 

  1441.             As an example, let's say you want to log security events to
    1442. 

  1442.             a file, but you also want keep the default logging behavior. You'd
    1443. 

  1443.             specify the following:
    1444. 

  1444.           </p>
    1445. 

  1445. <pre class="programlisting">channel my_security_channel {
    1446. 

  1446.     file "my_security_file";
    1447. 

  1447.     severity info;
    1448. 

  1448. };
    1449. 

  1449. category security {
    1450. 

  1450.     my_security_channel;
    1451. 

  1451.     default_syslog;
    1452. 

  1452.     default_debug;
    1453. 

  1453. };</pre>
    1454. 

  1454. <p>
    1455. 

  1455.             To discard all messages in a category, specify the <span><strong class="command">null</strong></span> channel:
    1456. 

  1456.           </p>
    1457. 

  1457. <pre class="programlisting">category xfer-out { null; };
    1458. 

  1458. category notify { null; };
    1459. 

  1459. </pre>
    1460. 

  1460. <p>
    1461. 

  1461.             Following are the available categories and brief descriptions
    1462. 

  1462.             of the types of log information they contain. More
    1463. 

  1463.             categories may be added in future <acronym class="acronym">BIND</acronym> releases.
    1464. 

  1464.           </p>
    1465. 

  1465. <div class="informaltable"><table border="1">
    1466. 

  1466. <colgroup>
    1467. 

  1467. <col>
    1468. 

  1468. <col>
    1469. 

  1469. </colgroup>
    1470. 

  1470. <tbody>
    1471. 

  1471. <tr>
    1472. 

  1472. <td>
    1473. 

  1473.                     <p><span><strong class="command">default</strong></span></p>
    1474. 

  1474.                   </td>
    1475. 

  1475. <td>
    1476. 

  1476.                     <p>
    1477. 

  1477.                       The default category defines the logging
    1478. 

  1478.                       options for those categories where no specific
    1479. 

  1479.                       configuration has been
    1480. 

  1480.                       defined.
    1481. 

  1481.                     </p>
    1482. 

  1482.                   </td>
    1483. 

  1483. </tr>
    1484. 

  1484. <tr>
    1485. 

  1485. <td>
    1486. 

  1486.                     <p><span><strong class="command">general</strong></span></p>
    1487. 

  1487.                   </td>
    1488. 

  1488. <td>
    1489. 

  1489.                     <p>
    1490. 

  1490.                       The catch-all. Many things still aren't
    1491. 

  1491.                       classified into categories, and they all end up here.
    1492. 

  1492.                     </p>
    1493. 

  1493.                   </td>
    1494. 

  1494. </tr>
    1495. 

  1495. <tr>
    1496. 

  1496. <td>
    1497. 

  1497.                     <p><span><strong class="command">database</strong></span></p>
    1498. 

  1498.                   </td>
    1499. 

  1499. <td>
    1500. 

  1500.                     <p>
    1501. 

  1501.                       Messages relating to the databases used
    1502. 

  1502.                       internally by the name server to store zone and cache
    1503. 

  1503.                       data.
    1504. 

  1504.                     </p>
    1505. 

  1505.                   </td>
    1506. 

  1506. </tr>
    1507. 

  1507. <tr>
    1508. 

  1508. <td>
    1509. 

  1509.                     <p><span><strong class="command">security</strong></span></p>
    1510. 

  1510.                   </td>
    1511. 

  1511. <td>
    1512. 

  1512.                     <p>
    1513. 

  1513.                       Approval and denial of requests.
    1514. 

  1514.                     </p>
    1515. 

  1515.                   </td>
    1516. 

  1516. </tr>
    1517. 

  1517. <tr>
    1518. 

  1518. <td>
    1519. 

  1519.                     <p><span><strong class="command">config</strong></span></p>
    1520. 

  1520.                   </td>
    1521. 

  1521. <td>
    1522. 

  1522.                     <p>
    1523. 

  1523.                       Configuration file parsing and processing.
    1524. 

  1524.                     </p>
    1525. 

  1525.                   </td>
    1526. 

  1526. </tr>
    1527. 

  1527. <tr>
    1528. 

  1528. <td>
    1529. 

  1529.                     <p><span><strong class="command">resolver</strong></span></p>
    1530. 

  1530.                   </td>
    1531. 

  1531. <td>
    1532. 

  1532.                     <p>
    1533. 

  1533.                       DNS resolution, such as the recursive
    1534. 

  1534.                       lookups performed on behalf of clients by a caching name
    1535. 

  1535.                       server.
    1536. 

  1536.                     </p>
    1537. 

  1537.                   </td>
    1538. 

  1538. </tr>
    1539. 

  1539. <tr>
    1540. 

  1540. <td>
    1541. 

  1541.                     <p><span><strong class="command">xfer-in</strong></span></p>
    1542. 

  1542.                   </td>
    1543. 

  1543. <td>
    1544. 

  1544.                     <p>
    1545. 

  1545.                       Zone transfers the server is receiving.
    1546. 

  1546.                     </p>
    1547. 

  1547.                   </td>
    1548. 

  1548. </tr>
    1549. 

  1549. <tr>
    1550. 

  1550. <td>
    1551. 

  1551.                     <p><span><strong class="command">xfer-out</strong></span></p>
    1552. 

  1552.                   </td>
    1553. 

  1553. <td>
    1554. 

  1554.                     <p>
    1555. 

  1555.                       Zone transfers the server is sending.
    1556. 

  1556.                     </p>
    1557. 

  1557.                   </td>
    1558. 

  1558. </tr>
    1559. 

  1559. <tr>
    1560. 

  1560. <td>
    1561. 

  1561.                     <p><span><strong class="command">notify</strong></span></p>
    1562. 

  1562.                   </td>
    1563. 

  1563. <td>
    1564. 

  1564.                     <p>
    1565. 

  1565.                       The NOTIFY protocol.
    1566. 

  1566.                     </p>
    1567. 

  1567.                   </td>
    1568. 

  1568. </tr>
    1569. 

  1569. <tr>
    1570. 

  1570. <td>
    1571. 

  1571.                     <p><span><strong class="command">client</strong></span></p>
    1572. 

  1572.                   </td>
    1573. 

  1573. <td>
    1574. 

  1574.                     <p>
    1575. 

  1575.                       Processing of client requests.
    1576. 

  1576.                     </p>
    1577. 

  1577.                   </td>
    1578. 

  1578. </tr>
    1579. 

  1579. <tr>
    1580. 

  1580. <td>
    1581. 

  1581.                     <p><span><strong class="command">unmatched</strong></span></p>
    1582. 

  1582.                   </td>
    1583. 

  1583. <td>
    1584. 

  1584.                     <p>
    1585. 

  1585.                       Messages that <span><strong class="command">named</strong></span> was unable to determine the
    1586. 

  1586.                       class of or for which there was no matching <span><strong class="command">view</strong></span>.
    1587. 

  1587.                       A one line summary is also logged to the <span><strong class="command">client</strong></span> category.
    1588. 

  1588.                       This category is best sent to a file or stderr, by
    1589. 

  1589.                       default it is sent to
    1590. 

  1590.                       the <span><strong class="command">null</strong></span> channel.
    1591. 

  1591.                     </p>
    1592. 

  1592.                   </td>
    1593. 

  1593. </tr>
    1594. 

  1594. <tr>
    1595. 

  1595. <td>
    1596. 

  1596.                     <p><span><strong class="command">network</strong></span></p>
    1597. 

  1597.                   </td>
    1598. 

  1598. <td>
    1599. 

  1599.                     <p>
    1600. 

  1600.                       Network operations.
    1601. 

  1601.                     </p>
    1602. 

  1602.                   </td>
    1603. 

  1603. </tr>
    1604. 

  1604. <tr>
    1605. 

  1605. <td>
    1606. 

  1606.                     <p><span><strong class="command">update</strong></span></p>
    1607. 

  1607.                   </td>
    1608. 

  1608. <td>
    1609. 

  1609.                     <p>
    1610. 

  1610.                       Dynamic updates.
    1611. 

  1611.                     </p>
    1612. 

  1612.                   </td>
    1613. 

  1613. </tr>
    1614. 

  1614. <tr>
    1615. 

  1615. <td>
    1616. 

  1616.                     <p><span><strong class="command">update-security</strong></span></p>
    1617. 

  1617.                   </td>
    1618. 

  1618. <td>
    1619. 

  1619.                     <p>
    1620. 

  1620.                       Approval and denial of update requests.
    1621. 

  1621.                     </p>
    1622. 

  1622.                   </td>
    1623. 

  1623. </tr>
    1624. 

  1624. <tr>
    1625. 

  1625. <td>
    1626. 

  1626.                     <p><span><strong class="command">queries</strong></span></p>
    1627. 

  1627.                   </td>
    1628. 

  1628. <td>
    1629. 

  1629.                     <p>
    1630. 

  1630.                       Specify where queries should be logged to.
    1631. 

  1631.                     </p>
    1632. 

  1632.                     <p>
    1633. 

  1633.                       At startup, specifying the category <span><strong class="command">queries</strong></span> will also
    1634. 

  1634.                       enable query logging unless <span><strong class="command">querylog</strong></span> option has been
    1635. 

  1635.                       specified.
    1636. 

  1636.                     </p>
    1637. 

  1637. 

  1638.                     <p>
    1639. 

  1639.                       The query log entry reports the client's IP
    1640. 

  1640.                       address and port number, and the query name,
    1641. 

  1641.                       class and type.  Next it reports whether the
    1642. 

  1642.                       Recursion Desired flag was set (+ if set, -
    1643. 

  1643.                       if not set), if the query was signed (S),
    1644. 

  1644.                       EDNS was in use (E), if TCP was used (T), if
    1645. 

  1645.                       DO (DNSSEC Ok) was set (D), or if CD (Checking
    1646. 

  1646.                       Disabled) was set (C).  After this the
    1647. 

  1647.                       destination address the query was sent to is
    1648. 

  1648.                       reported.
    1649. 

  1649.                     </p>
    1650. 

  1650. 

  1651.                     <p>
    1652. 

  1652.                       <code class="computeroutput">client 127.0.0.1#62536: query: www.example.com IN AAAA +SE</code>
    1653. 

  1653.                     </p>
    1654. 

  1654.                     <p>
    1655. 

  1655.                       <code class="computeroutput">client ::1#62537: query: www.example.net IN AAAA -SE</code>
    1656. 

  1656.                     </p>
    1657. 

  1657.                   </td>
    1658. 

  1658. </tr>
    1659. 

  1659. <tr>
    1660. 

  1660. <td>
    1661. 

  1661.                     <p><span><strong class="command">query-errors</strong></span></p>
    1662. 

  1662.                   </td>
    1663. 

  1663. <td>
    1664. 

  1664.                     <p>
    1665. 

  1665.                       Information about queries that resulted in some
    1666. 

  1666.                       failure.
    1667. 

  1667.                     </p>
    1668. 

  1668.                   </td>
    1669. 

  1669. </tr>
    1670. 

  1670. <tr>
    1671. 

  1671. <td>
    1672. 

  1672.                     <p><span><strong class="command">dispatch</strong></span></p>
    1673. 

  1673.                   </td>
    1674. 

  1674. <td>
    1675. 

  1675.                     <p>
    1676. 

  1676.                       Dispatching of incoming packets to the
    1677. 

  1677.                       server modules where they are to be processed.
    1678. 

  1678.                     </p>
    1679. 

  1679.                   </td>
    1680. 

  1680. </tr>
    1681. 

  1681. <tr>
    1682. 

  1682. <td>
    1683. 

  1683.                     <p><span><strong class="command">dnssec</strong></span></p>
    1684. 

  1684.                   </td>
    1685. 

  1685. <td>
    1686. 

  1686.                     <p>
    1687. 

  1687.                       DNSSEC and TSIG protocol processing.
    1688. 

  1688.                     </p>
    1689. 

  1689.                   </td>
    1690. 

  1690. </tr>
    1691. 

  1691. <tr>
    1692. 

  1692. <td>
    1693. 

  1693.                     <p><span><strong class="command">lame-servers</strong></span></p>
    1694. 

  1694.                   </td>
    1695. 

  1695. <td>
    1696. 

  1696.                     <p>
    1697. 

  1697.                       Lame servers.  These are misconfigurations
    1698. 

  1698.                       in remote servers, discovered by BIND 9 when trying to
    1699. 

  1699.                       query those servers during resolution.
    1700. 

  1700.                     </p>
    1701. 

  1701.                   </td>
    1702. 

  1702. </tr>
    1703. 

  1703. <tr>
    1704. 

  1704. <td>
    1705. 

  1705.                     <p><span><strong class="command">delegation-only</strong></span></p>
    1706. 

  1706.                   </td>
    1707. 

  1707. <td>
    1708. 

  1708.                     <p>
    1709. 

  1709.                       Delegation only.  Logs queries that have been
    1710. 

  1710.                       forced to NXDOMAIN as the result of a
    1711. 

  1711.                       delegation-only zone or a
    1712. 

  1712.                       <span><strong class="command">delegation-only</strong></span> in a hint
    1713. 

  1713.                       or stub zone declaration.
    1714. 

  1714.                     </p>
    1715. 

  1715.                   </td>
    1716. 

  1716. </tr>
    1717. 

  1717. <tr>
    1718. 

  1718. <td>
    1719. 

  1719.                     <p><span><strong class="command">edns-disabled</strong></span></p>
    1720. 

  1720.                   </td>
    1721. 

  1721. <td>
    1722. 

  1722.                     <p>
    1723. 

  1723.                       Log queries that have been forced to use plain
    1724. 

  1724.                       DNS due to timeouts.  This is often due to
    1725. 

  1725.                       the remote servers not being RFC 1034 compliant
    1726. 

  1726.                       (not always returning FORMERR or similar to
    1727. 

  1727.                       EDNS queries and other extensions to the DNS
    1728. 

  1728.                       when they are not understood).  In other words, this is
    1729. 

  1729.                       targeted at servers that fail to respond to
    1730. 

  1730.                       DNS queries that they don't understand.
    1731. 

  1731.                     </p>
    1732. 

  1732.                     <p>
    1733. 

  1733.                       Note: the log message can also be due to
    1734. 

  1734.                       packet loss.  Before reporting servers for
    1735. 

  1735.                       non-RFC 1034 compliance they should be re-tested
    1736. 

  1736.                       to determine the nature of the non-compliance.
    1737. 

  1737.                       This testing should prevent or reduce the
    1738. 

  1738.                       number of false-positive reports.
    1739. 

  1739.                     </p>
    1740. 

  1740.                     <p>
    1741. 

  1741.                       Note: eventually <span><strong class="command">named</strong></span> will have to stop
    1742. 

  1742.                       treating such timeouts as due to RFC 1034 non
    1743. 

  1743.                       compliance and start treating it as plain
    1744. 

  1744.                       packet loss.  Falsely classifying packet
    1745. 

  1745.                       loss as due to RFC 1034 non compliance impacts
    1746. 

  1746.                       on DNSSEC validation which requires EDNS for
    1747. 

  1747.                       the DNSSEC records to be returned.
    1748. 

  1748.                     </p>
    1749. 

  1749.                   </td>
    1750. 

  1750. </tr>
    1751. 

  1751. <tr>
    1752. 

  1752. <td>
    1753. 

  1753.                     <p><span><strong class="command">RPZ</strong></span></p>
    1754. 

  1754.                   </td>
    1755. 

  1755. <td>
    1756. 

  1756.                     <p>
    1757. 

  1757.                       Information about errors in response policy zone files,
    1758. 

  1758.                       rewritten responses, and at the highest
    1759. 

  1759.                       <span><strong class="command">debug</strong></span> levels, mere rewriting
    1760. 

  1760.                       attempts.
    1761. 

  1761.                     </p>
    1762. 

  1762.                   </td>
    1763. 

  1763. </tr>
    1764. 

  1764. </tbody>
    1765. 

  1765. </table></div>
    1766. 

  1766. </div>
    1767. 

  1767. <div class="sect3" lang="en">
    1768. 

  1768. <div class="titlepage"><div><div><h4 class="title">
    1769. 

  1769. <a name="id2577322"></a>The <span><strong class="command">query-errors</strong></span> Category</h4></div></div></div>
    1770. 

  1770. <p>
    1771. 

  1771.             The <span><strong class="command">query-errors</strong></span> category is
    1772. 

  1772.             specifically intended for debugging purposes: To identify
    1773. 

  1773.             why and how specific queries result in responses which
    1774. 

  1774.             indicate an error.
    1775. 

  1775.             Messages of this category are therefore only logged
    1776. 

  1776.             with <span><strong class="command">debug</strong></span> levels.
    1777. 

  1777.           </p>
    1778. 

  1778. <p>
    1779. 

  1779.             At the debug levels of 1 or higher, each response with the
    1780. 

  1780.             rcode of SERVFAIL is logged as follows:
    1781. 

  1781.           </p>
    1782. 

  1782. <p>
    1783. 

  1783.             <code class="computeroutput">client 127.0.0.1#61502: query failed (SERVFAIL) for www.example.com/IN/AAAA at query.c:3880</code>
    1784. 

  1784.           </p>
    1785. 

  1785. <p>
    1786. 

  1786.             This means an error resulting in SERVFAIL was
    1787. 

  1787.             detected at line 3880 of source file
    1788. 

  1788.             <code class="filename">query.c</code>.
    1789. 

  1789.             Log messages of this level will particularly
    1790. 

  1790.             help identify the cause of SERVFAIL for an
    1791. 

  1791.             authoritative server.
    1792. 

  1792.           </p>
    1793. 

  1793. <p>
    1794. 

  1794.             At the debug levels of 2 or higher, detailed context
    1795. 

  1795.             information of recursive resolutions that resulted in
    1796. 

  1796.             SERVFAIL is logged.
    1797. 

  1797.             The log message will look like as follows:
    1798. 

  1798.           </p>
    1799. 

  1799. <p>
    1800. 

  1800. 

  1801.             </p>
    1802. 

  1802. <pre class="programlisting">
    1803. 

  1803. fetch completed at resolver.c:2970 for www.example.com/A
    1804. 

  1804. in 30.000183: timed out/success [domain:example.com,
    1805. 

  1805. referral:2,restart:7,qrysent:8,timeout:5,lame:0,neterr:0,
    1806. 

  1806. badresp:1,adberr:0,findfail:0,valfail:0]
    1807. 

  1807.             </pre>
    1808. 

  1808. <p>
    1809. 

  1809.           </p>
    1810. 

  1810. <p>
    1811. 

  1811.             The first part before the colon shows that a recursive
    1812. 

  1812.             resolution for AAAA records of www.example.com completed
    1813. 

  1813.             in 30.000183 seconds and the final result that led to the
    1814. 

  1814.             SERVFAIL was determined at line 2970 of source file
    1815. 

  1815.             <code class="filename">resolver.c</code>.
    1816. 

  1816.           </p>
    1817. 

  1817. <p>
    1818. 

  1818.             The following part shows the detected final result and the
    1819. 

  1819.             latest result of DNSSEC validation.
    1820. 

  1820.             The latter is always success when no validation attempt
    1821. 

  1821.             is made.
    1822. 

  1822.             In this example, this query resulted in SERVFAIL probably
    1823. 

  1823.             because all name servers are down or unreachable, leading
    1824. 

  1824.             to a timeout in 30 seconds.
    1825. 

  1825.             DNSSEC validation was probably not attempted.
    1826. 

  1826.           </p>
    1827. 

  1827. <p>
    1828. 

  1828.             The last part enclosed in square brackets shows statistics
    1829. 

  1829.             information collected for this particular resolution
    1830. 

  1830.             attempt.
    1831. 

  1831.             The <code class="varname">domain</code> field shows the deepest zone
    1832. 

  1832.             that the resolver reached;
    1833. 

  1833.             it is the zone where the error was finally detected.
    1834. 

  1834.             The meaning of the other fields is summarized in the
    1835. 

  1835.             following table.
    1836. 

  1836.           </p>
    1837. 

  1837. <div class="informaltable"><table border="1">
    1838. 

  1838. <colgroup>
    1839. 

  1839. <col>
    1840. 

  1840. <col>
    1841. 

  1841. </colgroup>
    1842. 

  1842. <tbody>
    1843. 

  1843. <tr>
    1844. 

  1844. <td>
    1845. 

  1845.                     <p><code class="varname">referral</code></p>
    1846. 

  1846.                   </td>
    1847. 

  1847. <td>
    1848. 

  1848.                     <p>
    1849. 

  1849.                       The number of referrals the resolver received
    1850. 

  1850.                       throughout the resolution process.
    1851. 

  1851.                       In the above example this is 2, which are most
    1852. 

  1852.                       likely com and example.com.
    1853. 

  1853.                     </p>
    1854. 

  1854.                   </td>
    1855. 

  1855. </tr>
    1856. 

  1856. <tr>
    1857. 

  1857. <td>
    1858. 

  1858.                     <p><code class="varname">restart</code></p>
    1859. 

  1859.                   </td>
    1860. 

  1860. <td>
    1861. 

  1861.                     <p>
    1862. 

  1862.                       The number of cycles that the resolver tried
    1863. 

  1863.                       remote servers at the <code class="varname">domain</code>
    1864. 

  1864.                       zone.
    1865. 

  1865.                       In each cycle the resolver sends one query
    1866. 

  1866.                       (possibly resending it, depending on the response)
    1867. 

  1867.                       to each known name server of
    1868. 

  1868.                       the <code class="varname">domain</code> zone.
    1869. 

  1869.                     </p>
    1870. 

  1870.                   </td>
    1871. 

  1871. </tr>
    1872. 

  1872. <tr>
    1873. 

  1873. <td>
    1874. 

  1874.                     <p><code class="varname">qrysent</code></p>
    1875. 

  1875.                   </td>
    1876. 

  1876. <td>
    1877. 

  1877.                     <p>
    1878. 

  1878.                       The number of queries the resolver sent at the
    1879. 

  1879.                       <code class="varname">domain</code> zone.
    1880. 

  1880.                     </p>
    1881. 

  1881.                   </td>
    1882. 

  1882. </tr>
    1883. 

  1883. <tr>
    1884. 

  1884. <td>
    1885. 

  1885.                     <p><code class="varname">timeout</code></p>
    1886. 

  1886.                   </td>
    1887. 

  1887. <td>
    1888. 

  1888.                     <p>
    1889. 

  1889.                       The number of timeouts since the resolver
    1890. 

  1890.                       received the last response.
    1891. 

  1891.                     </p>
    1892. 

  1892.                   </td>
    1893. 

  1893. </tr>
    1894. 

  1894. <tr>
    1895. 

  1895. <td>
    1896. 

  1896.                     <p><code class="varname">lame</code></p>
    1897. 

  1897.                   </td>
    1898. 

  1898. <td>
    1899. 

  1899.                     <p>
    1900. 

  1900.                       The number of lame servers the resolver detected
    1901. 

  1901.                       at the <code class="varname">domain</code> zone.
    1902. 

  1902.                       A server is detected to be lame either by an
    1903. 

  1903.                       invalid response or as a result of lookup in
    1904. 

  1904.                       BIND9's address database (ADB), where lame
    1905. 

  1905.                       servers are cached.
    1906. 

  1906.                     </p>
    1907. 

  1907.                   </td>
    1908. 

  1908. </tr>
    1909. 

  1909. <tr>
    1910. 

  1910. <td>
    1911. 

  1911.                     <p><code class="varname">neterr</code></p>
    1912. 

  1912.                   </td>
    1913. 

  1913. <td>
    1914. 

  1914.                     <p>
    1915. 

  1915.                       The number of erroneous results that the
    1916. 

  1916.                       resolver encountered in sending queries
    1917. 

  1917.                       at the <code class="varname">domain</code> zone.
    1918. 

  1918.                       One common case is the remote server is
    1919. 

  1919.                       unreachable and the resolver receives an ICMP
    1920. 

  1920.                       unreachable error message.
    1921. 

  1921.                     </p>
    1922. 

  1922.                   </td>
    1923. 

  1923. </tr>
    1924. 

  1924. <tr>
    1925. 

  1925. <td>
    1926. 

  1926.                     <p><code class="varname">badresp</code></p>
    1927. 

  1927.                   </td>
    1928. 

  1928. <td>
    1929. 

  1929.                     <p>
    1930. 

  1930.                       The number of unexpected responses (other than
    1931. 

  1931.                       <code class="varname">lame</code>) to queries sent by the
    1932. 

  1932.                       resolver at the <code class="varname">domain</code> zone.
    1933. 

  1933.                     </p>
    1934. 

  1934.                   </td>
    1935. 

  1935. </tr>
    1936. 

  1936. <tr>
    1937. 

  1937. <td>
    1938. 

  1938.                     <p><code class="varname">adberr</code></p>
    1939. 

  1939.                   </td>
    1940. 

  1940. <td>
    1941. 

  1941.                     <p>
    1942. 

  1942.                       Failures in finding remote server addresses
    1943. 

  1943.                       of the <code class="varname">domain</code> zone in the ADB.
    1944. 

  1944.                       One common case of this is that the remote
    1945. 

  1945.                       server's name does not have any address records.
    1946. 

  1946.                     </p>
    1947. 

  1947.                   </td>
    1948. 

  1948. </tr>
    1949. 

  1949. <tr>
    1950. 

  1950. <td>
    1951. 

  1951.                     <p><code class="varname">findfail</code></p>
    1952. 

  1952.                   </td>
    1953. 

  1953. <td>
    1954. 

  1954.                     <p>
    1955. 

  1955.                       Failures of resolving remote server addresses.
    1956. 

  1956.                       This is a total number of failures throughout
    1957. 

  1957.                       the resolution process.
    1958. 

  1958.                     </p>
    1959. 

  1959.                   </td>
    1960. 

  1960. </tr>
    1961. 

  1961. <tr>
    1962. 

  1962. <td>
    1963. 

  1963.                     <p><code class="varname">valfail</code></p>
    1964. 

  1964.                   </td>
    1965. 

  1965. <td>
    1966. 

  1966.                     <p>
    1967. 

  1967.                       Failures of DNSSEC validation.
    1968. 

  1968.                       Validation failures are counted throughout
    1969. 

  1969.                       the resolution process (not limited to
    1970. 

  1970.                       the <code class="varname">domain</code> zone), but should
    1971. 

  1971.                       only happen in <code class="varname">domain</code>.
    1972. 

  1972.                     </p>
    1973. 

  1973.                   </td>
    1974. 

  1974. </tr>
    1975. 

  1975. </tbody>
    1976. 

  1976. </table></div>
    1977. 

  1977. <p>
    1978. 

  1978.             At the debug levels of 3 or higher, the same messages
    1979. 

  1979.             as those at the debug 1 level are logged for other errors
    1980. 

  1980.             than SERVFAIL.
    1981. 

  1981.             Note that negative responses such as NXDOMAIN are not
    1982. 

  1982.             regarded as errors here.
    1983. 

  1983.           </p>
    1984. 

  1984. <p>
    1985. 

  1985.             At the debug levels of 4 or higher, the same messages
    1986. 

  1986.             as those at the debug 2 level are logged for other errors
    1987. 

  1987.             than SERVFAIL.
    1988. 

  1988.             Unlike the above case of level 3, messages are logged for
    1989. 

  1989.             negative responses.
    1990. 

  1990.             This is because any unexpected results can be difficult to
    1991. 

  1991.             debug in the recursion case.
    1992. 

  1992.           </p>
    1993. 

  1993. </div>
    1994. 

  1994. </div>
    1995. 

  1995. <div class="sect2" lang="en">
    1996. 

  1996. <div class="titlepage"><div><div><h3 class="title">
    1997. 

  1997. <a name="id2577910"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div>
    1998. 

  1998. <p>
    1999. 

  1999.            This is the grammar of the <span><strong class="command">lwres</strong></span>
    2000. 

  2000.           statement in the <code class="filename">named.conf</code> file:
    2001. 

  2001.         </p>
    2002. 

  2002. <pre class="programlisting"><span><strong class="command">lwres</strong></span> {
    2003. 

  2003.     [<span class="optional"> listen-on { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
    2004. 

  2004.                 [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
    2005. 

  2005.     [<span class="optional"> view <em class="replaceable"><code>view_name</code></em>; </span>]
    2006. 

  2006.     [<span class="optional"> search { <em class="replaceable"><code>domain_name</code></em> ; [<span class="optional"> <em class="replaceable"><code>domain_name</code></em> ; ... </span>] }; </span>]
    2007. 

  2007.     [<span class="optional"> ndots <em class="replaceable"><code>number</code></em>; </span>]
    2008. 

  2008. };
    2009. 

  2009. </pre>
    2010. 

  2010. </div>
    2011. 

  2011. <div class="sect2" lang="en">
    2012. 

  2012. <div class="titlepage"><div><div><h3 class="title">
    2013. 

  2013. <a name="id2577984"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div>
    2014. 

  2014. <p>
    2015. 

  2015.           The <span><strong class="command">lwres</strong></span> statement configures the
    2016. 

  2016.           name
    2017. 

  2017.           server to also act as a lightweight resolver server. (See
    2018. 

  2018.           <a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called &#8220;Running a Resolver Daemon&#8221;</a>.)  There may be multiple
    2019. 

  2019.           <span><strong class="command">lwres</strong></span> statements configuring
    2020. 

  2020.           lightweight resolver servers with different properties.
    2021. 

  2021.         </p>
    2022. 

  2022. <p>
    2023. 

  2023.           The <span><strong class="command">listen-on</strong></span> statement specifies a
    2024. 

  2024.           list of
    2025. 

  2025.           addresses (and ports) that this instance of a lightweight resolver
    2026. 

  2026.           daemon
    2027. 

  2027.           should accept requests on.  If no port is specified, port 921 is
    2028. 

  2028.           used.
    2029. 

  2029.           If this statement is omitted, requests will be accepted on
    2030. 

  2030.           127.0.0.1,
    2031. 

  2031.           port 921.
    2032. 

  2032.         </p>
    2033. 

  2033. <p>
    2034. 

  2034.           The <span><strong class="command">view</strong></span> statement binds this
    2035. 

  2035.           instance of a
    2036. 

  2036.           lightweight resolver daemon to a view in the DNS namespace, so that
    2037. 

  2037.           the
    2038. 

  2038.           response will be constructed in the same manner as a normal DNS
    2039. 

  2039.           query
    2040. 

  2040.           matching this view.  If this statement is omitted, the default view
    2041. 

  2041.           is
    2042. 

  2042.           used, and if there is no default view, an error is triggered.
    2043. 

  2043.         </p>
    2044. 

  2044. <p>
    2045. 

  2045.           The <span><strong class="command">search</strong></span> statement is equivalent to
    2046. 

  2046.           the
    2047. 

  2047.           <span><strong class="command">search</strong></span> statement in
    2048. 

  2048.           <code class="filename">/etc/resolv.conf</code>.  It provides a
    2049. 

  2049.           list of domains
    2050. 

  2050.           which are appended to relative names in queries.
    2051. 

  2051.         </p>
    2052. 

  2052. <p>
    2053. 

  2053.           The <span><strong class="command">ndots</strong></span> statement is equivalent to
    2054. 

  2054.           the
    2055. 

  2055.           <span><strong class="command">ndots</strong></span> statement in
    2056. 

  2056.           <code class="filename">/etc/resolv.conf</code>.  It indicates the
    2057. 

  2057.           minimum
    2058. 

  2058.           number of dots in a relative domain name that should result in an
    2059. 

  2059.           exact match lookup before search path elements are appended.
    2060. 

  2060.         </p>
    2061. 

  2061. </div>
    2062. 

  2062. <div class="sect2" lang="en">
    2063. 

  2063. <div class="titlepage"><div><div><h3 class="title">
    2064. 

  2064. <a name="id2578116"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div>
    2065. 

  2065. <pre class="programlisting">
    2066. 

  2066. <span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | 
    2067. 

  2067.       <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] };
    2068. 

  2068. </pre>
    2069. 

  2069. </div>
    2070. 

  2070. <div class="sect2" lang="en">
    2071. 

  2071. <div class="titlepage"><div><div><h3 class="title">
    2072. 

  2072. <a name="id2578160"></a><span><strong class="command">masters</strong></span> Statement Definition and
    2073. 

  2073.           Usage</h3></div></div></div>
    2074. 

  2074. <p><span><strong class="command">masters</strong></span>
    2075. 

  2075.           lists allow for a common set of masters to be easily used by
    2076. 

  2076.           multiple stub and slave zones.
    2077. 

  2077.         </p>
    2078. 

  2078. </div>
    2079. 

  2079. <div class="sect2" lang="en">
    2080. 

  2080. <div class="titlepage"><div><div><h3 class="title">
    2081. 

  2081. <a name="id2578174"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div>
    2082. 

  2082. <p>
    2083. 

  2083.           This is the grammar of the <span><strong class="command">options</strong></span>
    2084. 

  2084.           statement in the <code class="filename">named.conf</code> file:
    2085. 

  2085.         </p>
    2086. 

  2086. <pre class="programlisting"><span><strong class="command">options</strong></span> {
    2087. 

  2087.     [<span class="optional"> attach-cache <em class="replaceable"><code>cache_name</code></em>; </span>]
    2088. 

  2088.     [<span class="optional"> version <em class="replaceable"><code>version_string</code></em>; </span>]
    2089. 

  2089.     [<span class="optional"> hostname <em class="replaceable"><code>hostname_string</code></em>; </span>]
    2090. 

  2090.     [<span class="optional"> server-id <em class="replaceable"><code>server_id_string</code></em>; </span>]
    2091. 

  2091.     [<span class="optional"> directory <em class="replaceable"><code>path_name</code></em>; </span>]
    2092. 

  2092.     [<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
    2093. 

  2093.     [<span class="optional"> managed-keys-directory <em class="replaceable"><code>path_name</code></em>; </span>]
    2094. 

  2094.     [<span class="optional"> named-xfer <em class="replaceable"><code>path_name</code></em>; </span>]
    2095. 

  2095.     [<span class="optional"> tkey-gssapi-keytab <em class="replaceable"><code>path_name</code></em>; </span>]
    2096. 

  2096.     [<span class="optional"> tkey-gssapi-credential <em class="replaceable"><code>principal</code></em>; </span>]
    2097. 

  2097.     [<span class="optional"> tkey-domain <em class="replaceable"><code>domainname</code></em>; </span>]
    2098. 

  2098.     [<span class="optional"> tkey-dhkey <em class="replaceable"><code>key_name</code></em> <em class="replaceable"><code>key_tag</code></em>; </span>]
    2099. 

  2099.     [<span class="optional"> cache-file <em class="replaceable"><code>path_name</code></em>; </span>]
    2100. 

  2100.     [<span class="optional"> dump-file <em class="replaceable"><code>path_name</code></em>; </span>]
    2101. 

  2101.     [<span class="optional"> bindkeys-file <em class="replaceable"><code>path_name</code></em>; </span>]
    2102. 

  2102.     [<span class="optional"> secroots-file <em class="replaceable"><code>path_name</code></em>; </span>]
    2103. 

  2103.     [<span class="optional"> session-keyfile <em class="replaceable"><code>path_name</code></em>; </span>]
    2104. 

  2104.     [<span class="optional"> session-keyname <em class="replaceable"><code>key_name</code></em>; </span>]
    2105. 

  2105.     [<span class="optional"> session-keyalg <em class="replaceable"><code>algorithm_id</code></em>; </span>]
    2106. 

  2106.     [<span class="optional"> memstatistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2107. 

  2107.     [<span class="optional"> memstatistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
    2108. 

  2108.     [<span class="optional"> pid-file <em class="replaceable"><code>path_name</code></em>; </span>]
    2109. 

  2109.     [<span class="optional"> recursing-file <em class="replaceable"><code>path_name</code></em>; </span>]
    2110. 

  2110.     [<span class="optional"> statistics-file <em class="replaceable"><code>path_name</code></em>; </span>]
    2111. 

  2111.     [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2112. 

  2112.     [<span class="optional"> auth-nxdomain <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2113. 

  2113.     [<span class="optional"> deallocate-on-exit <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2114. 

  2114.     [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em>; </span>]
    2115. 

  2115.     [<span class="optional"> fake-iquery <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2116. 

  2116.     [<span class="optional"> fetch-glue <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2117. 

  2117.     [<span class="optional"> flush-zones-on-shutdown <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2118. 

  2118.     [<span class="optional"> has-old-clients <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2119. 

  2119.     [<span class="optional"> host-statistics <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2120. 

  2120.     [<span class="optional"> host-statistics-max <em class="replaceable"><code>number</code></em>; </span>]
    2121. 

  2121.     [<span class="optional"> minimal-responses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2122. 

  2122.     [<span class="optional"> multiple-cnames <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2123. 

  2123.     [<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em>; </span>]
    2124. 

  2124.     [<span class="optional"> recursion <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2125. 

  2125.     [<span class="optional"> rfc2308-type1 <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2126. 

  2126.     [<span class="optional"> use-id-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2127. 

  2127.     [<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2128. 

  2128.     [<span class="optional"> ixfr-from-differences (<em class="replaceable"><code>yes_or_no</code></em> | <code class="constant">master</code> | <code class="constant">slave</code>); </span>]
    2129. 

  2129.     [<span class="optional"> dnssec-enable <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2130. 

  2130.     [<span class="optional"> dnssec-validation (<em class="replaceable"><code>yes_or_no</code></em> | <code class="constant">auto</code>); </span>]
    2131. 

  2131.     [<span class="optional"> dnssec-lookaside ( <em class="replaceable"><code>auto</code></em> |
    2132. 

  2132.                         <em class="replaceable"><code>no</code></em> |
    2133. 

  2133.                         <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em> ); </span>]
    2134. 

  2134.     [<span class="optional"> dnssec-must-be-secure <em class="replaceable"><code>domain yes_or_no</code></em>; </span>]
    2135. 

  2135.     [<span class="optional"> dnssec-accept-expired <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2136. 

  2136.     [<span class="optional"> forward ( <em class="replaceable"><code>only</code></em> | <em class="replaceable"><code>first</code></em> ); </span>]
    2137. 

  2137.     [<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
    2138. 

  2138.     [<span class="optional"> dual-stack-servers [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] {
    2139. 

  2139.         ( <em class="replaceable"><code>domain_name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] |
    2140. 

  2140.           <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ) ; 
    2141. 

  2141.         ... }; </span>]
    2142. 

  2142.     [<span class="optional"> check-names ( <em class="replaceable"><code>master</code></em> | <em class="replaceable"><code>slave</code></em> | <em class="replaceable"><code>response</code></em> )
    2143. 

  2143.         ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
    2144. 

  2144.     [<span class="optional"> check-dup-records ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
    2145. 

  2145.     [<span class="optional"> check-mx ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
    2146. 

  2146.     [<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2147. 

  2147.     [<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2148. 

  2148.     [<span class="optional"> check-mx-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
    2149. 

  2149.     [<span class="optional"> check-srv-cname ( <em class="replaceable"><code>warn</code></em> | <em class="replaceable"><code>fail</code></em> | <em class="replaceable"><code>ignore</code></em> ); </span>]
    2150. 

  2150.     [<span class="optional"> check-sibling <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2151. 

  2151.     [<span class="optional"> allow-new-zones { <em class="replaceable"><code>yes_or_no</code></em> }; </span>]
    2152. 

  2152.     [<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2153. 

  2153.     [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2154. 

  2154.     [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2155. 

  2155.     [<span class="optional"> allow-query-cache { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2156. 

  2156.     [<span class="optional"> allow-query-cache-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2157. 

  2157.     [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2158. 

  2158.     [<span class="optional"> allow-recursion { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2159. 

  2159.     [<span class="optional"> allow-recursion-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2160. 

  2160.     [<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2161. 

  2161.     [<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2162. 

  2162.     [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2163. 

  2163.     [<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2164. 

  2164.     [<span class="optional"> dnssec-secure-to-insecure <em class="replaceable"><code>yes_or_no</code></em> ;</span>]
    2165. 

  2165.     [<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2166. 

  2166.     [<span class="optional"> allow-v6-synthesis { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2167. 

  2167.     [<span class="optional"> blackhole { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2168. 

  2168.     [<span class="optional"> use-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
    2169. 

  2169.     [<span class="optional"> avoid-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
    2170. 

  2170.     [<span class="optional"> use-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
    2171. 

  2171.     [<span class="optional"> avoid-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
    2172. 

  2172.     [<span class="optional"> listen-on [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2173. 

  2173.     [<span class="optional"> listen-on-v6 [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2174. 

  2174.     [<span class="optional"> query-source ( ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> )
    2175. 

  2175.         [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] |
    2176. 

  2176.         [<span class="optional"> address ( <em class="replaceable"><code>ip4_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
    2177. 

  2177.         [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
    2178. 

  2178.     [<span class="optional"> query-source-v6 ( ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> )
    2179. 

  2179.         [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] | 
    2180. 

  2180.         [<span class="optional"> address ( <em class="replaceable"><code>ip6_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] 
    2181. 

  2181.         [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>] ) ; </span>]
    2182. 

  2182.     [<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2183. 

  2183.     [<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
    2184. 

  2184.     [<span class="optional"> queryport-pool-updateinterval <em class="replaceable"><code>number</code></em>; </span>]
    2185. 

  2185.     [<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em>; </span>]
    2186. 

  2186.     [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em>; </span>]
    2187. 

  2187.     [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em>; </span>]
    2188. 

  2188.     [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em>; </span>]
    2189. 

  2189.     [<span class="optional"> tcp-clients <em class="replaceable"><code>number</code></em>; </span>]
    2190. 

  2190.     [<span class="optional"> reserved-sockets <em class="replaceable"><code>number</code></em>; </span>]
    2191. 

  2191.     [<span class="optional"> recursive-clients <em class="replaceable"><code>number</code></em>; </span>]
    2192. 

  2192.     [<span class="optional"> serial-query-rate <em class="replaceable"><code>number</code></em>; </span>]
    2193. 

  2193.     [<span class="optional"> serial-queries <em class="replaceable"><code>number</code></em>; </span>]
    2194. 

  2194.     [<span class="optional"> tcp-listen-queue <em class="replaceable"><code>number</code></em>; </span>]
    2195. 

  2195.     [<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em>; </span>]
    2196. 

  2196.     [<span class="optional"> transfers-in  <em class="replaceable"><code>number</code></em>; </span>]
    2197. 

  2197.     [<span class="optional"> transfers-out <em class="replaceable"><code>number</code></em>; </span>]
    2198. 

  2198.     [<span class="optional"> transfers-per-ns <em class="replaceable"><code>number</code></em>; </span>]
    2199. 

  2199.     [<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    2200. 

  2200.     [<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    2201. 

  2201.     [<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    2202. 

  2202.     [<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
    2203. 

  2203.                              [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    2204. 

  2204.     [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2205. 

  2205.     [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>]
    2206. 

  2206.     [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    2207. 

  2207.     [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    2208. 

  2208.     [<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    2209. 

  2209.     [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
    2210. 

  2210.                   [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
    2211. 

  2211.     [<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em>; </span>]
    2212. 

  2212.     [<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
    2213. 

  2213.     [<span class="optional"> coresize <em class="replaceable"><code>size_spec</code></em> ; </span>]
    2214. 

  2214.     [<span class="optional"> datasize <em class="replaceable"><code>size_spec</code></em> ; </span>]
    2215. 

  2215.     [<span class="optional"> files <em class="replaceable"><code>size_spec</code></em> ; </span>]
    2216. 

  2216.     [<span class="optional"> stacksize <em class="replaceable"><code>size_spec</code></em> ; </span>]
    2217. 

  2217.     [<span class="optional"> cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
    2218. 

  2218.     [<span class="optional"> heartbeat-interval <em class="replaceable"><code>number</code></em>; </span>]
    2219. 

  2219.     [<span class="optional"> interface-interval <em class="replaceable"><code>number</code></em>; </span>]
    2220. 

  2220.     [<span class="optional"> statistics-interval <em class="replaceable"><code>number</code></em>; </span>]
    2221. 

  2221.     [<span class="optional"> topology { <em class="replaceable"><code>address_match_list</code></em> }</span>];
    2222. 

  2222.     [<span class="optional"> sortlist { <em class="replaceable"><code>address_match_list</code></em> }</span>];
    2223. 

  2223.     [<span class="optional"> rrset-order { <em class="replaceable"><code>order_spec</code></em> ; [<span class="optional"> <em class="replaceable"><code>order_spec</code></em> ; ... </span>] </span>] };
    2224. 

  2224.     [<span class="optional"> lame-ttl <em class="replaceable"><code>number</code></em>; </span>]
    2225. 

  2225.     [<span class="optional"> max-ncache-ttl <em class="replaceable"><code>number</code></em>; </span>]
    2226. 

  2226.     [<span class="optional"> max-cache-ttl <em class="replaceable"><code>number</code></em>; </span>]
    2227. 

  2227.     [<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
    2228. 

  2228.     [<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
    2229. 

  2229.     [<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
    2230. 

  2230.     [<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
    2231. 

  2231.     [<span class="optional"> min-roots <em class="replaceable"><code>number</code></em>; </span>]
    2232. 

  2232.     [<span class="optional"> use-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    2233. 

  2233.     [<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2234. 

  2234.     [<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2235. 

  2235.     [<span class="optional"> treat-cr-as-space <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    2236. 

  2236.     [<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
    2237. 

  2237.     [<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
    2238. 

  2238.     [<span class="optional"> min-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
    2239. 

  2239.     [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
    2240. 

  2240.     [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em>; </span>]
    2241. 

  2241.     [<span class="optional"> additional-from-auth <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    2242. 

  2242.     [<span class="optional"> additional-from-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    2243. 

  2243.     [<span class="optional"> random-device <em class="replaceable"><code>path_name</code></em> ; </span>]
    2244. 

  2244.     [<span class="optional"> max-cache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
    2245. 

  2245.     [<span class="optional"> match-mapped-addresses <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2246. 

  2246.     [<span class="optional"> filter-aaaa-on-v4 ( <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>break-dnssec</code></em> ); </span>]
    2247. 

  2247.     [<span class="optional"> filter-aaaa { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2248. 

  2248.     [<span class="optional"> dns64 <em class="replaceable"><code>IPv6-prefix</code></em> {
    2249. 

  2249.         [<span class="optional"> clients { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2250. 

  2250.         [<span class="optional"> mapped { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2251. 

  2251.         [<span class="optional"> exclude { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    2252. 

  2252.         [<span class="optional"> suffix IPv6-address; </span>]
    2253. 

  2253.         [<span class="optional"> recursive-only <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2254. 

  2254.         [<span class="optional"> break-dnssec <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    2255. 

  2255.     }; </span>];
    2256. 

  2256.     [<span class="optional"> dns64-server <em class="replaceable"><code>name</code></em> </span>]
    2257. 

  2257.     [<span class="optional"> dns64-contact <em class="replaceable"><code>name</code></em> </span>]
    2258. 

  2258.     [<span class="optional"> preferred-glue ( <em class="replaceable"><code>A</code></em> | <em class="replaceable"><code>AAAA</code></em> | <em class="replaceable"><code>NONE</code></em> ); </span>]
    2259. 

  2259.     [<span class="optional"> edns-udp-size <em class="replaceable"><code>number</code></em>; </span>]
    2260. 

  2260.     [<span class="optional"> max-udp-size <em class="replaceable"><code>number</code></em>; </span>]
    2261. 

  2261.     [<span class="optional"> root-delegation-only [<span class="optional"> exclude { <em class="replaceable"><code>namelist</code></em> } </span>] ; </span>]
    2262. 

  2262.     [<span class="optional"> querylog <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    2263. 

  2263.     [<span class="optional"> disable-algorithms <em class="replaceable"><code>domain</code></em> { <em class="replaceable"><code>algorithm</code></em>;
    2264. 

  2264.                                 [<span class="optional"> <em class="replaceable"><code>algorithm</code></em>; </span>] }; </span>]
    2265. 

  2265.     [<span class="optional"> acache-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    2266. 

  2266.     [<span class="optional"> acache-cleaning-interval <em class="replaceable"><code>number</code></em>; </span>]
    2267. 

  2267.     [<span class="optional"> max-acache-size <em class="replaceable"><code>size_spec</code></em> ; </span>]
    2268. 

  2268.     [<span class="optional"> clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
    2269. 

  2269.     [<span class="optional"> max-clients-per-query <em class="replaceable"><code>number</code></em> ; </span>]
    2270. 

  2270.     [<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
    2271. 

  2271.     [<span class="optional"> empty-server <em class="replaceable"><code>name</code></em> ; </span>]
    2272. 

  2272.     [<span class="optional"> empty-contact <em class="replaceable"><code>name</code></em> ; </span>]
    2273. 

  2273.     [<span class="optional"> empty-zones-enable <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    2274. 

  2274.     [<span class="optional"> disable-empty-zone <em class="replaceable"><code>zone_name</code></em> ; </span>]
    2275. 

  2275.     [<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    2276. 

  2276.     [<span class="optional"> zero-no-soa-ttl-cache <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    2277. 

  2277.     [<span class="optional"> resolver-query-timeout <em class="replaceable"><code>number</code></em> ; </span>]
    2278. 

  2278.     [<span class="optional"> deny-answer-addresses { <em class="replaceable"><code>address_match_list</code></em> } [<span class="optional"> except-from { <em class="replaceable"><code>namelist</code></em> } </span>];</span>]
    2279. 

  2279.     [<span class="optional"> deny-answer-aliases { <em class="replaceable"><code>namelist</code></em> } [<span class="optional"> except-from { <em class="replaceable"><code>namelist</code></em> } </span>];</span>]
    2280. 

  2280.     [<span class="optional"> response-policy { <em class="replaceable"><code>zone_name</code></em> [<span class="optional"> policy given | disabled | passthru | nxdomain | nodata | cname <em class="replaceable"><code>domain</code></em> </span>] ; } ; </span>]
    2281. 

  2281. };
    2282. 

  2282. </pre>
    2283. 

  2283. </div>
    2284. 

  2284. <div class="sect2" lang="en">
    2285. 

  2285. <div class="titlepage"><div><div><h3 class="title">
    2286. 

  2286. <a name="options"></a><span><strong class="command">options</strong></span> Statement Definition and
    2287. 

  2287.           Usage</h3></div></div></div>
    2288. 

  2288. <p>
    2289. 

  2289.           The <span><strong class="command">options</strong></span> statement sets up global
    2290. 

  2290.           options
    2291. 

  2291.           to be used by <acronym class="acronym">BIND</acronym>. This statement
    2292. 

  2292.           may appear only
    2293. 

  2293.           once in a configuration file. If there is no <span><strong class="command">options</strong></span>
    2294. 

  2294.           statement, an options block with each option set to its default will
    2295. 

  2295.           be used.
    2296. 

  2296.         </p>
    2297. 

  2297. <div class="variablelist"><dl>
    2298. 

  2298. <dt><span class="term"><span><strong class="command">attach-cache</strong></span></span></dt>
    2299. 

  2299. <dd>
    2300. 

  2300. <p>
    2301. 

  2301.                   Allows multiple views to share a single cache
    2302. 

  2302.                   database.
    2303. 

  2303.                   Each view has its own cache database by default, but
    2304. 

  2304.                   if multiple views have the same operational policy
    2305. 

  2305.                   for name resolution and caching, those views can
    2306. 

  2306.                   share a single cache to save memory and possibly
    2307. 

  2307.                   improve resolution efficiency by using this option.
    2308. 

  2308.                 </p>
    2309. 

  2309. <p>
    2310. 

  2310.                   The <span><strong class="command">attach-cache</strong></span> option
    2311. 

  2311.                   may also be specified in <span><strong class="command">view</strong></span>
    2312. 

  2312.                   statements, in which case it overrides the
    2313. 

  2313.                   global <span><strong class="command">attach-cache</strong></span> option.
    2314. 

  2314.                 </p>
    2315. 

  2315. <p>
    2316. 

  2316.                   The <em class="replaceable"><code>cache_name</code></em> specifies
    2317. 

  2317.                   the cache to be shared.
    2318. 

  2318.                   When the <span><strong class="command">named</strong></span> server configures
    2319. 

  2319.                   views which are supposed to share a cache, it
    2320. 

  2320.                   creates a cache with the specified name for the
    2321. 

  2321.                   first view of these sharing views.
    2322. 

  2322.                   The rest of the views will simply refer to the
    2323. 

  2323.                   already created cache.
    2324. 

  2324.                 </p>
    2325. 

  2325. <p>
    2326. 

  2326.                   One common configuration to share a cache would be to
    2327. 

  2327.                   allow all views to share a single cache.
    2328. 

  2328.                   This can be done by specifying
    2329. 

  2329.                   the <span><strong class="command">attach-cache</strong></span> as a global
    2330. 

  2330.                   option with an arbitrary name.
    2331. 

  2331.                 </p>
    2332. 

  2332. <p>
    2333. 

  2333.                   Another possible operation is to allow a subset of
    2334. 

  2334.                   all views to share a cache while the others to
    2335. 

  2335.                   retain their own caches.
    2336. 

  2336.                   For example, if there are three views A, B, and C,
    2337. 

  2337.                   and only A and B should share a cache, specify the
    2338. 

  2338.                   <span><strong class="command">attach-cache</strong></span> option as a view A (or
    2339. 

  2339.                   B)'s option, referring to the other view name:
    2340. 

  2340.                 </p>
    2341. 

  2341. <pre class="programlisting">
    2342. 

  2342.   view "A" {
    2343. 

  2343.     // this view has its own cache
    2344. 

  2344.     ...
    2345. 

  2345.   };
    2346. 

  2346.   view "B" {
    2347. 

  2347.     // this view refers to A's cache
    2348. 

  2348.     attach-cache "A";
    2349. 

  2349.   };
    2350. 

  2350.   view "C" {
    2351. 

  2351.     // this view has its own cache
    2352. 

  2352.     ...
    2353. 

  2353.   };
    2354. 

  2354. </pre>
    2355. 

  2355. <p>
    2356. 

  2356.                   Views that share a cache must have the same policy
    2357. 

  2357.                   on configurable parameters that may affect caching.
    2358. 

  2358.                   The current implementation requires the following
    2359. 

  2359.                   configurable options be consistent among these
    2360. 

  2360.                   views:
    2361. 

  2361.                   <span><strong class="command">check-names</strong></span>,
    2362. 

  2362.                   <span><strong class="command">cleaning-interval</strong></span>,
    2363. 

  2363.                   <span><strong class="command">dnssec-accept-expired</strong></span>,
    2364. 

  2364.                   <span><strong class="command">dnssec-validation</strong></span>,
    2365. 

  2365.                   <span><strong class="command">max-cache-ttl</strong></span>,
    2366. 

  2366.                   <span><strong class="command">max-ncache-ttl</strong></span>,
    2367. 

  2367.                   <span><strong class="command">max-cache-size</strong></span>, and
    2368. 

  2368.                   <span><strong class="command">zero-no-soa-ttl</strong></span>.
    2369. 

  2369.                 </p>
    2370. 

  2370. <p>
    2371. 

  2371.                   Note that there may be other parameters that may
    2372. 

  2372.                   cause confusion if they are inconsistent for
    2373. 

  2373.                   different views that share a single cache.
    2374. 

  2374.                   For example, if these views define different sets of
    2375. 

  2375.                   forwarders that can return different answers for the
    2376. 

  2376.                   same question, sharing the answer does not make
    2377. 

  2377.                   sense or could even be harmful.
    2378. 

  2378.                   It is administrator's responsibility to ensure
    2379. 

  2379.                   configuration differences in different views do
    2380. 

  2380.                   not cause disruption with a shared cache.
    2381. 

  2381.                 </p>
    2382. 

  2382. </dd>
    2383. 

  2383. <dt><span class="term"><span><strong class="command">directory</strong></span></span></dt>
    2384. 

  2384. <dd><p>
    2385. 

  2385.                 The working directory of the server.
    2386. 

  2386.                 Any non-absolute pathnames in the configuration file will be
    2387. 

  2387.                 taken
    2388. 

  2388.                 as relative to this directory. The default location for most
    2389. 

  2389.                 server
    2390. 

  2390.                 output files (e.g. <code class="filename">named.run</code>)
    2391. 

  2391.                 is this directory.
    2392. 

  2392.                 If a directory is not specified, the working directory
    2393. 

  2393.                 defaults to `<code class="filename">.</code>', the directory from
    2394. 

  2394.                 which the server
    2395. 

  2395.                 was started. The directory specified should be an absolute
    2396. 

  2396.                 path.
    2397. 

  2397.               </p></dd>
    2398. 

  2398. <dt><span class="term"><span><strong class="command">key-directory</strong></span></span></dt>
    2399. 

  2399. <dd><p>
    2400. 

  2400.                 When performing dynamic update of secure zones, the
    2401. 

  2401.                 directory where the public and private DNSSEC key files
    2402. 

  2402.                 should be found, if different than the current working
    2403. 

  2403.                 directory.  (Note that this option has no effect on the
    2404. 

  2404.                 paths for files containing non-DNSSEC keys such as
    2405. 

  2405.                 <code class="filename">bind.keys</code>,
    2406. 

  2406.                 <code class="filename">rndc.key</code> or
    2407. 

  2407.                 <code class="filename">session.key</code>.)
    2408. 

  2408.               </p></dd>
    2409. 

  2409. <dt><span class="term"><span><strong class="command">managed-keys-directory</strong></span></span></dt>
    2410. 

  2410. <dd><p>
    2411. 

  2411.                 The directory used to hold the files used to track managed keys.
    2412. 

  2412.                 By default it is the working directory.  It there are no
    2413. 

  2413.                 views then the file <code class="filename">managed-keys.bind</code>
    2414. 

  2414.                 otherwise a SHA256 hash of the view name is used with
    2415. 

  2415.                 <code class="filename">.mkeys</code> extension added.
    2416. 

  2416.               </p></dd>
    2417. 

  2417. <dt><span class="term"><span><strong class="command">named-xfer</strong></span></span></dt>
    2418. 

  2418. <dd><p>
    2419. 

  2419.                 <span class="emphasis"><em>This option is obsolete.</em></span> It
    2420. 

  2420.                 was used in <acronym class="acronym">BIND</acronym> 8 to specify
    2421. 

  2421.                 the pathname to the <span><strong class="command">named-xfer</strong></span>
    2422. 

  2422.                 program.  In <acronym class="acronym">BIND</acronym> 9, no separate
    2423. 

  2423.                 <span><strong class="command">named-xfer</strong></span> program is needed;
    2424. 

  2424.                 its functionality is built into the name server.
    2425. 

  2425.               </p></dd>
    2426. 

  2426. <dt><span class="term"><span><strong class="command">tkey-gssapi-keytab</strong></span></span></dt>
    2427. 

  2427. <dd><p>
    2428. 

  2428.                 The KRB5 keytab file to use for GSS-TSIG updates. If
    2429. 

  2429.                 this option is set and tkey-gssapi-credential is not
    2430. 

  2430.                 set, then updates will be allowed with any key
    2431. 

  2431.                 matching a principal in the specified keytab.
    2432. 

  2432.               </p></dd>
    2433. 

  2433. <dt><span class="term"><span><strong class="command">tkey-gssapi-credential</strong></span></span></dt>
    2434. 

  2434. <dd><p>
    2435. 

  2435.                 The security credential with which the server should
    2436. 

  2436.                 authenticate keys requested by the GSS-TSIG protocol.
    2437. 

  2437.                 Currently only Kerberos 5 authentication is available
    2438. 

  2438.                 and the credential is a Kerberos principal which the
    2439. 

  2439.                 server can acquire through the default system key
    2440. 

  2440.                 file, normally <code class="filename">/etc/krb5.keytab</code>.
    2441. 

  2441.                 The location keytab file can be overridden using the
    2442. 

  2442.                 tkey-gssapi-keytab option. Normally this principal is
    2443. 

  2443.                 of the form "<strong class="userinput"><code>DNS/</code></strong><code class="varname">server.domain</code>".
    2444. 

  2444.                 To use GSS-TSIG, <span><strong class="command">tkey-domain</strong></span> must
    2445. 

  2445.                 also be set if a specific keytab is not set with
    2446. 

  2446.                 tkey-gssapi-keytab.
    2447. 

  2447.               </p></dd>
    2448. 

  2448. <dt><span class="term"><span><strong class="command">tkey-domain</strong></span></span></dt>
    2449. 

  2449. <dd><p>
    2450. 

  2450.                 The domain appended to the names of all shared keys
    2451. 

  2451.                 generated with <span><strong class="command">TKEY</strong></span>.  When a
    2452. 

  2452.                 client requests a <span><strong class="command">TKEY</strong></span> exchange,
    2453. 

  2453.                 it may or may not specify the desired name for the
    2454. 

  2454.                 key. If present, the name of the shared key will
    2455. 

  2455.                 be <code class="varname">client specified part</code> +
    2456. 

  2456.                 <code class="varname">tkey-domain</code>.  Otherwise, the
    2457. 

  2457.                 name of the shared key will be <code class="varname">random hex
    2458. 

  2458.                 digits</code> + <code class="varname">tkey-domain</code>.
    2459. 

  2459.                 In most cases, the <span><strong class="command">domainname</strong></span>
    2460. 

  2460.                 should be the server's domain name, or an otherwise
    2461. 

  2461.                 non-existent subdomain like
    2462. 

  2462.                 "_tkey.<code class="varname">domainname</code>".  If you are
    2463. 

  2463.                 using GSS-TSIG, this variable must be defined, unless
    2464. 

  2464.                 you specify a specific keytab using tkey-gssapi-keytab.
    2465. 

  2465.               </p></dd>
    2466. 

  2466. <dt><span class="term"><span><strong class="command">tkey-dhkey</strong></span></span></dt>
    2467. 

  2467. <dd><p>
    2468. 

  2468.                 The Diffie-Hellman key used by the server
    2469. 

  2469.                 to generate shared keys with clients using the Diffie-Hellman
    2470. 

  2470.                 mode
    2471. 

  2471.                 of <span><strong class="command">TKEY</strong></span>. The server must be
    2472. 

  2472.                 able to load the
    2473. 

  2473.                 public and private keys from files in the working directory.
    2474. 

  2474.                 In
    2475. 

  2475.                 most cases, the keyname should be the server's host name.
    2476. 

  2476.               </p></dd>
    2477. 

  2477. <dt><span class="term"><span><strong class="command">cache-file</strong></span></span></dt>
    2478. 

  2478. <dd><p>
    2479. 

  2479.                 This is for testing only.  Do not use.
    2480. 

  2480.               </p></dd>
    2481. 

  2481. <dt><span class="term"><span><strong class="command">dump-file</strong></span></span></dt>
    2482. 

  2482. <dd><p>
    2483. 

  2483.                 The pathname of the file the server dumps
    2484. 

  2484.                 the database to when instructed to do so with
    2485. 

  2485.                 <span><strong class="command">rndc dumpdb</strong></span>.
    2486. 

  2486.                 If not specified, the default is <code class="filename">named_dump.db</code>.
    2487. 

  2487.               </p></dd>
    2488. 

  2488. <dt><span class="term"><span><strong class="command">memstatistics-file</strong></span></span></dt>
    2489. 

  2489. <dd><p>
    2490. 

  2490.                 The pathname of the file the server writes memory
    2491. 

  2491.                 usage statistics to on exit. If not specified,
    2492. 

  2492.                 the default is <code class="filename">named.memstats</code>.
    2493. 

  2493.               </p></dd>
    2494. 

  2494. <dt><span class="term"><span><strong class="command">pid-file</strong></span></span></dt>
    2495. 

  2495. <dd><p>
    2496. 

  2496.                 The pathname of the file the server writes its process ID
    2497. 

  2497.                 in. If not specified, the default is
    2498. 

  2498.                 <code class="filename">/var/run/named/named.pid</code>.
    2499. 

  2499.                 The PID file is used by programs that want to send signals to
    2500. 

  2500.                 the running
    2501. 

  2501.                 name server. Specifying <span><strong class="command">pid-file none</strong></span> disables the
    2502. 

  2502.                 use of a PID file &#8212; no file will be written and any
    2503. 

  2503.                 existing one will be removed.  Note that <span><strong class="command">none</strong></span>
    2504. 

  2504.                 is a keyword, not a filename, and therefore is not enclosed
    2505. 

  2505.                 in
    2506. 

  2506.                 double quotes.
    2507. 

  2507.               </p></dd>
    2508. 

  2508. <dt><span class="term"><span><strong class="command">recursing-file</strong></span></span></dt>
    2509. 

  2509. <dd><p>
    2510. 

  2510.                 The pathname of the file the server dumps
    2511. 

  2511.                 the queries that are currently recursing when instructed
    2512. 

  2512.                 to do so with <span><strong class="command">rndc recursing</strong></span>.
    2513. 

  2513.                 If not specified, the default is <code class="filename">named.recursing</code>.
    2514. 

  2514.               </p></dd>
    2515. 

  2515. <dt><span class="term"><span><strong class="command">statistics-file</strong></span></span></dt>
    2516. 

  2516. <dd><p>
    2517. 

  2517.                 The pathname of the file the server appends statistics
    2518. 

  2518.                 to when instructed to do so using <span><strong class="command">rndc stats</strong></span>.
    2519. 

  2519.                 If not specified, the default is <code class="filename">named.stats</code> in the
    2520. 

  2520.                 server's current directory.  The format of the file is
    2521. 

  2521.                 described
    2522. 

  2522.                 in <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called &#8220;The Statistics File&#8221;</a>.
    2523. 

  2523.               </p></dd>
    2524. 

  2524. <dt><span class="term"><span><strong class="command">bindkeys-file</strong></span></span></dt>
    2525. 

  2525. <dd><p>
    2526. 

  2526.                 The pathname of a file to override the built-in trusted
    2527. 

  2527.                 keys provided by <span><strong class="command">named</strong></span>.
    2528. 

  2528.                 See the discussion of <span><strong class="command">dnssec-lookaside</strong></span>
    2529. 

  2529.                 and <span><strong class="command">dnssec-validation</strong></span> for details. 
    2530. 

  2530.                 If not specified, the default is
    2531. 

  2531.                 <code class="filename">/etc/bind.keys</code>.
    2532. 

  2532.               </p></dd>
    2533. 

  2533. <dt><span class="term"><span><strong class="command">secroots-file</strong></span></span></dt>
    2534. 

  2534. <dd><p>
    2535. 

  2535.                 The pathname of the file the server dumps
    2536. 

  2536.                 security roots to when instructed to do so with
    2537. 

  2537.                 <span><strong class="command">rndc secroots</strong></span>.
    2538. 

  2538.                 If not specified, the default is
    2539. 

  2539.                 <code class="filename">named.secroots</code>.
    2540. 

  2540.               </p></dd>
    2541. 

  2541. <dt><span class="term"><span><strong class="command">session-keyfile</strong></span></span></dt>
    2542. 

  2542. <dd><p>
    2543. 

  2543.                 The pathname of the file into which to write a TSIG
    2544. 

  2544.                 session key generated by <span><strong class="command">named</strong></span> for use by
    2545. 

  2545.                 <span><strong class="command">nsupdate -l</strong></span>.  If not specified, the
    2546. 

  2546.                 default is <code class="filename">/var/run/named/session.key</code>.
    2547. 

  2547.                 (See <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called &#8220;Dynamic Update Policies&#8221;</a>, and in
    2548. 

  2548.                 particular the discussion of the
    2549. 

  2549.                 <span><strong class="command">update-policy</strong></span> statement's
    2550. 

  2550.                 <strong class="userinput"><code>local</code></strong> option for more
    2551. 

  2551.                 information about this feature.)
    2552. 

  2552.               </p></dd>
    2553. 

  2553. <dt><span class="term"><span><strong class="command">session-keyname</strong></span></span></dt>
    2554. 

  2554. <dd><p>
    2555. 

  2555.                 The key name to use for the TSIG session key.
    2556. 

  2556.                 If not specified, the default is "local-ddns".
    2557. 

  2557.               </p></dd>
    2558. 

  2558. <dt><span class="term"><span><strong class="command">session-keyalg</strong></span></span></dt>
    2559. 

  2559. <dd><p>
    2560. 

  2560.                 The algorithm to use for the TSIG session key.
    2561. 

  2561.                 Valid values are hmac-sha1, hmac-sha224, hmac-sha256,
    2562. 

  2562.                 hmac-sha384, hmac-sha512 and hmac-md5.  If not
    2563. 

  2563.                 specified, the default is hmac-sha256.
    2564. 

  2564.               </p></dd>
    2565. 

  2565. <dt><span class="term"><span><strong class="command">port</strong></span></span></dt>
    2566. 

  2566. <dd><p>
    2567. 

  2567.                 The UDP/TCP port number the server uses for
    2568. 

  2568.                 receiving and sending DNS protocol traffic.
    2569. 

  2569.                 The default is 53.  This option is mainly intended for server
    2570. 

  2570.                 testing;
    2571. 

  2571.                 a server using a port other than 53 will not be able to
    2572. 

  2572.                 communicate with
    2573. 

  2573.                 the global DNS.
    2574. 

  2574.               </p></dd>
    2575. 

  2575. <dt><span class="term"><span><strong class="command">random-device</strong></span></span></dt>
    2576. 

  2576. <dd><p>
    2577. 

  2577.                 The source of entropy to be used by the server.  Entropy is
    2578. 

  2578.                 primarily needed
    2579. 

  2579.                 for DNSSEC operations, such as TKEY transactions and dynamic
    2580. 

  2580.                 update of signed
    2581. 

  2581.                 zones.  This options specifies the device (or file) from which
    2582. 

  2582.                 to read
    2583. 

  2583.                 entropy.  If this is a file, operations requiring entropy will
    2584. 

  2584.                 fail when the
    2585. 

  2585.                 file has been exhausted.  If not specified, the default value
    2586. 

  2586.                 is
    2587. 

  2587.                 <code class="filename">/dev/random</code>
    2588. 

  2588.                 (or equivalent) when present, and none otherwise.  The
    2589. 

  2589.                 <span><strong class="command">random-device</strong></span> option takes
    2590. 

  2590.                 effect during
    2591. 

  2591.                 the initial configuration load at server startup time and
    2592. 

  2592.                 is ignored on subsequent reloads.
    2593. 

  2593.               </p></dd>
    2594. 

  2594. <dt><span class="term"><span><strong class="command">preferred-glue</strong></span></span></dt>
    2595. 

  2595. <dd><p>
    2596. 

  2596.                 If specified, the listed type (A or AAAA) will be emitted
    2597. 

  2597.                 before other glue
    2598. 

  2598.                 in the additional section of a query response.
    2599. 

  2599.                 The default is not to prefer any type (NONE).
    2600. 

  2600.               </p></dd>
    2601. 

  2601. <dt>
    2602. 

  2602. <a name="root_delegation_only"></a><span class="term"><span><strong class="command">root-delegation-only</strong></span></span>
    2603. 

  2603. </dt>
    2604. 

  2604. <dd>
    2605. 

  2605. <p>
    2606. 

  2606.                 Turn on enforcement of delegation-only in TLDs
    2607. 

  2607.                 (top level domains) and root zones with an optional
    2608. 

  2608.                 exclude list.
    2609. 

  2609.               </p>
    2610. 

  2610. <p>
    2611. 

  2611.                 DS queries are expected to be made to and be answered by
    2612. 

  2612.                 delegation only zones.  Such queries and responses are
    2613. 

  2613.                 treated as an exception to delegation-only processing
    2614. 

  2614.                 and are not converted to NXDOMAIN responses provided
    2615. 

  2615.                 a CNAME is not discovered at the query name.
    2616. 

  2616.               </p>
    2617. 

  2617. <p>
    2618. 

  2618.                 If a delegation only zone server also serves a child
    2619. 

  2619.                 zone it is not always possible to determine whether
    2620. 

  2620.                 an answer comes from the delegation only zone or the
    2621. 

  2621.                 child zone.  SOA NS and DNSKEY records are apex
    2622. 

  2622.                 only records and a matching response that contains
    2623. 

  2623.                 these records or DS is treated as coming from a
    2624. 

  2624.                 child zone.  RRSIG records are also examined to see
    2625. 

  2625.                 if they are signed by a child zone or not.  The
    2626. 

  2626.                 authority section is also examined to see if there
    2627. 

  2627.                 is evidence that the answer is from the child zone.
    2628. 

  2628.                 Answers that are determined to be from a child zone
    2629. 

  2629.                 are not converted to NXDOMAIN responses.  Despite
    2630. 

  2630.                 all these checks there is still a possibility of
    2631. 

  2631.                 false negatives when a child zone is being served.
    2632. 

  2632.               </p>
    2633. 

  2633. <p>
    2634. 

  2634.                 Similarly false positives can arise from empty nodes
    2635. 

  2635.                 (no records at the name) in the delegation only zone
    2636. 

  2636.                 when the query type is not ANY.
    2637. 

  2637.               </p>
    2638. 

  2638. <p>
    2639. 

  2639.                 Note some TLDs are not delegation only (e.g. "DE", "LV",
    2640. 

  2640.                 "US" and "MUSEUM").  This list is not exhaustive.
    2641. 

  2641.               </p>
    2642. 

  2642. <pre class="programlisting">
    2643. 

  2643. options {
    2644. 

  2644.         root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
    2645. 

  2645. };
    2646. 

  2646. </pre>
    2647. 

  2647. </dd>
    2648. 

  2648. <dt><span class="term"><span><strong class="command">disable-algorithms</strong></span></span></dt>
    2649. 

  2649. <dd><p>
    2650. 

  2650.                 Disable the specified DNSSEC algorithms at and below the
    2651. 

  2651.                 specified name.
    2652. 

  2652.                 Multiple <span><strong class="command">disable-algorithms</strong></span>
    2653. 

  2653.                 statements are allowed.
    2654. 

  2654.                 Only the most specific will be applied.
    2655. 

  2655.               </p></dd>
    2656. 

  2656. <dt><span class="term"><span><strong class="command">dnssec-lookaside</strong></span></span></dt>
    2657. 

  2657. <dd>
    2658. 

  2658. <p>
    2659. 

  2659.                 When set, <span><strong class="command">dnssec-lookaside</strong></span> provides the
    2660. 

  2660.                 validator with an alternate method to validate DNSKEY
    2661. 

  2661.                 records at the top of a zone.  When a DNSKEY is at or
    2662. 

  2662.                 below a domain specified by the deepest
    2663. 

  2663.                 <span><strong class="command">dnssec-lookaside</strong></span>, and the normal DNSSEC
    2664. 

  2664.                 validation has left the key untrusted, the trust-anchor
    2665. 

  2665.                 will be appended to the key name and a DLV record will be
    2666. 

  2666.                 looked up to see if it can validate the key.  If the DLV
    2667. 

  2667.                 record validates a DNSKEY (similarly to the way a DS
    2668. 

  2668.                 record does) the DNSKEY RRset is deemed to be trusted.
    2669. 

  2669.               </p>
    2670. 

  2670. <p>
    2671. 

  2671.                 If <span><strong class="command">dnssec-lookaside</strong></span> is set to
    2672. 

  2672.                 <strong class="userinput"><code>auto</code></strong>, then built-in default
    2673. 

  2673.                 values for the DLV domain and trust anchor will be
    2674. 

  2674.                 used, along with a built-in key for validation.
    2675. 

  2675.               </p>
    2676. 

  2676. <p>
    2677. 

  2677.                 If <span><strong class="command">dnssec-lookaside</strong></span> is set to
    2678. 

  2678.                 <strong class="userinput"><code>no</code></strong>, then dnssec-lookaside
    2679. 

  2679.                 is not used.
    2680. 

  2680.               </p>
    2681. 

  2681. <p>
    2682. 

  2682.                 The default DLV key is stored in the file
    2683. 

  2683.                 <code class="filename">bind.keys</code>;
    2684. 

  2684.                 <span><strong class="command">named</strong></span> will load that key at
    2685. 

  2685.                 startup if <span><strong class="command">dnssec-lookaside</strong></span> is set to
    2686. 

  2686.                 <code class="constant">auto</code>.  A copy of the file is
    2687. 

  2687.                 installed along with <acronym class="acronym">BIND</acronym> 9, and is
    2688. 

  2688.                 current as of the release date.  If the DLV key expires, a
    2689. 

  2689.                 new copy of <code class="filename">bind.keys</code> can be downloaded
    2690. 

  2690.                 from <a href="" target="_top">https://www.isc.org/solutions/dlv</a>.
    2691. 

  2691.               </p>
    2692. 

  2692. <p>
    2693. 

  2693.                 (To prevent problems if <code class="filename">bind.keys</code> is
    2694. 

  2694.                 not found, the current key is also compiled in to
    2695. 

  2695.                 <span><strong class="command">named</strong></span>.  Relying on this is not
    2696. 

  2696.                 recommended, however, as it requires <span><strong class="command">named</strong></span>
    2697. 

  2697.                 to be recompiled with a new key when the DLV key expires.)
    2698. 

  2698.               </p>
    2699. 

  2699. <p>
    2700. 

  2700.                 NOTE: <span><strong class="command">named</strong></span> only loads certain specific
    2701. 

  2701.                 keys from <code class="filename">bind.keys</code>:  those for the
    2702. 

  2702.                 DLV zone and for the DNS root zone.  The file cannot be
    2703. 

  2703.                 used to store keys for other zones.
    2704. 

  2704.               </p>
    2705. 

  2705. </dd>
    2706. 

  2706. <dt><span class="term"><span><strong class="command">dnssec-must-be-secure</strong></span></span></dt>
    2707. 

  2707. <dd><p>
    2708. 

  2708.                 Specify hierarchies which must be or may not be secure
    2709. 

  2709.                 (signed and validated).  If <strong class="userinput"><code>yes</code></strong>,
    2710. 

  2710.                 then <span><strong class="command">named</strong></span> will only accept answers if
    2711. 

  2711.                 they are secure.  If <strong class="userinput"><code>no</code></strong>, then normal
    2712. 

  2712.                 DNSSEC validation applies allowing for insecure answers to
    2713. 

  2713.                 be accepted.  The specified domain must be under a
    2714. 

  2714.                 <span><strong class="command">trusted-keys</strong></span> or
    2715. 

  2715.                 <span><strong class="command">managed-keys</strong></span> statement, or
    2716. 

  2716.                 <span><strong class="command">dnssec-lookaside</strong></span> must be active.
    2717. 

  2717.               </p></dd>
    2718. 

  2718. <dt><span class="term"><span><strong class="command">dns64</strong></span></span></dt>
    2719. 

  2719. <dd>
    2720. 

  2720. <p>
    2721. 

  2721.                 This directive instructs <span><strong class="command">named</strong></span> to
    2722. 

  2722.                 return mapped IPv4 addresses to AAAA queries when
    2723. 

  2723.                 there are no AAAA records.  It is intended to be
    2724. 

  2724.                 used in conjunction with a NAT64.  Each
    2725. 

  2725.                 <span><strong class="command">dns64</strong></span> defines one DNS64 prefix.
    2726. 

  2726.                 Multiple DNS64 prefixes can be defined.
    2727. 

  2727.               </p>
    2728. 

  2728. <p>
    2729. 

  2729.                 Compatible IPv6 prefixes have lengths of 32, 40, 48, 56,
    2730. 

  2730.                 64 and 96 as per RFC 6052.
    2731. 

  2731.               </p>
    2732. 

  2732. <p>
    2733. 

  2733.                 Additionally a reverse IP6.ARPA zone will be created for
    2734. 

  2734.                 the prefix to provide a mapping from the IP6.ARPA names
    2735. 

  2735.                 to the corresponding IN-ADDR.ARPA names using synthesized
    2736. 

  2736.                 CNAMEs.  <span><strong class="command">dns64-server</strong></span> and
    2737. 

  2737.                 <span><strong class="command">dns64-contact</strong></span> can be used to specify
    2738. 

  2738.                 the name of the server and contact for the zones. These
    2739. 

  2739.                 are settable at the view / options level.  These are
    2740. 

  2740.                 not settable on a per-prefix basis.
    2741. 

  2741.               </p>
    2742. 

  2742. <p>
    2743. 

  2743.                 Each <span><strong class="command">dns64</strong></span> supports an optional
    2744. 

  2744.                 <span><strong class="command">clients</strong></span> ACL that determines which
    2745. 

  2745.                 clients are affected by this directive.  If not defined,
    2746. 

  2746.                 it defaults to <strong class="userinput"><code>any;</code></strong>.
    2747. 

  2747.               </p>
    2748. 

  2748. <p>
    2749. 

  2749.                 Each <span><strong class="command">dns64</strong></span> supports an optional
    2750. 

  2750.                 <span><strong class="command">mapped</strong></span> ACL that selects which
    2751. 

  2751.                 IPv4 addresses are to be mapped in the corresponding    
    2752. 

  2752.                 A RRset.  If not defined it defaults to
    2753. 

  2753.                 <strong class="userinput"><code>any;</code></strong>.
    2754. 

  2754.               </p>
    2755. 

  2755. <p>
    2756. 

  2756.                 Normally, DNS64 won't apply to a domain name that
    2757. 

  2757.                 owns one or more AAAA records; these records will
    2758. 

  2758.                 simply be returned.  The optional
    2759. 

  2759.                 <span><strong class="command">exclude</strong></span> ACL allows specification
    2760. 

  2760.                 of a list of IPv6 addresses that will be ignored
    2761. 

  2761.                 if they appear in a domain name's AAAA records, and
    2762. 

  2762.                 DNS64 will be applied to any A records the domain
    2763. 

  2763.                 name owns.  If not defined, <span><strong class="command">exclude</strong></span>
    2764. 

  2764.                 defaults to none.
    2765. 

  2765.               </p>
    2766. 

  2766. <p>
    2767. 

  2767.                 A optional <span><strong class="command">suffix</strong></span> can also
    2768. 

  2768.                 be defined to set the bits trailing the mapped
    2769. 

  2769.                 IPv4 address bits.  By default these bits are
    2770. 

  2770.                 set to <strong class="userinput"><code>::</code></strong>.  The bits
    2771. 

  2771.                 matching the prefix and mapped IPv4 address
    2772. 

  2772.                 must be zero.
    2773. 

  2773.               </p>
    2774. 

  2774. <p>
    2775. 

  2775.                 If <span><strong class="command">recursive-only</strong></span> is set to
    2776. 

  2776.                 <span><strong class="command">yes</strong></span> the DNS64 synthesis will
    2777. 

  2777.                 only happen for recursive queries.  The default
    2778. 

  2778.                 is <span><strong class="command">no</strong></span>.
    2779. 

  2779.               </p>
    2780. 

  2780. <p>
    2781. 

  2781.                 If <span><strong class="command">break-dnssec</strong></span> is set to
    2782. 

  2782.                 <span><strong class="command">yes</strong></span> the DNS64 synthesis will
    2783. 

  2783.                 happen even if the result, if validated, would
    2784. 

  2784.                 cause a DNSSEC validation failure.  If this option
    2785. 

  2785.                 is set to <span><strong class="command">no</strong></span> (the default), the DO
    2786. 

  2786.                 is set on the incoming query, and there are RRSIGs on
    2787. 

  2787.                 the applicable records, then synthesis will not happen.
    2788. 

  2788.               </p>
    2789. 

  2789. <pre class="programlisting">
    2790. 

  2790.         acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
    2791. 

    2792. 

  2792.         dns64 64:FF9B::/96 {
    2793. 

  2793.                 clients { any; };
    2794. 

  2794.                 mapped { !rfc1918; any; };
    2795. 

  2795.                 exclude { 64:FF9B::/96; ::ffff:0000:0000/96; };
    2796. 

  2796.                 suffix ::;
    2797. 

  2797.         };
    2798. 

  2798. </pre>
    2799. 

  2799. </dd>
    2800. 

  2800. </dl></div>
    2801. 

  2801. <div class="sect3" lang="en">
    2802. 

  2802. <div class="titlepage"><div><div><h4 class="title">
    2803. 

  2803. <a name="boolean_options"></a>Boolean Options</h4></div></div></div>
    2804. 

  2804. <div class="variablelist"><dl>
    2805. 

  2805. <dt><span class="term"><span><strong class="command">allow-new-zones</strong></span></span></dt>
    2806. 

  2806. <dd><p>
    2807. 

  2807.                   If <strong class="userinput"><code>yes</code></strong>, then zones can be
    2808. 

  2808.                   added at runtime via <span><strong class="command">rndc addzone</strong></span>
    2809. 

  2809.                   or deleted via <span><strong class="command">rndc delzone</strong></span>.
    2810. 

  2810.                   The default is <strong class="userinput"><code>no</code></strong>.
    2811. 

  2811.                 </p></dd>
    2812. 

  2812. <dt><span class="term"><span><strong class="command">auth-nxdomain</strong></span></span></dt>
    2813. 

  2813. <dd><p>
    2814. 

  2814.                   If <strong class="userinput"><code>yes</code></strong>, then the <span><strong class="command">AA</strong></span> bit
    2815. 

  2815.                   is always set on NXDOMAIN responses, even if the server is
    2816. 

  2816.                   not actually
    2817. 

  2817.                   authoritative. The default is <strong class="userinput"><code>no</code></strong>;
    2818. 

  2818.                   this is
    2819. 

  2819.                   a change from <acronym class="acronym">BIND</acronym> 8. If you
    2820. 

  2820.                   are using very old DNS software, you
    2821. 

  2821.                   may need to set it to <strong class="userinput"><code>yes</code></strong>.
    2822. 

  2822.                 </p></dd>
    2823. 

  2823. <dt><span class="term"><span><strong class="command">deallocate-on-exit</strong></span></span></dt>
    2824. 

  2824. <dd><p>
    2825. 

  2825.                   This option was used in <acronym class="acronym">BIND</acronym>
    2826. 

  2826.                   8 to enable checking
    2827. 

  2827.                   for memory leaks on exit. <acronym class="acronym">BIND</acronym> 9 ignores the option and always performs
    2828. 

  2828.                   the checks.
    2829. 

  2829.                 </p></dd>
    2830. 

  2830. <dt><span class="term"><span><strong class="command">memstatistics</strong></span></span></dt>
    2831. 

  2831. <dd><p>
    2832. 

  2832.                   Write memory statistics to the file specified by
    2833. 

  2833.                   <span><strong class="command">memstatistics-file</strong></span> at exit.
    2834. 

  2834.                   The default is <strong class="userinput"><code>no</code></strong> unless
    2835. 

  2835.                   '-m record' is specified on the command line in
    2836. 

  2836.                   which case it is <strong class="userinput"><code>yes</code></strong>.
    2837. 

  2837.                 </p></dd>
    2838. 

  2838. <dt><span class="term"><span><strong class="command">dialup</strong></span></span></dt>
    2839. 

  2839. <dd>
    2840. 

  2840. <p>
    2841. 

  2841.                   If <strong class="userinput"><code>yes</code></strong>, then the
    2842. 

  2842.                   server treats all zones as if they are doing zone transfers
    2843. 

  2843.                   across
    2844. 

  2844.                   a dial-on-demand dialup link, which can be brought up by
    2845. 

  2845.                   traffic
    2846. 

  2846.                   originating from this server. This has different effects
    2847. 

  2847.                   according
    2848. 

  2848.                   to zone type and concentrates the zone maintenance so that
    2849. 

  2849.                   it all
    2850. 

  2850.                   happens in a short interval, once every <span><strong class="command">heartbeat-interval</strong></span> and
    2851. 

  2851.                   hopefully during the one call. It also suppresses some of
    2852. 

  2852.                   the normal
    2853. 

  2853.                   zone maintenance traffic. The default is <strong class="userinput"><code>no</code></strong>.
    2854. 

  2854.                 </p>
    2855. 

  2855. <p>
    2856. 

  2856.                   The <span><strong class="command">dialup</strong></span> option
    2857. 

  2857.                   may also be specified in the <span><strong class="command">view</strong></span> and
    2858. 

  2858.                   <span><strong class="command">zone</strong></span> statements,
    2859. 

  2859.                   in which case it overrides the global <span><strong class="command">dialup</strong></span>
    2860. 

  2860.                   option.
    2861. 

  2861.                 </p>
    2862. 

  2862. <p>
    2863. 

  2863.                   If the zone is a master zone, then the server will send out a
    2864. 

  2864.                   NOTIFY
    2865. 

  2865.                   request to all the slaves (default). This should trigger the
    2866. 

  2866.                   zone serial
    2867. 

  2867.                   number check in the slave (providing it supports NOTIFY)
    2868. 

  2868.                   allowing the slave
    2869. 

  2869.                   to verify the zone while the connection is active.
    2870. 

  2870.                   The set of servers to which NOTIFY is sent can be controlled
    2871. 

  2871.                   by
    2872. 

  2872.                   <span><strong class="command">notify</strong></span> and <span><strong class="command">also-notify</strong></span>.
    2873. 

  2873.                 </p>
    2874. 

  2874. <p>
    2875. 

  2875.                   If the
    2876. 

  2876.                   zone is a slave or stub zone, then the server will suppress
    2877. 

  2877.                   the regular
    2878. 

  2878.                   "zone up to date" (refresh) queries and only perform them
    2879. 

  2879.                   when the
    2880. 

  2880.                   <span><strong class="command">heartbeat-interval</strong></span> expires in
    2881. 

  2881.                   addition to sending
    2882. 

  2882.                   NOTIFY requests.
    2883. 

  2883.                 </p>
    2884. 

  2884. <p>
    2885. 

  2885.                   Finer control can be achieved by using
    2886. 

  2886.                   <strong class="userinput"><code>notify</code></strong> which only sends NOTIFY
    2887. 

  2887.                   messages,
    2888. 

  2888.                   <strong class="userinput"><code>notify-passive</code></strong> which sends NOTIFY
    2889. 

  2889.                   messages and
    2890. 

  2890.                   suppresses the normal refresh queries, <strong class="userinput"><code>refresh</code></strong>
    2891. 

  2891.                   which suppresses normal refresh processing and sends refresh
    2892. 

  2892.                   queries
    2893. 

  2893.                   when the <span><strong class="command">heartbeat-interval</strong></span>
    2894. 

  2894.                   expires, and
    2895. 

  2895.                   <strong class="userinput"><code>passive</code></strong> which just disables normal
    2896. 

  2896.                   refresh
    2897. 

  2897.                   processing.
    2898. 

  2898.                 </p>
    2899. 

  2899. <div class="informaltable"><table border="1">
    2900. 

  2900. <colgroup>
    2901. 

  2901. <col>
    2902. 

  2902. <col>
    2903. 

  2903. <col>
    2904. 

  2904. <col>
    2905. 

  2905. </colgroup>
    2906. 

  2906. <tbody>
    2907. 

  2907. <tr>
    2908. 

  2908. <td>
    2909. 

  2909.                           <p>
    2910. 

  2910.                             dialup mode
    2911. 

  2911.                           </p>
    2912. 

  2912.                         </td>
    2913. 

  2913. <td>
    2914. 

  2914.                           <p>
    2915. 

  2915.                             normal refresh
    2916. 

  2916.                           </p>
    2917. 

  2917.                         </td>
    2918. 

  2918. <td>
    2919. 

  2919.                           <p>
    2920. 

  2920.                             heart-beat refresh
    2921. 

  2921.                           </p>
    2922. 

  2922.                         </td>
    2923. 

  2923. <td>
    2924. 

  2924.                           <p>
    2925. 

  2925.                             heart-beat notify
    2926. 

  2926.                           </p>
    2927. 

  2927.                         </td>
    2928. 

  2928. </tr>
    2929. 

  2929. <tr>
    2930. 

  2930. <td>
    2931. 

  2931.                           <p><span><strong class="command">no</strong></span> (default)</p>
    2932. 

  2932.                         </td>
    2933. 

  2933. <td>
    2934. 

  2934.                           <p>
    2935. 

  2935.                             yes
    2936. 

  2936.                           </p>
    2937. 

  2937.                         </td>
    2938. 

  2938. <td>
    2939. 

  2939.                           <p>
    2940. 

  2940.                             no
    2941. 

  2941.                           </p>
    2942. 

  2942.                         </td>
    2943. 

  2943. <td>
    2944. 

  2944.                           <p>
    2945. 

  2945.                             no
    2946. 

  2946.                           </p>
    2947. 

  2947.                         </td>
    2948. 

  2948. </tr>
    2949. 

  2949. <tr>
    2950. 

  2950. <td>
    2951. 

  2951.                           <p><span><strong class="command">yes</strong></span></p>
    2952. 

  2952.                         </td>
    2953. 

  2953. <td>
    2954. 

  2954.                           <p>
    2955. 

  2955.                             no
    2956. 

  2956.                           </p>
    2957. 

  2957.                         </td>
    2958. 

  2958. <td>
    2959. 

  2959.                           <p>
    2960. 

  2960.                             yes
    2961. 

  2961.                           </p>
    2962. 

  2962.                         </td>
    2963. 

  2963. <td>
    2964. 

  2964.                           <p>
    2965. 

  2965.                             yes
    2966. 

  2966.                           </p>
    2967. 

  2967.                         </td>
    2968. 

  2968. </tr>
    2969. 

  2969. <tr>
    2970. 

  2970. <td>
    2971. 

  2971.                           <p><span><strong class="command">notify</strong></span></p>
    2972. 

  2972.                         </td>
    2973. 

  2973. <td>
    2974. 

  2974.                           <p>
    2975. 

  2975.                             yes
    2976. 

  2976.                           </p>
    2977. 

  2977.                         </td>
    2978. 

  2978. <td>
    2979. 

  2979.                           <p>
    2980. 

  2980.                             no
    2981. 

  2981.                           </p>
    2982. 

  2982.                         </td>
    2983. 

  2983. <td>
    2984. 

  2984.                           <p>
    2985. 

  2985.                             yes
    2986. 

  2986.                           </p>
    2987. 

  2987.                         </td>
    2988. 

  2988. </tr>
    2989. 

  2989. <tr>
    2990. 

  2990. <td>
    2991. 

  2991.                           <p><span><strong class="command">refresh</strong></span></p>
    2992. 

  2992.                         </td>
    2993. 

  2993. <td>
    2994. 

  2994.                           <p>
    2995. 

  2995.                             no
    2996. 

  2996.                           </p>
    2997. 

  2997.                         </td>
    2998. 

  2998. <td>
    2999. 

  2999.                           <p>
    3000. 

  3000.                             yes
    3001. 

  3001.                           </p>
    3002. 

  3002.                         </td>
    3003. 

  3003. <td>
    3004. 

  3004.                           <p>
    3005. 

  3005.                             no
    3006. 

  3006.                           </p>
    3007. 

  3007.                         </td>
    3008. 

  3008. </tr>
    3009. 

  3009. <tr>
    3010. 

  3010. <td>
    3011. 

  3011.                           <p><span><strong class="command">passive</strong></span></p>
    3012. 

  3012.                         </td>
    3013. 

  3013. <td>
    3014. 

  3014.                           <p>
    3015. 

  3015.                             no
    3016. 

  3016.                           </p>
    3017. 

  3017.                         </td>
    3018. 

  3018. <td>
    3019. 

  3019.                           <p>
    3020. 

  3020.                             no
    3021. 

  3021.                           </p>
    3022. 

  3022.                         </td>
    3023. 

  3023. <td>
    3024. 

  3024.                           <p>
    3025. 

  3025.                             no
    3026. 

  3026.                           </p>
    3027. 

  3027.                         </td>
    3028. 

  3028. </tr>
    3029. 

  3029. <tr>
    3030. 

  3030. <td>
    3031. 

  3031.                           <p><span><strong class="command">notify-passive</strong></span></p>
    3032. 

  3032.                         </td>
    3033. 

  3033. <td>
    3034. 

  3034.                           <p>
    3035. 

  3035.                             no
    3036. 

  3036.                           </p>
    3037. 

  3037.                         </td>
    3038. 

  3038. <td>
    3039. 

  3039.                           <p>
    3040. 

  3040.                             no
    3041. 

  3041.                           </p>
    3042. 

  3042.                         </td>
    3043. 

  3043. <td>
    3044. 

  3044.                           <p>
    3045. 

  3045.                             yes
    3046. 

  3046.                           </p>
    3047. 

  3047.                         </td>
    3048. 

  3048. </tr>
    3049. 

  3049. </tbody>
    3050. 

  3050. </table></div>
    3051. 

  3051. <p>
    3052. 

  3052.                   Note that normal NOTIFY processing is not affected by
    3053. 

  3053.                   <span><strong class="command">dialup</strong></span>.
    3054. 

  3054.                 </p>
    3055. 

  3055. </dd>
    3056. 

  3056. <dt><span class="term"><span><strong class="command">fake-iquery</strong></span></span></dt>
    3057. 

  3057. <dd><p>
    3058. 

  3058.                   In <acronym class="acronym">BIND</acronym> 8, this option
    3059. 

  3059.                   enabled simulating the obsolete DNS query type
    3060. 

  3060.                   IQUERY. <acronym class="acronym">BIND</acronym> 9 never does
    3061. 

  3061.                   IQUERY simulation.
    3062. 

  3062.                 </p></dd>
    3063. 

  3063. <dt><span class="term"><span><strong class="command">fetch-glue</strong></span></span></dt>
    3064. 

  3064. <dd><p>
    3065. 

  3065.                   This option is obsolete.
    3066. 

  3066.                   In BIND 8, <strong class="userinput"><code>fetch-glue yes</code></strong>
    3067. 

  3067.                   caused the server to attempt to fetch glue resource records
    3068. 

  3068.                   it
    3069. 

  3069.                   didn't have when constructing the additional
    3070. 

  3070.                   data section of a response.  This is now considered a bad
    3071. 

  3071.                   idea
    3072. 

  3072.                   and BIND 9 never does it.
    3073. 

  3073.                 </p></dd>
    3074. 

  3074. <dt><span class="term"><span><strong class="command">flush-zones-on-shutdown</strong></span></span></dt>
    3075. 

  3075. <dd><p>
    3076. 

  3076.                   When the nameserver exits due receiving SIGTERM,
    3077. 

  3077.                   flush or do not flush any pending zone writes.  The default
    3078. 

  3078.                   is
    3079. 

  3079.                   <span><strong class="command">flush-zones-on-shutdown</strong></span> <strong class="userinput"><code>no</code></strong>.
    3080. 

  3080.                 </p></dd>
    3081. 

  3081. <dt><span class="term"><span><strong class="command">has-old-clients</strong></span></span></dt>
    3082. 

  3082. <dd><p>
    3083. 

  3083.                   This option was incorrectly implemented
    3084. 

  3084.                   in <acronym class="acronym">BIND</acronym> 8, and is ignored by <acronym class="acronym">BIND</acronym> 9.
    3085. 

  3085.                   To achieve the intended effect
    3086. 

  3086.                   of
    3087. 

  3087.                   <span><strong class="command">has-old-clients</strong></span> <strong class="userinput"><code>yes</code></strong>, specify
    3088. 

  3088.                   the two separate options <span><strong class="command">auth-nxdomain</strong></span> <strong class="userinput"><code>yes</code></strong>
    3089. 

  3089.                   and <span><strong class="command">rfc2308-type1</strong></span> <strong class="userinput"><code>no</code></strong> instead.
    3090. 

  3090.                 </p></dd>
    3091. 

  3091. <dt><span class="term"><span><strong class="command">host-statistics</strong></span></span></dt>
    3092. 

  3092. <dd><p>
    3093. 

  3093.                   In BIND 8, this enables keeping of
    3094. 

  3094.                   statistics for every host that the name server interacts
    3095. 

  3095.                   with.
    3096. 

  3096.                   Not implemented in BIND 9.
    3097. 

  3097.                 </p></dd>
    3098. 

  3098. <dt><span class="term"><span><strong class="command">maintain-ixfr-base</strong></span></span></dt>
    3099. 

  3099. <dd><p>
    3100. 

  3100.                   <span class="emphasis"><em>This option is obsolete</em></span>.
    3101. 

  3101.                   It was used in <acronym class="acronym">BIND</acronym> 8 to
    3102. 

  3102.                   determine whether a transaction log was
    3103. 

  3103.                   kept for Incremental Zone Transfer. <acronym class="acronym">BIND</acronym> 9 maintains a transaction
    3104. 

  3104.                   log whenever possible.  If you need to disable outgoing
    3105. 

  3105.                   incremental zone
    3106. 

  3106.                   transfers, use <span><strong class="command">provide-ixfr</strong></span> <strong class="userinput"><code>no</code></strong>.
    3107. 

  3107.                 </p></dd>
    3108. 

  3108. <dt><span class="term"><span><strong class="command">minimal-responses</strong></span></span></dt>
    3109. 

  3109. <dd><p>
    3110. 

  3110.                   If <strong class="userinput"><code>yes</code></strong>, then when generating
    3111. 

  3111.                   responses the server will only add records to the authority
    3112. 

  3112.                   and additional data sections when they are required (e.g.
    3113. 

  3113.                   delegations, negative responses).  This may improve the
    3114. 

  3114.                   performance of the server.
    3115. 

  3115.                   The default is <strong class="userinput"><code>no</code></strong>.
    3116. 

  3116.                 </p></dd>
    3117. 

  3117. <dt><span class="term"><span><strong class="command">multiple-cnames</strong></span></span></dt>
    3118. 

  3118. <dd><p>
    3119. 

  3119.                   This option was used in <acronym class="acronym">BIND</acronym> 8 to allow
    3120. 

  3120.                   a domain name to have multiple CNAME records in violation of
    3121. 

  3121.                   the DNS standards.  <acronym class="acronym">BIND</acronym> 9.2 onwards
    3122. 

  3122.                   always strictly enforces the CNAME rules both in master
    3123. 

  3123.                   files and dynamic updates.
    3124. 

  3124.                 </p></dd>
    3125. 

  3125. <dt><span class="term"><span><strong class="command">notify</strong></span></span></dt>
    3126. 

  3126. <dd>
    3127. 

  3127. <p>
    3128. 

  3128.                   If <strong class="userinput"><code>yes</code></strong> (the default),
    3129. 

  3129.                   DNS NOTIFY messages are sent when a zone the server is
    3130. 

  3130.                   authoritative for
    3131. 

  3131.                   changes, see <a href="Bv9ARM.ch04.html#notify" title="Notify">the section called &#8220;Notify&#8221;</a>.  The messages are
    3132. 

  3132.                   sent to the
    3133. 

  3133.                   servers listed in the zone's NS records (except the master
    3134. 

  3134.                   server identified
    3135. 

  3135.                   in the SOA MNAME field), and to any servers listed in the
    3136. 

  3136.                   <span><strong class="command">also-notify</strong></span> option.
    3137. 

  3137.                 </p>
    3138. 

  3138. <p>
    3139. 

  3139.                   If <strong class="userinput"><code>master-only</code></strong>, notifies are only
    3140. 

  3140.                   sent
    3141. 

  3141.                   for master zones.
    3142. 

  3142.                   If <strong class="userinput"><code>explicit</code></strong>, notifies are sent only
    3143. 

  3143.                   to
    3144. 

  3144.                   servers explicitly listed using <span><strong class="command">also-notify</strong></span>.
    3145. 

  3145.                   If <strong class="userinput"><code>no</code></strong>, no notifies are sent.
    3146. 

  3146.                 </p>
    3147. 

  3147. <p>
    3148. 

  3148.                   The <span><strong class="command">notify</strong></span> option may also be
    3149. 

  3149.                   specified in the <span><strong class="command">zone</strong></span>
    3150. 

  3150.                   statement,
    3151. 

  3151.                   in which case it overrides the <span><strong class="command">options notify</strong></span> statement.
    3152. 

  3152.                   It would only be necessary to turn off this option if it
    3153. 

  3153.                   caused slaves
    3154. 

  3154.                   to crash.
    3155. 

  3155.                 </p>
    3156. 

  3156. </dd>
    3157. 

  3157. <dt><span class="term"><span><strong class="command">notify-to-soa</strong></span></span></dt>
    3158. 

  3158. <dd><p>
    3159. 

  3159.                   If <strong class="userinput"><code>yes</code></strong> do not check the nameservers
    3160. 

  3160.                   in the NS RRset against the SOA MNAME.  Normally a NOTIFY
    3161. 

  3161.                   message is not sent to the SOA MNAME (SOA ORIGIN) as it is
    3162. 

  3162.                   supposed to contain the name of the ultimate master.
    3163. 

  3163.                   Sometimes, however, a slave is listed as the SOA MNAME in
    3164. 

  3164.                   hidden master configurations and in that case you would
    3165. 

  3165.                   want the ultimate master to still send NOTIFY messages to
    3166. 

  3166.                   all the nameservers listed in the NS RRset.
    3167. 

  3167.                 </p></dd>
    3168. 

  3168. <dt><span class="term"><span><strong class="command">recursion</strong></span></span></dt>
    3169. 

  3169. <dd><p>
    3170. 

  3170.                   If <strong class="userinput"><code>yes</code></strong>, and a
    3171. 

  3171.                   DNS query requests recursion, then the server will attempt
    3172. 

  3172.                   to do
    3173. 

  3173.                   all the work required to answer the query. If recursion is
    3174. 

  3174.                   off
    3175. 

  3175.                   and the server does not already know the answer, it will
    3176. 

  3176.                   return a
    3177. 

  3177.                   referral response. The default is
    3178. 

  3178.                   <strong class="userinput"><code>yes</code></strong>.
    3179. 

  3179.                   Note that setting <span><strong class="command">recursion no</strong></span> does not prevent
    3180. 

  3180.                   clients from getting data from the server's cache; it only
    3181. 

  3181.                   prevents new data from being cached as an effect of client
    3182. 

  3182.                   queries.
    3183. 

  3183.                   Caching may still occur as an effect the server's internal
    3184. 

  3184.                   operation, such as NOTIFY address lookups.
    3185. 

  3185.                   See also <span><strong class="command">fetch-glue</strong></span> above.
    3186. 

  3186.                 </p></dd>
    3187. 

  3187. <dt><span class="term"><span><strong class="command">rfc2308-type1</strong></span></span></dt>
    3188. 

  3188. <dd>
    3189. 

  3189. <p>
    3190. 

  3190.                   Setting this to <strong class="userinput"><code>yes</code></strong> will
    3191. 

  3191.                   cause the server to send NS records along with the SOA
    3192. 

  3192.                   record for negative
    3193. 

  3193.                   answers. The default is <strong class="userinput"><code>no</code></strong>.
    3194. 

  3194.                 </p>
    3195. 

  3195. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    3196. 

  3196. <h3 class="title">Note</h3>
    3197. 

  3197. <p>
    3198. 

  3198.                     Not yet implemented in <acronym class="acronym">BIND</acronym>
    3199. 

  3199.                     9.
    3200. 

  3200.                   </p>
    3201. 

  3201. </div>
    3202. 

  3202. </dd>
    3203. 

  3203. <dt><span class="term"><span><strong class="command">use-id-pool</strong></span></span></dt>
    3204. 

  3204. <dd><p>
    3205. 

  3205.                   <span class="emphasis"><em>This option is obsolete</em></span>.
    3206. 

  3206.                   <acronym class="acronym">BIND</acronym> 9 always allocates query
    3207. 

  3207.                   IDs from a pool.
    3208. 

  3208.                 </p></dd>
    3209. 

  3209. <dt><span class="term"><span><strong class="command">zone-statistics</strong></span></span></dt>
    3210. 

  3210. <dd><p>
    3211. 

  3211.                   If <strong class="userinput"><code>yes</code></strong>, the server will collect
    3212. 

  3212.                   statistical data on all zones (unless specifically turned
    3213. 

  3213.                   off
    3214. 

  3214.                   on a per-zone basis by specifying <span><strong class="command">zone-statistics no</strong></span>
    3215. 

  3215.                   in the <span><strong class="command">zone</strong></span> statement).
    3216. 

  3216.                   The default is <strong class="userinput"><code>no</code></strong>.
    3217. 

  3217.                   These statistics may be accessed
    3218. 

  3218.                   using <span><strong class="command">rndc stats</strong></span>, which will
    3219. 

  3219.                   dump them to the file listed
    3220. 

  3220.                   in the <span><strong class="command">statistics-file</strong></span>.  See
    3221. 

  3221.                   also <a href="Bv9ARM.ch06.html#statsfile" title="The Statistics File">the section called &#8220;The Statistics File&#8221;</a>.
    3222. 

  3222.                 </p></dd>
    3223. 

  3223. <dt><span class="term"><span><strong class="command">use-ixfr</strong></span></span></dt>
    3224. 

  3224. <dd><p>
    3225. 

  3225.                   <span class="emphasis"><em>This option is obsolete</em></span>.
    3226. 

  3226.                   If you need to disable IXFR to a particular server or
    3227. 

  3227.                   servers, see
    3228. 

  3228.                   the information on the <span><strong class="command">provide-ixfr</strong></span> option
    3229. 

  3229.                   in <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
    3230. 

  3230.             Usage">the section called &#8220;<span><strong class="command">server</strong></span> Statement Definition and
    3231. 

  3231.             Usage&#8221;</a>.
    3232. 

  3232.                   See also
    3233. 

  3233.                   <a href="Bv9ARM.ch04.html#incremental_zone_transfers" title="Incremental Zone Transfers (IXFR)">the section called &#8220;Incremental Zone Transfers (IXFR)&#8221;</a>.
    3234. 

  3234.                 </p></dd>
    3235. 

  3235. <dt><span class="term"><span><strong class="command">provide-ixfr</strong></span></span></dt>
    3236. 

  3236. <dd><p>
    3237. 

  3237.                   See the description of
    3238. 

  3238.                   <span><strong class="command">provide-ixfr</strong></span> in
    3239. 

  3239.                   <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
    3240. 

  3240.             Usage">the section called &#8220;<span><strong class="command">server</strong></span> Statement Definition and
    3241. 

  3241.             Usage&#8221;</a>.
    3242. 

  3242.                 </p></dd>
    3243. 

  3243. <dt><span class="term"><span><strong class="command">request-ixfr</strong></span></span></dt>
    3244. 

  3244. <dd><p>
    3245. 

  3245.                   See the description of
    3246. 

  3246.                   <span><strong class="command">request-ixfr</strong></span> in
    3247. 

  3247.                   <a href="Bv9ARM.ch06.html#server_statement_definition_and_usage" title="server Statement Definition and
    3248. 

  3248.             Usage">the section called &#8220;<span><strong class="command">server</strong></span> Statement Definition and
    3249. 

  3249.             Usage&#8221;</a>.
    3250. 

  3250.                 </p></dd>
    3251. 

  3251. <dt><span class="term"><span><strong class="command">treat-cr-as-space</strong></span></span></dt>
    3252. 

  3252. <dd><p>
    3253. 

  3253.                   This option was used in <acronym class="acronym">BIND</acronym>
    3254. 

  3254.                   8 to make
    3255. 

  3255.                   the server treat carriage return ("<span><strong class="command">\r</strong></span>") characters the same way
    3256. 

  3256.                   as a space or tab character,
    3257. 

  3257.                   to facilitate loading of zone files on a UNIX system that
    3258. 

  3258.                   were generated
    3259. 

  3259.                   on an NT or DOS machine. In <acronym class="acronym">BIND</acronym> 9, both UNIX "<span><strong class="command">\n</strong></span>"
    3260. 

  3260.                   and NT/DOS "<span><strong class="command">\r\n</strong></span>" newlines
    3261. 

  3261.                   are always accepted,
    3262. 

  3262.                   and the option is ignored.
    3263. 

  3263.                 </p></dd>
    3264. 

  3264. <dt>
    3265. 

  3265. <span class="term"><span><strong class="command">additional-from-auth</strong></span>, </span><span class="term"><span><strong class="command">additional-from-cache</strong></span></span>
    3266. 

  3266. </dt>
    3267. 

  3267. <dd>
    3268. 

  3268. <p>
    3269. 

  3269.                   These options control the behavior of an authoritative
    3270. 

  3270.                   server when
    3271. 

  3271.                   answering queries which have additional data, or when
    3272. 

  3272.                   following CNAME
    3273. 

  3273.                   and DNAME chains.
    3274. 

  3274.                 </p>
    3275. 

  3275. <p>
    3276. 

  3276.                   When both of these options are set to <strong class="userinput"><code>yes</code></strong>
    3277. 

  3277.                   (the default) and a
    3278. 

  3278.                   query is being answered from authoritative data (a zone
    3279. 

  3279.                   configured into the server), the additional data section of
    3280. 

  3280.                   the
    3281. 

  3281.                   reply will be filled in using data from other authoritative
    3282. 

  3282.                   zones
    3283. 

  3283.                   and from the cache.  In some situations this is undesirable,
    3284. 

  3284.                   such
    3285. 

  3285.                   as when there is concern over the correctness of the cache,
    3286. 

  3286.                   or
    3287. 

  3287.                   in servers where slave zones may be added and modified by
    3288. 

  3288.                   untrusted third parties.  Also, avoiding
    3289. 

  3289.                   the search for this additional data will speed up server
    3290. 

  3290.                   operations
    3291. 

  3291.                   at the possible expense of additional queries to resolve
    3292. 

  3292.                   what would
    3293. 

  3293.                   otherwise be provided in the additional section.
    3294. 

  3294.                 </p>
    3295. 

  3295. <p>
    3296. 

  3296.                   For example, if a query asks for an MX record for host <code class="literal">foo.example.com</code>,
    3297. 

  3297.                   and the record found is "<code class="literal">MX 10 mail.example.net</code>", normally the address
    3298. 

  3298.                   records (A and AAAA) for <code class="literal">mail.example.net</code> will be provided as well,
    3299. 

  3299.                   if known, even though they are not in the example.com zone.
    3300. 

  3300.                   Setting these options to <span><strong class="command">no</strong></span>
    3301. 

  3301.                   disables this behavior and makes
    3302. 

  3302.                   the server only search for additional data in the zone it
    3303. 

  3303.                   answers from.
    3304. 

  3304.                 </p>
    3305. 

  3305. <p>
    3306. 

  3306.                   These options are intended for use in authoritative-only
    3307. 

  3307.                   servers, or in authoritative-only views.  Attempts to set
    3308. 

  3308.                   them to <span><strong class="command">no</strong></span> without also
    3309. 

  3309.                   specifying
    3310. 

  3310.                   <span><strong class="command">recursion no</strong></span> will cause the
    3311. 

  3311.                   server to
    3312. 

  3312.                   ignore the options and log a warning message.
    3313. 

  3313.                 </p>
    3314. 

  3314. <p>
    3315. 

  3315.                   Specifying <span><strong class="command">additional-from-cache no</strong></span> actually
    3316. 

  3316.                   disables the use of the cache not only for additional data
    3317. 

  3317.                   lookups
    3318. 

  3318.                   but also when looking up the answer.  This is usually the
    3319. 

  3319.                   desired
    3320. 

  3320.                   behavior in an authoritative-only server where the
    3321. 

  3321.                   correctness of
    3322. 

  3322.                   the cached data is an issue.
    3323. 

  3323.                 </p>
    3324. 

  3324. <p>
    3325. 

  3325.                   When a name server is non-recursively queried for a name
    3326. 

  3326.                   that is not
    3327. 

  3327.                   below the apex of any served zone, it normally answers with
    3328. 

  3328.                   an
    3329. 

  3329.                   "upwards referral" to the root servers or the servers of
    3330. 

  3330.                   some other
    3331. 

  3331.                   known parent of the query name.  Since the data in an
    3332. 

  3332.                   upwards referral
    3333. 

  3333.                   comes from the cache, the server will not be able to provide
    3334. 

  3334.                   upwards
    3335. 

  3335.                   referrals when <span><strong class="command">additional-from-cache no</strong></span>
    3336. 

  3336.                   has been specified.  Instead, it will respond to such
    3337. 

  3337.                   queries
    3338. 

  3338.                   with REFUSED.  This should not cause any problems since
    3339. 

  3339.                   upwards referrals are not required for the resolution
    3340. 

  3340.                   process.
    3341. 

  3341.                 </p>
    3342. 

  3342. </dd>
    3343. 

  3343. <dt><span class="term"><span><strong class="command">match-mapped-addresses</strong></span></span></dt>
    3344. 

  3344. <dd>
    3345. 

  3345. <p>
    3346. 

  3346.                   If <strong class="userinput"><code>yes</code></strong>, then an
    3347. 

  3347.                   IPv4-mapped IPv6 address will match any address match
    3348. 

  3348.                   list entries that match the corresponding IPv4 address.
    3349. 

  3349.                 </p>
    3350. 

  3350. <p>
    3351. 

  3351.                   This option was introduced to work around a kernel quirk
    3352. 

  3352.                   in some operating systems that causes IPv4 TCP
    3353. 

  3353.                   connections, such as zone transfers, to be accepted on an
    3354. 

  3354.                   IPv6 socket using mapped addresses.  This caused address
    3355. 

  3355.                   match lists designed for IPv4 to fail to match.  However,
    3356. 

  3356.                   <span><strong class="command">named</strong></span> now solves this problem
    3357. 

  3357.                   internally.  The use of this option is discouraged.
    3358. 

  3358.                 </p>
    3359. 

  3359. </dd>
    3360. 

  3360. <dt><span class="term"><span><strong class="command">filter-aaaa-on-v4</strong></span></span></dt>
    3361. 

  3361. <dd>
    3362. 

  3362. <p>
    3363. 

  3363.                   This option is only available when
    3364. 

  3364.                   <acronym class="acronym">BIND</acronym> 9 is compiled with the
    3365. 

  3365.                   <strong class="userinput"><code>--enable-filter-aaaa</code></strong> option on the
    3366. 

  3366.                   "configure" command line.  It is intended to help the
    3367. 

  3367.                   transition from IPv4 to IPv6 by not giving IPv6 addresses
    3368. 

  3368.                   to DNS clients unless they have connections to the IPv6
    3369. 

  3369.                   Internet.  This is not recommended unless absolutely
    3370. 

  3370.                   necessary.  The default is <strong class="userinput"><code>no</code></strong>.
    3371. 

  3371.                   The <span><strong class="command">filter-aaaa-on-v4</strong></span> option
    3372. 

  3372.                   may also be specified in <span><strong class="command">view</strong></span> statements
    3373. 

  3373.                   to override the global <span><strong class="command">filter-aaaa-on-v4</strong></span>
    3374. 

  3374.                   option.
    3375. 

  3375.                 </p>
    3376. 

  3376. <p>
    3377. 

  3377.                   If <strong class="userinput"><code>yes</code></strong>,
    3378. 

  3378.                   the DNS client is at an IPv4 address, in <span><strong class="command">filter-aaaa</strong></span>,
    3379. 

  3379.                   and if the response does not include DNSSEC signatures, 
    3380. 

  3380.                   then all AAAA records are deleted from the response.
    3381. 

  3381.                   This filtering applies to all responses and not only
    3382. 

  3382.                   authoritative responses.
    3383. 

  3383.                 </p>
    3384. 

  3384. <p>
    3385. 

  3385.                   If <strong class="userinput"><code>break-dnssec</code></strong>,
    3386. 

  3386.                   then AAAA records are deleted even when dnssec is enabled.
    3387. 

  3387.                   As suggested by the name, this makes the response not verify,
    3388. 

  3388.                   because the DNSSEC protocol is designed detect deletions.
    3389. 

  3389.                 </p>
    3390. 

  3390. <p>
    3391. 

  3391.                   This mechanism can erroneously cause other servers to 
    3392. 

  3392.                   not give AAAA records to their clients.  
    3393. 

  3393.                   A recursing server with both IPv6 and IPv4 network connections
    3394. 

  3394.                   that queries an authoritative server using this mechanism
    3395. 

  3395.                   via IPv4 will be denied AAAA records even if its client is
    3396. 

  3396.                   using IPv6.
    3397. 

  3397.                 </p>
    3398. 

  3398. <p>
    3399. 

  3399.                   This mechanism is applied to authoritative as well as
    3400. 

  3400.                   non-authoritative records.
    3401. 

  3401.                   A client using IPv4 that is not allowed recursion can
    3402. 

  3402.                   erroneously be given AAAA records because the server is not
    3403. 

  3403.                   allowed to check for A records.
    3404. 

  3404.                 </p>
    3405. 

  3405. <p>
    3406. 

  3406.                   Some AAAA records are given to IPv4 clients in glue records.
    3407. 

  3407.                   IPv4 clients that are servers can then erroneously
    3408. 

  3408.                   answer requests for AAAA records received via IPv4.
    3409. 

  3409.                 </p>
    3410. 

  3410. </dd>
    3411. 

  3411. <dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
    3412. 

  3412. <dd>
    3413. 

  3413. <p>
    3414. 

  3414.                   When <strong class="userinput"><code>yes</code></strong> and the server loads a new version of a master
    3415. 

  3415.                   zone from its zone file or receives a new version of a slave
    3416. 

  3416.                   file by a non-incremental zone transfer, it will compare
    3417. 

  3417.                   the new version to the previous one and calculate a set
    3418. 

  3418.                   of differences.  The differences are then logged in the
    3419. 

  3419.                   zone's journal file such that the changes can be transmitted
    3420. 

  3420.                   to downstream slaves as an incremental zone transfer.
    3421. 

  3421.                 </p>
    3422. 

  3422. <p>
    3423. 

  3423.                   By allowing incremental zone transfers to be used for
    3424. 

  3424.                   non-dynamic zones, this option saves bandwidth at the
    3425. 

  3425.                   expense of increased CPU and memory consumption at the
    3426. 

  3426.                   master.
    3427. 

  3427.                   In particular, if the new version of a zone is completely
    3428. 

  3428.                   different from the previous one, the set of differences
    3429. 

  3429.                   will be of a size comparable to the combined size of the
    3430. 

  3430.                   old and new zone version, and the server will need to
    3431. 

  3431.                   temporarily allocate memory to hold this complete
    3432. 

  3432.                   difference set.
    3433. 

  3433.                 </p>
    3434. 

  3434. <p><span><strong class="command">ixfr-from-differences</strong></span>
    3435. 

  3435.                   also accepts <span><strong class="command">master</strong></span> and
    3436. 

  3436.                   <span><strong class="command">slave</strong></span> at the view and options
    3437. 

  3437.                   levels which causes
    3438. 

  3438.                   <span><strong class="command">ixfr-from-differences</strong></span> to be enabled for
    3439. 

  3439.                   all <span><strong class="command">master</strong></span> or
    3440. 

  3440.                   <span><strong class="command">slave</strong></span> zones respectively.
    3441. 

  3441.                   It is off by default.
    3442. 

  3442.                 </p>
    3443. 

  3443. </dd>
    3444. 

  3444. <dt><span class="term"><span><strong class="command">multi-master</strong></span></span></dt>
    3445. 

  3445. <dd><p>
    3446. 

  3446.                   This should be set when you have multiple masters for a zone
    3447. 

  3447.                   and the
    3448. 

  3448.                   addresses refer to different machines.  If <strong class="userinput"><code>yes</code></strong>, <span><strong class="command">named</strong></span> will
    3449. 

  3449.                   not log
    3450. 

  3450.                   when the serial number on the master is less than what <span><strong class="command">named</strong></span>
    3451. 

  3451.                   currently
    3452. 

  3452.                   has.  The default is <strong class="userinput"><code>no</code></strong>.
    3453. 

  3453.                 </p></dd>
    3454. 

  3454. <dt><span class="term"><span><strong class="command">dnssec-enable</strong></span></span></dt>
    3455. 

  3455. <dd><p>
    3456. 

  3456.                   Enable DNSSEC support in <span><strong class="command">named</strong></span>.  Unless set to <strong class="userinput"><code>yes</code></strong>,
    3457. 

  3457.                   <span><strong class="command">named</strong></span> behaves as if it does not support DNSSEC.
    3458. 

  3458.                   The default is <strong class="userinput"><code>yes</code></strong>.
    3459. 

  3459.                 </p></dd>
    3460. 

  3460. <dt><span class="term"><span><strong class="command">dnssec-validation</strong></span></span></dt>
    3461. 

  3461. <dd><p>
    3462. 

  3462.                   Enable DNSSEC validation in <span><strong class="command">named</strong></span>.
    3463. 

  3463.                   Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
    3464. 

  3464.                   set to <strong class="userinput"><code>yes</code></strong> to be effective.
    3465. 

  3465.                   If set to <strong class="userinput"><code>no</code></strong>, DNSSEC validation
    3466. 

  3466.                   is disabled.  If set to <strong class="userinput"><code>auto</code></strong>,
    3467. 

  3467.                   DNSSEC validation is enabled, and a default
    3468. 

  3468.                   trust-anchor for the DNS root zone is used.  If set to
    3469. 

  3469.                   <strong class="userinput"><code>yes</code></strong>, DNSSEC validation is enabled,
    3470. 

  3470.                   but a trust anchor must be manually configured using
    3471. 

  3471.                   a <span><strong class="command">trusted-keys</strong></span> or
    3472. 

  3472.                   <span><strong class="command">managed-keys</strong></span> statement.  The default
    3473. 

  3473.                   is <strong class="userinput"><code>yes</code></strong>.
    3474. 

  3474.                 </p></dd>
    3475. 

  3475. <dt><span class="term"><span><strong class="command">dnssec-accept-expired</strong></span></span></dt>
    3476. 

  3476. <dd><p>
    3477. 

  3477.                   Accept expired signatures when verifying DNSSEC signatures.
    3478. 

  3478.                   The default is <strong class="userinput"><code>no</code></strong>.
    3479. 

  3479.                   Setting this option to <strong class="userinput"><code>yes</code></strong>
    3480. 

  3480.                   leaves <span><strong class="command">named</strong></span> vulnerable to
    3481. 

  3481.                   replay attacks.
    3482. 

  3482.                 </p></dd>
    3483. 

  3483. <dt><span class="term"><span><strong class="command">querylog</strong></span></span></dt>
    3484. 

  3484. <dd><p>
    3485. 

  3485.                   Specify whether query logging should be started when <span><strong class="command">named</strong></span>
    3486. 

  3486.                   starts.
    3487. 

  3487.                   If <span><strong class="command">querylog</strong></span> is not specified,
    3488. 

  3488.                   then the query logging
    3489. 

  3489.                   is determined by the presence of the logging category <span><strong class="command">queries</strong></span>.
    3490. 

  3490.                 </p></dd>
    3491. 

  3491. <dt><span class="term"><span><strong class="command">check-names</strong></span></span></dt>
    3492. 

  3492. <dd>
    3493. 

  3493. <p>
    3494. 

  3494.                   This option is used to restrict the character set and syntax
    3495. 

  3495.                   of
    3496. 

  3496.                   certain domain names in master files and/or DNS responses
    3497. 

  3497.                   received
    3498. 

  3498.                   from the network.  The default varies according to usage
    3499. 

  3499.                   area.  For
    3500. 

  3500.                   <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>.
    3501. 

  3501.                   For <span><strong class="command">slave</strong></span> zones the default
    3502. 

  3502.                   is <span><strong class="command">warn</strong></span>.
    3503. 

  3503.                   For answers received from the network (<span><strong class="command">response</strong></span>)
    3504. 

  3504.                   the default is <span><strong class="command">ignore</strong></span>.
    3505. 

  3505.                 </p>
    3506. 

  3506. <p>
    3507. 

  3507.                   The rules for legal hostnames and mail domains are derived
    3508. 

  3508.                   from RFC 952 and RFC 821 as modified by RFC 1123.
    3509. 

  3509.                 </p>
    3510. 

  3510. <p><span><strong class="command">check-names</strong></span>
    3511. 

  3511.                   applies to the owner names of A, AAAA and MX records.
    3512. 

  3512.                   It also applies to the domain names in the RDATA of NS, SOA,
    3513. 

  3513.                   MX, and SRV records.
    3514. 

  3514.                   It also applies to the RDATA of PTR records where the owner
    3515. 

  3515.                   name indicated that it is a reverse lookup of a hostname
    3516. 

  3516.                   (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT).
    3517. 

  3517.                 </p>
    3518. 

  3518. </dd>
    3519. 

  3519. <dt><span class="term"><span><strong class="command">check-dup-records</strong></span></span></dt>
    3520. 

  3520. <dd><p>
    3521. 

  3521.                   Check master zones for records that are treated as different
    3522. 

  3522.                   by DNSSEC but are semantically equal in plain DNS.  The
    3523. 

  3523.                   default is to <span><strong class="command">warn</strong></span>.  Other possible
    3524. 

  3524.                   values are <span><strong class="command">fail</strong></span> and
    3525. 

  3525.                   <span><strong class="command">ignore</strong></span>.
    3526. 

  3526.                 </p></dd>
    3527. 

  3527. <dt><span class="term"><span><strong class="command">check-mx</strong></span></span></dt>
    3528. 

  3528. <dd><p>
    3529. 

  3529.                   Check whether the MX record appears to refer to a IP address.
    3530. 

  3530.                   The default is to <span><strong class="command">warn</strong></span>.  Other possible
    3531. 

  3531.                   values are <span><strong class="command">fail</strong></span> and
    3532. 

  3532.                   <span><strong class="command">ignore</strong></span>.
    3533. 

  3533.                 </p></dd>
    3534. 

  3534. <dt><span class="term"><span><strong class="command">check-wildcard</strong></span></span></dt>
    3535. 

  3535. <dd><p>
    3536. 

  3536.                   This option is used to check for non-terminal wildcards.
    3537. 

  3537.                   The use of non-terminal wildcards is almost always as a
    3538. 

  3538.                   result of a failure
    3539. 

  3539.                   to understand the wildcard matching algorithm (RFC 1034).
    3540. 

  3540.                   This option
    3541. 

  3541.                   affects master zones.  The default (<span><strong class="command">yes</strong></span>) is to check
    3542. 

  3542.                   for non-terminal wildcards and issue a warning.
    3543. 

  3543.                 </p></dd>
    3544. 

  3544. <dt><span class="term"><span><strong class="command">check-integrity</strong></span></span></dt>
    3545. 

  3545. <dd><p>
    3546. 

  3546.                   Perform post load zone integrity checks on master
    3547. 

  3547.                   zones.  This checks that MX and SRV records refer
    3548. 

  3548.                   to address (A or AAAA) records and that glue
    3549. 

  3549.                   address records exist for delegated zones.  For
    3550. 

  3550.                   MX and SRV records only in-zone hostnames are
    3551. 

  3551.                   checked (for out-of-zone hostnames use
    3552. 

  3552.                   <span><strong class="command">named-checkzone</strong></span>).
    3553. 

  3553.                   For NS records only names below top of zone are
    3554. 

  3554.                   checked (for out-of-zone names and glue consistency
    3555. 

  3555.                   checks use <span><strong class="command">named-checkzone</strong></span>).
    3556. 

  3556.                   The default is <span><strong class="command">yes</strong></span>.
    3557. 

  3557.                 </p></dd>
    3558. 

  3558. <dt><span class="term"><span><strong class="command">check-mx-cname</strong></span></span></dt>
    3559. 

  3559. <dd><p>
    3560. 

  3560.                   If <span><strong class="command">check-integrity</strong></span> is set then
    3561. 

  3561.                   fail, warn or ignore MX records that refer
    3562. 

  3562.                   to CNAMES.  The default is to <span><strong class="command">warn</strong></span>.
    3563. 

  3563.                 </p></dd>
    3564. 

  3564. <dt><span class="term"><span><strong class="command">check-srv-cname</strong></span></span></dt>
    3565. 

  3565. <dd><p>
    3566. 

  3566.                   If <span><strong class="command">check-integrity</strong></span> is set then
    3567. 

  3567.                   fail, warn or ignore SRV records that refer
    3568. 

  3568.                   to CNAMES.  The default is to <span><strong class="command">warn</strong></span>.
    3569. 

  3569.                 </p></dd>
    3570. 

  3570. <dt><span class="term"><span><strong class="command">check-sibling</strong></span></span></dt>
    3571. 

  3571. <dd><p>
    3572. 

  3572.                   When performing integrity checks, also check that
    3573. 

  3573.                   sibling glue exists.  The default is <span><strong class="command">yes</strong></span>.
    3574. 

  3574.                 </p></dd>
    3575. 

  3575. <dt><span class="term"><span><strong class="command">zero-no-soa-ttl</strong></span></span></dt>
    3576. 

  3576. <dd><p>
    3577. 

  3577.                   When returning authoritative negative responses to
    3578. 

  3578.                   SOA queries set the TTL of the SOA record returned in
    3579. 

  3579.                   the authority section to zero.
    3580. 

  3580.                   The default is <span><strong class="command">yes</strong></span>.
    3581. 

  3581.                 </p></dd>
    3582. 

  3582. <dt><span class="term"><span><strong class="command">zero-no-soa-ttl-cache</strong></span></span></dt>
    3583. 

  3583. <dd><p>
    3584. 

  3584.                   When caching a negative response to a SOA query
    3585. 

  3585.                   set the TTL to zero.
    3586. 

  3586.                   The default is <span><strong class="command">no</strong></span>.
    3587. 

  3587.                 </p></dd>
    3588. 

  3588. <dt><span class="term"><span><strong class="command">update-check-ksk</strong></span></span></dt>
    3589. 

  3589. <dd>
    3590. 

  3590. <p>
    3591. 

  3591.                   When set to the default value of <code class="literal">yes</code>,
    3592. 

  3592.                   check the KSK bit in each key to determine how the key
    3593. 

  3593.                   should be used when generating RRSIGs for a secure zone.
    3594. 

  3594.                 </p>
    3595. 

  3595. <p>
    3596. 

  3596.                   Ordinarily, zone-signing keys (that is, keys without the
    3597. 

  3597.                   KSK bit set) are used to sign the entire zone, while
    3598. 

  3598.                   key-signing keys (keys with the KSK bit set) are only
    3599. 

  3599.                   used to sign the DNSKEY RRset at the zone apex.
    3600. 

  3600.                   However, if this option is set to <code class="literal">no</code>,
    3601. 

  3601.                   then the KSK bit is ignored; KSKs are treated as if they
    3602. 

  3602.                   were ZSKs and are used to sign the entire zone.  This is
    3603. 

  3603.                   similar to the <span><strong class="command">dnssec-signzone -z</strong></span>
    3604. 

  3604.                   command line option.
    3605. 

  3605.                 </p>
    3606. 

  3606. <p>
    3607. 

  3607.                   When this option is set to <code class="literal">yes</code>, there
    3608. 

  3608.                   must be at least two active keys for every algorithm
    3609. 

  3609.                   represented in the DNSKEY RRset: at least one KSK and one
    3610. 

  3610.                   ZSK per algorithm.  If there is any algorithm for which
    3611. 

  3611.                   this requirement is not met, this option will be ignored
    3612. 

  3612.                   for that algorithm.
    3613. 

  3613.                 </p>
    3614. 

  3614. </dd>
    3615. 

  3615. <dt><span class="term"><span><strong class="command">dnssec-dnskey-kskonly</strong></span></span></dt>
    3616. 

  3616. <dd>
    3617. 

  3617. <p>
    3618. 

  3618.                   When this option and <span><strong class="command">update-check-ksk</strong></span>
    3619. 

  3619.                   are both set to <code class="literal">yes</code>, only key-signing
    3620. 

  3620.                   keys (that is, keys with the KSK bit set) will be used
    3621. 

  3621.                   to sign the DNSKEY RRset at the zone apex.  Zone-signing
    3622. 

  3622.                   keys (keys without the KSK bit set) will be used to sign
    3623. 

  3623.                   the remainder of the zone, but not the DNSKEY RRset.
    3624. 

  3624.                   This is similar to the
    3625. 

  3625.                   <span><strong class="command">dnssec-signzone -x</strong></span> command line option.
    3626. 

  3626.                 </p>
    3627. 

  3627. <p>
    3628. 

  3628.                   The default is <span><strong class="command">no</strong></span>.  If
    3629. 

  3629.                   <span><strong class="command">update-check-ksk</strong></span> is set to
    3630. 

  3630.                   <code class="literal">no</code>, this option is ignored.
    3631. 

  3631.                 </p>
    3632. 

  3632. </dd>
    3633. 

  3633. <dt><span class="term"><span><strong class="command">try-tcp-refresh</strong></span></span></dt>
    3634. 

  3634. <dd><p>
    3635. 

  3635.                   Try to refresh the zone using TCP if UDP queries fail.
    3636. 

  3636.                   For BIND 8 compatibility, the default is
    3637. 

  3637.                   <span><strong class="command">yes</strong></span>.
    3638. 

  3638.                 </p></dd>
    3639. 

  3639. <dt><span class="term"><span><strong class="command">dnssec-secure-to-insecure</strong></span></span></dt>
    3640. 

  3640. <dd>
    3641. 

  3641. <p>
    3642. 

  3642.                   Allow a dynamic zone to transition from secure to
    3643. 

  3643.                   insecure (i.e., signed to unsigned) by deleting all
    3644. 

  3644.                   of the DNSKEY records.  The default is <span><strong class="command">no</strong></span>.
    3645. 

  3645.                   If set to <span><strong class="command">yes</strong></span>, and if the DNSKEY RRset
    3646. 

  3646.                   at the zone apex is deleted, all RRSIG and NSEC records
    3647. 

  3647.                   will be removed from the zone as well.
    3648. 

  3648.                 </p>
    3649. 

  3649. <p>
    3650. 

  3650.                   If the zone uses NSEC3, then it is also necessary to
    3651. 

  3651.                   delete the NSEC3PARAM RRset from the zone apex; this will
    3652. 

  3652.                   cause the removal of all corresponding NSEC3 records.
    3653. 

  3653.                   (It is expected that this requirement will be eliminated
    3654. 

  3654.                   in a future release.)
    3655. 

  3655.                 </p>
    3656. 

  3656. <p>
    3657. 

  3657.                   Note that if a zone has been configured with
    3658. 

  3658.                   <span><strong class="command">auto-dnssec maintain</strong></span> and the
    3659. 

  3659.                   private keys remain accessible in the key repository,
    3660. 

  3660.                   then the zone will be automatically signed again the
    3661. 

  3661.                   next time <span><strong class="command">named</strong></span> is started.
    3662. 

  3662.                 </p>
    3663. 

  3663. </dd>
    3664. 

  3664. </dl></div>
    3665. 

  3665. </div>
    3666. 

  3666. <div class="sect3" lang="en">
    3667. 

  3667. <div class="titlepage"><div><div><h4 class="title">
    3668. 

  3668. <a name="id2583643"></a>Forwarding</h4></div></div></div>
    3669. 

  3669. <p>
    3670. 

  3670.             The forwarding facility can be used to create a large site-wide
    3671. 

  3671.             cache on a few servers, reducing traffic over links to external
    3672. 

  3672.             name servers. It can also be used to allow queries by servers that
    3673. 

  3673.             do not have direct access to the Internet, but wish to look up
    3674. 

  3674.             exterior
    3675. 

  3675.             names anyway. Forwarding occurs only on those queries for which
    3676. 

  3676.             the server is not authoritative and does not have the answer in
    3677. 

  3677.             its cache.
    3678. 

  3678.           </p>
    3679. 

  3679. <div class="variablelist"><dl>
    3680. 

  3680. <dt><span class="term"><span><strong class="command">forward</strong></span></span></dt>
    3681. 

  3681. <dd><p>
    3682. 

  3682.                   This option is only meaningful if the
    3683. 

  3683.                   forwarders list is not empty. A value of <code class="varname">first</code>,
    3684. 

  3684.                   the default, causes the server to query the forwarders
    3685. 

  3685.                   first &#8212; and
    3686. 

  3686.                   if that doesn't answer the question, the server will then
    3687. 

  3687.                   look for
    3688. 

  3688.                   the answer itself. If <code class="varname">only</code> is
    3689. 

  3689.                   specified, the
    3690. 

  3690.                   server will only query the forwarders.
    3691. 

  3691.                 </p></dd>
    3692. 

  3692. <dt><span class="term"><span><strong class="command">forwarders</strong></span></span></dt>
    3693. 

  3693. <dd><p>
    3694. 

  3694.                   Specifies the IP addresses to be used
    3695. 

  3695.                   for forwarding. The default is the empty list (no
    3696. 

  3696.                   forwarding).
    3697. 

  3697.                 </p></dd>
    3698. 

  3698. </dl></div>
    3699. 

  3699. <p>
    3700. 

  3700.             Forwarding can also be configured on a per-domain basis, allowing
    3701. 

  3701.             for the global forwarding options to be overridden in a variety
    3702. 

  3702.             of ways. You can set particular domains to use different
    3703. 

  3703.             forwarders,
    3704. 

  3704.             or have a different <span><strong class="command">forward only/first</strong></span> behavior,
    3705. 

  3705.             or not forward at all, see <a href="Bv9ARM.ch06.html#zone_statement_grammar" title="zone
    3706. 

  3706.             Statement Grammar">the section called &#8220;<span><strong class="command">zone</strong></span>
    3707. 

  3707.             Statement Grammar&#8221;</a>.
    3708. 

  3708.           </p>
    3709. 

  3709. </div>
    3710. 

  3710. <div class="sect3" lang="en">
    3711. 

  3711. <div class="titlepage"><div><div><h4 class="title">
    3712. 

  3712. <a name="id2583702"></a>Dual-stack Servers</h4></div></div></div>
    3713. 

  3713. <p>
    3714. 

  3714.             Dual-stack servers are used as servers of last resort to work
    3715. 

  3715.             around
    3716. 

  3716.             problems in reachability due the lack of support for either IPv4
    3717. 

  3717.             or IPv6
    3718. 

  3718.             on the host machine.
    3719. 

  3719.           </p>
    3720. 

  3720. <div class="variablelist"><dl>
    3721. 

  3721. <dt><span class="term"><span><strong class="command">dual-stack-servers</strong></span></span></dt>
    3722. 

  3722. <dd><p>
    3723. 

  3723.                   Specifies host names or addresses of machines with access to
    3724. 

  3724.                   both IPv4 and IPv6 transports. If a hostname is used, the
    3725. 

  3725.                   server must be able
    3726. 

  3726.                   to resolve the name using only the transport it has.  If the
    3727. 

  3727.                   machine is dual
    3728. 

  3728.                   stacked, then the <span><strong class="command">dual-stack-servers</strong></span> have no effect unless
    3729. 

  3729.                   access to a transport has been disabled on the command line
    3730. 

  3730.                   (e.g. <span><strong class="command">named -4</strong></span>).
    3731. 

  3731.                 </p></dd>
    3732. 

  3732. </dl></div>
    3733. 

  3733. </div>
    3734. 

  3734. <div class="sect3" lang="en">
    3735. 

  3735. <div class="titlepage"><div><div><h4 class="title">
    3736. 

  3736. <a name="access_control"></a>Access Control</h4></div></div></div>
    3737. 

  3737. <p>
    3738. 

  3738.             Access to the server can be restricted based on the IP address
    3739. 

  3739.             of the requesting system. See <a href="Bv9ARM.ch06.html#address_match_lists" title="Address Match Lists">the section called &#8220;Address Match Lists&#8221;</a> for
    3740. 

  3740.             details on how to specify IP address lists.
    3741. 

  3741.           </p>
    3742. 

  3742. <div class="variablelist"><dl>
    3743. 

  3743. <dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt>
    3744. 

  3744. <dd><p>
    3745. 

  3745.                   Specifies which hosts are allowed to
    3746. 

  3746.                   notify this server, a slave, of zone changes in addition
    3747. 

  3747.                   to the zone masters.
    3748. 

  3748.                   <span><strong class="command">allow-notify</strong></span> may also be
    3749. 

  3749.                   specified in the
    3750. 

  3750.                   <span><strong class="command">zone</strong></span> statement, in which case
    3751. 

  3751.                   it overrides the
    3752. 

  3752.                   <span><strong class="command">options allow-notify</strong></span>
    3753. 

  3753.                   statement.  It is only meaningful
    3754. 

  3754.                   for a slave zone.  If not specified, the default is to
    3755. 

  3755.                   process notify messages
    3756. 

  3756.                   only from a zone's master.
    3757. 

  3757.                 </p></dd>
    3758. 

  3758. <dt><span class="term"><span><strong class="command">allow-query</strong></span></span></dt>
    3759. 

  3759. <dd>
    3760. 

  3760. <p>
    3761. 

  3761.                   Specifies which hosts are allowed to ask ordinary
    3762. 

  3762.                   DNS questions. <span><strong class="command">allow-query</strong></span> may
    3763. 

  3763.                   also be specified in the <span><strong class="command">zone</strong></span>
    3764. 

  3764.                   statement, in which case it overrides the
    3765. 

  3765.                   <span><strong class="command">options allow-query</strong></span> statement.
    3766. 

  3766.                   If not specified, the default is to allow queries
    3767. 

  3767.                   from all hosts.
    3768. 

  3768.                 </p>
    3769. 

  3769. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    3770. 

  3770. <h3 class="title">Note</h3>
    3771. 

  3771. <p>
    3772. 

  3772.                     <span><strong class="command">allow-query-cache</strong></span> is now
    3773. 

  3773.                     used to specify access to the cache.
    3774. 

  3774.                   </p>
    3775. 

  3775. </div>
    3776. 

  3776. </dd>
    3777. 

  3777. <dt><span class="term"><span><strong class="command">allow-query-on</strong></span></span></dt>
    3778. 

  3778. <dd>
    3779. 

  3779. <p>
    3780. 

  3780.                   Specifies which local addresses can accept ordinary
    3781. 

  3781.                   DNS questions. This makes it possible, for instance,
    3782. 

  3782.                   to allow queries on internal-facing interfaces but
    3783. 

  3783.                   disallow them on external-facing ones, without
    3784. 

  3784.                   necessarily knowing the internal network's addresses.
    3785. 

  3785.                 </p>
    3786. 

  3786. <p>
    3787. 

  3787.                   <span><strong class="command">allow-query-on</strong></span> may
    3788. 

  3788.                   also be specified in the <span><strong class="command">zone</strong></span>
    3789. 

  3789.                   statement, in which case it overrides the
    3790. 

  3790.                   <span><strong class="command">options allow-query-on</strong></span> statement.
    3791. 

  3791.                 </p>
    3792. 

  3792. <p>
    3793. 

  3793.                   If not specified, the default is to allow queries
    3794. 

  3794.                   on all addresses.
    3795. 

  3795.                 </p>
    3796. 

  3796. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    3797. 

  3797. <h3 class="title">Note</h3>
    3798. 

  3798. <p>
    3799. 

  3799.                     <span><strong class="command">allow-query-cache</strong></span> is
    3800. 

  3800.                     used to specify access to the cache.
    3801. 

  3801.                   </p>
    3802. 

  3802. </div>
    3803. 

  3803. </dd>
    3804. 

  3804. <dt><span class="term"><span><strong class="command">allow-query-cache</strong></span></span></dt>
    3805. 

  3805. <dd><p>
    3806. 

  3806.                   Specifies which hosts are allowed to get answers
    3807. 

  3807.                   from the cache.  If <span><strong class="command">allow-query-cache</strong></span>
    3808. 

  3808.                   is not set then <span><strong class="command">allow-recursion</strong></span>
    3809. 

  3809.                   is used if set, otherwise <span><strong class="command">allow-query</strong></span>
    3810. 

  3810.                   is used if set unless <span><strong class="command">recursion no;</strong></span> is
    3811. 

  3811.                   set in which case <span><strong class="command">none;</strong></span> is used,
    3812. 

  3812.                   otherwise the default (<span><strong class="command">localnets;</strong></span>
    3813. 

  3813.                   <span><strong class="command">localhost;</strong></span>) is used.
    3814. 

  3814.                 </p></dd>
    3815. 

  3815. <dt><span class="term"><span><strong class="command">allow-query-cache-on</strong></span></span></dt>
    3816. 

  3816. <dd><p>
    3817. 

  3817.                   Specifies which local addresses can give answers
    3818. 

  3818.                   from the cache.  If not specified, the default is
    3819. 

  3819.                   to allow cache queries on any address,
    3820. 

  3820.                   <span><strong class="command">localnets</strong></span> and
    3821. 

  3821.                   <span><strong class="command">localhost</strong></span>.
    3822. 

  3822.                 </p></dd>
    3823. 

  3823. <dt><span class="term"><span><strong class="command">allow-recursion</strong></span></span></dt>
    3824. 

  3824. <dd><p>
    3825. 

  3825.                   Specifies which hosts are allowed to make recursive
    3826. 

  3826.                   queries through this server. If
    3827. 

  3827.                   <span><strong class="command">allow-recursion</strong></span> is not set
    3828. 

  3828.                   then <span><strong class="command">allow-query-cache</strong></span> is
    3829. 

  3829.                   used if set, otherwise <span><strong class="command">allow-query</strong></span>
    3830. 

  3830.                   is used if set, otherwise the default
    3831. 

  3831.                   (<span><strong class="command">localnets;</strong></span>
    3832. 

  3832.                   <span><strong class="command">localhost;</strong></span>) is used.
    3833. 

  3833.                 </p></dd>
    3834. 

  3834. <dt><span class="term"><span><strong class="command">allow-recursion-on</strong></span></span></dt>
    3835. 

  3835. <dd><p>
    3836. 

  3836.                   Specifies which local addresses can accept recursive
    3837. 

  3837.                   queries.  If not specified, the default is to allow
    3838. 

  3838.                   recursive queries on all addresses.
    3839. 

  3839.                 </p></dd>
    3840. 

  3840. <dt><span class="term"><span><strong class="command">allow-update</strong></span></span></dt>
    3841. 

  3841. <dd><p>
    3842. 

  3842.                   Specifies which hosts are allowed to
    3843. 

  3843.                   submit Dynamic DNS updates for master zones. The default is
    3844. 

  3844.                   to deny
    3845. 

  3845.                   updates from all hosts.  Note that allowing updates based
    3846. 

  3846.                   on the requestor's IP address is insecure; see
    3847. 

  3847.                   <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called &#8220;Dynamic Update Security&#8221;</a> for details.
    3848. 

  3848.                 </p></dd>
    3849. 

  3849. <dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
    3850. 

  3850. <dd>
    3851. 

  3851. <p>
    3852. 

  3852.                   Specifies which hosts are allowed to
    3853. 

  3853.                   submit Dynamic DNS updates to slave zones to be forwarded to
    3854. 

  3854.                   the
    3855. 

  3855.                   master.  The default is <strong class="userinput"><code>{ none; }</code></strong>,
    3856. 

  3856.                   which
    3857. 

  3857.                   means that no update forwarding will be performed.  To
    3858. 

  3858.                   enable
    3859. 

  3859.                   update forwarding, specify
    3860. 

  3860.                   <strong class="userinput"><code>allow-update-forwarding { any; };</code></strong>.
    3861. 

  3861.                   Specifying values other than <strong class="userinput"><code>{ none; }</code></strong> or
    3862. 

  3862.                   <strong class="userinput"><code>{ any; }</code></strong> is usually
    3863. 

  3863.                   counterproductive, since
    3864. 

  3864.                   the responsibility for update access control should rest
    3865. 

  3865.                   with the
    3866. 

  3866.                   master server, not the slaves.
    3867. 

  3867.                 </p>
    3868. 

  3868. <p>
    3869. 

  3869.                   Note that enabling the update forwarding feature on a slave
    3870. 

  3870.                   server
    3871. 

  3871.                   may expose master servers relying on insecure IP address
    3872. 

  3872.                   based
    3873. 

  3873.                   access control to attacks; see <a href="Bv9ARM.ch07.html#dynamic_update_security" title="Dynamic Update Security">the section called &#8220;Dynamic Update Security&#8221;</a>
    3874. 

  3874.                   for more details.
    3875. 

  3875.                 </p>
    3876. 

  3876. </dd>
    3877. 

  3877. <dt><span class="term"><span><strong class="command">allow-v6-synthesis</strong></span></span></dt>
    3878. 

  3878. <dd><p>
    3879. 

  3879.                   This option was introduced for the smooth transition from
    3880. 

  3880.                   AAAA
    3881. 

  3881.                   to A6 and from "nibble labels" to binary labels.
    3882. 

  3882.                   However, since both A6 and binary labels were then
    3883. 

  3883.                   deprecated,
    3884. 

  3884.                   this option was also deprecated.
    3885. 

  3885.                   It is now ignored with some warning messages.
    3886. 

  3886.                 </p></dd>
    3887. 

  3887. <dt><span class="term"><span><strong class="command">allow-transfer</strong></span></span></dt>
    3888. 

  3888. <dd><p>
    3889. 

  3889.                   Specifies which hosts are allowed to
    3890. 

  3890.                   receive zone transfers from the server. <span><strong class="command">allow-transfer</strong></span> may
    3891. 

  3891.                   also be specified in the <span><strong class="command">zone</strong></span>
    3892. 

  3892.                   statement, in which
    3893. 

  3893.                   case it overrides the <span><strong class="command">options allow-transfer</strong></span> statement.
    3894. 

  3894.                   If not specified, the default is to allow transfers to all
    3895. 

  3895.                   hosts.
    3896. 

  3896.                 </p></dd>
    3897. 

  3897. <dt><span class="term"><span><strong class="command">blackhole</strong></span></span></dt>
    3898. 

  3898. <dd><p>
    3899. 

  3899.                   Specifies a list of addresses that the
    3900. 

  3900.                   server will not accept queries from or use to resolve a
    3901. 

  3901.                   query. Queries
    3902. 

  3902.                   from these addresses will not be responded to. The default
    3903. 

  3903.                   is <strong class="userinput"><code>none</code></strong>.
    3904. 

  3904.                 </p></dd>
    3905. 

  3905. <dt><span class="term"><span><strong class="command">filter-aaaa</strong></span></span></dt>
    3906. 

  3906. <dd><p>
    3907. 

  3907.                   Specifies a list of addresses to which
    3908. 

  3908.                   <span><strong class="command">filter-aaaa-on-v4</strong></span>
    3909. 

  3909.                   is applies.  The default is <strong class="userinput"><code>any</code></strong>.
    3910. 

  3910.                 </p></dd>
    3911. 

  3911. <dt><span class="term"><span><strong class="command">resolver-query-timeout</strong></span></span></dt>
    3912. 

  3912. <dd><p>
    3913. 

  3913.                   The amount of time the resolver will spend attempting
    3914. 

  3914.                   to resolve a recursive query before failing.  The
    3915. 

  3915.                   default is <code class="literal">10</code> and the maximum is
    3916. 

  3916.                   <code class="literal">30</code>.  Setting it to <code class="literal">0</code>
    3917. 

  3917.                   will result in the default being used.
    3918. 

  3918.                 </p></dd>
    3919. 

  3919. </dl></div>
    3920. 

  3920. </div>
    3921. 

  3921. <div class="sect3" lang="en">
    3922. 

  3922. <div class="titlepage"><div><div><h4 class="title">
    3923. 

  3923. <a name="id2584322"></a>Interfaces</h4></div></div></div>
    3924. 

  3924. <p>
    3925. 

  3925.             The interfaces and ports that the server will answer queries
    3926. 

  3926.             from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes
    3927. 

  3927.             an optional port and an <code class="varname">address_match_list</code>.
    3928. 

  3928.             The server will listen on all interfaces allowed by the address
    3929. 

  3929.             match list. If a port is not specified, port 53 will be used.
    3930. 

  3930.           </p>
    3931. 

  3931. <p>
    3932. 

  3932.             Multiple <span><strong class="command">listen-on</strong></span> statements are
    3933. 

  3933.             allowed.
    3934. 

  3934.             For example,
    3935. 

  3935.           </p>
    3936. 

  3936. <pre class="programlisting">listen-on { 5.6.7.8; };
    3937. 

  3937. listen-on port 1234 { !1.2.3.4; 1.2/16; };
    3938. 

  3938. </pre>
    3939. 

  3939. <p>
    3940. 

  3940.             will enable the name server on port 53 for the IP address
    3941. 

  3941.             5.6.7.8, and on port 1234 of an address on the machine in net
    3942. 

  3942.             1.2 that is not 1.2.3.4.
    3943. 

  3943.           </p>
    3944. 

  3944. <p>
    3945. 

  3945.             If no <span><strong class="command">listen-on</strong></span> is specified, the
    3946. 

  3946.             server will listen on port 53 on all IPv4 interfaces.
    3947. 

  3947.           </p>
    3948. 

  3948. <p>
    3949. 

  3949.             The <span><strong class="command">listen-on-v6</strong></span> option is used to
    3950. 

  3950.             specify the interfaces and the ports on which the server will
    3951. 

  3951.             listen
    3952. 

  3952.             for incoming queries sent using IPv6.
    3953. 

  3953.           </p>
    3954. 

  3954. <p>
    3955. 

  3955.             When </p>
    3956. 

  3956. <pre class="programlisting">{ any; }</pre>
    3957. 

  3957. <p> is
    3958. 

  3958.             specified
    3959. 

  3959.             as the <code class="varname">address_match_list</code> for the
    3960. 

  3960.             <span><strong class="command">listen-on-v6</strong></span> option,
    3961. 

  3961.             the server does not bind a separate socket to each IPv6 interface
    3962. 

  3962.             address as it does for IPv4 if the operating system has enough API
    3963. 

  3963.             support for IPv6 (specifically if it conforms to RFC 3493 and RFC
    3964. 

  3964.             3542).
    3965. 

  3965.             Instead, it listens on the IPv6 wildcard address.
    3966. 

  3966.             If the system only has incomplete API support for IPv6, however,
    3967. 

  3967.             the behavior is the same as that for IPv4.
    3968. 

  3968.           </p>
    3969. 

  3969. <p>
    3970. 

  3970.             A list of particular IPv6 addresses can also be specified, in
    3971. 

  3971.             which case
    3972. 

  3972.             the server listens on a separate socket for each specified
    3973. 

  3973.             address,
    3974. 

  3974.             regardless of whether the desired API is supported by the system.
    3975. 

  3975.           </p>
    3976. 

  3976. <p>
    3977. 

  3977.             Multiple <span><strong class="command">listen-on-v6</strong></span> options can
    3978. 

  3978.             be used.
    3979. 

  3979.             For example,
    3980. 

  3980.           </p>
    3981. 

  3981. <pre class="programlisting">listen-on-v6 { any; };
    3982. 

  3982. listen-on-v6 port 1234 { !2001:db8::/32; any; };
    3983. 

  3983. </pre>
    3984. 

  3984. <p>
    3985. 

  3985.             will enable the name server on port 53 for any IPv6 addresses
    3986. 

  3986.             (with a single wildcard socket),
    3987. 

  3987.             and on port 1234 of IPv6 addresses that is not in the prefix
    3988. 

  3988.             2001:db8::/32 (with separate sockets for each matched address.)
    3989. 

  3989.           </p>
    3990. 

  3990. <p>
    3991. 

  3991.             To make the server not listen on any IPv6 address, use
    3992. 

  3992.           </p>
    3993. 

  3993. <pre class="programlisting">listen-on-v6 { none; };
    3994. 

  3994. </pre>
    3995. 

  3995. <p>
    3996. 

  3996.             If no <span><strong class="command">listen-on-v6</strong></span> option is
    3997. 

  3997.             specified, the server will not listen on any IPv6 address
    3998. 

  3998.             unless <span><strong class="command">-6</strong></span> is specified when <span><strong class="command">named</strong></span> is
    3999. 

  3999.             invoked.  If <span><strong class="command">-6</strong></span> is specified then
    4000. 

  4000.             <span><strong class="command">named</strong></span> will listen on port 53 on all IPv6 interfaces by default.
    4001. 

  4001.           </p>
    4002. 

  4002. </div>
    4003. 

  4003. <div class="sect3" lang="en">
    4004. 

  4004. <div class="titlepage"><div><div><h4 class="title">
    4005. 

  4005. <a name="query_address"></a>Query Address</h4></div></div></div>
    4006. 

  4006. <p>
    4007. 

  4007.             If the server doesn't know the answer to a question, it will
    4008. 

  4008.             query other name servers. <span><strong class="command">query-source</strong></span> specifies
    4009. 

  4009.             the address and port used for such queries. For queries sent over
    4010. 

  4010.             IPv6, there is a separate <span><strong class="command">query-source-v6</strong></span> option.
    4011. 

  4011.             If <span><strong class="command">address</strong></span> is <span><strong class="command">*</strong></span> (asterisk) or is omitted,
    4012. 

  4012.             a wildcard IP address (<span><strong class="command">INADDR_ANY</strong></span>)
    4013. 

  4013.             will be used.
    4014. 

  4014.           </p>
    4015. 

  4015. <p>
    4016. 

  4016.             If <span><strong class="command">port</strong></span> is <span><strong class="command">*</strong></span> or is omitted,
    4017. 

  4017.             a random port number from a pre-configured
    4018. 

  4018.             range is picked up and will be used for each query.
    4019. 

  4019.             The port range(s) is that specified in
    4020. 

  4020.             the <span><strong class="command">use-v4-udp-ports</strong></span> (for IPv4)
    4021. 

  4021.             and <span><strong class="command">use-v6-udp-ports</strong></span> (for IPv6)
    4022. 

  4022.             options, excluding the ranges specified in
    4023. 

  4023.             the <span><strong class="command">avoid-v4-udp-ports</strong></span>
    4024. 

  4024.             and <span><strong class="command">avoid-v6-udp-ports</strong></span> options, respectively.
    4025. 

  4025.           </p>
    4026. 

  4026. <p>
    4027. 

  4027.             The defaults of the <span><strong class="command">query-source</strong></span> and
    4028. 

  4028.             <span><strong class="command">query-source-v6</strong></span> options
    4029. 

  4029.             are:
    4030. 

  4030.           </p>
    4031. 

  4031. <pre class="programlisting">query-source address * port *;
    4032. 

  4032. query-source-v6 address * port *;
    4033. 

  4033. </pre>
    4034. 

  4034. <p>
    4035. 

  4035.             If <span><strong class="command">use-v4-udp-ports</strong></span> or
    4036. 

  4036.             <span><strong class="command">use-v6-udp-ports</strong></span> is unspecified,
    4037. 

  4037.             <span><strong class="command">named</strong></span> will check if the operating
    4038. 

  4038.             system provides a programming interface to retrieve the
    4039. 

  4039.             system's default range for ephemeral ports.
    4040. 

  4040.             If such an interface is available,
    4041. 

  4041.             <span><strong class="command">named</strong></span> will use the corresponding system
    4042. 

  4042.             default range; otherwise, it will use its own defaults:
    4043. 

  4043.          </p>
    4044. 

  4044. <pre class="programlisting">use-v4-udp-ports { range 1024 65535; };
    4045. 

  4045. use-v6-udp-ports { range 1024 65535; };
    4046. 

  4046. </pre>
    4047. 

  4047. <p>
    4048. 

  4048.             Note: make sure the ranges be sufficiently large for
    4049. 

  4049.             security.  A desirable size depends on various parameters,
    4050. 

  4050.             but we generally recommend it contain at least 16384 ports
    4051. 

  4051.             (14 bits of entropy).
    4052. 

  4052.             Note also that the system's default range when used may be
    4053. 

  4053.             too small for this purpose, and that the range may even be
    4054. 

  4054.             changed while <span><strong class="command">named</strong></span> is running; the new
    4055. 

  4055.             range will automatically be applied when <span><strong class="command">named</strong></span>
    4056. 

  4056.             is reloaded.
    4057. 

  4057.             It is encouraged to
    4058. 

  4058.             configure <span><strong class="command">use-v4-udp-ports</strong></span> and
    4059. 

  4059.             <span><strong class="command">use-v6-udp-ports</strong></span> explicitly so that the
    4060. 

  4060.             ranges are sufficiently large and are reasonably
    4061. 

  4061.             independent from the ranges used by other applications.
    4062. 

  4062.           </p>
    4063. 

  4063. <p>
    4064. 

  4064.             Note: the operational configuration
    4065. 

  4065.             where <span><strong class="command">named</strong></span> runs may prohibit the use
    4066. 

  4066.             of some ports.  For example, UNIX systems will not allow
    4067. 

  4067.             <span><strong class="command">named</strong></span> running without a root privilege
    4068. 

  4068.             to use ports less than 1024.
    4069. 

  4069.             If such ports are included in the specified (or detected)
    4070. 

  4070.             set of query ports, the corresponding query attempts will
    4071. 

  4071.             fail, resulting in resolution failures or delay.
    4072. 

  4072.             It is therefore important to configure the set of ports
    4073. 

  4073.             that can be safely used in the expected operational environment.
    4074. 

  4074.           </p>
    4075. 

  4075. <p>
    4076. 

  4076.             The defaults of the <span><strong class="command">avoid-v4-udp-ports</strong></span> and
    4077. 

  4077.             <span><strong class="command">avoid-v6-udp-ports</strong></span> options
    4078. 

  4078.             are:
    4079. 

  4079.           </p>
    4080. 

  4080. <pre class="programlisting">avoid-v4-udp-ports {};
    4081. 

  4081. avoid-v6-udp-ports {};
    4082. 

  4082. </pre>
    4083. 

  4083. <p>
    4084. 

  4084.             Note: BIND 9.5.0 introduced
    4085. 

  4085.             the <span><strong class="command">use-queryport-pool</strong></span> 
    4086. 

  4086.             option to support a pool of such random ports, but this
    4087. 

  4087.             option is now obsolete because reusing the same ports in
    4088. 

  4088.             the pool may not be sufficiently secure.
    4089. 

  4089.             For the same reason, it is generally strongly discouraged to
    4090. 

  4090.             specify a particular port for the
    4091. 

  4091.             <span><strong class="command">query-source</strong></span> or
    4092. 

  4092.             <span><strong class="command">query-source-v6</strong></span> options;
    4093. 

  4093.             it implicitly disables the use of randomized port numbers.
    4094. 

  4094.           </p>
    4095. 

  4095. <div class="variablelist"><dl>
    4096. 

  4096. <dt><span class="term"><span><strong class="command">use-queryport-pool</strong></span></span></dt>
    4097. 

  4097. <dd><p>
    4098. 

  4098.                   This option is obsolete.
    4099. 

  4099.                 </p></dd>
    4100. 

  4100. <dt><span class="term"><span><strong class="command">queryport-pool-ports</strong></span></span></dt>
    4101. 

  4101. <dd><p>
    4102. 

  4102.                   This option is obsolete.
    4103. 

  4103.                 </p></dd>
    4104. 

  4104. <dt><span class="term"><span><strong class="command">queryport-pool-updateinterval</strong></span></span></dt>
    4105. 

  4105. <dd><p>
    4106. 

  4106.                   This option is obsolete.
    4107. 

  4107.                 </p></dd>
    4108. 

  4108. </dl></div>
    4109. 

  4109. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    4110. 

  4110. <h3 class="title">Note</h3>
    4111. 

  4111. <p>
    4112. 

  4112.               The address specified in the <span><strong class="command">query-source</strong></span> option
    4113. 

  4113.               is used for both UDP and TCP queries, but the port applies only
    4114. 

  4114.               to UDP queries.  TCP queries always use a random
    4115. 

  4115.               unprivileged port.
    4116. 

  4116.             </p>
    4117. 

  4117. </div>
    4118. 

  4118. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    4119. 

  4119. <h3 class="title">Note</h3>
    4120. 

  4120. <p>
    4121. 

  4121.               Solaris 2.5.1 and earlier does not support setting the source
    4122. 

  4122.               address for TCP sockets.
    4123. 

  4123.             </p>
    4124. 

  4124. </div>
    4125. 

  4125. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    4126. 

  4126. <h3 class="title">Note</h3>
    4127. 

  4127. <p>
    4128. 

  4128.               See also <span><strong class="command">transfer-source</strong></span> and
    4129. 

  4129.               <span><strong class="command">notify-source</strong></span>.
    4130. 

  4130.             </p>
    4131. 

  4131. </div>
    4132. 

  4132. </div>
    4133. 

  4133. <div class="sect3" lang="en">
    4134. 

  4134. <div class="titlepage"><div><div><h4 class="title">
    4135. 

  4135. <a name="zone_transfers"></a>Zone Transfers</h4></div></div></div>
    4136. 

  4136. <p>
    4137. 

  4137.             <acronym class="acronym">BIND</acronym> has mechanisms in place to
    4138. 

  4138.             facilitate zone transfers
    4139. 

  4139.             and set limits on the amount of load that transfers place on the
    4140. 

  4140.             system. The following options apply to zone transfers.
    4141. 

  4141.           </p>
    4142. 

  4142. <div class="variablelist"><dl>
    4143. 

  4143. <dt><span class="term"><span><strong class="command">also-notify</strong></span></span></dt>
    4144. 

  4144. <dd><p>
    4145. 

  4145.                   Defines a global list of IP addresses of name servers
    4146. 

  4146.                   that are also sent NOTIFY messages whenever a fresh copy of
    4147. 

  4147.                   the
    4148. 

  4148.                   zone is loaded, in addition to the servers listed in the
    4149. 

  4149.                   zone's NS records.
    4150. 

  4150.                   This helps to ensure that copies of the zones will
    4151. 

  4151.                   quickly converge on stealth servers.
    4152. 

  4152.                   Optionally, a port may be specified with each
    4153. 

  4153.                   <span><strong class="command">also-notify</strong></span> address to send
    4154. 

  4154.                   the notify messages to a port other than the
    4155. 

  4155.                   default of 53.
    4156. 

  4156.                   If an <span><strong class="command">also-notify</strong></span> list
    4157. 

  4157.                   is given in a <span><strong class="command">zone</strong></span> statement,
    4158. 

  4158.                   it will override
    4159. 

  4159.                   the <span><strong class="command">options also-notify</strong></span>
    4160. 

  4160.                   statement. When a <span><strong class="command">zone notify</strong></span>
    4161. 

  4161.                   statement
    4162. 

  4162.                   is set to <span><strong class="command">no</strong></span>, the IP
    4163. 

  4163.                   addresses in the global <span><strong class="command">also-notify</strong></span> list will
    4164. 

  4164.                   not be sent NOTIFY messages for that zone. The default is
    4165. 

  4165.                   the empty
    4166. 

  4166.                   list (no global notification list).
    4167. 

  4167.                 </p></dd>
    4168. 

  4168. <dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
    4169. 

  4169. <dd><p>
    4170. 

  4170.                   Inbound zone transfers running longer than
    4171. 

  4171.                   this many minutes will be terminated. The default is 120
    4172. 

  4172.                   minutes
    4173. 

  4173.                   (2 hours).  The maximum value is 28 days (40320 minutes).
    4174. 

  4174.                 </p></dd>
    4175. 

  4175. <dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
    4176. 

  4176. <dd><p>
    4177. 

  4177.                   Inbound zone transfers making no progress
    4178. 

  4178.                   in this many minutes will be terminated. The default is 60
    4179. 

  4179.                   minutes
    4180. 

  4180.                   (1 hour).  The maximum value is 28 days (40320 minutes).
    4181. 

  4181.                 </p></dd>
    4182. 

  4182. <dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
    4183. 

  4183. <dd><p>
    4184. 

  4184.                   Outbound zone transfers running longer than
    4185. 

  4185.                   this many minutes will be terminated. The default is 120
    4186. 

  4186.                   minutes
    4187. 

  4187.                   (2 hours).  The maximum value is 28 days (40320 minutes).
    4188. 

  4188.                 </p></dd>
    4189. 

  4189. <dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
    4190. 

  4190. <dd><p>
    4191. 

  4191.                   Outbound zone transfers making no progress
    4192. 

  4192.                   in this many minutes will be terminated.  The default is 60
    4193. 

  4193.                   minutes (1
    4194. 

  4194.                   hour).  The maximum value is 28 days (40320 minutes).
    4195. 

  4195.                 </p></dd>
    4196. 

  4196. <dt><span class="term"><span><strong class="command">serial-query-rate</strong></span></span></dt>
    4197. 

  4197. <dd>
    4198. 

  4198. <p>
    4199. 

  4199.                   Slave servers will periodically query master
    4200. 

  4200.                   servers to find out if zone serial numbers have
    4201. 

  4201.                   changed. Each such query uses a minute amount of
    4202. 

  4202.                   the slave server's network bandwidth.  To limit
    4203. 

  4203.                   the amount of bandwidth used, BIND 9 limits the
    4204. 

  4204.                   rate at which queries are sent.  The value of the
    4205. 

  4205.                   <span><strong class="command">serial-query-rate</strong></span> option, an
    4206. 

  4206.                   integer, is the maximum number of queries sent
    4207. 

  4207.                   per second.  The default is 20.
    4208. 

  4208.                 </p>
    4209. 

  4209. <p>
    4210. 

  4210.                   In addition to controlling the rate SOA refresh
    4211. 

  4211.                   queries are issued at
    4212. 

  4212.                   <span><strong class="command">serial-query-rate</strong></span> also controls
    4213. 

  4213.                   the rate at which NOTIFY messages are sent from
    4214. 

  4214.                   both master and slave zones.
    4215. 

  4215.                 </p>
    4216. 

  4216. </dd>
    4217. 

  4217. <dt><span class="term"><span><strong class="command">serial-queries</strong></span></span></dt>
    4218. 

  4218. <dd><p>
    4219. 

  4219.                   In BIND 8, the <span><strong class="command">serial-queries</strong></span>
    4220. 

  4220.                   option
    4221. 

  4221.                   set the maximum number of concurrent serial number queries
    4222. 

  4222.                   allowed to be outstanding at any given time.
    4223. 

  4223.                   BIND 9 does not limit the number of outstanding
    4224. 

  4224.                   serial queries and ignores the <span><strong class="command">serial-queries</strong></span> option.
    4225. 

  4225.                   Instead, it limits the rate at which the queries are sent
    4226. 

  4226.                   as defined using the <span><strong class="command">serial-query-rate</strong></span> option.
    4227. 

  4227.                 </p></dd>
    4228. 

  4228. <dt><span class="term"><span><strong class="command">transfer-format</strong></span></span></dt>
    4229. 

  4229. <dd><p>
    4230. 

  4230.                   Zone transfers can be sent using two different formats,
    4231. 

  4231.                   <span><strong class="command">one-answer</strong></span> and
    4232. 

  4232.                   <span><strong class="command">many-answers</strong></span>.
    4233. 

  4233.                   The <span><strong class="command">transfer-format</strong></span> option is used
    4234. 

  4234.                   on the master server to determine which format it sends.
    4235. 

  4235.                   <span><strong class="command">one-answer</strong></span> uses one DNS message per
    4236. 

  4236.                   resource record transferred.
    4237. 

  4237.                   <span><strong class="command">many-answers</strong></span> packs as many resource
    4238. 

  4238.                   records as possible into a message.
    4239. 

  4239.                   <span><strong class="command">many-answers</strong></span> is more efficient, but is
    4240. 

  4240.                   only supported by relatively new slave servers,
    4241. 

  4241.                   such as <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
    4242. 

  4242.                   8.x and <acronym class="acronym">BIND</acronym> 4.9.5 onwards.
    4243. 

  4243.                   The <span><strong class="command">many-answers</strong></span> format is also supported by
    4244. 

  4244.                   recent Microsoft Windows nameservers.
    4245. 

  4245.                   The default is <span><strong class="command">many-answers</strong></span>.
    4246. 

  4246.                   <span><strong class="command">transfer-format</strong></span> may be overridden on a
    4247. 

  4247.                   per-server basis by using the <span><strong class="command">server</strong></span>
    4248. 

  4248.                   statement.
    4249. 

  4249.                 </p></dd>
    4250. 

  4250. <dt><span class="term"><span><strong class="command">transfers-in</strong></span></span></dt>
    4251. 

  4251. <dd><p>
    4252. 

  4252.                   The maximum number of inbound zone transfers
    4253. 

  4253.                   that can be running concurrently. The default value is <code class="literal">10</code>.
    4254. 

  4254.                   Increasing <span><strong class="command">transfers-in</strong></span> may
    4255. 

  4255.                   speed up the convergence
    4256. 

  4256.                   of slave zones, but it also may increase the load on the
    4257. 

  4257.                   local system.
    4258. 

  4258.                 </p></dd>
    4259. 

  4259. <dt><span class="term"><span><strong class="command">transfers-out</strong></span></span></dt>
    4260. 

  4260. <dd><p>
    4261. 

  4261.                   The maximum number of outbound zone transfers
    4262. 

  4262.                   that can be running concurrently. Zone transfer requests in
    4263. 

  4263.                   excess
    4264. 

  4264.                   of the limit will be refused. The default value is <code class="literal">10</code>.
    4265. 

  4265.                 </p></dd>
    4266. 

  4266. <dt><span class="term"><span><strong class="command">transfers-per-ns</strong></span></span></dt>
    4267. 

  4267. <dd><p>
    4268. 

  4268.                   The maximum number of inbound zone transfers
    4269. 

  4269.                   that can be concurrently transferring from a given remote
    4270. 

  4270.                   name server.
    4271. 

  4271.                   The default value is <code class="literal">2</code>.
    4272. 

  4272.                   Increasing <span><strong class="command">transfers-per-ns</strong></span>
    4273. 

  4273.                   may
    4274. 

  4274.                   speed up the convergence of slave zones, but it also may
    4275. 

  4275.                   increase
    4276. 

  4276.                   the load on the remote name server. <span><strong class="command">transfers-per-ns</strong></span> may
    4277. 

  4277.                   be overridden on a per-server basis by using the <span><strong class="command">transfers</strong></span> phrase
    4278. 

  4278.                   of the <span><strong class="command">server</strong></span> statement.
    4279. 

  4279.                 </p></dd>
    4280. 

  4280. <dt><span class="term"><span><strong class="command">transfer-source</strong></span></span></dt>
    4281. 

  4281. <dd>
    4282. 

  4282. <p><span><strong class="command">transfer-source</strong></span>
    4283. 

  4283.                   determines which local address will be bound to IPv4
    4284. 

  4284.                   TCP connections used to fetch zones transferred
    4285. 

  4285.                   inbound by the server.  It also determines the
    4286. 

  4286.                   source IPv4 address, and optionally the UDP port,
    4287. 

  4287.                   used for the refresh queries and forwarded dynamic
    4288. 

  4288.                   updates.  If not set, it defaults to a system
    4289. 

  4289.                   controlled value which will usually be the address
    4290. 

  4290.                   of the interface "closest to" the remote end. This
    4291. 

  4291.                   address must appear in the remote end's
    4292. 

  4292.                   <span><strong class="command">allow-transfer</strong></span> option for the
    4293. 

  4293.                   zone being transferred, if one is specified. This
    4294. 

  4294.                   statement sets the
    4295. 

  4295.                   <span><strong class="command">transfer-source</strong></span> for all zones,
    4296. 

  4296.                   but can be overridden on a per-view or per-zone
    4297. 

  4297.                   basis by including a
    4298. 

  4298.                   <span><strong class="command">transfer-source</strong></span> statement within
    4299. 

  4299.                   the <span><strong class="command">view</strong></span> or
    4300. 

  4300.                   <span><strong class="command">zone</strong></span> block in the configuration
    4301. 

  4301.                   file.
    4302. 

  4302.                 </p>
    4303. 

  4303. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    4304. 

  4304. <h3 class="title">Note</h3>
    4305. 

  4305. <p>
    4306. 

  4306.                     Solaris 2.5.1 and earlier does not support setting the
    4307. 

  4307.                     source address for TCP sockets.
    4308. 

  4308.                   </p>
    4309. 

  4309. </div>
    4310. 

  4310. </dd>
    4311. 

  4311. <dt><span class="term"><span><strong class="command">transfer-source-v6</strong></span></span></dt>
    4312. 

  4312. <dd><p>
    4313. 

  4313.                   The same as <span><strong class="command">transfer-source</strong></span>,
    4314. 

  4314.                   except zone transfers are performed using IPv6.
    4315. 

  4315.                 </p></dd>
    4316. 

  4316. <dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
    4317. 

  4317. <dd>
    4318. 

  4318. <p>
    4319. 

  4319.                   An alternate transfer source if the one listed in
    4320. 

  4320.                   <span><strong class="command">transfer-source</strong></span> fails and
    4321. 

  4321.                   <span><strong class="command">use-alt-transfer-source</strong></span> is
    4322. 

  4322.                   set.
    4323. 

  4323.                 </p>
    4324. 

  4324. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    4325. 

  4325. <h3 class="title">Note</h3>
    4326. 

  4326.                   If you do not wish the alternate transfer source
    4327. 

  4327.                   to be used, you should set
    4328. 

  4328.                   <span><strong class="command">use-alt-transfer-source</strong></span>
    4329. 

  4329.                   appropriately and you should not depend upon
    4330. 

  4330.                   getting an answer back to the first refresh
    4331. 

  4331.                   query.
    4332. 

  4332.                 </div>
    4333. 

  4333. </dd>
    4334. 

  4334. <dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
    4335. 

  4335. <dd><p>
    4336. 

  4336.                   An alternate transfer source if the one listed in
    4337. 

  4337.                   <span><strong class="command">transfer-source-v6</strong></span> fails and
    4338. 

  4338.                   <span><strong class="command">use-alt-transfer-source</strong></span> is
    4339. 

  4339.                   set.
    4340. 

  4340.                 </p></dd>
    4341. 

  4341. <dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
    4342. 

  4342. <dd><p>
    4343. 

  4343.                   Use the alternate transfer sources or not.  If views are
    4344. 

  4344.                   specified this defaults to <span><strong class="command">no</strong></span>
    4345. 

  4345.                   otherwise it defaults to
    4346. 

  4346.                   <span><strong class="command">yes</strong></span> (for BIND 8
    4347. 

  4347.                   compatibility).
    4348. 

  4348.                 </p></dd>
    4349. 

  4349. <dt><span class="term"><span><strong class="command">notify-source</strong></span></span></dt>
    4350. 

  4350. <dd>
    4351. 

  4351. <p><span><strong class="command">notify-source</strong></span>
    4352. 

  4352.                   determines which local source address, and
    4353. 

  4353.                   optionally UDP port, will be used to send NOTIFY
    4354. 

  4354.                   messages.  This address must appear in the slave
    4355. 

  4355.                   server's <span><strong class="command">masters</strong></span> zone clause or
    4356. 

  4356.                   in an <span><strong class="command">allow-notify</strong></span> clause.  This
    4357. 

  4357.                   statement sets the <span><strong class="command">notify-source</strong></span>
    4358. 

  4358.                   for all zones, but can be overridden on a per-zone or
    4359. 

  4359.                   per-view basis by including a
    4360. 

  4360.                   <span><strong class="command">notify-source</strong></span> statement within
    4361. 

  4361.                   the <span><strong class="command">zone</strong></span> or
    4362. 

  4362.                   <span><strong class="command">view</strong></span> block in the configuration
    4363. 

  4363.                   file.
    4364. 

  4364.                 </p>
    4365. 

  4365. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    4366. 

  4366. <h3 class="title">Note</h3>
    4367. 

  4367. <p>
    4368. 

  4368.                     Solaris 2.5.1 and earlier does not support setting the
    4369. 

  4369.                     source address for TCP sockets.
    4370. 

  4370.                   </p>
    4371. 

  4371. </div>
    4372. 

  4372. </dd>
    4373. 

  4373. <dt><span class="term"><span><strong class="command">notify-source-v6</strong></span></span></dt>
    4374. 

  4374. <dd><p>
    4375. 

  4375.                   Like <span><strong class="command">notify-source</strong></span>,
    4376. 

  4376.                   but applies to notify messages sent to IPv6 addresses.
    4377. 

  4377.                 </p></dd>
    4378. 

  4378. </dl></div>
    4379. 

  4379. </div>
    4380. 

  4380. <div class="sect3" lang="en">
    4381. 

  4381. <div class="titlepage"><div><div><h4 class="title">
    4382. 

  4382. <a name="id2585531"></a>UDP Port Lists</h4></div></div></div>
    4383. 

  4383. <p>
    4384. 

  4384.             <span><strong class="command">use-v4-udp-ports</strong></span>,
    4385. 

  4385.             <span><strong class="command">avoid-v4-udp-ports</strong></span>,
    4386. 

  4386.             <span><strong class="command">use-v6-udp-ports</strong></span>, and
    4387. 

  4387.             <span><strong class="command">avoid-v6-udp-ports</strong></span>
    4388. 

  4388.             specify a list of IPv4 and IPv6 UDP ports that will be
    4389. 

  4389.             used or not used as source ports for UDP messages.
    4390. 

  4390.             See <a href="Bv9ARM.ch06.html#query_address" title="Query Address">the section called &#8220;Query Address&#8221;</a> about how the
    4391. 

  4391.             available ports are determined.
    4392. 

  4392.             For example, with the following configuration
    4393. 

  4393.           </p>
    4394. 

  4394. <pre class="programlisting">
    4395. 

  4395. use-v6-udp-ports { range 32768 65535; };
    4396. 

  4396. avoid-v6-udp-ports { 40000; range 50000 60000; };
    4397. 

  4397. </pre>
    4398. 

  4398. <p>
    4399. 

  4399.              UDP ports of IPv6 messages sent
    4400. 

  4400.              from <span><strong class="command">named</strong></span> will be in one
    4401. 

  4401.              of the following ranges: 32768 to 39999, 40001 to 49999,
    4402. 

  4402.              and 60001 to 65535.
    4403. 

  4403.            </p>
    4404. 

  4404. <p>
    4405. 

  4405.              <span><strong class="command">avoid-v4-udp-ports</strong></span> and
    4406. 

  4406.              <span><strong class="command">avoid-v6-udp-ports</strong></span> can be used
    4407. 

  4407.              to prevent <span><strong class="command">named</strong></span> from choosing as its random source port a
    4408. 

  4408.              port that is blocked by your firewall or a port that is
    4409. 

  4409.              used by other applications;
    4410. 

  4410.              if a query went out with a source port blocked by a
    4411. 

  4411.              firewall, the
    4412. 

  4412.              answer would not get by the firewall and the name server would
    4413. 

  4413.              have to query again.
    4414. 

  4414.              Note: the desired range can also be represented only with
    4415. 

  4415.              <span><strong class="command">use-v4-udp-ports</strong></span> and
    4416. 

  4416.              <span><strong class="command">use-v6-udp-ports</strong></span>, and the
    4417. 

  4417.              <span><strong class="command">avoid-</strong></span> options are redundant in that
    4418. 

  4418.              sense; they are provided for backward compatibility and
    4419. 

  4419.              to possibly simplify the port specification.
    4420. 

  4420.            </p>
    4421. 

  4421. </div>
    4422. 

  4422. <div class="sect3" lang="en">
    4423. 

  4423. <div class="titlepage"><div><div><h4 class="title">
    4424. 

  4424. <a name="id2585591"></a>Operating System Resource Limits</h4></div></div></div>
    4425. 

  4425. <p>
    4426. 

  4426.             The server's usage of many system resources can be limited.
    4427. 

  4427.             Scaled values are allowed when specifying resource limits.  For
    4428. 

  4428.             example, <span><strong class="command">1G</strong></span> can be used instead of
    4429. 

  4429.             <span><strong class="command">1073741824</strong></span> to specify a limit of
    4430. 

  4430.             one
    4431. 

  4431.             gigabyte. <span><strong class="command">unlimited</strong></span> requests
    4432. 

  4432.             unlimited use, or the
    4433. 

  4433.             maximum available amount. <span><strong class="command">default</strong></span>
    4434. 

  4434.             uses the limit
    4435. 

  4435.             that was in force when the server was started. See the description
    4436. 

  4436.             of <span><strong class="command">size_spec</strong></span> in <a href="Bv9ARM.ch06.html#configuration_file_elements" title="Configuration File Elements">the section called &#8220;Configuration File Elements&#8221;</a>.
    4437. 

  4437.           </p>
    4438. 

  4438. <p>
    4439. 

  4439.             The following options set operating system resource limits for
    4440. 

  4440.             the name server process.  Some operating systems don't support
    4441. 

  4441.             some or
    4442. 

  4442.             any of the limits. On such systems, a warning will be issued if
    4443. 

  4443.             the
    4444. 

  4444.             unsupported limit is used.
    4445. 

  4445.           </p>
    4446. 

  4446. <div class="variablelist"><dl>
    4447. 

  4447. <dt><span class="term"><span><strong class="command">coresize</strong></span></span></dt>
    4448. 

  4448. <dd><p>
    4449. 

  4449.                   The maximum size of a core dump. The default
    4450. 

  4450.                   is <code class="literal">default</code>.
    4451. 

  4451.                 </p></dd>
    4452. 

  4452. <dt><span class="term"><span><strong class="command">datasize</strong></span></span></dt>
    4453. 

  4453. <dd><p>
    4454. 

  4454.                   The maximum amount of data memory the server
    4455. 

  4455.                   may use. The default is <code class="literal">default</code>.
    4456. 

  4456.                   This is a hard limit on server memory usage.
    4457. 

  4457.                   If the server attempts to allocate memory in excess of this
    4458. 

  4458.                   limit, the allocation will fail, which may in turn leave
    4459. 

  4459.                   the server unable to perform DNS service.  Therefore,
    4460. 

  4460.                   this option is rarely useful as a way of limiting the
    4461. 

  4461.                   amount of memory used by the server, but it can be used
    4462. 

  4462.                   to raise an operating system data size limit that is
    4463. 

  4463.                   too small by default.  If you wish to limit the amount
    4464. 

  4464.                   of memory used by the server, use the
    4465. 

  4465.                   <span><strong class="command">max-cache-size</strong></span> and
    4466. 

  4466.                   <span><strong class="command">recursive-clients</strong></span>
    4467. 

  4467.                   options instead.
    4468. 

  4468.                 </p></dd>
    4469. 

  4469. <dt><span class="term"><span><strong class="command">files</strong></span></span></dt>
    4470. 

  4470. <dd><p>
    4471. 

  4471.                   The maximum number of files the server
    4472. 

  4472.                   may have open concurrently. The default is <code class="literal">unlimited</code>.
    4473. 

  4473.                 </p></dd>
    4474. 

  4474. <dt><span class="term"><span><strong class="command">stacksize</strong></span></span></dt>
    4475. 

  4475. <dd><p>
    4476. 

  4476.                   The maximum amount of stack memory the server
    4477. 

  4477.                   may use. The default is <code class="literal">default</code>.
    4478. 

  4478.                 </p></dd>
    4479. 

  4479. </dl></div>
    4480. 

  4480. </div>
    4481. 

  4481. <div class="sect3" lang="en">
    4482. 

  4482. <div class="titlepage"><div><div><h4 class="title">
    4483. 

  4483. <a name="server_resource_limits"></a>Server  Resource Limits</h4></div></div></div>
    4484. 

  4484. <p>
    4485. 

  4485.             The following options set limits on the server's
    4486. 

  4486.             resource consumption that are enforced internally by the
    4487. 

  4487.             server rather than the operating system.
    4488. 

  4488.           </p>
    4489. 

  4489. <div class="variablelist"><dl>
    4490. 

  4490. <dt><span class="term"><span><strong class="command">max-ixfr-log-size</strong></span></span></dt>
    4491. 

  4491. <dd><p>
    4492. 

  4492.                   This option is obsolete; it is accepted
    4493. 

  4493.                   and ignored for BIND 8 compatibility.  The option
    4494. 

  4494.                   <span><strong class="command">max-journal-size</strong></span> performs a
    4495. 

  4495.                   similar function in BIND 9.
    4496. 

  4496.                 </p></dd>
    4497. 

  4497. <dt><span class="term"><span><strong class="command">max-journal-size</strong></span></span></dt>
    4498. 

  4498. <dd><p>
    4499. 

  4499.                   Sets a maximum size for each journal file
    4500. 

  4500.                   (see <a href="Bv9ARM.ch04.html#journal" title="The journal file">the section called &#8220;The journal file&#8221;</a>).  When the journal file
    4501. 

  4501.                   approaches
    4502. 

  4502.                   the specified size, some of the oldest transactions in the
    4503. 

  4503.                   journal
    4504. 

  4504.                   will be automatically removed.  The default is
    4505. 

  4505.                   <code class="literal">unlimited</code>.
    4506. 

  4506.                   This may also be set on a per-zone basis.
    4507. 

  4507.                 </p></dd>
    4508. 

  4508. <dt><span class="term"><span><strong class="command">host-statistics-max</strong></span></span></dt>
    4509. 

  4509. <dd><p>
    4510. 

  4510.                   In BIND 8, specifies the maximum number of host statistics
    4511. 

  4511.                   entries to be kept.
    4512. 

  4512.                   Not implemented in BIND 9.
    4513. 

  4513.                 </p></dd>
    4514. 

  4514. <dt><span class="term"><span><strong class="command">recursive-clients</strong></span></span></dt>
    4515. 

  4515. <dd><p>
    4516. 

  4516.                   The maximum number of simultaneous recursive lookups
    4517. 

  4517.                   the server will perform on behalf of clients.  The default
    4518. 

  4518.                   is
    4519. 

  4519.                   <code class="literal">1000</code>.  Because each recursing
    4520. 

  4520.                   client uses a fair
    4521. 

  4521.                   bit of memory, on the order of 20 kilobytes, the value of
    4522. 

  4522.                   the
    4523. 

  4523.                   <span><strong class="command">recursive-clients</strong></span> option may
    4524. 

  4524.                   have to be decreased
    4525. 

  4525.                   on hosts with limited memory.
    4526. 

  4526.                 </p></dd>
    4527. 

  4527. <dt><span class="term"><span><strong class="command">tcp-clients</strong></span></span></dt>
    4528. 

  4528. <dd><p>
    4529. 

  4529.                   The maximum number of simultaneous client TCP
    4530. 

  4530.                   connections that the server will accept.
    4531. 

  4531.                   The default is <code class="literal">100</code>.
    4532. 

  4532.                 </p></dd>
    4533. 

  4533. <dt><span class="term"><span><strong class="command">reserved-sockets</strong></span></span></dt>
    4534. 

  4534. <dd>
    4535. 

  4535. <p>
    4536. 

  4536.                   The number of file descriptors reserved for TCP, stdio,
    4537. 

  4537.                   etc.  This needs to be big enough to cover the number of
    4538. 

  4538.                   interfaces <span><strong class="command">named</strong></span> listens on, <span><strong class="command">tcp-clients</strong></span> as well as
    4539. 

  4539.                   to provide room for outgoing TCP queries and incoming zone
    4540. 

  4540.                   transfers.  The default is <code class="literal">512</code>.
    4541. 

  4541.                   The minimum value is <code class="literal">128</code> and the
    4542. 

  4542.                   maximum value is <code class="literal">128</code> less than
    4543. 

  4543.                   maxsockets (-S).  This option may be removed in the future.
    4544. 

  4544.                 </p>
    4545. 

  4545. <p>
    4546. 

  4546.                   This option has little effect on Windows.
    4547. 

  4547.                 </p>
    4548. 

  4548. </dd>
    4549. 

  4549. <dt><span class="term"><span><strong class="command">max-cache-size</strong></span></span></dt>
    4550. 

  4550. <dd><p>
    4551. 

  4551.                   The maximum amount of memory to use for the
    4552. 

  4552.                   server's cache, in bytes.
    4553. 

  4553.                   When the amount of data in the cache
    4554. 

  4554.                   reaches this limit, the server will cause records to expire
    4555. 

  4555.                   prematurely based on an LRU based strategy so that
    4556. 

  4556.                   the limit is not exceeded.
    4557. 

  4557.                   A value of 0 is special, meaning that
    4558. 

  4558.                   records are purged from the cache only when their
    4559. 

  4559.                   TTLs expire.
    4560. 

  4560.                   Another special keyword <strong class="userinput"><code>unlimited</code></strong>
    4561. 

  4561.                   means the maximum value of 32-bit unsigned integers
    4562. 

  4562.                   (0xffffffff), which may not have the same effect as
    4563. 

  4563.                   0 on machines that support more than 32 bits of
    4564. 

  4564.                   memory space.
    4565. 

  4565.                   Any positive values less than 2MB will be ignored reset
    4566. 

  4566.                   to 2MB.
    4567. 

  4567.                   In a server with multiple views, the limit applies
    4568. 

  4568.                   separately to the cache of each view.
    4569. 

  4569.                   The default is 0.
    4570. 

  4570.                 </p></dd>
    4571. 

  4571. <dt><span class="term"><span><strong class="command">tcp-listen-queue</strong></span></span></dt>
    4572. 

  4572. <dd><p>
    4573. 

  4573.                   The listen queue depth.  The default and minimum is 3.
    4574. 

  4574.                   If the kernel supports the accept filter "dataready" this
    4575. 

  4575.                   also controls how
    4576. 

  4576.                   many TCP connections that will be queued in kernel space
    4577. 

  4577.                   waiting for
    4578. 

  4578.                   some data before being passed to accept.  Values less than 3
    4579. 

  4579.                   will be
    4580. 

  4580.                   silently raised.
    4581. 

  4581.                 </p></dd>
    4582. 

  4582. </dl></div>
    4583. 

  4583. </div>
    4584. 

  4584. <div class="sect3" lang="en">
    4585. 

  4585. <div class="titlepage"><div><div><h4 class="title">
    4586. 

  4586. <a name="id2586082"></a>Periodic Task Intervals</h4></div></div></div>
    4587. 

  4587. <div class="variablelist"><dl>
    4588. 

  4588. <dt><span class="term"><span><strong class="command">cleaning-interval</strong></span></span></dt>
    4589. 

  4589. <dd><p>
    4590. 

  4590.                   This interval is effectively obsolete.  Previously,
    4591. 

  4591.                   the server would remove expired resource records
    4592. 

  4592.                   from the cache every <span><strong class="command">cleaning-interval</strong></span> minutes.
    4593. 

  4593.                   <acronym class="acronym">BIND</acronym> 9 now manages cache
    4594. 

  4594.                   memory in a more sophisticated manner and does not
    4595. 

  4595.                   rely on the periodic cleaning any more.
    4596. 

  4596.                   Specifying this option therefore has no effect on
    4597. 

  4597.                   the server's behavior.
    4598. 

  4598.                 </p></dd>
    4599. 

  4599. <dt><span class="term"><span><strong class="command">heartbeat-interval</strong></span></span></dt>
    4600. 

  4600. <dd><p>
    4601. 

  4601.                   The server will perform zone maintenance tasks
    4602. 

  4602.                   for all zones marked as <span><strong class="command">dialup</strong></span> whenever this
    4603. 

  4603.                   interval expires. The default is 60 minutes. Reasonable
    4604. 

  4604.                   values are up
    4605. 

  4605.                   to 1 day (1440 minutes).  The maximum value is 28 days
    4606. 

  4606.                   (40320 minutes).
    4607. 

  4607.                   If set to 0, no zone maintenance for these zones will occur.
    4608. 

  4608.                 </p></dd>
    4609. 

  4609. <dt><span class="term"><span><strong class="command">interface-interval</strong></span></span></dt>
    4610. 

  4610. <dd><p>
    4611. 

  4611.                   The server will scan the network interface list
    4612. 

  4612.                   every <span><strong class="command">interface-interval</strong></span>
    4613. 

  4613.                   minutes. The default
    4614. 

  4614.                   is 60 minutes. The maximum value is 28 days (40320 minutes).
    4615. 

  4615.                   If set to 0, interface scanning will only occur when
    4616. 

  4616.                   the configuration file is  loaded. After the scan, the
    4617. 

  4617.                   server will
    4618. 

  4618.                   begin listening for queries on any newly discovered
    4619. 

  4619.                   interfaces (provided they are allowed by the
    4620. 

  4620.                   <span><strong class="command">listen-on</strong></span> configuration), and
    4621. 

  4621.                   will
    4622. 

  4622.                   stop listening on interfaces that have gone away.
    4623. 

  4623.                 </p></dd>
    4624. 

  4624. <dt><span class="term"><span><strong class="command">statistics-interval</strong></span></span></dt>
    4625. 

  4625. <dd>
    4626. 

  4626. <p>
    4627. 

  4627.                   Name server statistics will be logged
    4628. 

  4628.                   every <span><strong class="command">statistics-interval</strong></span>
    4629. 

  4629.                   minutes. The default is
    4630. 

  4630.                   60. The maximum value is 28 days (40320 minutes).
    4631. 

  4631.                   If set to 0, no statistics will be logged.
    4632. 

  4632.                   </p>
    4633. 

  4633. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    4634. 

  4634. <h3 class="title">Note</h3>
    4635. 

  4635. <p>
    4636. 

  4636.                     Not yet implemented in
    4637. 

  4637.                     <acronym class="acronym">BIND</acronym> 9.
    4638. 

  4638.                   </p>
    4639. 

  4639. </div>
    4640. 

  4640. </dd>
    4641. 

  4641. </dl></div>
    4642. 

  4642. </div>
    4643. 

  4643. <div class="sect3" lang="en">
    4644. 

  4644. <div class="titlepage"><div><div><h4 class="title">
    4645. 

  4645. <a name="topology"></a>Topology</h4></div></div></div>
    4646. 

  4646. <p>
    4647. 

  4647.             All other things being equal, when the server chooses a name
    4648. 

  4648.             server
    4649. 

  4649.             to query from a list of name servers, it prefers the one that is
    4650. 

  4650.             topologically closest to itself. The <span><strong class="command">topology</strong></span> statement
    4651. 

  4651.             takes an <span><strong class="command">address_match_list</strong></span> and
    4652. 

  4652.             interprets it
    4653. 

  4653.             in a special way. Each top-level list element is assigned a
    4654. 

  4654.             distance.
    4655. 

  4655.             Non-negated elements get a distance based on their position in the
    4656. 

  4656.             list, where the closer the match is to the start of the list, the
    4657. 

  4657.             shorter the distance is between it and the server. A negated match
    4658. 

  4658.             will be assigned the maximum distance from the server. If there
    4659. 

  4659.             is no match, the address will get a distance which is further than
    4660. 

  4660.             any non-negated list element, and closer than any negated element.
    4661. 

  4661.             For example,
    4662. 

  4662.           </p>
    4663. 

  4663. <pre class="programlisting">topology {
    4664. 

  4664.     10/8;
    4665. 

  4665.     !1.2.3/24;
    4666. 

  4666.     { 1.2/16; 3/8; };
    4667. 

  4667. };</pre>
    4668. 

  4668. <p>
    4669. 

  4669.             will prefer servers on network 10 the most, followed by hosts
    4670. 

  4670.             on network 1.2.0.0 (netmask 255.255.0.0) and network 3, with the
    4671. 

  4671.             exception of hosts on network 1.2.3 (netmask 255.255.255.0), which
    4672. 

  4672.             is preferred least of all.
    4673. 

  4673.           </p>
    4674. 

  4674. <p>
    4675. 

  4675.             The default topology is
    4676. 

  4676.           </p>
    4677. 

  4677. <pre class="programlisting">    topology { localhost; localnets; };
    4678. 

  4678. </pre>
    4679. 

  4679. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    4680. 

  4680. <h3 class="title">Note</h3>
    4681. 

  4681. <p>
    4682. 

  4682.               The <span><strong class="command">topology</strong></span> option
    4683. 

  4683.               is not implemented in <acronym class="acronym">BIND</acronym> 9.
    4684. 

  4684.             </p>
    4685. 

  4685. </div>
    4686. 

  4686. </div>
    4687. 

  4687. <div class="sect3" lang="en">
    4688. 

  4688. <div class="titlepage"><div><div><h4 class="title">
    4689. 

  4689. <a name="the_sortlist_statement"></a>The <span><strong class="command">sortlist</strong></span> Statement</h4></div></div></div>
    4690. 

  4690. <p>
    4691. 

  4691.             The response to a DNS query may consist of multiple resource
    4692. 

  4692.             records (RRs) forming a resource records set (RRset).
    4693. 

  4693.             The name server will normally return the
    4694. 

  4694.             RRs within the RRset in an indeterminate order
    4695. 

  4695.             (but see the <span><strong class="command">rrset-order</strong></span>
    4696. 

  4696.             statement in <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called &#8220;RRset Ordering&#8221;</a>).
    4697. 

  4697.             The client resolver code should rearrange the RRs as appropriate,
    4698. 

  4698.             that is, using any addresses on the local net in preference to
    4699. 

  4699.             other addresses.
    4700. 

  4700.             However, not all resolvers can do this or are correctly
    4701. 

  4701.             configured.
    4702. 

  4702.             When a client is using a local server, the sorting can be performed
    4703. 

  4703.             in the server, based on the client's address. This only requires
    4704. 

  4704.             configuring the name servers, not all the clients.
    4705. 

  4705.           </p>
    4706. 

  4706. <p>
    4707. 

  4707.             The <span><strong class="command">sortlist</strong></span> statement (see below)
    4708. 

  4708.             takes
    4709. 

  4709.             an <span><strong class="command">address_match_list</strong></span> and
    4710. 

  4710.             interprets it even
    4711. 

  4711.             more specifically than the <span><strong class="command">topology</strong></span>
    4712. 

  4712.             statement
    4713. 

  4713.             does (<a href="Bv9ARM.ch06.html#topology" title="Topology">the section called &#8220;Topology&#8221;</a>).
    4714. 

  4714.             Each top level statement in the <span><strong class="command">sortlist</strong></span> must
    4715. 

  4715.             itself be an explicit <span><strong class="command">address_match_list</strong></span> with
    4716. 

  4716.             one or two elements. The first element (which may be an IP
    4717. 

  4717.             address,
    4718. 

  4718.             an IP prefix, an ACL name or a nested <span><strong class="command">address_match_list</strong></span>)
    4719. 

  4719.             of each top level list is checked against the source address of
    4720. 

  4720.             the query until a match is found.
    4721. 

  4721.           </p>
    4722. 

  4722. <p>
    4723. 

  4723.             Once the source address of the query has been matched, if
    4724. 

  4724.             the top level statement contains only one element, the actual
    4725. 

  4725.             primitive
    4726. 

  4726.             element that matched the source address is used to select the
    4727. 

  4727.             address
    4728. 

  4728.             in the response to move to the beginning of the response. If the
    4729. 

  4729.             statement is a list of two elements, then the second element is
    4730. 

  4730.             treated the same as the <span><strong class="command">address_match_list</strong></span> in
    4731. 

  4731.             a <span><strong class="command">topology</strong></span> statement. Each top
    4732. 

  4732.             level element
    4733. 

  4733.             is assigned a distance and the address in the response with the
    4734. 

  4734.             minimum
    4735. 

  4735.             distance is moved to the beginning of the response.
    4736. 

  4736.           </p>
    4737. 

  4737. <p>
    4738. 

  4738.             In the following example, any queries received from any of
    4739. 

  4739.             the addresses of the host itself will get responses preferring
    4740. 

  4740.             addresses
    4741. 

  4741.             on any of the locally connected networks. Next most preferred are
    4742. 

  4742.             addresses
    4743. 

  4743.             on the 192.168.1/24 network, and after that either the
    4744. 

  4744.             192.168.2/24
    4745. 

  4745.             or
    4746. 

  4746.             192.168.3/24 network with no preference shown between these two
    4747. 

  4747.             networks. Queries received from a host on the 192.168.1/24 network
    4748. 

  4748.             will prefer other addresses on that network to the 192.168.2/24
    4749. 

  4749.             and
    4750. 

  4750.             192.168.3/24 networks. Queries received from a host on the
    4751. 

  4751.             192.168.4/24
    4752. 

  4752.             or the 192.168.5/24 network will only prefer other addresses on
    4753. 

  4753.             their directly connected networks.
    4754. 

  4754.           </p>
    4755. 

  4755. <pre class="programlisting">sortlist {
    4756. 

  4756.     // IF the local host
    4757. 

  4757.     // THEN first fit on the following nets
    4758. 

  4758.     { localhost;
    4759. 

  4759.         { localnets;
    4760. 

  4760.             192.168.1/24;
    4761. 

  4761.             { 192.168.2/24; 192.168.3/24; }; }; };
    4762. 

  4762.     // IF on class C 192.168.1 THEN use .1, or .2 or .3
    4763. 

  4763.     { 192.168.1/24;
    4764. 

  4764.         { 192.168.1/24;
    4765. 

  4765.             { 192.168.2/24; 192.168.3/24; }; }; };
    4766. 

  4766.     // IF on class C 192.168.2 THEN use .2, or .1 or .3
    4767. 

  4767.     { 192.168.2/24;
    4768. 

  4768.         { 192.168.2/24;
    4769. 

  4769.             { 192.168.1/24; 192.168.3/24; }; }; };
    4770. 

  4770.     // IF on class C 192.168.3 THEN use .3, or .1 or .2
    4771. 

  4771.     { 192.168.3/24;
    4772. 

  4772.         { 192.168.3/24;
    4773. 

  4773.             { 192.168.1/24; 192.168.2/24; }; }; };
    4774. 

  4774.     // IF .4 or .5 THEN prefer that net
    4775. 

  4775.     { { 192.168.4/24; 192.168.5/24; };
    4776. 

  4776.     };
    4777. 

  4777. };</pre>
    4778. 

  4778. <p>
    4779. 

  4779.             The following example will give reasonable behavior for the
    4780. 

  4780.             local host and hosts on directly connected networks. It is similar
    4781. 

  4781.             to the behavior of the address sort in <acronym class="acronym">BIND</acronym> 4.9.x. Responses sent
    4782. 

  4782.             to queries from the local host will favor any of the directly
    4783. 

  4783.             connected
    4784. 

  4784.             networks. Responses sent to queries from any other hosts on a
    4785. 

  4785.             directly
    4786. 

  4786.             connected network will prefer addresses on that same network.
    4787. 

  4787.             Responses
    4788. 

  4788.             to other queries will not be sorted.
    4789. 

  4789.           </p>
    4790. 

  4790. <pre class="programlisting">sortlist {
    4791. 

  4791.            { localhost; localnets; };
    4792. 

  4792.            { localnets; };
    4793. 

  4793. };
    4794. 

  4794. </pre>
    4795. 

  4795. </div>
    4796. 

  4796. <div class="sect3" lang="en">
    4797. 

  4797. <div class="titlepage"><div><div><h4 class="title">
    4798. 

  4798. <a name="rrset_ordering"></a>RRset Ordering</h4></div></div></div>
    4799. 

  4799. <p>
    4800. 

  4800.             When multiple records are returned in an answer it may be
    4801. 

  4801.             useful to configure the order of the records placed into the
    4802. 

  4802.             response.
    4803. 

  4803.             The <span><strong class="command">rrset-order</strong></span> statement permits
    4804. 

  4804.             configuration
    4805. 

  4805.             of the ordering of the records in a multiple record response.
    4806. 

  4806.             See also the <span><strong class="command">sortlist</strong></span> statement,
    4807. 

  4807.             <a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called &#8220;The <span><strong class="command">sortlist</strong></span> Statement&#8221;</a>.
    4808. 

  4808.           </p>
    4809. 

  4809. <p>
    4810. 

  4810.             An <span><strong class="command">order_spec</strong></span> is defined as
    4811. 

  4811.             follows:
    4812. 

  4812.           </p>
    4813. 

  4813. <p>
    4814. 

  4814.             [<span class="optional">class <em class="replaceable"><code>class_name</code></em></span>]
    4815. 

  4815.             [<span class="optional">type <em class="replaceable"><code>type_name</code></em></span>]
    4816. 

  4816.             [<span class="optional">name <em class="replaceable"><code>"domain_name"</code></em></span>]
    4817. 

  4817.             order <em class="replaceable"><code>ordering</code></em>
    4818. 

  4818.           </p>
    4819. 

  4819. <p>
    4820. 

  4820.             If no class is specified, the default is <span><strong class="command">ANY</strong></span>.
    4821. 

  4821.             If no type is specified, the default is <span><strong class="command">ANY</strong></span>.
    4822. 

  4822.             If no name is specified, the default is "<span><strong class="command">*</strong></span>" (asterisk).
    4823. 

  4823.           </p>
    4824. 

  4824. <p>
    4825. 

  4825.             The legal values for <span><strong class="command">ordering</strong></span> are:
    4826. 

  4826.           </p>
    4827. 

  4827. <div class="informaltable"><table border="1">
    4828. 

  4828. <colgroup>
    4829. 

  4829. <col>
    4830. 

  4830. <col>
    4831. 

  4831. </colgroup>
    4832. 

  4832. <tbody>
    4833. 

  4833. <tr>
    4834. 

  4834. <td>
    4835. 

  4835.                     <p><span><strong class="command">fixed</strong></span></p>
    4836. 

  4836.                   </td>
    4837. 

  4837. <td>
    4838. 

  4838.                     <p>
    4839. 

  4839.                       Records are returned in the order they
    4840. 

  4840.                       are defined in the zone file.
    4841. 

  4841.                     </p>
    4842. 

  4842.                   </td>
    4843. 

  4843. </tr>
    4844. 

  4844. <tr>
    4845. 

  4845. <td>
    4846. 

  4846.                     <p><span><strong class="command">random</strong></span></p>
    4847. 

  4847.                   </td>
    4848. 

  4848. <td>
    4849. 

  4849.                     <p>
    4850. 

  4850.                       Records are returned in some random order.
    4851. 

  4851.                     </p>
    4852. 

  4852.                   </td>
    4853. 

  4853. </tr>
    4854. 

  4854. <tr>
    4855. 

  4855. <td>
    4856. 

  4856.                     <p><span><strong class="command">cyclic</strong></span></p>
    4857. 

  4857.                   </td>
    4858. 

  4858. <td>
    4859. 

  4859.                     <p>
    4860. 

  4860.                       Records are returned in a cyclic round-robin order.
    4861. 

  4861.                     </p>
    4862. 

  4862.                     <p>
    4863. 

  4863.                       If <acronym class="acronym">BIND</acronym> is configured with the
    4864. 

  4864.                       "--enable-fixed-rrset" option at compile time, then
    4865. 

  4865.                       the initial ordering of the RRset will match the
    4866. 

  4866.                       one specified in the zone file.
    4867. 

  4867.                     </p>
    4868. 

  4868.                   </td>
    4869. 

  4869. </tr>
    4870. 

  4870. </tbody>
    4871. 

  4871. </table></div>
    4872. 

  4872. <p>
    4873. 

  4873.             For example:
    4874. 

  4874.           </p>
    4875. 

  4875. <pre class="programlisting">rrset-order {
    4876. 

  4876.    class IN type A name "host.example.com" order random;
    4877. 

  4877.    order cyclic;
    4878. 

  4878. };
    4879. 

  4879. </pre>
    4880. 

  4880. <p>
    4881. 

  4881.             will cause any responses for type A records in class IN that
    4882. 

  4882.             have "<code class="literal">host.example.com</code>" as a
    4883. 

  4883.             suffix, to always be returned
    4884. 

  4884.             in random order. All other records are returned in cyclic order.
    4885. 

  4885.           </p>
    4886. 

  4886. <p>
    4887. 

  4887.             If multiple <span><strong class="command">rrset-order</strong></span> statements
    4888. 

  4888.             appear,
    4889. 

  4889.             they are not combined &#8212; the last one applies.
    4890. 

  4890.           </p>
    4891. 

  4891. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    4892. 

  4892. <h3 class="title">Note</h3>
    4893. 

  4893. <p>
    4894. 

  4894.               In this release of <acronym class="acronym">BIND</acronym> 9, the
    4895. 

  4895.               <span><strong class="command">rrset-order</strong></span> statement does not support
    4896. 

  4896.               "fixed" ordering by default.  Fixed ordering can be enabled
    4897. 

  4897.               at compile time by specifying "--enable-fixed-rrset" on
    4898. 

  4898.               the "configure" command line.
    4899. 

  4899.             </p>
    4900. 

  4900. </div>
    4901. 

  4901. </div>
    4902. 

  4902. <div class="sect3" lang="en">
    4903. 

  4903. <div class="titlepage"><div><div><h4 class="title">
    4904. 

  4904. <a name="tuning"></a>Tuning</h4></div></div></div>
    4905. 

  4905. <div class="variablelist"><dl>
    4906. 

  4906. <dt><span class="term"><span><strong class="command">lame-ttl</strong></span></span></dt>
    4907. 

  4907. <dd>
    4908. 

  4908. <p>
    4909. 

  4909.                   Sets the number of seconds to cache a
    4910. 

  4910.                   lame server indication. 0 disables caching. (This is
    4911. 

  4911.                   <span class="bold"><strong>NOT</strong></span> recommended.)
    4912. 

  4912.                   The default is <code class="literal">600</code> (10 minutes) and the
    4913. 

  4913.                   maximum value is
    4914. 

  4914.                   <code class="literal">1800</code> (30 minutes).
    4915. 

  4915.                 </p>
    4916. 

  4916. <p>
    4917. 

  4917.                   Lame-ttl also controls the amount of time DNSSEC
    4918. 

  4918.                   validation failures are cached.  There is a minimum
    4919. 

  4919.                   of 30 seconds applied to bad cache entries if the
    4920. 

  4920.                   lame-ttl is set to less than 30 seconds.
    4921. 

  4921.                 </p>
    4922. 

  4922. </dd>
    4923. 

  4923. <dt><span class="term"><span><strong class="command">max-ncache-ttl</strong></span></span></dt>
    4924. 

  4924. <dd><p>
    4925. 

  4925.                   To reduce network traffic and increase performance,
    4926. 

  4926.                   the server stores negative answers. <span><strong class="command">max-ncache-ttl</strong></span> is
    4927. 

  4927.                   used to set a maximum retention time for these answers in
    4928. 

  4928.                   the server
    4929. 

  4929.                   in seconds. The default
    4930. 

  4930.                   <span><strong class="command">max-ncache-ttl</strong></span> is <code class="literal">10800</code> seconds (3 hours).
    4931. 

  4931.                   <span><strong class="command">max-ncache-ttl</strong></span> cannot exceed
    4932. 

  4932.                   7 days and will
    4933. 

  4933.                   be silently truncated to 7 days if set to a greater value.
    4934. 

  4934.                 </p></dd>
    4935. 

  4935. <dt><span class="term"><span><strong class="command">max-cache-ttl</strong></span></span></dt>
    4936. 

  4936. <dd><p>
    4937. 

  4937.                   Sets the maximum time for which the server will
    4938. 

  4938.                   cache ordinary (positive) answers. The default is
    4939. 

  4939.                   one week (7 days).
    4940. 

  4940.                   A value of zero may cause all queries to return
    4941. 

  4941.                   SERVFAIL, because of lost caches of intermediate
    4942. 

  4942.                   RRsets (such as NS and glue AAAA/A records) in the
    4943. 

  4943.                   resolution process.
    4944. 

  4944.                 </p></dd>
    4945. 

  4945. <dt><span class="term"><span><strong class="command">min-roots</strong></span></span></dt>
    4946. 

  4946. <dd>
    4947. 

  4947. <p>
    4948. 

  4948.                   The minimum number of root servers that
    4949. 

  4949.                   is required for a request for the root servers to be
    4950. 

  4950.                   accepted. The default
    4951. 

  4951.                   is <strong class="userinput"><code>2</code></strong>.
    4952. 

  4952.                 </p>
    4953. 

  4953. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    4954. 

  4954. <h3 class="title">Note</h3>
    4955. 

  4955. <p>
    4956. 

  4956.                     Not implemented in <acronym class="acronym">BIND</acronym> 9.
    4957. 

  4957.                   </p>
    4958. 

  4958. </div>
    4959. 

  4959. </dd>
    4960. 

  4960. <dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
    4961. 

  4961. <dd>
    4962. 

  4962. <p>
    4963. 

  4963.                   Specifies the number of days into the future when
    4964. 

  4964.                   DNSSEC signatures automatically generated as a
    4965. 

  4965.                   result of dynamic updates (<a href="Bv9ARM.ch04.html#dynamic_update" title="Dynamic Update">the section called &#8220;Dynamic Update&#8221;</a>) will expire.  There
    4966. 

  4966.                   is an optional second field which specifies how
    4967. 

  4967.                   long before expiry that the signatures will be
    4968. 

  4968.                   regenerated.  If not specified, the signatures will
    4969. 

  4969.                   be regenerated at 1/4 of base interval.  The second
    4970. 

  4970.                   field is specified in days if the base interval is
    4971. 

  4971.                   greater than 7 days otherwise it is specified in hours.
    4972. 

  4972.                   The default base interval is <code class="literal">30</code> days
    4973. 

  4973.                   giving a re-signing interval of 7 1/2 days.  The maximum
    4974. 

  4974.                   values are 10 years (3660 days).
    4975. 

  4975.                 </p>
    4976. 

  4976. <p>
    4977. 

  4977.                   The signature inception time is unconditionally
    4978. 

  4978.                   set to one hour before the current time to allow
    4979. 

  4979.                   for a limited amount of clock skew.
    4980. 

  4980.                 </p>
    4981. 

  4981. <p>
    4982. 

  4982.                   The <span><strong class="command">sig-validity-interval</strong></span>
    4983. 

  4983.                   should be, at least, several multiples of the SOA
    4984. 

  4984.                   expire interval to allow for reasonable interaction
    4985. 

  4985.                   between the various timer and expiry dates.
    4986. 

  4986.                 </p>
    4987. 

  4987. </dd>
    4988. 

  4988. <dt><span class="term"><span><strong class="command">sig-signing-nodes</strong></span></span></dt>
    4989. 

  4989. <dd><p>
    4990. 

  4990.                   Specify the maximum number of nodes to be
    4991. 

  4991.                   examined in each quantum when signing a zone with
    4992. 

  4992.                   a new DNSKEY. The default is
    4993. 

  4993.                   <code class="literal">100</code>.
    4994. 

  4994.                 </p></dd>
    4995. 

  4995. <dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
    4996. 

  4996. <dd><p>
    4997. 

  4997.                   Specify a threshold number of signatures that
    4998. 

  4998.                   will terminate processing a quantum when signing
    4999. 

  4999.                   a zone with a new DNSKEY.  The default is
    5000. 

  5000.                   <code class="literal">10</code>.
    5001. 

  5001.                 </p></dd>
    5002. 

  5002. <dt><span class="term"><span><strong class="command">sig-signing-type</strong></span></span></dt>
    5003. 

  5003. <dd>
    5004. 

  5004. <p>
    5005. 

  5005.                   Specify a private RDATA type to be used when generating
    5006. 

  5006.                   key signing records.  The default is
    5007. 

  5007.                   <code class="literal">65534</code>.
    5008. 

  5008.                 </p>
    5009. 

  5009. <p>
    5010. 

  5010.                   It is expected that this parameter may be removed
    5011. 

  5011.                   in a future version once there is a standard type.
    5012. 

  5012.                 </p>
    5013. 

  5013. </dd>
    5014. 

  5014. <dt>
    5015. 

  5015. <span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
    5016. 

  5016. </dt>
    5017. 

  5017. <dd>
    5018. 

  5018. <p>
    5019. 

  5019.                   These options control the server's behavior on refreshing a
    5020. 

  5020.                   zone
    5021. 

  5021.                   (querying for SOA changes) or retrying failed transfers.
    5022. 

  5022.                   Usually the SOA values for the zone are used, but these
    5023. 

  5023.                   values
    5024. 

  5024.                   are set by the master, giving slave server administrators
    5025. 

  5025.                   little
    5026. 

  5026.                   control over their contents.
    5027. 

  5027.                 </p>
    5028. 

  5028. <p>
    5029. 

  5029.                   These options allow the administrator to set a minimum and
    5030. 

  5030.                   maximum
    5031. 

  5031.                   refresh and retry time either per-zone, per-view, or
    5032. 

  5032.                   globally.
    5033. 

  5033.                   These options are valid for slave and stub zones,
    5034. 

  5034.                   and clamp the SOA refresh and retry times to the specified
    5035. 

  5035.                   values.
    5036. 

  5036.                 </p>
    5037. 

  5037. <p>
    5038. 

  5038.                   The following defaults apply.
    5039. 

  5039.                   <span><strong class="command">min-refresh-time</strong></span> 300 seconds,
    5040. 

  5040.                   <span><strong class="command">max-refresh-time</strong></span> 2419200 seconds
    5041. 

  5041.                   (4 weeks), <span><strong class="command">min-retry-time</strong></span> 500 seconds,
    5042. 

  5042.                   and <span><strong class="command">max-retry-time</strong></span> 1209600 seconds
    5043. 

  5043.                   (2 weeks).
    5044. 

  5044.                 </p>
    5045. 

  5045. </dd>
    5046. 

  5046. <dt><span class="term"><span><strong class="command">edns-udp-size</strong></span></span></dt>
    5047. 

  5047. <dd>
    5048. 

  5048. <p>
    5049. 

  5049.                   Sets the advertised EDNS UDP buffer size in bytes
    5050. 

  5050.                   to control the size of packets received.
    5051. 

  5051.                   Valid values are 512 to 4096 (values outside this range
    5052. 

  5052.                   will be silently adjusted).  The default value
    5053. 

  5053.                   is 4096.  The usual reason for setting
    5054. 

  5054.                   <span><strong class="command">edns-udp-size</strong></span> to a non-default
    5055. 

  5055.                   value is to get UDP answers to pass through broken
    5056. 

  5056.                   firewalls that block fragmented packets and/or
    5057. 

  5057.                   block UDP packets that are greater than 512 bytes.
    5058. 

  5058.                 </p>
    5059. 

  5059. <p>
    5060. 

  5060.                   <span><strong class="command">named</strong></span> will fallback to using 512 bytes
    5061. 

  5061.                   if it get a series of timeout at the initial value.  512
    5062. 

  5062.                   bytes is not being offered to encourage sites to fix their
    5063. 

  5063.                   firewalls.  Small EDNS UDP sizes will result in the
    5064. 

  5064.                   excessive use of TCP.
    5065. 

  5065.                 </p>
    5066. 

  5066. </dd>
    5067. 

  5067. <dt><span class="term"><span><strong class="command">max-udp-size</strong></span></span></dt>
    5068. 

  5068. <dd>
    5069. 

  5069. <p>
    5070. 

  5070.                   Sets the maximum EDNS UDP message size
    5071. 

  5071.                   <span><strong class="command">named</strong></span> will send in bytes.
    5072. 

  5072.                   Valid values are 512 to 4096 (values outside this
    5073. 

  5073.                   range will be silently adjusted).  The default
    5074. 

  5074.                   value is 4096.  The usual reason for setting
    5075. 

  5075.                   <span><strong class="command">max-udp-size</strong></span> to a non-default
    5076. 

  5076.                   value is to get UDP answers to pass through broken
    5077. 

  5077.                   firewalls that block fragmented packets and/or
    5078. 

  5078.                   block UDP packets that are greater than 512 bytes.
    5079. 

  5079.                   This is independent of the advertised receive
    5080. 

  5080.                   buffer (<span><strong class="command">edns-udp-size</strong></span>).
    5081. 

  5081.                 </p>
    5082. 

  5082. <p>
    5083. 

  5083.                   Setting this to a low value will encourage additional
    5084. 

  5084.                   TCP traffic to the nameserver.
    5085. 

  5085.                 </p>
    5086. 

  5086. </dd>
    5087. 

  5087. <dt><span class="term"><span><strong class="command">masterfile-format</strong></span></span></dt>
    5088. 

  5088. <dd><p>Specifies
    5089. 

  5089.                   the file format of zone files (see
    5090. 

  5090.                   <a href="Bv9ARM.ch06.html#zonefile_format" title="Additional File Formats">the section called &#8220;Additional File Formats&#8221;</a>).
    5091. 

  5091.                   The default value is <code class="constant">text</code>, which is the
    5092. 

  5092.                   standard textual representation.  Files in other formats
    5093. 

  5093.                   than <code class="constant">text</code> are typically expected
    5094. 

  5094.                   to be generated by the <span><strong class="command">named-compilezone</strong></span> tool.
    5095. 

  5095.                   Note that when a zone file in a different format than
    5096. 

  5096.                   <code class="constant">text</code> is loaded, <span><strong class="command">named</strong></span>
    5097. 

  5097.                   may omit some of the checks which would be performed for a
    5098. 

  5098.                   file in the <code class="constant">text</code> format.  In particular,
    5099. 

  5099.                   <span><strong class="command">check-names</strong></span> checks do not apply
    5100. 

  5100.                   for the <code class="constant">raw</code> format.  This means
    5101. 

  5101.                   a zone file in the <code class="constant">raw</code> format
    5102. 

  5102.                   must be generated with the same check level as that
    5103. 

  5103.                   specified in the <span><strong class="command">named</strong></span> configuration
    5104. 

  5104.                   file.  This statement sets the
    5105. 

  5105.                   <span><strong class="command">masterfile-format</strong></span> for all zones,
    5106. 

  5106.                   but can be overridden on a per-zone or per-view basis
    5107. 

  5107.                   by including a <span><strong class="command">masterfile-format</strong></span>
    5108. 

  5108.                   statement within the <span><strong class="command">zone</strong></span> or
    5109. 

  5109.                   <span><strong class="command">view</strong></span> block in the configuration
    5110. 

  5110.                   file.
    5111. 

  5111.                 </p></dd>
    5112. 

  5112. <dt>
    5113. 

  5113. <a name="clients-per-query"></a><span class="term"><span><strong class="command">clients-per-query</strong></span>, </span><span class="term"><span><strong class="command">max-clients-per-query</strong></span></span>
    5114. 

  5114. </dt>
    5115. 

  5115. <dd>
    5116. 

  5116. <p>These set the
    5117. 

  5117.                   initial value (minimum) and maximum number of recursive
    5118. 

  5118.                   simultaneous clients for any given query
    5119. 

  5119.                   (&lt;qname,qtype,qclass&gt;) that the server will accept
    5120. 

  5120.                   before dropping additional clients.  <span><strong class="command">named</strong></span> will attempt to
    5121. 

  5121.                   self tune this value and changes will be logged.  The
    5122. 

  5122.                   default values are 10 and 100.
    5123. 

  5123.                 </p>
    5124. 

  5124. <p>
    5125. 

  5125.                   This value should reflect how many queries come in for
    5126. 

  5126.                   a given name in the time it takes to resolve that name.
    5127. 

  5127.                   If the number of queries exceed this value, <span><strong class="command">named</strong></span> will
    5128. 

  5128.                   assume that it is dealing with a non-responsive zone
    5129. 

  5129.                   and will drop additional queries.  If it gets a response
    5130. 

  5130.                   after dropping queries, it will raise the estimate.  The
    5131. 

  5131.                   estimate will then be lowered in 20 minutes if it has
    5132. 

  5132.                   remained unchanged.
    5133. 

  5133.                 </p>
    5134. 

  5134. <p>
    5135. 

  5135.                   If <span><strong class="command">clients-per-query</strong></span> is set to zero,
    5136. 

  5136.                   then there is no limit on the number of clients per query
    5137. 

  5137.                   and no queries will be dropped.
    5138. 

  5138.                 </p>
    5139. 

  5139. <p>
    5140. 

  5140.                   If <span><strong class="command">max-clients-per-query</strong></span> is set to zero,
    5141. 

  5141.                   then there is no upper bound other than imposed by
    5142. 

  5142.                   <span><strong class="command">recursive-clients</strong></span>.
    5143. 

  5143.                 </p>
    5144. 

  5144. </dd>
    5145. 

  5145. <dt><span class="term"><span><strong class="command">notify-delay</strong></span></span></dt>
    5146. 

  5146. <dd>
    5147. 

  5147. <p>
    5148. 

  5148.                   The delay, in seconds, between sending sets of notify
    5149. 

  5149.                   messages for a zone.  The default is five (5) seconds.
    5150. 

  5150.                 </p>
    5151. 

  5151. <p>
    5152. 

  5152.                   The overall rate that NOTIFY messages are sent for all
    5153. 

  5153.                   zones is controlled by <span><strong class="command">serial-query-rate</strong></span>.
    5154. 

  5154.                 </p>
    5155. 

  5155. </dd>
    5156. 

  5156. </dl></div>
    5157. 

  5157. </div>
    5158. 

  5158. <div class="sect3" lang="en">
    5159. 

  5159. <div class="titlepage"><div><div><h4 class="title">
    5160. 

  5160. <a name="builtin"></a>Built-in server information zones</h4></div></div></div>
    5161. 

  5161. <p>
    5162. 

  5162.             The server provides some helpful diagnostic information
    5163. 

  5163.             through a number of built-in zones under the
    5164. 

  5164.             pseudo-top-level-domain <code class="literal">bind</code> in the
    5165. 

  5165.             <span><strong class="command">CHAOS</strong></span> class.  These zones are part
    5166. 

  5166.             of a
    5167. 

  5167.             built-in view (see <a href="Bv9ARM.ch06.html#view_statement_grammar" title="view Statement Grammar">the section called &#8220;<span><strong class="command">view</strong></span> Statement Grammar&#8221;</a>) of
    5168. 

  5168.             class
    5169. 

  5169.             <span><strong class="command">CHAOS</strong></span> which is separate from the
    5170. 

  5170.             default view of
    5171. 

  5171.             class <span><strong class="command">IN</strong></span>; therefore, any global
    5172. 

  5172.             server options
    5173. 

  5173.             such as <span><strong class="command">allow-query</strong></span> do not apply
    5174. 

  5174.             the these zones.
    5175. 

  5175.             If you feel the need to disable these zones, use the options
    5176. 

  5176.             below, or hide the built-in <span><strong class="command">CHAOS</strong></span>
    5177. 

  5177.             view by
    5178. 

  5178.             defining an explicit view of class <span><strong class="command">CHAOS</strong></span>
    5179. 

  5179.             that matches all clients.
    5180. 

  5180.           </p>
    5181. 

  5181. <div class="variablelist"><dl>
    5182. 

  5182. <dt><span class="term"><span><strong class="command">version</strong></span></span></dt>
    5183. 

  5183. <dd><p>
    5184. 

  5184.                   The version the server should report
    5185. 

  5185.                   via a query of the name <code class="literal">version.bind</code>
    5186. 

  5186.                   with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
    5187. 

  5187.                   The default is the real version number of this server.
    5188. 

  5188.                   Specifying <span><strong class="command">version none</strong></span>
    5189. 

  5189.                   disables processing of the queries.
    5190. 

  5190.                 </p></dd>
    5191. 

  5191. <dt><span class="term"><span><strong class="command">hostname</strong></span></span></dt>
    5192. 

  5192. <dd><p>
    5193. 

  5193.                   The hostname the server should report via a query of
    5194. 

  5194.                   the name <code class="filename">hostname.bind</code>
    5195. 

  5195.                   with type <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
    5196. 

  5196.                   This defaults to the hostname of the machine hosting the
    5197. 

  5197.                   name server as
    5198. 

  5198.                   found by the gethostname() function.  The primary purpose of such queries
    5199. 

  5199.                   is to
    5200. 

  5200.                   identify which of a group of anycast servers is actually
    5201. 

  5201.                   answering your queries.  Specifying <span><strong class="command">hostname none;</strong></span>
    5202. 

  5202.                   disables processing of the queries.
    5203. 

  5203.                 </p></dd>
    5204. 

  5204. <dt><span class="term"><span><strong class="command">server-id</strong></span></span></dt>
    5205. 

  5205. <dd><p>
    5206. 

  5206.                   The ID the server should report when receiving a Name
    5207. 

  5207.                   Server Identifier (NSID) query, or a query of the name
    5208. 

  5208.                   <code class="filename">ID.SERVER</code> with type
    5209. 

  5209.                   <span><strong class="command">TXT</strong></span>, class <span><strong class="command">CHAOS</strong></span>.
    5210. 

  5210.                   The primary purpose of such queries is to
    5211. 

  5211.                   identify which of a group of anycast servers is actually
    5212. 

  5212.                   answering your queries.  Specifying <span><strong class="command">server-id none;</strong></span>
    5213. 

  5213.                   disables processing of the queries.
    5214. 

  5214.                   Specifying <span><strong class="command">server-id hostname;</strong></span> will cause <span><strong class="command">named</strong></span> to
    5215. 

  5215.                   use the hostname as found by the gethostname() function.
    5216. 

  5216.                   The default <span><strong class="command">server-id</strong></span> is <span><strong class="command">none</strong></span>.
    5217. 

  5217.                 </p></dd>
    5218. 

  5218. </dl></div>
    5219. 

  5219. </div>
    5220. 

  5220. <div class="sect3" lang="en">
    5221. 

  5221. <div class="titlepage"><div><div><h4 class="title">
    5222. 

  5222. <a name="empty"></a>Built-in Empty Zones</h4></div></div></div>
    5223. 

  5223. <p>
    5224. 

  5224.             Named has some built-in empty zones (SOA and NS records only).
    5225. 

  5225.             These are for zones that should normally be answered locally
    5226. 

  5226.             and which queries should not be sent to the Internet's root
    5227. 

  5227.             servers.  The official servers which cover these namespaces
    5228. 

  5228.             return NXDOMAIN responses to these queries.  In particular,
    5229. 

  5229.             these cover the reverse namespaces for addresses from
    5230. 

  5230.             RFC 1918, RFC 4193, and RFC 5737.  They also include the
    5231. 

  5231.             reverse namespace for IPv6 local address (locally assigned),
    5232. 

  5232.             IPv6 link local addresses, the IPv6 loopback address and the
    5233. 

  5233.             IPv6 unknown address.
    5234. 

  5234.           </p>
    5235. 

  5235. <p>
    5236. 

  5236.             Named will attempt to determine if a built-in zone already exists
    5237. 

  5237.             or is active (covered by a forward-only forwarding declaration)
    5238. 

  5238.             and will not create an empty zone in that case.
    5239. 

  5239.           </p>
    5240. 

  5240. <p>
    5241. 

  5241.             The current list of empty zones is:
    5242. 

  5242.             </p>
    5243. 

  5243. <div class="itemizedlist"><ul type="disc">
    5244. 

  5244. <li>10.IN-ADDR.ARPA</li>
    5245. 

  5245. <li>16.172.IN-ADDR.ARPA</li>
    5246. 

  5246. <li>17.172.IN-ADDR.ARPA</li>
    5247. 

  5247. <li>18.172.IN-ADDR.ARPA</li>
    5248. 

  5248. <li>19.172.IN-ADDR.ARPA</li>
    5249. 

  5249. <li>20.172.IN-ADDR.ARPA</li>
    5250. 

  5250. <li>21.172.IN-ADDR.ARPA</li>
    5251. 

  5251. <li>22.172.IN-ADDR.ARPA</li>
    5252. 

  5252. <li>23.172.IN-ADDR.ARPA</li>
    5253. 

  5253. <li>24.172.IN-ADDR.ARPA</li>
    5254. 

  5254. <li>25.172.IN-ADDR.ARPA</li>
    5255. 

  5255. <li>26.172.IN-ADDR.ARPA</li>
    5256. 

  5256. <li>27.172.IN-ADDR.ARPA</li>
    5257. 

  5257. <li>28.172.IN-ADDR.ARPA</li>
    5258. 

  5258. <li>29.172.IN-ADDR.ARPA</li>
    5259. 

  5259. <li>30.172.IN-ADDR.ARPA</li>
    5260. 

  5260. <li>31.172.IN-ADDR.ARPA</li>
    5261. 

  5261. <li>168.192.IN-ADDR.ARPA</li>
    5262. 

  5262. <li>0.IN-ADDR.ARPA</li>
    5263. 

  5263. <li>127.IN-ADDR.ARPA</li>
    5264. 

  5264. <li>254.169.IN-ADDR.ARPA</li>
    5265. 

  5265. <li>2.0.192.IN-ADDR.ARPA</li>
    5266. 

  5266. <li>100.51.198.IN-ADDR.ARPA</li>
    5267. 

  5267. <li>113.0.203.IN-ADDR.ARPA</li>
    5268. 

  5268. <li>255.255.255.255.IN-ADDR.ARPA</li>
    5269. 

  5269. <li>0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA</li>
    5270. 

  5270. <li>1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA</li>
    5271. 

  5271. <li>8.B.D.0.1.0.0.2.IP6.ARPA</li>
    5272. 

  5272. <li>D.F.IP6.ARPA</li>
    5273. 

  5273. <li>8.E.F.IP6.ARPA</li>
    5274. 

  5274. <li>9.E.F.IP6.ARPA</li>
    5275. 

  5275. <li>A.E.F.IP6.ARPA</li>
    5276. 

  5276. <li>B.E.F.IP6.ARPA</li>
    5277. 

  5277. </ul></div>
    5278. 

  5278. <p>
    5279. 

  5279.           </p>
    5280. 

  5280. <p>
    5281. 

  5281.             Empty zones are settable at the view level and only apply to
    5282. 

  5282.             views of class IN.  Disabled empty zones are only inherited
    5283. 

  5283.             from options if there are no disabled empty zones specified
    5284. 

  5284.             at the view level.  To override the options list of disabled
    5285. 

  5285.             zones, you can disable the root zone at the view level, for example:
    5286. 

  5286. </p>
    5287. 

  5287. <pre class="programlisting">
    5288. 

  5288.             disable-empty-zone ".";
    5289. 

  5289. </pre>
    5290. 

  5290. <p>
    5291. 

  5291.           </p>
    5292. 

  5292. <p>
    5293. 

  5293.             If you are using the address ranges covered here, you should
    5294. 

  5294.             already have reverse zones covering the addresses you use.
    5295. 

  5295.             In practice this appears to not be the case with many queries
    5296. 

  5296.             being made to the infrastructure servers for names in these
    5297. 

  5297.             spaces.  So many in fact that sacrificial servers were needed
    5298. 

  5298.             to be deployed to channel the query load away from the
    5299. 

  5299.             infrastructure servers.
    5300. 

  5300.           </p>
    5301. 

  5301. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    5302. 

  5302. <h3 class="title">Note</h3>
    5303. 

  5303.             The real parent servers for these zones should disable all
    5304. 

  5304.             empty zone under the parent zone they serve.  For the real
    5305. 

  5305.             root servers, this is all built-in empty zones.  This will
    5306. 

  5306.             enable them to return referrals to deeper in the tree.
    5307. 

  5307.           </div>
    5308. 

  5308. <div class="variablelist"><dl>
    5309. 

  5309. <dt><span class="term"><span><strong class="command">empty-server</strong></span></span></dt>
    5310. 

  5310. <dd><p>
    5311. 

  5311.                   Specify what server name will appear in the returned
    5312. 

  5312.                   SOA record for empty zones.  If none is specified, then
    5313. 

  5313.                   the zone's name will be used.
    5314. 

  5314.                 </p></dd>
    5315. 

  5315. <dt><span class="term"><span><strong class="command">empty-contact</strong></span></span></dt>
    5316. 

  5316. <dd><p>
    5317. 

  5317.                   Specify what contact name will appear in the returned
    5318. 

  5318.                   SOA record for empty zones.  If none is specified, then
    5319. 

  5319.                   "." will be used.
    5320. 

  5320.                 </p></dd>
    5321. 

  5321. <dt><span class="term"><span><strong class="command">empty-zones-enable</strong></span></span></dt>
    5322. 

  5322. <dd><p>
    5323. 

  5323.                   Enable or disable all empty zones.  By default, they
    5324. 

  5324.                   are enabled.
    5325. 

  5325.                 </p></dd>
    5326. 

  5326. <dt><span class="term"><span><strong class="command">disable-empty-zone</strong></span></span></dt>
    5327. 

  5327. <dd><p>
    5328. 

  5328.                   Disable individual empty zones.  By default, none are
    5329. 

  5329.                   disabled.  This option can be specified multiple times.
    5330. 

  5330.                 </p></dd>
    5331. 

  5331. </dl></div>
    5332. 

  5332. </div>
    5333. 

  5333. <div class="sect3" lang="en">
    5334. 

  5334. <div class="titlepage"><div><div><h4 class="title">
    5335. 

  5335. <a name="acache"></a>Additional Section Caching</h4></div></div></div>
    5336. 

  5336. <p>
    5337. 

  5337.             The additional section cache, also called <span><strong class="command">acache</strong></span>,
    5338. 

  5338.             is an internal cache to improve the response performance of BIND 9.
    5339. 

  5339.             When additional section caching is enabled, BIND 9 will
    5340. 

  5340.             cache an internal short-cut to the additional section content for
    5341. 

  5341.             each answer RR.
    5342. 

  5342.             Note that <span><strong class="command">acache</strong></span> is an internal caching
    5343. 

  5343.             mechanism of BIND 9, and is not related to the DNS caching
    5344. 

  5344.             server function.
    5345. 

  5345.           </p>
    5346. 

  5346. <p>
    5347. 

  5347.             Additional section caching does not change the
    5348. 

  5348.             response content (except the RRsets ordering of the additional
    5349. 

  5349.             section, see below), but can improve the response performance
    5350. 

  5350.             significantly.
    5351. 

  5351.             It is particularly effective when BIND 9 acts as an authoritative
    5352. 

  5352.             server for a zone that has many delegations with many glue RRs.
    5353. 

  5353.           </p>
    5354. 

  5354. <p>
    5355. 

  5355.             In order to obtain the maximum performance improvement
    5356. 

  5356.             from additional section caching, setting
    5357. 

  5357.             <span><strong class="command">additional-from-cache</strong></span>
    5358. 

  5358.             to <span><strong class="command">no</strong></span> is recommended, since the current
    5359. 

  5359.             implementation of <span><strong class="command">acache</strong></span>
    5360. 

  5360.             does not short-cut of additional section information from the
    5361. 

  5361.             DNS cache data.
    5362. 

  5362.           </p>
    5363. 

  5363. <p>
    5364. 

  5364.             One obvious disadvantage of <span><strong class="command">acache</strong></span> is
    5365. 

  5365.             that it requires much more
    5366. 

  5366.             memory for the internal cached data.
    5367. 

  5367.             Thus, if the response performance does not matter and memory
    5368. 

  5368.             consumption is much more critical, the
    5369. 

  5369.             <span><strong class="command">acache</strong></span> mechanism can be
    5370. 

  5370.             disabled by setting <span><strong class="command">acache-enable</strong></span> to
    5371. 

  5371.             <span><strong class="command">no</strong></span>.
    5372. 

  5372.             It is also possible to specify the upper limit of memory
    5373. 

  5373.             consumption
    5374. 

  5374.             for acache by using <span><strong class="command">max-acache-size</strong></span>.
    5375. 

  5375.           </p>
    5376. 

  5376. <p>
    5377. 

  5377.             Additional section caching also has a minor effect on the
    5378. 

  5378.             RRset ordering in the additional section.
    5379. 

  5379.             Without <span><strong class="command">acache</strong></span>,
    5380. 

  5380.             <span><strong class="command">cyclic</strong></span> order is effective for the additional
    5381. 

  5381.             section as well as the answer and authority sections.
    5382. 

  5382.             However, additional section caching fixes the ordering when it
    5383. 

  5383.             first caches an RRset for the additional section, and the same
    5384. 

  5384.             ordering will be kept in succeeding responses, regardless of the
    5385. 

  5385.             setting of <span><strong class="command">rrset-order</strong></span>.
    5386. 

  5386.             The effect of this should be minor, however, since an
    5387. 

  5387.             RRset in the additional section
    5388. 

  5388.             typically only contains a small number of RRs (and in many cases
    5389. 

  5389.             it only contains a single RR), in which case the
    5390. 

  5390.             ordering does not matter much.
    5391. 

  5391.           </p>
    5392. 

  5392. <p>
    5393. 

  5393.             The following is a summary of options related to
    5394. 

  5394.             <span><strong class="command">acache</strong></span>.
    5395. 

  5395.           </p>
    5396. 

  5396. <div class="variablelist"><dl>
    5397. 

  5397. <dt><span class="term"><span><strong class="command">acache-enable</strong></span></span></dt>
    5398. 

  5398. <dd><p>
    5399. 

  5399.                   If <span><strong class="command">yes</strong></span>, additional section caching is
    5400. 

  5400.                   enabled.  The default value is <span><strong class="command">no</strong></span>.
    5401. 

  5401.                 </p></dd>
    5402. 

  5402. <dt><span class="term"><span><strong class="command">acache-cleaning-interval</strong></span></span></dt>
    5403. 

  5403. <dd><p>
    5404. 

  5404.                   The server will remove stale cache entries, based on an LRU
    5405. 

  5405.                   based
    5406. 

  5406.                   algorithm, every <span><strong class="command">acache-cleaning-interval</strong></span> minutes.
    5407. 

  5407.                   The default is 60 minutes.
    5408. 

  5408.                   If set to 0, no periodic cleaning will occur.
    5409. 

  5409.                 </p></dd>
    5410. 

  5410. <dt><span class="term"><span><strong class="command">max-acache-size</strong></span></span></dt>
    5411. 

  5411. <dd><p>
    5412. 

  5412.                   The maximum amount of memory in bytes to use for the server's acache.
    5413. 

  5413.                   When the amount of data in the acache reaches this limit,
    5414. 

  5414.                   the server
    5415. 

  5415.                   will clean more aggressively so that the limit is not
    5416. 

  5416.                   exceeded.
    5417. 

  5417.                   In a server with multiple views, the limit applies
    5418. 

  5418.                   separately to the
    5419. 

  5419.                   acache of each view.
    5420. 

  5420.                   The default is <code class="literal">16M</code>.
    5421. 

  5421.                 </p></dd>
    5422. 

  5422. </dl></div>
    5423. 

  5423. </div>
    5424. 

  5424. <div class="sect3" lang="en">
    5425. 

  5425. <div class="titlepage"><div><div><h4 class="title">
    5426. 

  5426. <a name="id2588188"></a>Content Filtering</h4></div></div></div>
    5427. 

  5427. <p>
    5428. 

  5428.             <acronym class="acronym">BIND</acronym> 9 provides the ability to filter
    5429. 

  5429.             out DNS responses from external DNS servers containing
    5430. 

  5430.             certain types of data in the answer section.
    5431. 

  5431.             Specifically, it can reject address (A or AAAA) records if
    5432. 

  5432.             the corresponding IPv4 or IPv6 addresses match the given
    5433. 

  5433.             <code class="varname">address_match_list</code> of the
    5434. 

  5434.             <span><strong class="command">deny-answer-addresses</strong></span> option.
    5435. 

  5435.             It can also reject CNAME or DNAME records if the "alias"
    5436. 

  5436.             name (i.e., the CNAME alias or the substituted query name
    5437. 

  5437.             due to DNAME) matches the
    5438. 

  5438.             given <code class="varname">namelist</code> of the
    5439. 

  5439.             <span><strong class="command">deny-answer-aliases</strong></span> option, where
    5440. 

  5440.             "match" means the alias name is a subdomain of one of
    5441. 

  5441.             the <code class="varname">name_list</code> elements.
    5442. 

  5442.             If the optional <code class="varname">namelist</code> is specified
    5443. 

  5443.             with <span><strong class="command">except-from</strong></span>, records whose query name
    5444. 

  5444.             matches the list will be accepted regardless of the filter
    5445. 

  5445.             setting.
    5446. 

  5446.             Likewise, if the alias name is a subdomain of the
    5447. 

  5447.             corresponding zone, the <span><strong class="command">deny-answer-aliases</strong></span>
    5448. 

  5448.             filter will not apply;
    5449. 

  5449.             for example, even if "example.com" is specified for
    5450. 

  5450.             <span><strong class="command">deny-answer-aliases</strong></span>,
    5451. 

  5451.           </p>
    5452. 

  5452. <pre class="programlisting">www.example.com. CNAME xxx.example.com.</pre>
    5453. 

  5453. <p>
    5454. 

  5454.             returned by an "example.com" server will be accepted.
    5455. 

  5455.           </p>
    5456. 

  5456. <p>
    5457. 

  5457.             In the <code class="varname">address_match_list</code> of the
    5458. 

  5458.             <span><strong class="command">deny-answer-addresses</strong></span> option, only
    5459. 

  5459.             <code class="varname">ip_addr</code>
    5460. 

  5460.             and <code class="varname">ip_prefix</code>
    5461. 

  5461.             are meaningful;
    5462. 

  5462.             any <code class="varname">key_id</code> will be silently ignored.
    5463. 

  5463.           </p>
    5464. 

  5464. <p>
    5465. 

  5465.             If a response message is rejected due to the filtering,
    5466. 

  5466.             the entire message is discarded without being cached, and
    5467. 

  5467.             a SERVFAIL error will be returned to the client.
    5468. 

  5468.           </p>
    5469. 

  5469. <p>
    5470. 

  5470.             This filtering is intended to prevent "DNS rebinding attacks," in
    5471. 

  5471.             which an attacker, in response to a query for a domain name the
    5472. 

  5472.             attacker controls, returns an IP address within your own network or
    5473. 

  5473.             an alias name within your own domain.
    5474. 

  5474.             A naive web browser or script could then serve as an
    5475. 

  5475.             unintended proxy, allowing the attacker
    5476. 

  5476.             to get access to an internal node of your local network
    5477. 

  5477.             that couldn't be externally accessed otherwise.
    5478. 

  5478.             See the paper available at
    5479. 

  5479.             <a href="" target="_top">
    5480. 

  5480.             http://portal.acm.org/citation.cfm?id=1315245.1315298
    5481. 

  5481.             </a>
    5482. 

  5482.             for more details about the attacks.
    5483. 

  5483.           </p>
    5484. 

  5484. <p>
    5485. 

  5485.             For example, if you own a domain named "example.net" and
    5486. 

  5486.             your internal network uses an IPv4 prefix 192.0.2.0/24,
    5487. 

  5487.             you might specify the following rules:
    5488. 

  5488.           </p>
    5489. 

  5489. <pre class="programlisting">deny-answer-addresses { 192.0.2.0/24; } except-from { "example.net"; };
    5490. 

  5490. deny-answer-aliases { "example.net"; };
    5491. 

  5491. </pre>
    5492. 

  5492. <p>
    5493. 

  5493.             If an external attacker lets a web browser in your local
    5494. 

  5494.             network look up an IPv4 address of "attacker.example.com",
    5495. 

  5495.             the attacker's DNS server would return a response like this:
    5496. 

  5496.           </p>
    5497. 

  5497. <pre class="programlisting">attacker.example.com. A 192.0.2.1</pre>
    5498. 

  5498. <p>
    5499. 

  5499.             in the answer section.
    5500. 

  5500.             Since the rdata of this record (the IPv4 address) matches
    5501. 

  5501.             the specified prefix 192.0.2.0/24, this response will be
    5502. 

  5502.             ignored.
    5503. 

  5503.           </p>
    5504. 

  5504. <p>
    5505. 

  5505.             On the other hand, if the browser looks up a legitimate
    5506. 

  5506.             internal web server "www.example.net" and the
    5507. 

  5507.             following response is returned to
    5508. 

  5508.             the <acronym class="acronym">BIND</acronym> 9 server
    5509. 

  5509.           </p>
    5510. 

  5510. <pre class="programlisting">www.example.net. A 192.0.2.2</pre>
    5511. 

  5511. <p>
    5512. 

  5512.             it will be accepted since the owner name "www.example.net"
    5513. 

  5513.             matches the <span><strong class="command">except-from</strong></span> element,
    5514. 

  5514.             "example.net".
    5515. 

  5515.           </p>
    5516. 

  5516. <p>
    5517. 

  5517.             Note that this is not really an attack on the DNS per se.
    5518. 

  5518.             In fact, there is nothing wrong for an "external" name to
    5519. 

  5519.             be mapped to your "internal" IP address or domain name
    5520. 

  5520.             from the DNS point of view.
    5521. 

  5521.             It might actually be provided for a legitimate purpose,
    5522. 

  5522.             such as for debugging.
    5523. 

  5523.             As long as the mapping is provided by the correct owner,
    5524. 

  5524.             it is not possible or does not make sense to detect
    5525. 

  5525.             whether the intent of the mapping is legitimate or not
    5526. 

  5526.             within the DNS.
    5527. 

  5527.             The "rebinding" attack must primarily be protected at the
    5528. 

  5528.             application that uses the DNS.
    5529. 

  5529.             For a large site, however, it may be difficult to protect
    5530. 

  5530.             all possible applications at once.
    5531. 

  5531.             This filtering feature is provided only to help such an
    5532. 

  5532.             operational environment;
    5533. 

  5533.             it is generally discouraged to turn it on unless you are
    5534. 

  5534.             very sure you have no other choice and the attack is a
    5535. 

  5535.             real threat for your applications.
    5536. 

  5536.           </p>
    5537. 

  5537. <p>
    5538. 

  5538.             Care should be particularly taken if you want to use this
    5539. 

  5539.             option for addresses within 127.0.0.0/8.
    5540. 

  5540.             These addresses are obviously "internal", but many
    5541. 

  5541.             applications conventionally rely on a DNS mapping from
    5542. 

  5542.             some name to such an address.
    5543. 

  5543.             Filtering out DNS records containing this address
    5544. 

  5544.             spuriously can break such applications.
    5545. 

  5545.           </p>
    5546. 

  5546. </div>
    5547. 

  5547. <div class="sect3" lang="en">
    5548. 

  5548. <div class="titlepage"><div><div><h4 class="title">
    5549. 

  5549. <a name="id2588379"></a>Response Policy Zone (RPZ) Rewriting</h4></div></div></div>
    5550. 

  5550. <p>
    5551. 

  5551.             <acronym class="acronym">BIND</acronym> 9 includes an intentionally limited
    5552. 

  5552.             mechanism to modify DNS responses for recursive requests
    5553. 

  5553.             somewhat similar to email anti-spam DNS blacklists.
    5554. 

  5554.             Responses can be changed to deny the existence of domains(NXDOMAIN),
    5555. 

  5555.             deny the existence of IP addresses for domains (NODATA),
    5556. 

  5556.             or contain other IP addresses or data.
    5557. 

  5557.           </p>
    5558. 

  5558. <p>
    5559. 

  5559.             The actions encoded in a response policy zone (RPZ) are applied
    5560. 

  5560.             only to queries that ask for recursion (RD=1).
    5561. 

  5561.             Response policy zones are named in the
    5562. 

  5562.             <span><strong class="command">response-policy</strong></span> option for the view or among the
    5563. 

  5563.             global options if there is no response-policy option for the view.
    5564. 

  5564.             RPZs are ordinary DNS zones containing RRsets
    5565. 

  5565.             that can be queried normally if allowed.
    5566. 

  5566.             It is usually best to restrict those queries with something like
    5567. 

  5567.             <span><strong class="command">allow-query { localhost; };</strong></span>.
    5568. 

  5568.           </p>
    5569. 

  5569. <p>
    5570. 

  5570.             There are four kinds of RPZ records, QNAME, IP, NSIP,
    5571. 

  5571.             and NSDNAME.
    5572. 

  5572.             QNAME records are applied to query names of requests and targets
    5573. 

  5573.             of CNAME records resolved to generate the response.
    5574. 

  5574.             The owner name of a QNAME RPZ record is the query name relativized
    5575. 

  5575.             to the RPZ.
    5576. 

  5576.           </p>
    5577. 

  5577. <p>
    5578. 

  5578.             The second kind of RPZ record, an IP policy record,
    5579. 

  5579.             is triggered by addresses in A and AAAA records
    5580. 

  5580.             for the ANSWER sections of responses.
    5581. 

  5581.             IP policy records have owner names that are
    5582. 

  5582.             subdomains of <strong class="userinput"><code>rpz-ip</code></strong> relativized to the
    5583. 

  5583.             RPZ origin name and encode an IP address or address block.
    5584. 

  5584.             IPv4 addresses are encoded as
    5585. 

  5585.             <strong class="userinput"><code>prefixlength.B4.B3.B2.B1.rpz-ip</code></strong>.
    5586. 

  5586.             The prefix length must be between 1 and 32.
    5587. 

  5587.             All four bytes, B4, B3, B2, and B1, must be present.
    5588. 

  5588.             B4 is the decimal value of the least significant byte of the
    5589. 

  5589.             IPv4 address as in IN-ADDR.ARPA.
    5590. 

  5590.             IPv6 addresses are encoded in a format similar to the standard
    5591. 

  5591.             IPv6 text representation,
    5592. 

  5592.             <strong class="userinput"><code>prefixlength.W8.W7.W6.W5.W4.W3.W2.W1.rpz-ip</code></strong>.
    5593. 

  5593.             Each of W8,...,W1 is a one to four digit hexadecimal number
    5594. 

  5594.             representing 16 bits of the IPv6 address as in the standard text
    5595. 

  5595.             representation of IPv6 addresses, but reversed as in IN-ADDR.ARPA.
    5596. 

  5596.             All 8 words must be present except when consecutive
    5597. 

  5597.             zero words are replaced with <strong class="userinput"><code>.zz.</code></strong>
    5598. 

  5598.             analogous to double colons (::) in standard IPv6 text encodings.
    5599. 

  5599.             The prefix length must be between 1 and 128.
    5600. 

  5600.           </p>
    5601. 

  5601. <p>
    5602. 

  5602.             NSDNAME policy records match names of authoritative servers
    5603. 

  5603.             for the query name, a parent of the query name, a CNAME,
    5604. 

  5604.             or a parent of a CNAME.
    5605. 

  5605.             They are encoded as subdomains of
    5606. 

  5606.             <strong class="userinput"><code>rpz-nsdomain</code></strong> relativized
    5607. 

  5607.             to the RPZ origin name.
    5608. 

  5608.           </p>
    5609. 

  5609. <p>
    5610. 

  5610.             NSIP policy records match IP addresses in A and AAAA RRsets
    5611. 

  5611.             for domains that can be checked against NSDNAME policy records.
    5612. 

  5612.             The are encoded like IP policies except as subdomains of
    5613. 

  5613.             <strong class="userinput"><code>rpz-nsip</code></strong>.
    5614. 

  5614.           </p>
    5615. 

  5615. <p>
    5616. 

  5616.             The query response is checked against all RPZs, so
    5617. 

  5617.             two or more policy records can apply to a single response.
    5618. 

  5618.             Because DNS responses can be rewritten according by at most a
    5619. 

  5619.             single policy record, a single policy (other than
    5620. 

  5620.             <span><strong class="command">DISABLED</strong></span> policies) must be chosen.
    5621. 

  5621.             Policies are chosen in the following order:
    5622. 

  5622.             </p>
    5623. 

  5623. <div class="itemizedlist"><ul type="disc">
    5624. 

  5624. <li>Among applicable zones, use the RPZ that appears first
    5625. 

  5625.                 in the response-policy option.
    5626. 

  5626.               </li>
    5627. 

  5627. <li>Prefer QNAME to IP to NSDNAME to NSIP policy records
    5628. 

  5628.                 in a single RPZ
    5629. 

  5629.               </li>
    5630. 

  5630. <li>Among applicable NSDNAME policy records, prefer the
    5631. 

  5631.                 policy record that matches the lexically smallest name
    5632. 

  5632.               </li>
    5633. 

  5633. <li>Among IP or NSIP policy records, prefer the record
    5634. 

  5634.                 with the longest prefix.
    5635. 

  5635.               </li>
    5636. 

  5636. <li>Among records with the same prefex length,
    5637. 

  5637.                 prefer the IP or NSIP policy record that matches
    5638. 

  5638.                 the smallest IP address.
    5639. 

  5639.               </li>
    5640. 

  5640. </ul></div>
    5641. 

  5641. <p>
    5642. 

  5642.           </p>
    5643. 

  5643. <p>
    5644. 

  5644.             When the processing of a response is restarted to resolve
    5645. 

  5645.             DNAME or CNAME records and an applicable policy record set has
    5646. 

  5646.             not been found,
    5647. 

  5647.             all RPZs are again consulted for the DNAME or CNAME names
    5648. 

  5648.             and addresses.
    5649. 

  5649.           </p>
    5650. 

  5650. <p>
    5651. 

  5651.             Authority verification issues and variations in authority data
    5652. 

  5652.             can cause inconsistent results for NSIP and NSDNAME policy records.
    5653. 

  5653.             Glue NS records often differ from authoritative NS records.
    5654. 

  5654.             So they are available
    5655. 

  5655.             only when <acronym class="acronym">BIND</acronym> is built with the
    5656. 

  5656.             <strong class="userinput"><code>--enable-rpz-nsip</code></strong> or
    5657. 

  5657.             <strong class="userinput"><code>--enable-rpz-nsdname</code></strong> options
    5658. 

  5658.             on the "configure" command line.
    5659. 

  5659.           </p>
    5660. 

  5660. <p>
    5661. 

  5661.             RPZ record sets are special CNAME records or one or more
    5662. 

  5662.             of any types of DNS record except DNAME or DNSSEC.
    5663. 

  5663.             Except when a policy record is a CNAME, there can be more
    5664. 

  5664.             more than one record and more than one type
    5665. 

  5665.             in a set of policy records.
    5666. 

  5666.             Except for three kinds of CNAME records that are illegal except
    5667. 

  5667.             in policy zones, the records in a set are used in the response as if
    5668. 

  5668.             their owner name were the query name.  They are copied to the
    5669. 

  5669.             response as dictated by their types.
    5670. 

  5670.             </p>
    5671. 

  5671. <div class="itemizedlist"><ul type="disc">
    5672. 

  5672. <li>A CNAME whose target is the root domain (.)
    5673. 

  5673.                 specifies the <span><strong class="command">NXDOMAIN</strong></span> policy,
    5674. 

  5674.                 which generates an NXDOMAIN response.
    5675. 

  5675.               </li>
    5676. 

  5676. <li>A CNAME whose target is the wildcard top-level
    5677. 

  5677.                 domain (*.) specifies the <span><strong class="command">NODATA</strong></span> policy,
    5678. 

  5678.                 which rewrites the response to NODATA or ANCOUNT=1.
    5679. 

  5679.               </li>
    5680. 

  5680. <li>A CNAME whose target is a wildcard hostname such
    5681. 

  5681.                 as *.example.com is used normally after the astrisk (*)
    5682. 

  5682.                 has been replaced with the query name.
    5683. 

  5683.                 These records are usually resolved with ordinary CNAMEs
    5684. 

  5684.                 outside the policy zones.  They can be useful for logging.
    5685. 

  5685.               </li>
    5686. 

  5686. <li>The <span><strong class="command">PASSTHRU</strong></span> policy is specified
    5687. 

  5687.                 by a CNAME whose target is the variable part of its own
    5688. 

  5688.                 owner name.  It causes the response to not be rewritten
    5689. 

  5689.                 and is most often used to "poke holes" in policies for
    5690. 

  5690.                 CIDR blocks.
    5691. 

  5691.               </li>
    5692. 

  5692. </ul></div>
    5693. 

  5693. <p>
    5694. 

  5694.           </p>
    5695. 

  5695. <p>
    5696. 

  5696.             The policies specified in individual records
    5697. 

  5697.             in an RPZ can be overridden with a <span><strong class="command">policy</strong></span> clause
    5698. 

  5698.             in the <span><strong class="command">response-policy</strong></span> option.
    5699. 

  5699.             An organization using an RPZ provided by another organization might
    5700. 

  5700.             use this mechanism to redirect domains to its own walled garden.
    5701. 

  5701.             </p>
    5702. 

  5702. <div class="itemizedlist"><ul type="disc">
    5703. 

  5703. <li>
    5704. 

  5704. <span><strong class="command">GIVEN</strong></span> says "do not override."
    5705. 

  5705.               </li>
    5706. 

  5706. <li>
    5707. 

  5707. <span><strong class="command">DISABLED</strong></span> causes policy records to do
    5708. 

  5708.                 nothing but log what they might have done.
    5709. 

  5709.                 The response to the DNS query will be written according to
    5710. 

  5710.                 any matching policy records that are not disabled.
    5711. 

  5711.                 Policy zones overridden with <span><strong class="command">DISABLED</strong></span> should
    5712. 

  5712.                 appear first, because they will often not be logged
    5713. 

  5713.                 if a higher precedence policy is found first.
    5714. 

  5714.               </li>
    5715. 

  5715. <li>
    5716. 

  5716. <span><strong class="command">PASSTHRU</strong></span> causes all policy records
    5717. 

  5717.                 to act as if they were CNAME records with targets the variable
    5718. 

  5718.                 part of their owner name.  They protect the response from
    5719. 

  5719.                 being changed.
    5720. 

  5720.               </li>
    5721. 

  5721. <li>
    5722. 

  5722. <span><strong class="command">NXDOMAIN</strong></span> causes all RPZ records
    5723. 

  5723.                 to specify NXDOMAIN policies.
    5724. 

  5724.               </li>
    5725. 

  5725. <li>
    5726. 

  5726. <span><strong class="command">NODATA</strong></span> overrides with the
    5727. 

  5727.                 NODATA policy
    5728. 

  5728.               </li>
    5729. 

  5729. <li>
    5730. 

  5730. <span><strong class="command">CNAME domain</strong></span> causes all RPZ
    5731. 

  5731.                 policy records to act as if they were "cname domain" records.
    5732. 

  5732.               </li>
    5733. 

  5733. </ul></div>
    5734. 

  5734. <p>
    5735. 

  5735.           </p>
    5736. 

  5736. <p>
    5737. 

  5737.             For example, you might use this option statement
    5738. 

  5738.           </p>
    5739. 

  5739. <pre class="programlisting">    response-policy { zone "badlist"; };</pre>
    5740. 

  5740. <p>
    5741. 

  5741.             and this zone statement
    5742. 

  5742.           </p>
    5743. 

  5743. <pre class="programlisting">    zone "badlist" {type master; file "master/badlist"; allow-query {none;}; };</pre>
    5744. 

  5744. <p>
    5745. 

  5745.             with this zone file
    5746. 

  5746.           </p>
    5747. 

  5747. <pre class="programlisting">$TTL 1H
    5748. 

  5748. @                       SOA LOCALHOST. named-mgr.example.com (1 1h 15m 30d 2h)
    5749. 

  5749.                         NS  LOCALHOST.
    5750. 

    5751. 

  5751. ; QNAME policy records.  There are no periods (.) after the owner names.
    5752. 

  5752. nxdomain.domain.com     CNAME   .               ; NXDOMAIN policy
    5753. 

  5753. nodata.domain.com       CNAME   *.              ; NODATA policy
    5754. 

  5754. bad.domain.com          A       10.0.0.1        ; redirect to a walled garden
    5755. 

  5755.                         AAAA    2001:2::1
    5756. 

    5757. 

  5757. ; do not rewrite (PASSTHRU) OK.DOMAIN.COM
    5758. 

  5758. ok.domain.com           CNAME   ok.domain.com.
    5759. 

    5760. 

  5760. bzone.domain.com        CNAME   garden.example.com.
    5761. 

    5762. 

  5762. ; redirect x.bzone.domain.com to x.bzone.domain.com.garden.example.com
    5763. 

  5763. *.bzone.domain.com      CNAME   *.garden.example.com.
    5764. 

    5765. 

    5766. 

  5766. ; IP policy records that rewrite all answers for 127/8 except 127.0.0.1
    5767. 

  5767. 8.0.0.0.127.rpz-ip      CNAME   .
    5768. 

  5768. 32.1.0.0.127.rpz-ip     CNAME   32.1.0.0.127.   ; PASSTHRU for 127.0.0.1
    5769. 

    5770. 

  5770. ; NSDNAME and NSIP policy records
    5771. 

  5771. ns.domain.com.rpz-nsdname   CNAME   .
    5772. 

  5772. 48.zz.2.2001.rpz-nsip       CNAME   .
    5773. 

  5773. </pre>
    5774. 

  5774. </div>
    5775. 

  5775. </div>
    5776. 

  5776. <div class="sect2" lang="en">
    5777. 

  5777. <div class="titlepage"><div><div><h3 class="title">
    5778. 

  5778. <a name="server_statement_grammar"></a><span><strong class="command">server</strong></span> Statement Grammar</h3></div></div></div>
    5779. 

  5779. <pre class="programlisting"><span><strong class="command">server</strong></span> <em class="replaceable"><code>ip_addr[/prefixlen]</code></em> {
    5780. 

  5780.     [<span class="optional"> bogus <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    5781. 

  5781.     [<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    5782. 

  5782.     [<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    5783. 

  5783.     [<span class="optional"> edns <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    5784. 

  5784.     [<span class="optional"> edns-udp-size <em class="replaceable"><code>number</code></em> ; </span>]
    5785. 

  5785.     [<span class="optional"> max-udp-size <em class="replaceable"><code>number</code></em> ; </span>]
    5786. 

  5786.     [<span class="optional"> transfers <em class="replaceable"><code>number</code></em> ; </span>]
    5787. 

  5787.     [<span class="optional"> transfer-format <em class="replaceable"><code>( one-answer | many-answers )</code></em> ; ]</span>]
    5788. 

  5788.     [<span class="optional"> keys <em class="replaceable"><code>{ string ; [<span class="optional"> string ; [<span class="optional">...</span>]</span>] }</code></em> ; </span>]
    5789. 

  5789.     [<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    5790. 

  5790.     [<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    5791. 

  5791.     [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    5792. 

  5792.     [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    5793. 

  5793.     [<span class="optional"> query-source [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
    5794. 

  5794.                   [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
    5795. 

  5795.     [<span class="optional"> query-source-v6 [<span class="optional"> address ( <em class="replaceable"><code>ip_addr</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]
    5796. 

  5796.                      [<span class="optional"> port ( <em class="replaceable"><code>ip_port</code></em> | <em class="replaceable"><code>*</code></em> ) </span>]; </span>]
    5797. 

  5797.     [<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    5798. 

  5798.     [<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
    5799. 

  5799.     [<span class="optional"> queryport-pool-updateinterval <em class="replaceable"><code>number</code></em>; </span>]
    5800. 

  5800. };
    5801. 

  5801. </pre>
    5802. 

  5802. </div>
    5803. 

  5803. <div class="sect2" lang="en">
    5804. 

  5804. <div class="titlepage"><div><div><h3 class="title">
    5805. 

  5805. <a name="server_statement_definition_and_usage"></a><span><strong class="command">server</strong></span> Statement Definition and
    5806. 

  5806.             Usage</h3></div></div></div>
    5807. 

  5807. <p>
    5808. 

  5808.             The <span><strong class="command">server</strong></span> statement defines
    5809. 

  5809.             characteristics
    5810. 

  5810.             to be associated with a remote name server.  If a prefix length is
    5811. 

  5811.             specified, then a range of servers is covered.  Only the most
    5812. 

  5812.             specific
    5813. 

  5813.             server clause applies regardless of the order in
    5814. 

  5814.             <code class="filename">named.conf</code>.
    5815. 

  5815.           </p>
    5816. 

  5816. <p>
    5817. 

  5817.             The <span><strong class="command">server</strong></span> statement can occur at
    5818. 

  5818.             the top level of the
    5819. 

  5819.             configuration file or inside a <span><strong class="command">view</strong></span>
    5820. 

  5820.             statement.
    5821. 

  5821.             If a <span><strong class="command">view</strong></span> statement contains
    5822. 

  5822.             one or more <span><strong class="command">server</strong></span> statements, only
    5823. 

  5823.             those
    5824. 

  5824.             apply to the view and any top-level ones are ignored.
    5825. 

  5825.             If a view contains no <span><strong class="command">server</strong></span>
    5826. 

  5826.             statements,
    5827. 

  5827.             any top-level <span><strong class="command">server</strong></span> statements are
    5828. 

  5828.             used as
    5829. 

  5829.             defaults.
    5830. 

  5830.           </p>
    5831. 

  5831. <p>
    5832. 

  5832.             If you discover that a remote server is giving out bad data,
    5833. 

  5833.             marking it as bogus will prevent further queries to it. The
    5834. 

  5834.             default
    5835. 

  5835.             value of <span><strong class="command">bogus</strong></span> is <span><strong class="command">no</strong></span>.
    5836. 

  5836.           </p>
    5837. 

  5837. <p>
    5838. 

  5838.             The <span><strong class="command">provide-ixfr</strong></span> clause determines
    5839. 

  5839.             whether
    5840. 

  5840.             the local server, acting as master, will respond with an
    5841. 

  5841.             incremental
    5842. 

  5842.             zone transfer when the given remote server, a slave, requests it.
    5843. 

  5843.             If set to <span><strong class="command">yes</strong></span>, incremental transfer
    5844. 

  5844.             will be provided
    5845. 

  5845.             whenever possible. If set to <span><strong class="command">no</strong></span>,
    5846. 

  5846.             all transfers
    5847. 

  5847.             to the remote server will be non-incremental. If not set, the
    5848. 

  5848.             value
    5849. 

  5849.             of the <span><strong class="command">provide-ixfr</strong></span> option in the
    5850. 

  5850.             view or
    5851. 

  5851.             global options block is used as a default.
    5852. 

  5852.           </p>
    5853. 

  5853. <p>
    5854. 

  5854.             The <span><strong class="command">request-ixfr</strong></span> clause determines
    5855. 

  5855.             whether
    5856. 

  5856.             the local server, acting as a slave, will request incremental zone
    5857. 

  5857.             transfers from the given remote server, a master. If not set, the
    5858. 

  5858.             value of the <span><strong class="command">request-ixfr</strong></span> option in
    5859. 

  5859.             the view or
    5860. 

  5860.             global options block is used as a default.
    5861. 

  5861.           </p>
    5862. 

  5862. <p>
    5863. 

  5863.             IXFR requests to servers that do not support IXFR will
    5864. 

  5864.             automatically
    5865. 

  5865.             fall back to AXFR.  Therefore, there is no need to manually list
    5866. 

  5866.             which servers support IXFR and which ones do not; the global
    5867. 

  5867.             default
    5868. 

  5868.             of <span><strong class="command">yes</strong></span> should always work.
    5869. 

  5869.             The purpose of the <span><strong class="command">provide-ixfr</strong></span> and
    5870. 

  5870.             <span><strong class="command">request-ixfr</strong></span> clauses is
    5871. 

  5871.             to make it possible to disable the use of IXFR even when both
    5872. 

  5872.             master
    5873. 

  5873.             and slave claim to support it, for example if one of the servers
    5874. 

  5874.             is buggy and crashes or corrupts data when IXFR is used.
    5875. 

  5875.           </p>
    5876. 

  5876. <p>
    5877. 

  5877.             The <span><strong class="command">edns</strong></span> clause determines whether
    5878. 

  5878.             the local server will attempt to use EDNS when communicating
    5879. 

  5879.             with the remote server.  The default is <span><strong class="command">yes</strong></span>.
    5880. 

  5880.           </p>
    5881. 

  5881. <p>
    5882. 

  5882.             The <span><strong class="command">edns-udp-size</strong></span> option sets the EDNS UDP size
    5883. 

  5883.             that is advertised by <span><strong class="command">named</strong></span> when querying the remote server.
    5884. 

  5884.             Valid values are 512 to 4096 bytes (values outside this range will be
    5885. 

  5885.             silently adjusted).  This option is useful when you wish to
    5886. 

  5886.             advertises a different value to this server than the value you
    5887. 

  5887.             advertise globally, for example, when there is a firewall at the
    5888. 

  5888.             remote site that is blocking large replies.
    5889. 

  5889.           </p>
    5890. 

  5890. <p>
    5891. 

  5891.             The <span><strong class="command">max-udp-size</strong></span> option sets the
    5892. 

  5892.             maximum EDNS UDP message size <span><strong class="command">named</strong></span> will send.  Valid
    5893. 

  5893.             values are 512 to 4096 bytes (values outside this range will
    5894. 

  5894.             be silently adjusted).  This option is useful when you
    5895. 

  5895.             know that there is a firewall that is blocking large
    5896. 

  5896.             replies from <span><strong class="command">named</strong></span>.
    5897. 

  5897.           </p>
    5898. 

  5898. <p>
    5899. 

  5899.             The server supports two zone transfer methods. The first, <span><strong class="command">one-answer</strong></span>,
    5900. 

  5900.             uses one DNS message per resource record transferred. <span><strong class="command">many-answers</strong></span> packs
    5901. 

  5901.             as many resource records as possible into a message. <span><strong class="command">many-answers</strong></span> is
    5902. 

  5902.             more efficient, but is only known to be understood by <acronym class="acronym">BIND</acronym> 9, <acronym class="acronym">BIND</acronym>
    5903. 

  5903.             8.x, and patched versions of <acronym class="acronym">BIND</acronym>
    5904. 

  5904.             4.9.5. You can specify which method
    5905. 

  5905.             to use for a server with the <span><strong class="command">transfer-format</strong></span> option.
    5906. 

  5906.             If <span><strong class="command">transfer-format</strong></span> is not
    5907. 

  5907.             specified, the <span><strong class="command">transfer-format</strong></span>
    5908. 

  5908.             specified
    5909. 

  5909.             by the <span><strong class="command">options</strong></span> statement will be
    5910. 

  5910.             used.
    5911. 

  5911.           </p>
    5912. 

  5912. <p><span><strong class="command">transfers</strong></span>
    5913. 

  5913.             is used to limit the number of concurrent inbound zone
    5914. 

  5914.             transfers from the specified server. If no
    5915. 

  5915.             <span><strong class="command">transfers</strong></span> clause is specified, the
    5916. 

  5916.             limit is set according to the
    5917. 

  5917.             <span><strong class="command">transfers-per-ns</strong></span> option.
    5918. 

  5918.           </p>
    5919. 

  5919. <p>
    5920. 

  5920.             The <span><strong class="command">keys</strong></span> clause identifies a
    5921. 

  5921.             <span><strong class="command">key_id</strong></span> defined by the <span><strong class="command">key</strong></span> statement,
    5922. 

  5922.             to be used for transaction security (TSIG, <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called &#8220;TSIG&#8221;</a>)
    5923. 

  5923.             when talking to the remote server.
    5924. 

  5924.             When a request is sent to the remote server, a request signature
    5925. 

  5925.             will be generated using the key specified here and appended to the
    5926. 

  5926.             message. A request originating from the remote server is not
    5927. 

  5927.             required
    5928. 

  5928.             to be signed by this key.
    5929. 

  5929.           </p>
    5930. 

  5930. <p>
    5931. 

  5931.             Although the grammar of the <span><strong class="command">keys</strong></span>
    5932. 

  5932.             clause
    5933. 

  5933.             allows for multiple keys, only a single key per server is
    5934. 

  5934.             currently
    5935. 

  5935.             supported.
    5936. 

  5936.           </p>
    5937. 

  5937. <p>
    5938. 

  5938.             The <span><strong class="command">transfer-source</strong></span> and
    5939. 

  5939.             <span><strong class="command">transfer-source-v6</strong></span> clauses specify
    5940. 

  5940.             the IPv4 and IPv6 source
    5941. 

  5941.             address to be used for zone transfer with the remote server,
    5942. 

  5942.             respectively.
    5943. 

  5943.             For an IPv4 remote server, only <span><strong class="command">transfer-source</strong></span> can
    5944. 

  5944.             be specified.
    5945. 

  5945.             Similarly, for an IPv6 remote server, only
    5946. 

  5946.             <span><strong class="command">transfer-source-v6</strong></span> can be
    5947. 

  5947.             specified.
    5948. 

  5948.             For more details, see the description of
    5949. 

  5949.             <span><strong class="command">transfer-source</strong></span> and
    5950. 

  5950.             <span><strong class="command">transfer-source-v6</strong></span> in
    5951. 

  5951.             <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called &#8220;Zone Transfers&#8221;</a>.
    5952. 

  5952.           </p>
    5953. 

  5953. <p>
    5954. 

  5954.             The <span><strong class="command">notify-source</strong></span> and
    5955. 

  5955.             <span><strong class="command">notify-source-v6</strong></span> clauses specify the
    5956. 

  5956.             IPv4 and IPv6 source address to be used for notify
    5957. 

  5957.             messages sent to remote servers, respectively.  For an
    5958. 

  5958.             IPv4 remote server, only <span><strong class="command">notify-source</strong></span>
    5959. 

  5959.             can be specified.  Similarly, for an IPv6 remote server,
    5960. 

  5960.             only <span><strong class="command">notify-source-v6</strong></span> can be specified.
    5961. 

  5961.           </p>
    5962. 

  5962. <p>
    5963. 

  5963.             The <span><strong class="command">query-source</strong></span> and
    5964. 

  5964.             <span><strong class="command">query-source-v6</strong></span> clauses specify the
    5965. 

  5965.             IPv4 and IPv6 source address to be used for queries
    5966. 

  5966.             sent to remote servers, respectively.  For an IPv4
    5967. 

  5967.             remote server, only <span><strong class="command">query-source</strong></span> can
    5968. 

  5968.             be specified.  Similarly, for an IPv6 remote server,
    5969. 

  5969.             only <span><strong class="command">query-source-v6</strong></span> can be specified.
    5970. 

  5970.           </p>
    5971. 

  5971. </div>
    5972. 

  5972. <div class="sect2" lang="en">
    5973. 

  5973. <div class="titlepage"><div><div><h3 class="title">
    5974. 

  5974. <a name="statschannels"></a><span><strong class="command">statistics-channels</strong></span> Statement Grammar</h3></div></div></div>
    5975. 

  5975. <pre class="programlisting"><span><strong class="command">statistics-channels</strong></span> {
    5976. 

  5976.    [ inet ( ip_addr | * ) [ port ip_port ]
    5977. 

  5977.    [ allow { <em class="replaceable"><code> address_match_list </code></em> } ]; ]
    5978. 

  5978.    [ inet ...; ]
    5979. 

  5979. };
    5980. 

  5980. </pre>
    5981. 

  5981. </div>
    5982. 

  5982. <div class="sect2" lang="en">
    5983. 

  5983. <div class="titlepage"><div><div><h3 class="title">
    5984. 

  5984. <a name="id2589481"></a><span><strong class="command">statistics-channels</strong></span> Statement Definition and
    5985. 

  5985.             Usage</h3></div></div></div>
    5986. 

  5986. <p>
    5987. 

  5987.           The <span><strong class="command">statistics-channels</strong></span> statement
    5988. 

  5988.           declares communication channels to be used by system
    5989. 

  5989.           administrators to get access to statistics information of
    5990. 

  5990.           the name server.
    5991. 

  5991.         </p>
    5992. 

  5992. <p>
    5993. 

  5993.           This statement intends to be flexible to support multiple
    5994. 

  5994.           communication protocols in the future, but currently only
    5995. 

  5995.           HTTP access is supported.
    5996. 

  5996.           It requires that BIND 9 be compiled with libxml2;
    5997. 

  5997.           the <span><strong class="command">statistics-channels</strong></span> statement is
    5998. 

  5998.           still accepted even if it is built without the library,
    5999. 

  5999.           but any HTTP access will fail with an error.
    6000. 

  6000.         </p>
    6001. 

  6001. <p>
    6002. 

  6002.           An <span><strong class="command">inet</strong></span> control channel is a TCP socket
    6003. 

  6003.           listening at the specified <span><strong class="command">ip_port</strong></span> on the
    6004. 

  6004.           specified <span><strong class="command">ip_addr</strong></span>, which can be an IPv4 or IPv6
    6005. 

  6005.           address.  An <span><strong class="command">ip_addr</strong></span> of <code class="literal">*</code> (asterisk) is
    6006. 

  6006.           interpreted as the IPv4 wildcard address; connections will be
    6007. 

  6007.           accepted on any of the system's IPv4 addresses.
    6008. 

  6008.           To listen on the IPv6 wildcard address,
    6009. 

  6009.           use an <span><strong class="command">ip_addr</strong></span> of <code class="literal">::</code>.
    6010. 

  6010.         </p>
    6011. 

  6011. <p>
    6012. 

  6012.           If no port is specified, port 80 is used for HTTP channels.
    6013. 

  6013.           The asterisk "<code class="literal">*</code>" cannot be used for
    6014. 

  6014.           <span><strong class="command">ip_port</strong></span>.
    6015. 

  6015.         </p>
    6016. 

  6016. <p>
    6017. 

  6017.           The attempt of opening a statistics channel is
    6018. 

  6018.           restricted by the optional <span><strong class="command">allow</strong></span> clause.
    6019. 

  6019.           Connections to the statistics channel are permitted based on the
    6020. 

  6020.           <span><strong class="command">address_match_list</strong></span>.
    6021. 

  6021.           If no <span><strong class="command">allow</strong></span> clause is present,
    6022. 

  6022.           <span><strong class="command">named</strong></span> accepts connection
    6023. 

  6023.           attempts from any address; since the statistics may
    6024. 

  6024.           contain sensitive internal information, it is highly
    6025. 

  6025.           recommended to restrict the source of connection requests
    6026. 

  6026.           appropriately.
    6027. 

  6027.         </p>
    6028. 

  6028. <p>
    6029. 

  6029.           If no <span><strong class="command">statistics-channels</strong></span> statement is present,
    6030. 

  6030.           <span><strong class="command">named</strong></span> will not open any communication channels.
    6031. 

  6031.         </p>
    6032. 

  6032. </div>
    6033. 

  6033. <div class="sect2" lang="en">
    6034. 

  6034. <div class="titlepage"><div><div><h3 class="title">
    6035. 

  6035. <a name="trusted-keys"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div>
    6036. 

  6036. <pre class="programlisting"><span><strong class="command">trusted-keys</strong></span> {
    6037. 

  6037.     <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
    6038. 

  6038.     [<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
    6039. 

  6039. };
    6040. 

  6040. </pre>
    6041. 

  6041. </div>
    6042. 

  6042. <div class="sect2" lang="en">
    6043. 

  6043. <div class="titlepage"><div><div><h3 class="title">
    6044. 

  6044. <a name="id2589689"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition
    6045. 

  6045.             and Usage</h3></div></div></div>
    6046. 

  6046. <p>
    6047. 

  6047.             The <span><strong class="command">trusted-keys</strong></span> statement defines
    6048. 

  6048.             DNSSEC security roots. DNSSEC is described in <a href="Bv9ARM.ch04.html#DNSSEC" title="DNSSEC">the section called &#8220;DNSSEC&#8221;</a>. A security root is defined when the
    6049. 

  6049.             public key for a non-authoritative zone is known, but
    6050. 

  6050.             cannot be securely obtained through DNS, either because
    6051. 

  6051.             it is the DNS root zone or because its parent zone is
    6052. 

  6052.             unsigned.  Once a key has been configured as a trusted
    6053. 

  6053.             key, it is treated as if it had been validated and
    6054. 

  6054.             proven secure. The resolver attempts DNSSEC validation
    6055. 

  6055.             on all DNS data in subdomains of a security root.
    6056. 

  6056.           </p>
    6057. 

  6057. <p>
    6058. 

  6058.             All keys (and corresponding zones) listed in
    6059. 

  6059.             <span><strong class="command">trusted-keys</strong></span> are deemed to exist regardless
    6060. 

  6060.             of what parent zones say.  Similarly for all keys listed in
    6061. 

  6061.             <span><strong class="command">trusted-keys</strong></span> only those keys are
    6062. 

  6062.             used to validate the DNSKEY RRset.  The parent's DS RRset
    6063. 

  6063.             will not be used.
    6064. 

  6064.           </p>
    6065. 

  6065. <p>
    6066. 

  6066.             The <span><strong class="command">trusted-keys</strong></span> statement can contain
    6067. 

  6067.             multiple key entries, each consisting of the key's
    6068. 

  6068.             domain name, flags, protocol, algorithm, and the Base-64
    6069. 

  6069.             representation of the key data.
    6070. 

  6070.             Spaces, tabs, newlines and carriage returns are ignored
    6071. 

  6071.             in the key data, so the configuration may be split up into
    6072. 

  6072.             multiple lines.
    6073. 

  6073.           </p>
    6074. 

  6074. <p>
    6075. 

  6075.             <span><strong class="command">trusted-keys</strong></span> may be set at the top level
    6076. 

  6076.             of <code class="filename">named.conf</code> or within a view.  If it is
    6077. 

  6077.             set in both places, they are additive: keys defined at the top
    6078. 

  6078.             level are inherited by all views, but keys defined in a view
    6079. 

  6079.             are only used within that view.
    6080. 

  6080.           </p>
    6081. 

  6081. </div>
    6082. 

  6082. <div class="sect2" lang="en">
    6083. 

  6083. <div class="titlepage"><div><div><h3 class="title">
    6084. 

  6084. <a name="id2589736"></a><span><strong class="command">managed-keys</strong></span> Statement Grammar</h3></div></div></div>
    6085. 

  6085. <pre class="programlisting"><span><strong class="command">managed-keys</strong></span> {
    6086. 

  6086.     <em class="replaceable"><code>string</code></em> initial-key <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
    6087. 

  6087.     [<span class="optional"> <em class="replaceable"><code>string</code></em> initial-key <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
    6088. 

  6088. };
    6089. 

  6089. </pre>
    6090. 

  6090. </div>
    6091. 

  6091. <div class="sect2" lang="en">
    6092. 

  6092. <div class="titlepage"><div><div><h3 class="title">
    6093. 

  6093. <a name="managed-keys"></a><span><strong class="command">managed-keys</strong></span> Statement Definition
    6094. 

  6094.             and Usage</h3></div></div></div>
    6095. 

  6095. <p>
    6096. 

  6096.             The <span><strong class="command">managed-keys</strong></span> statement, like 
    6097. 

  6097.             <span><strong class="command">trusted-keys</strong></span>, defines DNSSEC
    6098. 

  6098.             security roots.  The difference is that
    6099. 

  6099.             <span><strong class="command">managed-keys</strong></span> can be kept up to date
    6100. 

  6100.             automatically, without intervention from the resolver
    6101. 

  6101.             operator.
    6102. 

  6102.           </p>
    6103. 

  6103. <p>
    6104. 

  6104.             Suppose, for example, that a zone's key-signing
    6105. 

  6105.             key was compromised, and the zone owner had to revoke and
    6106. 

  6106.             replace the key.  A resolver which had the old key in a
    6107. 

  6107.             <span><strong class="command">trusted-keys</strong></span> statement would be
    6108. 

  6108.             unable to validate this zone any longer; it would
    6109. 

  6109.             reply with a SERVFAIL response code.  This would
    6110. 

  6110.             continue until the resolver operator had updated the
    6111. 

  6111.             <span><strong class="command">trusted-keys</strong></span> statement with the new key.
    6112. 

  6112.           </p>
    6113. 

  6113. <p>
    6114. 

  6114.             If, however, the zone were listed in a
    6115. 

  6115.             <span><strong class="command">managed-keys</strong></span> statement instead, then the
    6116. 

  6116.             zone owner could add a "stand-by" key to the zone in advance.
    6117. 

  6117.             <span><strong class="command">named</strong></span> would store the stand-by key, and
    6118. 

  6118.             when the original key was revoked, <span><strong class="command">named</strong></span>
    6119. 

  6119.             would be able to transition smoothly to the new key.  It would
    6120. 

  6120.             also recognize that the old key had been revoked, and cease
    6121. 

  6121.             using that key to validate answers, minimizing the damage that
    6122. 

  6122.             the compromised key could do.
    6123. 

  6123.           </p>
    6124. 

  6124. <p>
    6125. 

  6125.             A <span><strong class="command">managed-keys</strong></span> statement contains a list of
    6126. 

  6126.             the keys to be managed, along with information about how the
    6127. 

  6127.             keys are to be initialized for the first time.  The only
    6128. 

  6128.             initialization method currently supported (as of
    6129. 

  6129.             <acronym class="acronym">BIND</acronym> 9.7.0) is <code class="literal">initial-key</code>.
    6130. 

  6130.             This means the <span><strong class="command">managed-keys</strong></span> statement must
    6131. 

  6131.             contain a copy of the initializing key.  (Future releases may
    6132. 

  6132.             allow keys to be initialized by other methods, eliminating this
    6133. 

  6133.             requirement.)
    6134. 

  6134.           </p>
    6135. 

  6135. <p>
    6136. 

  6136.             Consequently, a <span><strong class="command">managed-keys</strong></span> statement
    6137. 

  6137.             appears similar to a <span><strong class="command">trusted-keys</strong></span>, differing
    6138. 

  6138.             in the presence of the second field, containing the keyword
    6139. 

  6139.             <code class="literal">initial-key</code>.  The difference is, whereas the
    6140. 

  6140.             keys listed in a <span><strong class="command">trusted-keys</strong></span> continue to be
    6141. 

  6141.             trusted until they are removed from
    6142. 

  6142.             <code class="filename">named.conf</code>, an initializing key listed 
    6143. 

  6143.             in a <span><strong class="command">managed-keys</strong></span> statement is only trusted
    6144. 

  6144.             <span class="emphasis"><em>once</em></span>: for as long as it takes to load the
    6145. 

  6145.             managed key database and start the RFC 5011 key maintenance
    6146. 

  6146.             process.
    6147. 

  6147.           </p>
    6148. 

  6148. <p>
    6149. 

  6149.             The first time <span><strong class="command">named</strong></span> runs with a managed key
    6150. 

  6150.             configured in <code class="filename">named.conf</code>, it fetches the
    6151. 

  6151.             DNSKEY RRset directly from the zone apex, and validates it
    6152. 

  6152.             using the key specified in the <span><strong class="command">managed-keys</strong></span>
    6153. 

  6153.             statement.  If the DNSKEY RRset is validly signed, then it is
    6154. 

  6154.             used as the basis for a new managed keys database.
    6155. 

  6155.           </p>
    6156. 

  6156. <p>
    6157. 

  6157.             From that point on, whenever <span><strong class="command">named</strong></span> runs, it
    6158. 

  6158.             sees the <span><strong class="command">managed-keys</strong></span> statement, checks to
    6159. 

  6159.             make sure RFC 5011 key maintenance has already been initialized
    6160. 

  6160.             for the specified domain, and if so, it simply moves on.  The
    6161. 

  6161.             key specified in the <span><strong class="command">managed-keys</strong></span> is not
    6162. 

  6162.             used to validate answers; it has been superseded by the key or
    6163. 

  6163.             keys stored in the managed keys database.
    6164. 

  6164.           </p>
    6165. 

  6165. <p>
    6166. 

  6166.             The next time <span><strong class="command">named</strong></span> runs after a name
    6167. 

  6167.             has been <span class="emphasis"><em>removed</em></span> from the
    6168. 

  6168.             <span><strong class="command">managed-keys</strong></span> statement, the corresponding
    6169. 

  6169.             zone will be removed from the managed keys database,
    6170. 

  6170.             and RFC 5011 key maintenance will no longer be used for that
    6171. 

  6171.             domain.
    6172. 

  6172.           </p>
    6173. 

  6173. <p>
    6174. 

  6174.             <span><strong class="command">named</strong></span> only maintains a single managed keys
    6175. 

  6175.             database; consequently, unlike <span><strong class="command">trusted-keys</strong></span>,
    6176. 

  6176.             <span><strong class="command">managed-keys</strong></span> may only be set at the top
    6177. 

  6177.             level of <code class="filename">named.conf</code>, not within a view.
    6178. 

  6178.           </p>
    6179. 

  6179. <p>
    6180. 

  6180.             In the current implementation, the managed keys database is
    6181. 

  6181.             stored as a master-format zone file called
    6182. 

  6182.             <code class="filename">managed-keys.bind</code>.  When the key database
    6183. 

  6183.             is changed, the zone is updated.  As with any other dynamic
    6184. 

  6184.             zone, changes will be written into a journal file,
    6185. 

  6185.             <code class="filename">managed-keys.bind.jnl</code>.  They are committed
    6186. 

  6186.             to the master file as soon as possible afterward; in the case
    6187. 

  6187.             of the managed key database, this will usually occur within 30
    6188. 

  6188.             seconds.  So, whenever <span><strong class="command">named</strong></span> is using
    6189. 

  6189.             automatic key maintenance, those two files can be expected to
    6190. 

  6190.             exist in the working directory.  (For this reason among others,
    6191. 

  6191.             the working directory should be always be writable by
    6192. 

  6192.             <span><strong class="command">named</strong></span>.)
    6193. 

  6193.           </p>
    6194. 

  6194. <p>
    6195. 

  6195.             If the <span><strong class="command">dnssec-lookaside</strong></span> option is
    6196. 

  6196.             set to <strong class="userinput"><code>auto</code></strong>, <span><strong class="command">named</strong></span>
    6197. 

  6197.             will automatically initialize a managed key for the
    6198. 

  6198.             zone <code class="literal">dlv.isc.org</code>.  The key that is
    6199. 

  6199.             used to initialize the key maintenance process is built
    6200. 

  6200.             into <span><strong class="command">named</strong></span>, and can be overridden
    6201. 

  6201.             from <span><strong class="command">bindkeys-file</strong></span>.
    6202. 

  6202.           </p>
    6203. 

  6203. </div>
    6204. 

  6204. <div class="sect2" lang="en">
    6205. 

  6205. <div class="titlepage"><div><div><h3 class="title">
    6206. 

  6206. <a name="view_statement_grammar"></a><span><strong class="command">view</strong></span> Statement Grammar</h3></div></div></div>
    6207. 

  6207. <pre class="programlisting"><span><strong class="command">view</strong></span> <em class="replaceable"><code>view_name</code></em>
    6208. 

  6208.       [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
    6209. 

  6209.       match-clients { <em class="replaceable"><code>address_match_list</code></em> };
    6210. 

  6210.       match-destinations { <em class="replaceable"><code>address_match_list</code></em> };
    6211. 

  6211.       match-recursive-only <em class="replaceable"><code>yes_or_no</code></em> ;
    6212. 

  6212.       [<span class="optional"> <em class="replaceable"><code>view_option</code></em>; ...</span>]
    6213. 

  6213.       [<span class="optional"> <em class="replaceable"><code>zone_statement</code></em>; ...</span>]
    6214. 

  6214. };
    6215. 

  6215. </pre>
    6216. 

  6216. </div>
    6217. 

  6217. <div class="sect2" lang="en">
    6218. 

  6218. <div class="titlepage"><div><div><h3 class="title">
    6219. 

  6219. <a name="id2590162"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div>
    6220. 

  6220. <p>
    6221. 

  6221.             The <span><strong class="command">view</strong></span> statement is a powerful
    6222. 

  6222.             feature
    6223. 

  6223.             of <acronym class="acronym">BIND</acronym> 9 that lets a name server
    6224. 

  6224.             answer a DNS query differently
    6225. 

  6225.             depending on who is asking. It is particularly useful for
    6226. 

  6226.             implementing
    6227. 

  6227.             split DNS setups without having to run multiple servers.
    6228. 

  6228.           </p>
    6229. 

  6229. <p>
    6230. 

  6230.             Each <span><strong class="command">view</strong></span> statement defines a view
    6231. 

  6231.             of the
    6232. 

  6232.             DNS namespace that will be seen by a subset of clients.  A client
    6233. 

  6233.             matches
    6234. 

  6234.             a view if its source IP address matches the
    6235. 

  6235.             <code class="varname">address_match_list</code> of the view's
    6236. 

  6236.             <span><strong class="command">match-clients</strong></span> clause and its
    6237. 

  6237.             destination IP address matches
    6238. 

  6238.             the <code class="varname">address_match_list</code> of the
    6239. 

  6239.             view's
    6240. 

  6240.             <span><strong class="command">match-destinations</strong></span> clause.  If not
    6241. 

  6241.             specified, both
    6242. 

  6242.             <span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
    6243. 

  6243.             default to matching all addresses.  In addition to checking IP
    6244. 

  6244.             addresses
    6245. 

  6245.             <span><strong class="command">match-clients</strong></span> and <span><strong class="command">match-destinations</strong></span>
    6246. 

  6246.             can also take <span><strong class="command">keys</strong></span> which provide an
    6247. 

  6247.             mechanism for the
    6248. 

  6248.             client to select the view.  A view can also be specified
    6249. 

  6249.             as <span><strong class="command">match-recursive-only</strong></span>, which
    6250. 

  6250.             means that only recursive
    6251. 

  6251.             requests from matching clients will match that view.
    6252. 

  6252.             The order of the <span><strong class="command">view</strong></span> statements is
    6253. 

  6253.             significant &#8212;
    6254. 

  6254.             a client request will be resolved in the context of the first
    6255. 

  6255.             <span><strong class="command">view</strong></span> that it matches.
    6256. 

  6256.           </p>
    6257. 

  6257. <p>
    6258. 

  6258.             Zones defined within a <span><strong class="command">view</strong></span>
    6259. 

  6259.             statement will
    6260. 

  6260.             only be accessible to clients that match the <span><strong class="command">view</strong></span>.
    6261. 

  6261.             By defining a zone of the same name in multiple views, different
    6262. 

  6262.             zone data can be given to different clients, for example,
    6263. 

  6263.             "internal"
    6264. 

  6264.             and "external" clients in a split DNS setup.
    6265. 

  6265.           </p>
    6266. 

  6266. <p>
    6267. 

  6267.             Many of the options given in the <span><strong class="command">options</strong></span> statement
    6268. 

  6268.             can also be used within a <span><strong class="command">view</strong></span>
    6269. 

  6269.             statement, and then
    6270. 

  6270.             apply only when resolving queries with that view.  When no
    6271. 

  6271.             view-specific
    6272. 

  6272.             value is given, the value in the <span><strong class="command">options</strong></span> statement
    6273. 

  6273.             is used as a default.  Also, zone options can have default values
    6274. 

  6274.             specified
    6275. 

  6275.             in the <span><strong class="command">view</strong></span> statement; these
    6276. 

  6276.             view-specific defaults
    6277. 

  6277.             take precedence over those in the <span><strong class="command">options</strong></span> statement.
    6278. 

  6278.           </p>
    6279. 

  6279. <p>
    6280. 

  6280.             Views are class specific.  If no class is given, class IN
    6281. 

  6281.             is assumed.  Note that all non-IN views must contain a hint zone,
    6282. 

  6282.             since only the IN class has compiled-in default hints.
    6283. 

  6283.           </p>
    6284. 

  6284. <p>
    6285. 

  6285.             If there are no <span><strong class="command">view</strong></span> statements in
    6286. 

  6286.             the config
    6287. 

  6287.             file, a default view that matches any client is automatically
    6288. 

  6288.             created
    6289. 

  6289.             in class IN. Any <span><strong class="command">zone</strong></span> statements
    6290. 

  6290.             specified on
    6291. 

  6291.             the top level of the configuration file are considered to be part
    6292. 

  6292.             of
    6293. 

  6293.             this default view, and the <span><strong class="command">options</strong></span>
    6294. 

  6294.             statement will
    6295. 

  6295.             apply to the default view. If any explicit <span><strong class="command">view</strong></span>
    6296. 

  6296.             statements are present, all <span><strong class="command">zone</strong></span>
    6297. 

  6297.             statements must
    6298. 

  6298.             occur inside <span><strong class="command">view</strong></span> statements.
    6299. 

  6299.           </p>
    6300. 

  6300. <p>
    6301. 

  6301.             Here is an example of a typical split DNS setup implemented
    6302. 

  6302.             using <span><strong class="command">view</strong></span> statements:
    6303. 

  6303.           </p>
    6304. 

  6304. <pre class="programlisting">view "internal" {
    6305. 

  6305.       // This should match our internal networks.
    6306. 

  6306.       match-clients { 10.0.0.0/8; };
    6307. 

    6308. 

  6308.       // Provide recursive service to internal
    6309. 

  6309.       // clients only.
    6310. 

  6310.       recursion yes;
    6311. 

    6312. 

  6312.       // Provide a complete view of the example.com
    6313. 

  6313.       // zone including addresses of internal hosts.
    6314. 

  6314.       zone "example.com" {
    6315. 

  6315.             type master;
    6316. 

  6316.             file "example-internal.db";
    6317. 

  6317.       };
    6318. 

  6318. };
    6319. 

    6320. 

  6320. view "external" {
    6321. 

  6321.       // Match all clients not matched by the
    6322. 

  6322.       // previous view.
    6323. 

  6323.       match-clients { any; };
    6324. 

    6325. 

  6325.       // Refuse recursive service to external clients.
    6326. 

  6326.       recursion no;
    6327. 

    6328. 

  6328.       // Provide a restricted view of the example.com
    6329. 

  6329.       // zone containing only publicly accessible hosts.
    6330. 

  6330.       zone "example.com" {
    6331. 

  6331.            type master;
    6332. 

  6332.            file "example-external.db";
    6333. 

  6333.       };
    6334. 

  6334. };
    6335. 

  6335. </pre>
    6336. 

  6336. </div>
    6337. 

  6337. <div class="sect2" lang="en">
    6338. 

  6338. <div class="titlepage"><div><div><h3 class="title">
    6339. 

  6339. <a name="zone_statement_grammar"></a><span><strong class="command">zone</strong></span>
    6340. 

  6340.             Statement Grammar</h3></div></div></div>
    6341. 

  6341. <pre class="programlisting"><span><strong class="command">zone</strong></span> <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
    6342. 

  6342.     type master;
    6343. 

  6343.     [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    6344. 

  6344.     [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    6345. 

  6345.     [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    6346. 

  6346.     [<span class="optional"> allow-update { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    6347. 

  6347.     [<span class="optional"> update-policy <em class="replaceable"><code>local</code></em> | { <em class="replaceable"><code>update_policy_rule</code></em> [<span class="optional">...</span>] }; </span>]
    6348. 

  6348.     [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
    6349. 

  6349.                   [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
    6350. 

  6350.     [<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
    6351. 

  6351.     [<span class="optional"> check-mx (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
    6352. 

  6352.     [<span class="optional"> check-wildcard <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    6353. 

  6353.     [<span class="optional"> check-integrity <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6354. 

  6354.     [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em> ; </span>]
    6355. 

  6355.     [<span class="optional"> file <em class="replaceable"><code>string</code></em> ; </span>]
    6356. 

  6356.     [<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
    6357. 

  6357.     [<span class="optional"> journal <em class="replaceable"><code>string</code></em> ; </span>]
    6358. 

  6358.     [<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
    6359. 

  6359.     [<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
    6360. 

  6360.     [<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
    6361. 

  6361.     [<span class="optional"> ixfr-base <em class="replaceable"><code>string</code></em> ; </span>]
    6362. 

  6362.     [<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    6363. 

  6363.     [<span class="optional"> ixfr-tmp-file <em class="replaceable"><code>string</code></em> ; </span>]
    6364. 

  6364.     [<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6365. 

  6365.     [<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
    6366. 

  6366.     [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
    6367. 

  6367.     [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
    6368. 

  6368.     [<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
    6369. 

  6369.     [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>]
    6370. 

  6370.     [<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    6371. 

  6371.     [<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
    6372. 

  6372.     [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    6373. 

  6373.     [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    6374. 

  6374.     [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6375. 

  6375.     [<span class="optional"> sig-validity-interval <em class="replaceable"><code>number</code></em> [<span class="optional"><em class="replaceable"><code>number</code></em></span>] ; </span>]
    6376. 

  6376.     [<span class="optional"> sig-signing-nodes <em class="replaceable"><code>number</code></em> ; </span>]
    6377. 

  6377.     [<span class="optional"> sig-signing-signatures <em class="replaceable"><code>number</code></em> ; </span>]
    6378. 

  6378.     [<span class="optional"> sig-signing-type <em class="replaceable"><code>number</code></em> ; </span>]
    6379. 

  6379.     [<span class="optional"> database <em class="replaceable"><code>string</code></em> ; </span>]
    6380. 

  6380.     [<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
    6381. 

  6381.     [<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
    6382. 

  6382.     [<span class="optional"> min-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
    6383. 

  6383.     [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
    6384. 

  6384.     [<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
    6385. 

  6385.     [<span class="optional"> auto-dnssec <code class="constant">allow</code>|<code class="constant">maintain</code>|<code class="constant">off</code>; </span>]
    6386. 

  6386.     [<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6387. 

  6387. };
    6388. 

    6389. 

  6389. zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
    6390. 

  6390.     type slave;
    6391. 

  6391.     [<span class="optional"> allow-notify { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    6392. 

  6392.     [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    6393. 

  6393.     [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    6394. 

  6394.     [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    6395. 

  6395.     [<span class="optional"> allow-update-forwarding { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    6396. 

  6396.     [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    6397. 

  6397.     [<span class="optional"> dnssec-update-mode ( <em class="replaceable"><code>maintain</code></em> | <em class="replaceable"><code>no-resign</code></em> ); </span>]
    6398. 

  6398.     [<span class="optional"> dnssec-dnskey-kskonly <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    6399. 

  6399.     [<span class="optional"> dnssec-secure-to-insecure <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6400. 

  6400.     [<span class="optional"> try-tcp-refresh <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    6401. 

  6401.     [<span class="optional"> also-notify { <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ;
    6402. 

  6402.                   [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
    6403. 

  6403.     [<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
    6404. 

  6404.     [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em> ; </span>]
    6405. 

  6405.     [<span class="optional"> file <em class="replaceable"><code>string</code></em> ; </span>]
    6406. 

  6406.     [<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
    6407. 

  6407.     [<span class="optional"> journal <em class="replaceable"><code>string</code></em> ; </span>]
    6408. 

  6408.     [<span class="optional"> max-journal-size <em class="replaceable"><code>size_spec</code></em>; </span>]
    6409. 

  6409.     [<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
    6410. 

  6410.     [<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
    6411. 

  6411.     [<span class="optional"> ixfr-base <em class="replaceable"><code>string</code></em> ; </span>]
    6412. 

  6412.     [<span class="optional"> ixfr-from-differences <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    6413. 

  6413.     [<span class="optional"> ixfr-tmp-file <em class="replaceable"><code>string</code></em> ; </span>]
    6414. 

  6414.     [<span class="optional"> maintain-ixfr-base <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6415. 

  6415.     [<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
    6416. 

  6416.                               [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>]
    6417. 

  6417.                               [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
    6418. 

  6418.     [<span class="optional"> max-ixfr-log-size <em class="replaceable"><code>number</code></em> ; </span>]
    6419. 

  6419.     [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
    6420. 

  6420.     [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em> ; </span>]
    6421. 

  6421.     [<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
    6422. 

  6422.     [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em> ; </span>]
    6423. 

  6423.     [<span class="optional"> notify <em class="replaceable"><code>yes_or_no</code></em> | <em class="replaceable"><code>explicit</code></em> | <em class="replaceable"><code>master-only</code></em> ; </span>]
    6424. 

  6424.     [<span class="optional"> notify-delay <em class="replaceable"><code>seconds</code></em> ; </span>]
    6425. 

  6425.     [<span class="optional"> notify-to-soa <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    6426. 

  6426.     [<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
    6427. 

  6427.     [<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    6428. 

  6428.     [<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    6429. 

  6429.     [<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    6430. 

  6430.     [<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
    6431. 

  6431.                              [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    6432. 

  6432.     [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    6433. 

  6433.     [<span class="optional"> notify-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    6434. 

  6434.     [<span class="optional"> notify-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    6435. 

  6435.     [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6436. 

  6436.     [<span class="optional"> database <em class="replaceable"><code>string</code></em> ; </span>]
    6437. 

  6437.     [<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
    6438. 

  6438.     [<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
    6439. 

  6439.     [<span class="optional"> min-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
    6440. 

  6440.     [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
    6441. 

  6441.     [<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6442. 

  6442.     [<span class="optional"> zero-no-soa-ttl <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6443. 

  6443. };
    6444. 

    6445. 

  6445. zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
    6446. 

  6446.     type hint;
    6447. 

  6447.     file <em class="replaceable"><code>string</code></em> ;
    6448. 

  6448.     [<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6449. 

  6449.     [<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>] // Not Implemented.
    6450. 

  6450. };
    6451. 

    6452. 

  6452. zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
    6453. 

  6453.     type stub;
    6454. 

  6454.     [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    6455. 

  6455.     [<span class="optional"> allow-query-on { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    6456. 

  6456.     [<span class="optional"> check-names (<code class="constant">warn</code>|<code class="constant">fail</code>|<code class="constant">ignore</code>) ; </span>]
    6457. 

  6457.     [<span class="optional"> dialup <em class="replaceable"><code>dialup_option</code></em> ; </span>]
    6458. 

  6458.     [<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6459. 

  6459.     [<span class="optional"> file <em class="replaceable"><code>string</code></em> ; </span>]
    6460. 

  6460.     [<span class="optional"> masterfile-format (<code class="constant">text</code>|<code class="constant">raw</code>) ; </span>]
    6461. 

  6461.     [<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
    6462. 

  6462.     [<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
    6463. 

  6463.     [<span class="optional"> masters [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em>
    6464. 

  6464.                               [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>]
    6465. 

  6465.                               [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] }; </span>]
    6466. 

  6466.     [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em> ; </span>]
    6467. 

  6467.     [<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em> ; </span>]
    6468. 

  6468.     [<span class="optional"> pubkey <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; </span>]
    6469. 

  6469.     [<span class="optional"> transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    6470. 

  6470.     [<span class="optional"> transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
    6471. 

  6471.                          [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    6472. 

  6472.     [<span class="optional"> alt-transfer-source (<em class="replaceable"><code>ip4_addr</code></em> | <code class="constant">*</code>) [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    6473. 

  6473.     [<span class="optional"> alt-transfer-source-v6 (<em class="replaceable"><code>ip6_addr</code></em> | <code class="constant">*</code>)
    6474. 

  6474.                             [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; </span>]
    6475. 

  6475.     [<span class="optional"> use-alt-transfer-source <em class="replaceable"><code>yes_or_no</code></em>; </span>]
    6476. 

  6476.     [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6477. 

  6477.     [<span class="optional"> database <em class="replaceable"><code>string</code></em> ; </span>]
    6478. 

  6478.     [<span class="optional"> min-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
    6479. 

  6479.     [<span class="optional"> max-refresh-time <em class="replaceable"><code>number</code></em> ; </span>]
    6480. 

  6480.     [<span class="optional"> min-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
    6481. 

  6481.     [<span class="optional"> max-retry-time <em class="replaceable"><code>number</code></em> ; </span>]
    6482. 

  6482.     [<span class="optional"> multi-master <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6483. 

  6483. };
    6484. 

    6485. 

  6485. zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
    6486. 

  6486.     type static-stub;
    6487. 

  6487.     [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
    6488. 

  6488.     [<span class="optional"> server-addresses { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> ; ... </span>] }; </span>]
    6489. 

  6489.     [<span class="optional"> server-names { [<span class="optional"> <em class="replaceable"><code>namelist</code></em> </span>] }; </span>]  
    6490. 

  6490.     [<span class="optional"> zone-statistics <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6491. 

  6491. };
    6492. 

    6493. 

  6493. zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
    6494. 

  6494.     type forward;
    6495. 

  6495.     [<span class="optional"> forward (<code class="constant">only</code>|<code class="constant">first</code>) ; </span>]
    6496. 

  6496.     [<span class="optional"> forwarders { [<span class="optional"> <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] ; ... </span>] }; </span>]
    6497. 

  6497.     [<span class="optional"> delegation-only <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
    6498. 

  6498. };
    6499. 

    6500. 

  6500. zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
    6501. 

  6501.     type delegation-only;
    6502. 

  6502. };
    6503. 

    6504. 

  6504. </pre>
    6505. 

  6505. </div>
    6506. 

  6506. <div class="sect2" lang="en">
    6507. 

  6507. <div class="titlepage"><div><div><h3 class="title">
    6508. 

  6508. <a name="id2591713"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div>
    6509. 

  6509. <div class="sect3" lang="en">
    6510. 

  6510. <div class="titlepage"><div><div><h4 class="title">
    6511. 

  6511. <a name="id2591720"></a>Zone Types</h4></div></div></div>
    6512. 

  6512. <div class="informaltable"><table border="1">
    6513. 

  6513. <colgroup>
    6514. 

  6514. <col>
    6515. 

  6515. <col>
    6516. 

  6516. </colgroup>
    6517. 

  6517. <tbody>
    6518. 

  6518. <tr>
    6519. 

  6519. <td>
    6520. 

  6520.                       <p>
    6521. 

  6521.                         <code class="varname">master</code>
    6522. 

  6522.                       </p>
    6523. 

  6523.                     </td>
    6524. 

  6524. <td>
    6525. 

  6525.                       <p>
    6526. 

  6526.                         The server has a master copy of the data
    6527. 

  6527.                         for the zone and will be able to provide authoritative
    6528. 

  6528.                         answers for
    6529. 

  6529.                         it.
    6530. 

  6530.                       </p>
    6531. 

  6531.                     </td>
    6532. 

  6532. </tr>
    6533. 

  6533. <tr>
    6534. 

  6534. <td>
    6535. 

  6535.                       <p>
    6536. 

  6536.                         <code class="varname">slave</code>
    6537. 

  6537.                       </p>
    6538. 

  6538.                     </td>
    6539. 

  6539. <td>
    6540. 

  6540.                       <p>
    6541. 

  6541.                         A slave zone is a replica of a master
    6542. 

  6542.                         zone. The <span><strong class="command">masters</strong></span> list
    6543. 

  6543.                         specifies one or more IP addresses
    6544. 

  6544.                         of master servers that the slave contacts to update
    6545. 

  6545.                         its copy of the zone.
    6546. 

  6546.                         Masters list elements can also be names of other
    6547. 

  6547.                         masters lists.
    6548. 

  6548.                         By default, transfers are made from port 53 on the
    6549. 

  6549.                         servers; this can
    6550. 

  6550.                         be changed for all servers by specifying a port number
    6551. 

  6551.                         before the
    6552. 

  6552.                         list of IP addresses, or on a per-server basis after
    6553. 

  6553.                         the IP address.
    6554. 

  6554.                         Authentication to the master can also be done with
    6555. 

  6555.                         per-server TSIG keys.
    6556. 

  6556.                         If a file is specified, then the
    6557. 

  6557.                         replica will be written to this file whenever the zone
    6558. 

  6558.                         is changed,
    6559. 

  6559.                         and reloaded from this file on a server restart. Use
    6560. 

  6560.                         of a file is
    6561. 

  6561.                         recommended, since it often speeds server startup and
    6562. 

  6562.                         eliminates
    6563. 

  6563.                         a needless waste of bandwidth. Note that for large
    6564. 

  6564.                         numbers (in the
    6565. 

  6565.                         tens or hundreds of thousands) of zones per server, it
    6566. 

  6566.                         is best to
    6567. 

  6567.                         use a two-level naming scheme for zone filenames. For
    6568. 

  6568.                         example,
    6569. 

  6569.                         a slave server for the zone <code class="literal">example.com</code> might place
    6570. 

  6570.                         the zone contents into a file called
    6571. 

  6571.                         <code class="filename">ex/example.com</code> where <code class="filename">ex/</code> is
    6572. 

  6572.                         just the first two letters of the zone name. (Most
    6573. 

  6573.                         operating systems
    6574. 

  6574.                         behave very slowly if you put 100000 files into
    6575. 

  6575.                         a single directory.)
    6576. 

  6576.                       </p>
    6577. 

  6577.                     </td>
    6578. 

  6578. </tr>
    6579. 

  6579. <tr>
    6580. 

  6580. <td>
    6581. 

  6581.                       <p>
    6582. 

  6582.                         <code class="varname">stub</code>
    6583. 

  6583.                       </p>
    6584. 

  6584.                     </td>
    6585. 

  6585. <td>
    6586. 

  6586.                       <p>
    6587. 

  6587.                         A stub zone is similar to a slave zone,
    6588. 

  6588.                         except that it replicates only the NS records of a
    6589. 

  6589.                         master zone instead
    6590. 

  6590.                         of the entire zone. Stub zones are not a standard part
    6591. 

  6591.                         of the DNS;
    6592. 

  6592.                         they are a feature specific to the <acronym class="acronym">BIND</acronym> implementation.
    6593. 

  6593.                       </p>
    6594. 

    6595. 

  6595.                       <p>
    6596. 

  6596.                         Stub zones can be used to eliminate the need for glue
    6597. 

  6597.                         NS record
    6598. 

  6598.                         in a parent zone at the expense of maintaining a stub
    6599. 

  6599.                         zone entry and
    6600. 

  6600.                         a set of name server addresses in <code class="filename">named.conf</code>.
    6601. 

  6601.                         This usage is not recommended for new configurations,
    6602. 

  6602.                         and BIND 9
    6603. 

  6603.                         supports it only in a limited way.
    6604. 

  6604.                         In <acronym class="acronym">BIND</acronym> 4/8, zone
    6605. 

  6605.                         transfers of a parent zone
    6606. 

  6606.                         included the NS records from stub children of that
    6607. 

  6607.                         zone. This meant
    6608. 

  6608.                         that, in some cases, users could get away with
    6609. 

  6609.                         configuring child stubs
    6610. 

  6610.                         only in the master server for the parent zone. <acronym class="acronym">BIND</acronym>
    6611. 

  6611.                         9 never mixes together zone data from different zones
    6612. 

  6612.                         in this
    6613. 

  6613.                         way. Therefore, if a <acronym class="acronym">BIND</acronym> 9 master serving a parent
    6614. 

  6614.                         zone has child stub zones configured, all the slave
    6615. 

  6615.                         servers for the
    6616. 

  6616.                         parent zone also need to have the same child stub
    6617. 

  6617.                         zones
    6618. 

  6618.                         configured.
    6619. 

  6619.                       </p>
    6620. 

    6621. 

  6621.                       <p>
    6622. 

  6622.                         Stub zones can also be used as a way of forcing the
    6623. 

  6623.                         resolution
    6624. 

  6624.                         of a given domain to use a particular set of
    6625. 

  6625.                         authoritative servers.
    6626. 

  6626.                         For example, the caching name servers on a private
    6627. 

  6627.                         network using
    6628. 

  6628.                         RFC1918 addressing may be configured with stub zones
    6629. 

  6629.                         for
    6630. 

  6630.                         <code class="literal">10.in-addr.arpa</code>
    6631. 

  6631.                         to use a set of internal name servers as the
    6632. 

  6632.                         authoritative
    6633. 

  6633.                         servers for that domain.
    6634. 

  6634.                       </p>
    6635. 

  6635.                     </td>
    6636. 

  6636. </tr>
    6637. 

  6637. <tr>
    6638. 

  6638. <td>
    6639. 

  6639.                       <p>
    6640. 

  6640.                         <code class="varname">static-stub</code>
    6641. 

  6641.                       </p>
    6642. 

  6642.                     </td>
    6643. 

  6643. <td>
    6644. 

  6644.                       <p>
    6645. 

  6645.                         A static-stub zone is similar to a stub zone
    6646. 

  6646.                         with the following exceptions:
    6647. 

  6647.                         the zone data is statically configured, rather
    6648. 

  6648.                         than transferred from a master server;
    6649. 

  6649.                         when recursion is necessary for a query that
    6650. 

  6650.                         matches a static-stub zone, the locally
    6651. 

  6651.                         configured data (nameserver names and glue addresses)
    6652. 

  6652.                         is always used even if different authoritative
    6653. 

  6653.                         information is cached.
    6654. 

  6654.                       </p>
    6655. 

  6655.                       <p>
    6656. 

  6656.                         Zone data is configured via the
    6657. 

  6657.                         <span><strong class="command">server-addresses</strong></span> and
    6658. 

  6658.                         <span><strong class="command">server-names</strong></span> zone options.
    6659. 

  6659.                       </p>
    6660. 

  6660.                       <p>
    6661. 

  6661.                         The zone data is maintained in the form of NS
    6662. 

  6662.                         and (if necessary) glue A or AAAA RRs
    6663. 

  6663.                         internally, which can be seen by dumping zone
    6664. 

  6664.                         databases by <span><strong class="command">rndc dumpdb -all</strong></span>.
    6665. 

  6665.                         The configured RRs are considered local configuration
    6666. 

  6666.                         parameters rather than public data.
    6667. 

  6667.                         Non recursive queries (i.e., those with the RD
    6668. 

  6668.                         bit off) to a static-stub zone are therefore
    6669. 

  6669.                         prohibited and will be responded with REFUSED.
    6670. 

  6670.                       </p>
    6671. 

  6671.                       <p>
    6672. 

  6672.                         Since the data is statically configured, no
    6673. 

  6673.                         zone maintenance action takes place for a static-stub
    6674. 

  6674.                         zone.
    6675. 

  6675.                         For example, there is no periodic refresh
    6676. 

  6676.                         attempt, and an incoming notify message
    6677. 

  6677.                         will be rejected with an rcode of NOTAUTH.
    6678. 

  6678.                       </p>
    6679. 

  6679.                       <p>
    6680. 

  6680.                         Each static-stub zone is configured with
    6681. 

  6681.                         internally generated NS and (if necessary)
    6682. 

  6682.                         glue A or AAAA RRs 
    6683. 

  6683.                       </p>
    6684. 

  6684.                     </td>
    6685. 

  6685. </tr>
    6686. 

  6686. <tr>
    6687. 

  6687. <td>
    6688. 

  6688.                       <p>
    6689. 

  6689.                         <code class="varname">forward</code>
    6690. 

  6690.                       </p>
    6691. 

  6691.                     </td>
    6692. 

  6692. <td>
    6693. 

  6693.                       <p>
    6694. 

  6694.                         A "forward zone" is a way to configure
    6695. 

  6695.                         forwarding on a per-domain basis.  A <span><strong class="command">zone</strong></span> statement
    6696. 

  6696.                         of type <span><strong class="command">forward</strong></span> can
    6697. 

  6697.                         contain a <span><strong class="command">forward</strong></span>
    6698. 

  6698.                         and/or <span><strong class="command">forwarders</strong></span>
    6699. 

  6699.                         statement,
    6700. 

  6700.                         which will apply to queries within the domain given by
    6701. 

  6701.                         the zone
    6702. 

  6702.                         name. If no <span><strong class="command">forwarders</strong></span>
    6703. 

  6703.                         statement is present or
    6704. 

  6704.                         an empty list for <span><strong class="command">forwarders</strong></span> is given, then no
    6705. 

  6705.                         forwarding will be done for the domain, canceling the
    6706. 

  6706.                         effects of
    6707. 

  6707.                         any forwarders in the <span><strong class="command">options</strong></span> statement. Thus
    6708. 

  6708.                         if you want to use this type of zone to change the
    6709. 

  6709.                         behavior of the
    6710. 

  6710.                         global <span><strong class="command">forward</strong></span> option
    6711. 

  6711.                         (that is, "forward first"
    6712. 

  6712.                         to, then "forward only", or vice versa, but want to
    6713. 

  6713.                         use the same
    6714. 

  6714.                         servers as set globally) you need to re-specify the
    6715. 

  6715.                         global forwarders.
    6716. 

  6716.                       </p>
    6717. 

  6717.                     </td>
    6718. 

  6718. </tr>
    6719. 

  6719. <tr>
    6720. 

  6720. <td>
    6721. 

  6721.                       <p>
    6722. 

  6722.                         <code class="varname">hint</code>
    6723. 

  6723.                       </p>
    6724. 

  6724.                     </td>
    6725. 

  6725. <td>
    6726. 

  6726.                       <p>
    6727. 

  6727.                         The initial set of root name servers is
    6728. 

  6728.                         specified using a "hint zone". When the server starts
    6729. 

  6729.                         up, it uses
    6730. 

  6730.                         the root hints to find a root name server and get the
    6731. 

  6731.                         most recent
    6732. 

  6732.                         list of root name servers. If no hint zone is
    6733. 

  6733.                         specified for class
    6734. 

  6734.                         IN, the server uses a compiled-in default set of root
    6735. 

  6735.                         servers hints.
    6736. 

  6736.                         Classes other than IN have no built-in defaults hints.
    6737. 

  6737.                       </p>
    6738. 

  6738.                     </td>
    6739. 

  6739. </tr>
    6740. 

  6740. <tr>
    6741. 

  6741. <td>
    6742. 

  6742.                       <p>
    6743. 

  6743.                         <code class="varname">delegation-only</code>
    6744. 

  6744.                       </p>
    6745. 

  6745.                     </td>
    6746. 

  6746. <td>
    6747. 

  6747.                       <p>
    6748. 

  6748.                         This is used to enforce the delegation-only
    6749. 

  6749.                         status of infrastructure zones (e.g. COM,
    6750. 

  6750.                         NET, ORG).  Any answer that is received
    6751. 

  6751.                         without an explicit or implicit delegation
    6752. 

  6752.                         in the authority section will be treated
    6753. 

  6753.                         as NXDOMAIN.  This does not apply to the
    6754. 

  6754.                         zone apex.  This should not be applied to
    6755. 

  6755.                         leaf zones.
    6756. 

  6756.                       </p>
    6757. 

  6757.                       <p>
    6758. 

  6758.                         <code class="varname">delegation-only</code> has no
    6759. 

  6759.                         effect on answers received from forwarders.
    6760. 

  6760.                       </p>
    6761. 

  6761.                       <p>
    6762. 

  6762.                         See caveats in <a href="Bv9ARM.ch06.html#root_delegation_only"><span><strong class="command">root-delegation-only</strong></span></a>.
    6763. 

  6763.                       </p>
    6764. 

  6764.                     </td>
    6765. 

  6765. </tr>
    6766. 

  6766. </tbody>
    6767. 

  6767. </table></div>
    6768. 

  6768. </div>
    6769. 

  6769. <div class="sect3" lang="en">
    6770. 

  6770. <div class="titlepage"><div><div><h4 class="title">
    6771. 

  6771. <a name="id2592402"></a>Class</h4></div></div></div>
    6772. 

  6772. <p>
    6773. 

  6773.               The zone's name may optionally be followed by a class. If
    6774. 

  6774.               a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>),
    6775. 

  6775.               is assumed. This is correct for the vast majority of cases.
    6776. 

  6776.             </p>
    6777. 

  6777. <p>
    6778. 

  6778.               The <code class="literal">hesiod</code> class is
    6779. 

  6779.               named for an information service from MIT's Project Athena. It
    6780. 

  6780.               is
    6781. 

  6781.               used to share information about various systems databases, such
    6782. 

  6782.               as users, groups, printers and so on. The keyword
    6783. 

  6783.               <code class="literal">HS</code> is
    6784. 

  6784.               a synonym for hesiod.
    6785. 

  6785.             </p>
    6786. 

  6786. <p>
    6787. 

  6787.               Another MIT development is Chaosnet, a LAN protocol created
    6788. 

  6788.               in the mid-1970s. Zone data for it can be specified with the <code class="literal">CHAOS</code> class.
    6789. 

  6789.             </p>
    6790. 

  6790. </div>
    6791. 

  6791. <div class="sect3" lang="en">
    6792. 

  6792. <div class="titlepage"><div><div><h4 class="title">
    6793. 

  6793. <a name="id2592503"></a>Zone Options</h4></div></div></div>
    6794. 

  6794. <div class="variablelist"><dl>
    6795. 

  6795. <dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt>
    6796. 

  6796. <dd><p>
    6797. 

  6797.                     See the description of
    6798. 

  6798.                     <span><strong class="command">allow-notify</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called &#8220;Access Control&#8221;</a>.
    6799. 

  6799.                   </p></dd>
    6800. 

  6800. <dt><span class="term"><span><strong class="command">allow-query</strong></span></span></dt>
    6801. 

  6801. <dd><p>
    6802. 

  6802.                     See the description of
    6803. 

  6803.                     <span><strong class="command">allow-query</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called &#8220;Access Control&#8221;</a>.
    6804. 

  6804.                   </p></dd>
    6805. 

  6805. <dt><span class="term"><span><strong class="command">allow-query-on</strong></span></span></dt>
    6806. 

  6806. <dd><p>
    6807. 

  6807.                     See the description of
    6808. 

  6808.                     <span><strong class="command">allow-query-on</strong></span> in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called &#8220;Access Control&#8221;</a>.
    6809. 

  6809.                   </p></dd>
    6810. 

  6810. <dt><span class="term"><span><strong class="command">allow-transfer</strong></span></span></dt>
    6811. 

  6811. <dd><p>
    6812. 

  6812.                     See the description of <span><strong class="command">allow-transfer</strong></span>
    6813. 

  6813.                     in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called &#8220;Access Control&#8221;</a>.
    6814. 

  6814.                   </p></dd>
    6815. 

  6815. <dt><span class="term"><span><strong class="command">allow-update</strong></span></span></dt>
    6816. 

  6816. <dd><p>
    6817. 

  6817.                     See the description of <span><strong class="command">allow-update</strong></span>
    6818. 

  6818.                     in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called &#8220;Access Control&#8221;</a>.
    6819. 

  6819.                   </p></dd>
    6820. 

  6820. <dt><span class="term"><span><strong class="command">update-policy</strong></span></span></dt>
    6821. 

  6821. <dd><p>
    6822. 

  6822.                     Specifies a "Simple Secure Update" policy. See
    6823. 

  6823.                     <a href="Bv9ARM.ch06.html#dynamic_update_policies" title="Dynamic Update Policies">the section called &#8220;Dynamic Update Policies&#8221;</a>.
    6824. 

  6824.                   </p></dd>
    6825. 

  6825. <dt><span class="term"><span><strong class="command">allow-update-forwarding</strong></span></span></dt>
    6826. 

  6826. <dd><p>
    6827. 

  6827.                     See the description of <span><strong class="command">allow-update-forwarding</strong></span>
    6828. 

  6828.                     in <a href="Bv9ARM.ch06.html#access_control" title="Access Control">the section called &#8220;Access Control&#8221;</a>.
    6829. 

  6829.                   </p></dd>
    6830. 

  6830. <dt><span class="term"><span><strong class="command">also-notify</strong></span></span></dt>
    6831. 

  6831. <dd><p>
    6832. 

  6832.                     Only meaningful if <span><strong class="command">notify</strong></span>
    6833. 

  6833.                     is
    6834. 

  6834.                     active for this zone. The set of machines that will
    6835. 

  6835.                     receive a
    6836. 

  6836.                     <code class="literal">DNS NOTIFY</code> message
    6837. 

  6837.                     for this zone is made up of all the listed name servers
    6838. 

  6838.                     (other than
    6839. 

  6839.                     the primary master) for the zone plus any IP addresses
    6840. 

  6840.                     specified
    6841. 

  6841.                     with <span><strong class="command">also-notify</strong></span>. A port
    6842. 

  6842.                     may be specified
    6843. 

  6843.                     with each <span><strong class="command">also-notify</strong></span>
    6844. 

  6844.                     address to send the notify
    6845. 

  6845.                     messages to a port other than the default of 53.
    6846. 

  6846.                     <span><strong class="command">also-notify</strong></span> is not
    6847. 

  6847.                     meaningful for stub zones.
    6848. 

  6848.                     The default is the empty list.
    6849. 

  6849.                   </p></dd>
    6850. 

  6850. <dt><span class="term"><span><strong class="command">check-names</strong></span></span></dt>
    6851. 

  6851. <dd><p>
    6852. 

  6852.                     This option is used to restrict the character set and
    6853. 

  6853.                     syntax of
    6854. 

  6854.                     certain domain names in master files and/or DNS responses
    6855. 

  6855.                     received from the
    6856. 

  6856.                     network.  The default varies according to zone type.  For <span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>.  For <span><strong class="command">slave</strong></span>
    6857. 

  6857.                     zones the default is <span><strong class="command">warn</strong></span>.
    6858. 

  6858.                     It is not implemented for <span><strong class="command">hint</strong></span> zones.
    6859. 

  6859.                   </p></dd>
    6860. 

  6860. <dt><span class="term"><span><strong class="command">check-mx</strong></span></span></dt>
    6861. 

  6861. <dd><p>
    6862. 

  6862.                     See the description of
    6863. 

  6863.                     <span><strong class="command">check-mx</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a>.
    6864. 

  6864.                   </p></dd>
    6865. 

  6865. <dt><span class="term"><span><strong class="command">check-wildcard</strong></span></span></dt>
    6866. 

  6866. <dd><p>
    6867. 

  6867.                     See the description of
    6868. 

  6868.                     <span><strong class="command">check-wildcard</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a>.
    6869. 

  6869.                   </p></dd>
    6870. 

  6870. <dt><span class="term"><span><strong class="command">check-integrity</strong></span></span></dt>
    6871. 

  6871. <dd><p>
    6872. 

  6872.                     See the description of
    6873. 

  6873.                     <span><strong class="command">check-integrity</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a>.
    6874. 

  6874.                   </p></dd>
    6875. 

  6875. <dt><span class="term"><span><strong class="command">check-sibling</strong></span></span></dt>
    6876. 

  6876. <dd><p>
    6877. 

  6877.                     See the description of
    6878. 

  6878.                     <span><strong class="command">check-sibling</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a>.
    6879. 

  6879.                   </p></dd>
    6880. 

  6880. <dt><span class="term"><span><strong class="command">zero-no-soa-ttl</strong></span></span></dt>
    6881. 

  6881. <dd><p>
    6882. 

  6882.                     See the description of
    6883. 

  6883.                     <span><strong class="command">zero-no-soa-ttl</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a>.
    6884. 

  6884.                   </p></dd>
    6885. 

  6885. <dt><span class="term"><span><strong class="command">update-check-ksk</strong></span></span></dt>
    6886. 

  6886. <dd><p>
    6887. 

  6887.                     See the description of
    6888. 

  6888.                     <span><strong class="command">update-check-ksk</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a>.
    6889. 

  6889.                   </p></dd>
    6890. 

  6890. <dt><span class="term"><span><strong class="command">dnssec-dnskey-kskonly</strong></span></span></dt>
    6891. 

  6891. <dd><p>
    6892. 

  6892.                     See the description of
    6893. 

  6893.                     <span><strong class="command">dnssec-dnskey-kskonly</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a>.
    6894. 

  6894.                   </p></dd>
    6895. 

  6895. <dt><span class="term"><span><strong class="command">try-tcp-refresh</strong></span></span></dt>
    6896. 

  6896. <dd><p>
    6897. 

  6897.                     See the description of
    6898. 

  6898.                     <span><strong class="command">try-tcp-refresh</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a>.
    6899. 

  6899.                   </p></dd>
    6900. 

  6900. <dt><span class="term"><span><strong class="command">database</strong></span></span></dt>
    6901. 

  6901. <dd>
    6902. 

  6902. <p>
    6903. 

  6903.                     Specify the type of database to be used for storing the
    6904. 

  6904.                     zone data.  The string following the <span><strong class="command">database</strong></span> keyword
    6905. 

  6905.                     is interpreted as a list of whitespace-delimited words.
    6906. 

  6906.                     The first word
    6907. 

  6907.                     identifies the database type, and any subsequent words are
    6908. 

  6908.                     passed
    6909. 

  6909.                     as arguments to the database to be interpreted in a way
    6910. 

  6910.                     specific
    6911. 

  6911.                     to the database type.
    6912. 

  6912.                   </p>
    6913. 

  6913. <p>
    6914. 

  6914.                     The default is <strong class="userinput"><code>"rbt"</code></strong>, BIND 9's
    6915. 

  6915.                     native in-memory
    6916. 

  6916.                     red-black-tree database.  This database does not take
    6917. 

  6917.                     arguments.
    6918. 

  6918.                   </p>
    6919. 

  6919. <p>
    6920. 

  6920.                     Other values are possible if additional database drivers
    6921. 

  6921.                     have been linked into the server.  Some sample drivers are
    6922. 

  6922.                     included
    6923. 

  6923.                     with the distribution but none are linked in by default.
    6924. 

  6924.                   </p>
    6925. 

  6925. </dd>
    6926. 

  6926. <dt><span class="term"><span><strong class="command">dialup</strong></span></span></dt>
    6927. 

  6927. <dd><p>
    6928. 

  6928.                     See the description of
    6929. 

  6929.                     <span><strong class="command">dialup</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a>.
    6930. 

  6930.                   </p></dd>
    6931. 

  6931. <dt><span class="term"><span><strong class="command">delegation-only</strong></span></span></dt>
    6932. 

  6932. <dd>
    6933. 

  6933. <p>
    6934. 

  6934.                     The flag only applies to hint and stub zones.  If set
    6935. 

  6935.                     to <strong class="userinput"><code>yes</code></strong>, then the zone will also be
    6936. 

  6936.                     treated as if it is also a delegation-only type zone.
    6937. 

  6937.                   </p>
    6938. 

  6938. <p>
    6939. 

  6939.                     See caveats in <a href="Bv9ARM.ch06.html#root_delegation_only"><span><strong class="command">root-delegation-only</strong></span></a>.
    6940. 

  6940.                   </p>
    6941. 

  6941. </dd>
    6942. 

  6942. <dt><span class="term"><span><strong class="command">forward</strong></span></span></dt>
    6943. 

  6943. <dd><p>
    6944. 

  6944.                     Only meaningful if the zone has a forwarders
    6945. 

  6945.                     list. The <span><strong class="command">only</strong></span> value causes
    6946. 

  6946.                     the lookup to fail
    6947. 

  6947.                     after trying the forwarders and getting no answer, while <span><strong class="command">first</strong></span> would
    6948. 

  6948.                     allow a normal lookup to be tried.
    6949. 

  6949.                   </p></dd>
    6950. 

  6950. <dt><span class="term"><span><strong class="command">forwarders</strong></span></span></dt>
    6951. 

  6951. <dd><p>
    6952. 

  6952.                     Used to override the list of global forwarders.
    6953. 

  6953.                     If it is not specified in a zone of type <span><strong class="command">forward</strong></span>,
    6954. 

  6954.                     no forwarding is done for the zone and the global options are
    6955. 

  6955.                     not used.
    6956. 

  6956.                   </p></dd>
    6957. 

  6957. <dt><span class="term"><span><strong class="command">ixfr-base</strong></span></span></dt>
    6958. 

  6958. <dd><p>
    6959. 

  6959.                     Was used in <acronym class="acronym">BIND</acronym> 8 to
    6960. 

  6960.                     specify the name
    6961. 

  6961.                     of the transaction log (journal) file for dynamic update
    6962. 

  6962.                     and IXFR.
    6963. 

  6963.                     <acronym class="acronym">BIND</acronym> 9 ignores the option
    6964. 

  6964.                     and constructs the name of the journal
    6965. 

  6965.                     file by appending "<code class="filename">.jnl</code>"
    6966. 

  6966.                     to the name of the
    6967. 

  6967.                     zone file.
    6968. 

  6968.                   </p></dd>
    6969. 

  6969. <dt><span class="term"><span><strong class="command">ixfr-tmp-file</strong></span></span></dt>
    6970. 

  6970. <dd><p>
    6971. 

  6971.                     Was an undocumented option in <acronym class="acronym">BIND</acronym> 8.
    6972. 

  6972.                     Ignored in <acronym class="acronym">BIND</acronym> 9.
    6973. 

  6973.                   </p></dd>
    6974. 

  6974. <dt><span class="term"><span><strong class="command">journal</strong></span></span></dt>
    6975. 

  6975. <dd><p>
    6976. 

  6976.                     Allow the default journal's filename to be overridden.
    6977. 

  6977.                     The default is the zone's filename with "<code class="filename">.jnl</code>" appended.
    6978. 

  6978.                     This is applicable to <span><strong class="command">master</strong></span> and <span><strong class="command">slave</strong></span> zones.
    6979. 

  6979.                   </p></dd>
    6980. 

  6980. <dt><span class="term"><span><strong class="command">max-journal-size</strong></span></span></dt>
    6981. 

  6981. <dd><p>
    6982. 

  6982.                     See the description of
    6983. 

  6983.                     <span><strong class="command">max-journal-size</strong></span> in <a href="Bv9ARM.ch06.html#server_resource_limits" title="Server  Resource Limits">the section called &#8220;Server  Resource Limits&#8221;</a>.
    6984. 

  6984.                   </p></dd>
    6985. 

  6985. <dt><span class="term"><span><strong class="command">max-transfer-time-in</strong></span></span></dt>
    6986. 

  6986. <dd><p>
    6987. 

  6987.                     See the description of
    6988. 

  6988.                     <span><strong class="command">max-transfer-time-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called &#8220;Zone Transfers&#8221;</a>.
    6989. 

  6989.                   </p></dd>
    6990. 

  6990. <dt><span class="term"><span><strong class="command">max-transfer-idle-in</strong></span></span></dt>
    6991. 

  6991. <dd><p>
    6992. 

  6992.                     See the description of
    6993. 

  6993.                     <span><strong class="command">max-transfer-idle-in</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called &#8220;Zone Transfers&#8221;</a>.
    6994. 

  6994.                   </p></dd>
    6995. 

  6995. <dt><span class="term"><span><strong class="command">max-transfer-time-out</strong></span></span></dt>
    6996. 

  6996. <dd><p>
    6997. 

  6997.                     See the description of
    6998. 

  6998.                     <span><strong class="command">max-transfer-time-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called &#8220;Zone Transfers&#8221;</a>.
    6999. 

  6999.                   </p></dd>
    7000. 

  7000. <dt><span class="term"><span><strong class="command">max-transfer-idle-out</strong></span></span></dt>
    7001. 

  7001. <dd><p>
    7002. 

  7002.                     See the description of
    7003. 

  7003.                     <span><strong class="command">max-transfer-idle-out</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called &#8220;Zone Transfers&#8221;</a>.
    7004. 

  7004.                   </p></dd>
    7005. 

  7005. <dt><span class="term"><span><strong class="command">notify</strong></span></span></dt>
    7006. 

  7006. <dd><p>
    7007. 

  7007.                     See the description of
    7008. 

  7008.                     <span><strong class="command">notify</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a>.
    7009. 

  7009.                   </p></dd>
    7010. 

  7010. <dt><span class="term"><span><strong class="command">notify-delay</strong></span></span></dt>
    7011. 

  7011. <dd><p>
    7012. 

  7012.                     See the description of
    7013. 

  7013.                     <span><strong class="command">notify-delay</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called &#8220;Tuning&#8221;</a>.
    7014. 

  7014.                   </p></dd>
    7015. 

  7015. <dt><span class="term"><span><strong class="command">notify-to-soa</strong></span></span></dt>
    7016. 

  7016. <dd><p>
    7017. 

  7017.                     See the description of
    7018. 

  7018.                     <span><strong class="command">notify-to-soa</strong></span> in
    7019. 

  7019.                     <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a>.
    7020. 

  7020.                   </p></dd>
    7021. 

  7021. <dt><span class="term"><span><strong class="command">pubkey</strong></span></span></dt>
    7022. 

  7022. <dd><p>
    7023. 

  7023.                     In <acronym class="acronym">BIND</acronym> 8, this option was
    7024. 

  7024.                     intended for specifying
    7025. 

  7025.                     a public zone key for verification of signatures in DNSSEC
    7026. 

  7026.                     signed
    7027. 

  7027.                     zones when they are loaded from disk. <acronym class="acronym">BIND</acronym> 9 does not verify signatures
    7028. 

  7028.                     on load and ignores the option.
    7029. 

  7029.                   </p></dd>
    7030. 

  7030. <dt><span class="term"><span><strong class="command">zone-statistics</strong></span></span></dt>
    7031. 

  7031. <dd><p>
    7032. 

  7032.                     If <strong class="userinput"><code>yes</code></strong>, the server will keep
    7033. 

  7033.                     statistical
    7034. 

  7034.                     information for this zone, which can be dumped to the
    7035. 

  7035.                     <span><strong class="command">statistics-file</strong></span> defined in
    7036. 

  7036.                     the server options.
    7037. 

  7037.                   </p></dd>
    7038. 

  7038. <dt><span class="term"><span><strong class="command">server-addresses</strong></span></span></dt>
    7039. 

  7039. <dd>
    7040. 

  7040. <p>
    7041. 

  7041.                     Only meaningful for static-stub zones.
    7042. 

  7042.                     This is a list of IP addresses to which queries
    7043. 

  7043.                     should be sent in recursive resolution for the
    7044. 

  7044.                     zone.
    7045. 

  7045.                     A non empty list for this option will internally
    7046. 

  7046.                     configure the apex NS RR with associated glue A or
    7047. 

  7047.                     AAAA RRs.
    7048. 

  7048.                   </p>
    7049. 

  7049. <p>
    7050. 

  7050.                     For example, if "example.com" is configured as a
    7051. 

  7051.                     static-stub zone with 192.0.2.1 and 2001:db8::1234
    7052. 

  7052.                     in a <span><strong class="command">server-addresses</strong></span> option,
    7053. 

  7053.                     the following RRs will be internally configured.
    7054. 

  7054.                   </p>
    7055. 

  7055. <pre class="programlisting">example.com. NS example.com.
    7056. 

  7056. example.com. A 192.0.2.1
    7057. 

  7057. example.com. AAAA 2001:db8::1234</pre>
    7058. 

  7058. <p>
    7059. 

  7059.                     These records are internally used to resolve
    7060. 

  7060.                     names under the static-stub zone.
    7061. 

  7061.                     For instance, if the server receives a query for
    7062. 

  7062.                     "www.example.com" with the RD bit on, the server
    7063. 

  7063.                     will initiate recursive resolution and send
    7064. 

  7064.                     queries to 192.0.2.1 and/or 2001:db8::1234.
    7065. 

  7065.                   </p>
    7066. 

  7066. </dd>
    7067. 

  7067. <dt><span class="term"><span><strong class="command">server-names</strong></span></span></dt>
    7068. 

  7068. <dd>
    7069. 

  7069. <p>
    7070. 

  7070.                     Only meaningful for static-stub zones.
    7071. 

  7071.                     This is a list of domain names of nameservers that
    7072. 

  7072.                     act as authoritative servers of the static-stub
    7073. 

  7073.                     zone.
    7074. 

  7074.                     These names will be resolved to IP addresses when
    7075. 

  7075.                     <span><strong class="command">named</strong></span> needs to send queries to
    7076. 

  7076.                     these servers.
    7077. 

  7077.                     To make this supplemental resolution successful,
    7078. 

  7078.                     these names must not be a subdomain of the origin
    7079. 

  7079.                     name of static-stub zone.
    7080. 

  7080.                     That is, when "example.net" is the origin of a
    7081. 

  7081.                     static-stub zone, "ns.example" and
    7082. 

  7082.                     "master.example.com" can be specified in the
    7083. 

  7083.                     <span><strong class="command">server-names</strong></span> option, but
    7084. 

  7084.                     "ns.example.net" cannot, and will be rejected by
    7085. 

  7085.                     the configuration parser.
    7086. 

  7086.                   </p>
    7087. 

  7087. <p>
    7088. 

  7088.                     A non empty list for this option will internally
    7089. 

  7089.                     configure the apex NS RR with the specified names.
    7090. 

  7090.                     For example, if "example.com" is configured as a
    7091. 

  7091.                     static-stub zone with "ns1.example.net" and
    7092. 

  7092.                     "ns2.example.net"
    7093. 

  7093.                     in a <span><strong class="command">server-names</strong></span> option,
    7094. 

  7094.                     the following RRs will be internally configured.
    7095. 

  7095.                   </p>
    7096. 

  7096. <pre class="programlisting">example.com. NS ns1.example.net.
    7097. 

  7097. example.com. NS ns2.example.net.
    7098. 

  7098. </pre>
    7099. 

  7099. <p>
    7100. 

  7100.                     These records are internally used to resolve
    7101. 

  7101.                     names under the static-stub zone.
    7102. 

  7102.                     For instance, if the server receives a query for
    7103. 

  7103.                     "www.example.com" with the RD bit on, the server
    7104. 

  7104.                     initiate recursive resolution,
    7105. 

  7105.                     resolve "ns1.example.net" and/or
    7106. 

  7106.                     "ns2.example.net" to IP addresses, and then send
    7107. 

  7107.                     queries to (one or more of) these addresses.
    7108. 

  7108.                   </p>
    7109. 

  7109. </dd>
    7110. 

  7110. <dt><span class="term"><span><strong class="command">sig-validity-interval</strong></span></span></dt>
    7111. 

  7111. <dd><p>
    7112. 

  7112.                     See the description of
    7113. 

  7113.                     <span><strong class="command">sig-validity-interval</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called &#8220;Tuning&#8221;</a>.
    7114. 

  7114.                   </p></dd>
    7115. 

  7115. <dt><span class="term"><span><strong class="command">sig-signing-nodes</strong></span></span></dt>
    7116. 

  7116. <dd><p>
    7117. 

  7117.                     See the description of
    7118. 

  7118.                     <span><strong class="command">sig-signing-nodes</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called &#8220;Tuning&#8221;</a>.
    7119. 

  7119.                   </p></dd>
    7120. 

  7120. <dt><span class="term"><span><strong class="command">sig-signing-signatures</strong></span></span></dt>
    7121. 

  7121. <dd><p>
    7122. 

  7122.                     See the description of
    7123. 

  7123.                     <span><strong class="command">sig-signing-signatures</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called &#8220;Tuning&#8221;</a>.
    7124. 

  7124.                   </p></dd>
    7125. 

  7125. <dt><span class="term"><span><strong class="command">sig-signing-type</strong></span></span></dt>
    7126. 

  7126. <dd><p>
    7127. 

  7127.                     See the description of
    7128. 

  7128.                     <span><strong class="command">sig-signing-type</strong></span> in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called &#8220;Tuning&#8221;</a>.
    7129. 

  7129.                   </p></dd>
    7130. 

  7130. <dt><span class="term"><span><strong class="command">transfer-source</strong></span></span></dt>
    7131. 

  7131. <dd><p>
    7132. 

  7132.                     See the description of
    7133. 

  7133.                     <span><strong class="command">transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called &#8220;Zone Transfers&#8221;</a>.
    7134. 

  7134.                   </p></dd>
    7135. 

  7135. <dt><span class="term"><span><strong class="command">transfer-source-v6</strong></span></span></dt>
    7136. 

  7136. <dd><p>
    7137. 

  7137.                     See the description of
    7138. 

  7138.                     <span><strong class="command">transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called &#8220;Zone Transfers&#8221;</a>.
    7139. 

  7139.                   </p></dd>
    7140. 

  7140. <dt><span class="term"><span><strong class="command">alt-transfer-source</strong></span></span></dt>
    7141. 

  7141. <dd><p>
    7142. 

  7142.                     See the description of
    7143. 

  7143.                     <span><strong class="command">alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called &#8220;Zone Transfers&#8221;</a>.
    7144. 

  7144.                   </p></dd>
    7145. 

  7145. <dt><span class="term"><span><strong class="command">alt-transfer-source-v6</strong></span></span></dt>
    7146. 

  7146. <dd><p>
    7147. 

  7147.                     See the description of
    7148. 

  7148.                     <span><strong class="command">alt-transfer-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called &#8220;Zone Transfers&#8221;</a>.
    7149. 

  7149.                   </p></dd>
    7150. 

  7150. <dt><span class="term"><span><strong class="command">use-alt-transfer-source</strong></span></span></dt>
    7151. 

  7151. <dd><p>
    7152. 

  7152.                     See the description of
    7153. 

  7153.                     <span><strong class="command">use-alt-transfer-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called &#8220;Zone Transfers&#8221;</a>.
    7154. 

  7154.                   </p></dd>
    7155. 

  7155. <dt><span class="term"><span><strong class="command">notify-source</strong></span></span></dt>
    7156. 

  7156. <dd><p>
    7157. 

  7157.                     See the description of
    7158. 

  7158.                     <span><strong class="command">notify-source</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called &#8220;Zone Transfers&#8221;</a>.
    7159. 

  7159.                   </p></dd>
    7160. 

  7160. <dt><span class="term"><span><strong class="command">notify-source-v6</strong></span></span></dt>
    7161. 

  7161. <dd><p>
    7162. 

  7162.                     See the description of
    7163. 

  7163.                     <span><strong class="command">notify-source-v6</strong></span> in <a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called &#8220;Zone Transfers&#8221;</a>.
    7164. 

  7164.                   </p></dd>
    7165. 

  7165. <dt>
    7166. 

  7166. <span class="term"><span><strong class="command">min-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">max-refresh-time</strong></span>, </span><span class="term"><span><strong class="command">min-retry-time</strong></span>, </span><span class="term"><span><strong class="command">max-retry-time</strong></span></span>
    7167. 

  7167. </dt>
    7168. 

  7168. <dd><p>
    7169. 

  7169.                     See the description in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called &#8220;Tuning&#8221;</a>.
    7170. 

  7170.                   </p></dd>
    7171. 

  7171. <dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
    7172. 

  7172. <dd><p>
    7173. 

  7173.                     See the description of
    7174. 

  7174.                     <span><strong class="command">ixfr-from-differences</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a>.
    7175. 

  7175.                     (Note that the <span><strong class="command">ixfr-from-differences</strong></span>
    7176. 

  7176.                     <strong class="userinput"><code>master</code></strong> and
    7177. 

  7177.                     <strong class="userinput"><code>slave</code></strong> choices are not
    7178. 

  7178.                     available at the zone level.)
    7179. 

  7179.                   </p></dd>
    7180. 

  7180. <dt><span class="term"><span><strong class="command">key-directory</strong></span></span></dt>
    7181. 

  7181. <dd><p>
    7182. 

  7182.                     See the description of
    7183. 

  7183.                     <span><strong class="command">key-directory</strong></span> in <a href="Bv9ARM.ch06.html#options" title="options Statement Definition and
    7184. 

  7184.           Usage">the section called &#8220;<span><strong class="command">options</strong></span> Statement Definition and
    7185. 

  7185.           Usage&#8221;</a>.
    7186. 

  7186.                   </p></dd>
    7187. 

  7187. <dt><span class="term"><span><strong class="command">auto-dnssec</strong></span></span></dt>
    7188. 

  7188. <dd>
    7189. 

  7189. <p>
    7190. 

  7190.                     Zones configured for dynamic DNS may also use this
    7191. 

  7191.                     option to allow varying levels of automatic DNSSEC key
    7192. 

  7192.                     management. There are three possible settings:
    7193. 

  7193.                   </p>
    7194. 

  7194. <p>
    7195. 

  7195.                     <span><strong class="command">auto-dnssec allow;</strong></span> permits
    7196. 

  7196.                     keys to be updated and the zone fully re-signed
    7197. 

  7197.                     whenever the user issues the command <span><strong class="command">rndc sign
    7198. 

  7198.                     <em class="replaceable"><code>zonename</code></em></strong></span>.
    7199. 

  7199.                   </p>
    7200. 

  7200. <p>
    7201. 

  7201.                     <span><strong class="command">auto-dnssec maintain;</strong></span> includes the
    7202. 

  7202.                     above, but also automatically adjusts the zone's DNSSEC
    7203. 

  7203.                     keys on schedule, according to the keys' timing metadata
    7204. 

  7204.                     (see <a href="man.dnssec-keygen.html" title="dnssec-keygen"><span class="refentrytitle"><span class="application">dnssec-keygen</span></span>(8)</a> and
    7205. 

  7205.                     <a href="man.dnssec-settime.html" title="dnssec-settime"><span class="refentrytitle"><span class="application">dnssec-settime</span></span>(8)</a>).  The command
    7206. 

  7206.                     <span><strong class="command">rndc sign
    7207. 

  7207.                     <em class="replaceable"><code>zonename</code></em></strong></span> causes
    7208. 

  7208.                     <span><strong class="command">named</strong></span> to load keys from the key
    7209. 

  7209.                     repository and sign the zone with all keys that are
    7210. 

  7210.                     active. 
    7211. 

  7211.                     <span><strong class="command">rndc loadkeys
    7212. 

  7212.                     <em class="replaceable"><code>zonename</code></em></strong></span> causes
    7213. 

  7213.                     <span><strong class="command">named</strong></span> to load keys from the key
    7214. 

  7214.                     repository and schedule key maintenance events to occur
    7215. 

  7215.                     in the future, but it does not sign the full zone
    7216. 

  7216.                     immediately.  Note: once keys have been loaded for a
    7217. 

  7217.                     zone the first time, the repository will be searched
    7218. 

  7218.                     for changes periodically, regardless of whether
    7219. 

  7219.                     <span><strong class="command">rndc loadkeys</strong></span> is used.  The recheck
    7220. 

  7220.                     interval is hard-coded to
    7221. 

  7221.                     one hour.
    7222. 

  7222.                   </p>
    7223. 

  7223. <p>
    7224. 

  7224.                     <span><strong class="command">auto-dnssec create;</strong></span> includes the
    7225. 

  7225.                     above, but also allows <span><strong class="command">named</strong></span>
    7226. 

  7226.                     to create new keys in the key repository when needed.
    7227. 

  7227.                     (NOTE: This option is not yet implemented; the syntax is
    7228. 

  7228.                     being reserved for future use.)
    7229. 

  7229.                   </p>
    7230. 

  7230. <p>
    7231. 

  7231.                     The default setting is <span><strong class="command">auto-dnssec off</strong></span>.
    7232. 

  7232.                   </p>
    7233. 

  7233. </dd>
    7234. 

  7234. <dt><span class="term"><span><strong class="command">multi-master</strong></span></span></dt>
    7235. 

  7235. <dd><p>
    7236. 

  7236.                     See the description of <span><strong class="command">multi-master</strong></span> in
    7237. 

  7237.                     <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a>.
    7238. 

  7238.                   </p></dd>
    7239. 

  7239. <dt><span class="term"><span><strong class="command">masterfile-format</strong></span></span></dt>
    7240. 

  7240. <dd><p>
    7241. 

  7241.                     See the description of <span><strong class="command">masterfile-format</strong></span>
    7242. 

  7242.                     in <a href="Bv9ARM.ch06.html#tuning" title="Tuning">the section called &#8220;Tuning&#8221;</a>.
    7243. 

  7243.                   </p></dd>
    7244. 

  7244. <dt><span class="term"><span><strong class="command">dnssec-secure-to-insecure</strong></span></span></dt>
    7245. 

  7245. <dd><p>
    7246. 

  7246.                     See the description of
    7247. 

  7247.                     <span><strong class="command">dnssec-secure-to-insecure</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a>.
    7248. 

  7248.                   </p></dd>
    7249. 

  7249. </dl></div>
    7250. 

  7250. </div>
    7251. 

  7251. <div class="sect3" lang="en">
    7252. 

  7252. <div class="titlepage"><div><div><h4 class="title">
    7253. 

  7253. <a name="dynamic_update_policies"></a>Dynamic Update Policies</h4></div></div></div>
    7254. 

  7254. <p><acronym class="acronym">BIND</acronym> 9 supports two alternative
    7255. 

  7255.               methods of granting clients the right to perform
    7256. 

  7256.               dynamic updates to a zone, configured by the
    7257. 

  7257.               <span><strong class="command">allow-update</strong></span> and
    7258. 

  7258.               <span><strong class="command">update-policy</strong></span> option, respectively.
    7259. 

  7259.             </p>
    7260. 

  7260. <p>
    7261. 

  7261.               The <span><strong class="command">allow-update</strong></span> clause works the
    7262. 

  7262.               same way as in previous versions of <acronym class="acronym">BIND</acronym>.
    7263. 

  7263.               It grants given clients the permission to update any
    7264. 

  7264.               record of any name in the zone.
    7265. 

  7265.             </p>
    7266. 

  7266. <p>
    7267. 

  7267.               The <span><strong class="command">update-policy</strong></span> clause
    7268. 

  7268.               allows more fine-grained control over what updates are
    7269. 

  7269.               allowed.  A set of rules is specified, where each rule
    7270. 

  7270.               either grants or denies permissions for one or more
    7271. 

  7271.               names to be updated by one or more identities.  If
    7272. 

  7272.               the dynamic update request message is signed (that is,
    7273. 

  7273.               it includes either a TSIG or SIG(0) record), the
    7274. 

  7274.               identity of the signer can be determined.
    7275. 

  7275.             </p>
    7276. 

  7276. <p>
    7277. 

  7277.               Rules are specified in the <span><strong class="command">update-policy</strong></span>
    7278. 

  7278.               zone option, and are only meaningful for master zones.
    7279. 

  7279.               When the <span><strong class="command">update-policy</strong></span> statement
    7280. 

  7280.               is present, it is a configuration error for the
    7281. 

  7281.               <span><strong class="command">allow-update</strong></span> statement to be
    7282. 

  7282.               present.  The <span><strong class="command">update-policy</strong></span> statement
    7283. 

  7283.               only examines the signer of a message; the source
    7284. 

  7284.               address is not relevant.
    7285. 

  7285.             </p>
    7286. 

  7286. <p>
    7287. 

  7287.               There is a pre-defined <span><strong class="command">update-policy</strong></span>
    7288. 

  7288.               rule which can be switched on with the command
    7289. 

  7289.               <span><strong class="command">update-policy local;</strong></span>.
    7290. 

  7290.               Switching on this rule in a zone causes
    7291. 

  7291.               <span><strong class="command">named</strong></span> to generate a TSIG session
    7292. 

  7292.               key and place it in a file, and to allow that key
    7293. 

  7293.               to update the zone.  (By default, the file is
    7294. 

  7294.               <code class="filename">/var/run/named/session.key</code>, the key
    7295. 

  7295.               name is "local-ddns" and the key algorithm is HMAC-SHA256,
    7296. 

  7296.               but these values are configurable with the
    7297. 

  7297.               <span><strong class="command">session-keyfile</strong></span>,
    7298. 

  7298.               <span><strong class="command">session-keyname</strong></span> and
    7299. 

  7299.               <span><strong class="command">session-keyalg</strong></span> options, respectively).
    7300. 

  7300.             </p>
    7301. 

  7301. <p>
    7302. 

  7302.               A client running on the local system, and with appropriate
    7303. 

  7303.               permissions, may read that file and use the key to sign update
    7304. 

  7304.               requests.  The zone's update policy will be set to allow that
    7305. 

  7305.               key to change any record within the zone.  Assuming the
    7306. 

  7306.               key name is "local-ddns", this policy is equivalent to:
    7307. 

  7307.             </p>
    7308. 

  7308. <pre class="programlisting">update-policy { grant local-ddns zonesub any; };
    7309. 

  7309.             </pre>
    7310. 

  7310. <p>
    7311. 

  7311.               The command <span><strong class="command">nsupdate -l</strong></span> sends update
    7312. 

  7312.               requests to localhost, and signs them using the session key.
    7313. 

  7313.             </p>
    7314. 

  7314. <p>
    7315. 

  7315.               Other rule definitions look like this:
    7316. 

  7316.             </p>
    7317. 

  7317. <pre class="programlisting">
    7318. 

  7318. ( <span><strong class="command">grant</strong></span> | <span><strong class="command">deny</strong></span> ) <em class="replaceable"><code>identity</code></em> <em class="replaceable"><code>nametype</code></em> [<span class="optional"> <em class="replaceable"><code>name</code></em> </span>] [<span class="optional"> <em class="replaceable"><code>types</code></em> </span>]
    7319. 

  7319. </pre>
    7320. 

  7320. <p>
    7321. 

  7321.               Each rule grants or denies privileges.  Once a message has
    7322. 

  7322.               successfully matched a rule, the operation is immediately
    7323. 

  7323.               granted or denied and no further rules are examined.  A rule
    7324. 

  7324.               is matched when the signer matches the identity field, the
    7325. 

  7325.               name matches the name field in accordance with the nametype
    7326. 

  7326.               field, and the type matches the types specified in the type
    7327. 

  7327.               field.
    7328. 

  7328.             </p>
    7329. 

  7329. <p>
    7330. 

  7330.               No signer is required for <em class="replaceable"><code>tcp-self</code></em>
    7331. 

  7331.               or <em class="replaceable"><code>6to4-self</code></em> however the standard
    7332. 

  7332.               reverse mapping / prefix conversion must match the identity
    7333. 

  7333.               field.
    7334. 

  7334.             </p>
    7335. 

  7335. <p>
    7336. 

  7336.               The identity field specifies a name or a wildcard
    7337. 

  7337.               name.  Normally, this is the name of the TSIG or
    7338. 

  7338.               SIG(0) key used to sign the update request.  When a
    7339. 

  7339.               TKEY exchange has been used to create a shared secret,
    7340. 

  7340.               the identity of the shared secret is the same as the
    7341. 

  7341.               identity of the key used to authenticate the TKEY
    7342. 

  7342.               exchange.  TKEY is also the negotiation method used
    7343. 

  7343.               by GSS-TSIG, which establishes an identity that is
    7344. 

  7344.               the Kerberos principal of the client, such as
    7345. 

  7345.               <strong class="userinput"><code>"user@host.domain"</code></strong>.  When the
    7346. 

  7346.               <em class="replaceable"><code>identity</code></em> field specifies
    7347. 

  7347.               a wildcard name, it is subject to DNS wildcard
    7348. 

  7348.               expansion, so the rule will apply to multiple identities.
    7349. 

  7349.               The <em class="replaceable"><code>identity</code></em> field must
    7350. 

  7350.               contain a fully-qualified domain name.
    7351. 

  7351.             </p>
    7352. 

  7352. <p>
    7353. 

  7353.               For nametypes <code class="varname">krb5-self</code>,
    7354. 

  7354.               <code class="varname">ms-self</code>, <code class="varname">krb5-subdomain</code>,
    7355. 

  7355.               and <code class="varname">ms-subdomain</code> the
    7356. 

  7356.               <em class="replaceable"><code>identity</code></em> field specifies
    7357. 

  7357.               the Windows or Kerberos realm of the machine belongs to.
    7358. 

  7358.             </p>
    7359. 

  7359. <p>
    7360. 

  7360.               The <em class="replaceable"><code>nametype</code></em> field has 13
    7361. 

  7361.               values:
    7362. 

  7362.               <code class="varname">name</code>, <code class="varname">subdomain</code>,
    7363. 

  7363.               <code class="varname">wildcard</code>, <code class="varname">self</code>,
    7364. 

  7364.               <code class="varname">selfsub</code>, <code class="varname">selfwild</code>,
    7365. 

  7365.               <code class="varname">krb5-self</code>, <code class="varname">ms-self</code>,
    7366. 

  7366.               <code class="varname">krb5-subdomain</code>,
    7367. 

  7367.               <code class="varname">ms-subdomain</code>,
    7368. 

  7368.               <code class="varname">tcp-self</code>, <code class="varname">6to4-self</code>,
    7369. 

  7369.               <code class="varname">zonesub</code>, and <code class="varname">external</code>.
    7370. 

  7370.             </p>
    7371. 

  7371. <div class="informaltable"><table border="1">
    7372. 

  7372. <colgroup>
    7373. 

  7373. <col>
    7374. 

  7374. <col>
    7375. 

  7375. </colgroup>
    7376. 

  7376. <tbody>
    7377. 

  7377. <tr>
    7378. 

  7378. <td>
    7379. 

  7379.                       <p>
    7380. 

  7380.                         <code class="varname">name</code>
    7381. 

  7381.                       </p>
    7382. 

  7382.                     </td>
    7383. 

  7383. <td>
    7384. 

  7384.                       <p>
    7385. 

  7385.                         Exact-match semantics.  This rule matches
    7386. 

  7386.                         when the name being updated is identical
    7387. 

  7387.                         to the contents of the
    7388. 

  7388.                         <em class="replaceable"><code>name</code></em> field.
    7389. 

  7389.                       </p>
    7390. 

  7390.                     </td>
    7391. 

  7391. </tr>
    7392. 

  7392. <tr>
    7393. 

  7393. <td>
    7394. 

  7394.                       <p>
    7395. 

  7395.                         <code class="varname">subdomain</code>
    7396. 

  7396.                       </p>
    7397. 

  7397.                     </td>
    7398. 

  7398. <td>
    7399. 

  7399.                       <p>
    7400. 

  7400.                         This rule matches when the name being updated
    7401. 

  7401.                         is a subdomain of, or identical to, the
    7402. 

  7402.                         contents of the <em class="replaceable"><code>name</code></em>
    7403. 

  7403.                         field.
    7404. 

  7404.                       </p>
    7405. 

  7405.                     </td>
    7406. 

  7406. </tr>
    7407. 

  7407. <tr>
    7408. 

  7408. <td>
    7409. 

  7409.                       <p>
    7410. 

  7410.                         <code class="varname">zonesub</code>
    7411. 

  7411.                       </p>
    7412. 

  7412.                     </td>
    7413. 

  7413. <td>
    7414. 

  7414.                       <p>
    7415. 

  7415.                         This rule is similar to subdomain, except that
    7416. 

  7416.                         it matches when the name being updated is a
    7417. 

  7417.                         subdomain of the zone in which the
    7418. 

  7418.                         <span><strong class="command">update-policy</strong></span> statement
    7419. 

  7419.                         appears.  This obviates the need to type the zone
    7420. 

  7420.                         name twice, and enables the use of a standard
    7421. 

  7421.                         <span><strong class="command">update-policy</strong></span> statement in
    7422. 

  7422.                         multiple zones without modification.
    7423. 

  7423.                       </p>
    7424. 

  7424.                       <p>
    7425. 

  7425.                         When this rule is used, the
    7426. 

  7426.                         <em class="replaceable"><code>name</code></em> field is omitted.
    7427. 

  7427.                       </p>
    7428. 

  7428.                     </td>
    7429. 

  7429. </tr>
    7430. 

  7430. <tr>
    7431. 

  7431. <td>
    7432. 

  7432.                       <p>
    7433. 

  7433.                         <code class="varname">wildcard</code>
    7434. 

  7434.                       </p>
    7435. 

  7435.                     </td>
    7436. 

  7436. <td>
    7437. 

  7437.                       <p>
    7438. 

  7438.                         The <em class="replaceable"><code>name</code></em> field
    7439. 

  7439.                         is subject to DNS wildcard expansion, and
    7440. 

  7440.                         this rule matches when the name being updated
    7441. 

  7441.                         name is a valid expansion of the wildcard.
    7442. 

  7442.                       </p>
    7443. 

  7443.                     </td>
    7444. 

  7444. </tr>
    7445. 

  7445. <tr>
    7446. 

  7446. <td>
    7447. 

  7447.                       <p>
    7448. 

  7448.                         <code class="varname">self</code>
    7449. 

  7449.                       </p>
    7450. 

  7450.                     </td>
    7451. 

  7451. <td>
    7452. 

  7452.                       <p>
    7453. 

  7453.                         This rule matches when the name being updated
    7454. 

  7454.                         matches the contents of the
    7455. 

  7455.                         <em class="replaceable"><code>identity</code></em> field.
    7456. 

  7456.                         The <em class="replaceable"><code>name</code></em> field
    7457. 

  7457.                         is ignored, but should be the same as the
    7458. 

  7458.                         <em class="replaceable"><code>identity</code></em> field.
    7459. 

  7459.                         The <code class="varname">self</code> nametype is
    7460. 

  7460.                         most useful when allowing using one key per
    7461. 

  7461.                         name to update, where the key has the same
    7462. 

  7462.                         name as the name to be updated.  The
    7463. 

  7463.                         <em class="replaceable"><code>identity</code></em> would
    7464. 

  7464.                         be specified as <code class="constant">*</code> (an asterisk) in
    7465. 

  7465.                         this case.
    7466. 

  7466.                       </p>
    7467. 

  7467.                     </td>
    7468. 

  7468. </tr>
    7469. 

  7469. <tr>
    7470. 

  7470. <td>
    7471. 

  7471.                       <p>
    7472. 

  7472.                         <code class="varname">selfsub</code>
    7473. 

  7473.                       </p>
    7474. 

  7474.                     </td>
    7475. 

  7475. <td>
    7476. 

  7476.                       <p>
    7477. 

  7477.                         This rule is similar to <code class="varname">self</code>
    7478. 

  7478.                         except that subdomains of <code class="varname">self</code>
    7479. 

  7479.                         can also be updated.
    7480. 

  7480.                       </p>
    7481. 

  7481.                     </td>
    7482. 

  7482. </tr>
    7483. 

  7483. <tr>
    7484. 

  7484. <td>
    7485. 

  7485.                       <p>
    7486. 

  7486.                         <code class="varname">selfwild</code>
    7487. 

  7487.                       </p>
    7488. 

  7488.                     </td>
    7489. 

  7489. <td>
    7490. 

  7490.                       <p>
    7491. 

  7491.                         This rule is similar to <code class="varname">self</code>
    7492. 

  7492.                         except that only subdomains of
    7493. 

  7493.                         <code class="varname">self</code> can be updated.
    7494. 

  7494.                       </p>
    7495. 

  7495.                     </td>
    7496. 

  7496. </tr>
    7497. 

  7497. <tr>
    7498. 

  7498. <td>
    7499. 

  7499.                       <p>
    7500. 

  7500.                         <code class="varname">ms-self</code>
    7501. 

  7501.                       </p>
    7502. 

  7502.                     </td>
    7503. 

  7503. <td>
    7504. 

  7504.                       <p>
    7505. 

  7505.                         This rule takes a Windows machine principal
    7506. 

  7506.                         (machine$@REALM) for machine in REALM and
    7507. 

  7507.                         and converts it machine.realm allowing the machine 
    7508. 

  7508.                         to update machine.realm.  The REALM to be matched
    7509. 

  7509.                         is specified in the <font color="red">&lt;replacable&gt;identity&lt;/replacable&gt;</font>
    7510. 

  7510.                         field.
    7511. 

  7511.                       </p>
    7512. 

  7512.                     </td>
    7513. 

  7513. </tr>
    7514. 

  7514. <tr>
    7515. 

  7515. <td>
    7516. 

  7516.                       <p>
    7517. 

  7517.                         <code class="varname">ms-subdomain</code>
    7518. 

  7518.                       </p>
    7519. 

  7519.                     </td>
    7520. 

  7520. <td>
    7521. 

  7521.                       <p>
    7522. 

  7522.                         This rule takes a Windows machine principal 
    7523. 

  7523.                         (machine$@REALM) for machine in REALM and
    7524. 

  7524.                         converts it to machine.realm allowing the machine
    7525. 

  7525.                         to update subdomains of machine.realm.  The REALM
    7526. 

  7526.                         to be matched is specified in the
    7527. 

  7527.                         <font color="red">&lt;replacable&gt;identity&lt;/replacable&gt;</font> field.
    7528. 

  7528.                       </p>
    7529. 

  7529.                     </td>
    7530. 

  7530. </tr>
    7531. 

  7531. <tr>
    7532. 

  7532. <td>
    7533. 

  7533.                       <p>
    7534. 

  7534.                         <code class="varname">krb5-self</code>
    7535. 

  7535.                       </p>
    7536. 

  7536.                     </td>
    7537. 

  7537. <td>
    7538. 

  7538.                       <p>
    7539. 

  7539.                         This rule takes a Kerberos machine principal
    7540. 

  7540.                         (host/machine@REALM) for machine in REALM and
    7541. 

  7541.                         and converts it machine.realm allowing the machine 
    7542. 

  7542.                         to update machine.realm.  The REALM to be matched
    7543. 

  7543.                         is specified in the <font color="red">&lt;replacable&gt;identity&lt;/replacable&gt;</font>
    7544. 

  7544.                         field.
    7545. 

  7545.                       </p>
    7546. 

  7546.                     </td>
    7547. 

  7547. </tr>
    7548. 

  7548. <tr>
    7549. 

  7549. <td>
    7550. 

  7550.                       <p>
    7551. 

  7551.                         <code class="varname">krb5-subdomain</code>
    7552. 

  7552.                       </p>
    7553. 

  7553.                     </td>
    7554. 

  7554. <td>
    7555. 

  7555.                       <p>
    7556. 

  7556.                         This rule takes a Kerberos machine principal 
    7557. 

  7557.                         (host/machine@REALM) for machine in REALM and
    7558. 

  7558.                         converts it to machine.realm allowing the machine
    7559. 

  7559.                         to update subdomains of machine.realm.  The REALM
    7560. 

  7560.                         to be matched is specified in the
    7561. 

  7561.                         <font color="red">&lt;replacable&gt;identity&lt;/replacable&gt;</font> field.
    7562. 

  7562.                       </p>
    7563. 

  7563.                     </td>
    7564. 

  7564. </tr>
    7565. 

  7565. <tr>
    7566. 

  7566. <td>
    7567. 

  7567.                       <p>
    7568. 

  7568.                         <code class="varname">tcp-self</code>
    7569. 

  7569.                       </p>
    7570. 

  7570.                     </td>
    7571. 

  7571. <td>
    7572. 

  7572.                       <p>
    7573. 

  7573.                         Allow updates that have been sent via TCP and
    7574. 

  7574.                         for which the standard mapping from the initiating
    7575. 

  7575.                         IP address into the IN-ADDR.ARPA and IP6.ARPA
    7576. 

  7576.                         namespaces match the name to be updated.
    7577. 

  7577.                       </p>
    7578. 

  7578.                       <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    7579. 

  7579. <h3 class="title">Note</h3>
    7580. 

  7580.                         It is theoretically possible to spoof these TCP
    7581. 

  7581.                         sessions.
    7582. 

  7582.                       </div>
    7583. 

  7583.                     </td>
    7584. 

  7584. </tr>
    7585. 

  7585. <tr>
    7586. 

  7586. <td>
    7587. 

  7587.                       <p>
    7588. 

  7588.                         <code class="varname">6to4-self</code>
    7589. 

  7589.                       </p>
    7590. 

  7590.                     </td>
    7591. 

  7591. <td>
    7592. 

  7592.                       <p>
    7593. 

  7593.                         Allow the 6to4 prefix to be update by any TCP
    7594. 

  7594.                         connection from the 6to4 network or from the
    7595. 

  7595.                         corresponding IPv4 address.  This is intended
    7596. 

  7596.                         to allow NS or DNAME RRsets to be added to the
    7597. 

  7597.                         reverse tree.
    7598. 

  7598.                       </p>
    7599. 

  7599.                       <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    7600. 

  7600. <h3 class="title">Note</h3>
    7601. 

  7601.                         It is theoretically possible to spoof these TCP
    7602. 

  7602.                         sessions.
    7603. 

  7603.                       </div>
    7604. 

  7604.                     </td>
    7605. 

  7605. </tr>
    7606. 

  7606. <tr>
    7607. 

  7607. <td>
    7608. 

  7608.                       <p>
    7609. 

  7609.                         <code class="varname">external</code>
    7610. 

  7610.                       </p>
    7611. 

  7611.                     </td>
    7612. 

  7612. <td>
    7613. 

  7613.                       <p>
    7614. 

  7614.                         This rule allows <span><strong class="command">named</strong></span>
    7615. 

  7615.                         to defer the decision of whether to allow a
    7616. 

  7616.                         given update to an external daemon.
    7617. 

  7617.                       </p>
    7618. 

  7618.                       <p>
    7619. 

  7619.                         The method of communicating with the daemon is
    7620. 

  7620.                         specified in the <em class="replaceable"><code>identity</code></em>
    7621. 

  7621.                         field, the format of which is
    7622. 

  7622.                         "<code class="constant">local:</code><em class="replaceable"><code>path</code></em>",
    7623. 

  7623.                         where <em class="replaceable"><code>path</code></em> is the location
    7624. 

  7624.                         of a UNIX-domain socket.  (Currently, "local" is the
    7625. 

  7625.                         only supported mechanism.)
    7626. 

  7626.                       </p>
    7627. 

  7627.                       <p>
    7628. 

  7628.                         Requests to the external daemon are sent over the
    7629. 

  7629.                         UNIX-domain socket as datagrams with the following
    7630. 

  7630.                         format:
    7631. 

  7631.                       </p>
    7632. 

  7632.                       <pre class="programlisting">
    7633. 

  7633.    Protocol version number (4 bytes, network byte order, currently 1)
    7634. 

  7634.    Request length (4 bytes, network byte order)
    7635. 

  7635.    Signer (null-terminated string)
    7636. 

  7636.    Name (null-terminated string)
    7637. 

  7637.    TCP source address (null-terminated string)
    7638. 

  7638.    Rdata type (null-terminated string)
    7639. 

  7639.    Key (null-terminated string)
    7640. 

  7640.    TKEY token length (4 bytes, network byte order)
    7641. 

  7641.    TKEY token (remainder of packet)</pre>
    7642. 

  7642.                       <p>
    7643. 

  7643.                         The daemon replies with a four-byte value in
    7644. 

  7644.                         network byte order, containing either 0 or 1; 0
    7645. 

  7645.                         indicates that the specified update is not
    7646. 

  7646.                         permitted, and 1 indicates that it is.
    7647. 

  7647.                       </p>
    7648. 

  7648.                     </td>
    7649. 

  7649. </tr>
    7650. 

  7650. </tbody>
    7651. 

  7651. </table></div>
    7652. 

  7652. <p>
    7653. 

  7653.               In all cases, the <em class="replaceable"><code>name</code></em>
    7654. 

  7654.               field must specify a fully-qualified domain name.
    7655. 

  7655.             </p>
    7656. 

  7656. <p>
    7657. 

  7657.               If no types are explicitly specified, this rule matches
    7658. 

  7658.               all types except RRSIG, NS, SOA, NSEC and NSEC3. Types
    7659. 

  7659.               may be specified by name, including "ANY" (ANY matches
    7660. 

  7660.               all types except NSEC and NSEC3, which can never be
    7661. 

  7661.               updated).  Note that when an attempt is made to delete
    7662. 

  7662.               all records associated with a name, the rules are
    7663. 

  7663.               checked for each existing record type.
    7664. 

  7664.             </p>
    7665. 

  7665. </div>
    7666. 

  7666. </div>
    7667. 

  7667. </div>
    7668. 

  7668. <div class="sect1" lang="en">
    7669. 

  7669. <div class="titlepage"><div><div><h2 class="title" style="clear: both">
    7670. 

  7670. <a name="id2595116"></a>Zone File</h2></div></div></div>
    7671. 

  7671. <div class="sect2" lang="en">
    7672. 

  7672. <div class="titlepage"><div><div><h3 class="title">
    7673. 

  7673. <a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div>
    7674. 

  7674. <p>
    7675. 

  7675.             This section, largely borrowed from RFC 1034, describes the
    7676. 

  7676.             concept of a Resource Record (RR) and explains when each is used.
    7677. 

  7677.             Since the publication of RFC 1034, several new RRs have been
    7678. 

  7678.             identified
    7679. 

  7679.             and implemented in the DNS. These are also included.
    7680. 

  7680.           </p>
    7681. 

  7681. <div class="sect3" lang="en">
    7682. 

  7682. <div class="titlepage"><div><div><h4 class="title">
    7683. 

  7683. <a name="id2595134"></a>Resource Records</h4></div></div></div>
    7684. 

  7684. <p>
    7685. 

  7685.               A domain name identifies a node.  Each node has a set of
    7686. 

  7686.               resource information, which may be empty.  The set of resource
    7687. 

  7687.               information associated with a particular name is composed of
    7688. 

  7688.               separate RRs. The order of RRs in a set is not significant and
    7689. 

  7689.               need not be preserved by name servers, resolvers, or other
    7690. 

  7690.               parts of the DNS. However, sorting of multiple RRs is
    7691. 

  7691.               permitted for optimization purposes, for example, to specify
    7692. 

  7692.               that a particular nearby server be tried first. See <a href="Bv9ARM.ch06.html#the_sortlist_statement" title="The sortlist Statement">the section called &#8220;The <span><strong class="command">sortlist</strong></span> Statement&#8221;</a> and <a href="Bv9ARM.ch06.html#rrset_ordering" title="RRset Ordering">the section called &#8220;RRset Ordering&#8221;</a>.
    7693. 

  7693.             </p>
    7694. 

  7694. <p>
    7695. 

  7695.               The components of a Resource Record are:
    7696. 

  7696.             </p>
    7697. 

  7697. <div class="informaltable"><table border="1">
    7698. 

  7698. <colgroup>
    7699. 

  7699. <col>
    7700. 

  7700. <col>
    7701. 

  7701. </colgroup>
    7702. 

  7702. <tbody>
    7703. 

  7703. <tr>
    7704. 

  7704. <td>
    7705. 

  7705.                       <p>
    7706. 

  7706.                         owner name
    7707. 

  7707.                       </p>
    7708. 

  7708.                     </td>
    7709. 

  7709. <td>
    7710. 

  7710.                       <p>
    7711. 

  7711.                         The domain name where the RR is found.
    7712. 

  7712.                       </p>
    7713. 

  7713.                     </td>
    7714. 

  7714. </tr>
    7715. 

  7715. <tr>
    7716. 

  7716. <td>
    7717. 

  7717.                       <p>
    7718. 

  7718.                         type
    7719. 

  7719.                       </p>
    7720. 

  7720.                     </td>
    7721. 

  7721. <td>
    7722. 

  7722.                       <p>
    7723. 

  7723.                         An encoded 16-bit value that specifies
    7724. 

  7724.                         the type of the resource record.
    7725. 

  7725.                       </p>
    7726. 

  7726.                     </td>
    7727. 

  7727. </tr>
    7728. 

  7728. <tr>
    7729. 

  7729. <td>
    7730. 

  7730.                       <p>
    7731. 

  7731.                         TTL
    7732. 

  7732.                       </p>
    7733. 

  7733.                     </td>
    7734. 

  7734. <td>
    7735. 

  7735.                       <p>
    7736. 

  7736.                         The time-to-live of the RR. This field
    7737. 

  7737.                         is a 32-bit integer in units of seconds, and is
    7738. 

  7738.                         primarily used by
    7739. 

  7739.                         resolvers when they cache RRs. The TTL describes how
    7740. 

  7740.                         long a RR can
    7741. 

  7741.                         be cached before it should be discarded.
    7742. 

  7742.                       </p>
    7743. 

  7743.                     </td>
    7744. 

  7744. </tr>
    7745. 

  7745. <tr>
    7746. 

  7746. <td>
    7747. 

  7747.                       <p>
    7748. 

  7748.                         class
    7749. 

  7749.                       </p>
    7750. 

  7750.                     </td>
    7751. 

  7751. <td>
    7752. 

  7752.                       <p>
    7753. 

  7753.                         An encoded 16-bit value that identifies
    7754. 

  7754.                         a protocol family or instance of a protocol.
    7755. 

  7755.                       </p>
    7756. 

  7756.                     </td>
    7757. 

  7757. </tr>
    7758. 

  7758. <tr>
    7759. 

  7759. <td>
    7760. 

  7760.                       <p>
    7761. 

  7761.                         RDATA
    7762. 

  7762.                       </p>
    7763. 

  7763.                     </td>
    7764. 

  7764. <td>
    7765. 

  7765.                       <p>
    7766. 

  7766.                         The resource data.  The format of the
    7767. 

  7767.                         data is type (and sometimes class) specific.
    7768. 

  7768.                       </p>
    7769. 

  7769.                     </td>
    7770. 

  7770. </tr>
    7771. 

  7771. </tbody>
    7772. 

  7772. </table></div>
    7773. 

  7773. <p>
    7774. 

  7774.               The following are <span class="emphasis"><em>types</em></span> of valid RRs:
    7775. 

  7775.             </p>
    7776. 

  7776. <div class="informaltable"><table border="1">
    7777. 

  7777. <colgroup>
    7778. 

  7778. <col>
    7779. 

  7779. <col>
    7780. 

  7780. </colgroup>
    7781. 

  7781. <tbody>
    7782. 

  7782. <tr>
    7783. 

  7783. <td>
    7784. 

  7784.                       <p>
    7785. 

  7785.                         A
    7786. 

  7786.                       </p>
    7787. 

  7787.                     </td>
    7788. 

  7788. <td>
    7789. 

  7789.                       <p>
    7790. 

  7790.                         A host address.  In the IN class, this is a
    7791. 

  7791.                         32-bit IP address.  Described in RFC 1035.
    7792. 

  7792.                       </p>
    7793. 

  7793.                     </td>
    7794. 

  7794. </tr>
    7795. 

  7795. <tr>
    7796. 

  7796. <td>
    7797. 

  7797.                       <p>
    7798. 

  7798.                         AAAA
    7799. 

  7799.                       </p>
    7800. 

  7800.                     </td>
    7801. 

  7801. <td>
    7802. 

  7802.                       <p>
    7803. 

  7803.                         IPv6 address.  Described in RFC 1886.
    7804. 

  7804.                       </p>
    7805. 

  7805.                     </td>
    7806. 

  7806. </tr>
    7807. 

  7807. <tr>
    7808. 

  7808. <td>
    7809. 

  7809.                       <p>
    7810. 

  7810.                         A6
    7811. 

  7811.                       </p>
    7812. 

  7812.                     </td>
    7813. 

  7813. <td>
    7814. 

  7814.                       <p>
    7815. 

  7815.                         IPv6 address.  This can be a partial
    7816. 

  7816.                         address (a suffix) and an indirection to the name
    7817. 

  7817.                         where the rest of the
    7818. 

  7818.                         address (the prefix) can be found.  Experimental.
    7819. 

  7819.                         Described in RFC 2874.
    7820. 

  7820.                       </p>
    7821. 

  7821.                     </td>
    7822. 

  7822. </tr>
    7823. 

  7823. <tr>
    7824. 

  7824. <td>
    7825. 

  7825.                       <p>
    7826. 

  7826.                         AFSDB
    7827. 

  7827.                       </p>
    7828. 

  7828.                     </td>
    7829. 

  7829. <td>
    7830. 

  7830.                       <p>
    7831. 

  7831.                         Location of AFS database servers.
    7832. 

  7832.                         Experimental.  Described in RFC 1183.
    7833. 

  7833.                       </p>
    7834. 

  7834.                     </td>
    7835. 

  7835. </tr>
    7836. 

  7836. <tr>
    7837. 

  7837. <td>
    7838. 

  7838.                       <p>
    7839. 

  7839.                         APL
    7840. 

  7840.                       </p>
    7841. 

  7841.                     </td>
    7842. 

  7842. <td>
    7843. 

  7843.                       <p>
    7844. 

  7844.                         Address prefix list.  Experimental.
    7845. 

  7845.                         Described in RFC 3123.
    7846. 

  7846.                       </p>
    7847. 

  7847.                     </td>
    7848. 

  7848. </tr>
    7849. 

  7849. <tr>
    7850. 

  7850. <td>
    7851. 

  7851.                       <p>
    7852. 

  7852.                         CERT
    7853. 

  7853.                       </p>
    7854. 

  7854.                     </td>
    7855. 

  7855. <td>
    7856. 

  7856.                       <p>
    7857. 

  7857.                         Holds a digital certificate.
    7858. 

  7858.                         Described in RFC 2538.
    7859. 

  7859.                       </p>
    7860. 

  7860.                     </td>
    7861. 

  7861. </tr>
    7862. 

  7862. <tr>
    7863. 

  7863. <td>
    7864. 

  7864.                       <p>
    7865. 

  7865.                         CNAME
    7866. 

  7866.                       </p>
    7867. 

  7867.                     </td>
    7868. 

  7868. <td>
    7869. 

  7869.                       <p>
    7870. 

  7870.                         Identifies the canonical name of an alias.
    7871. 

  7871.                         Described in RFC 1035.
    7872. 

  7872.                       </p>
    7873. 

  7873.                     </td>
    7874. 

  7874. </tr>
    7875. 

  7875. <tr>
    7876. 

  7876. <td>
    7877. 

  7877.                       <p>
    7878. 

  7878.                         DHCID
    7879. 

  7879.                       </p>
    7880. 

  7880.                     </td>
    7881. 

  7881. <td>
    7882. 

  7882.                       <p>
    7883. 

  7883.                         Is used for identifying which DHCP client is
    7884. 

  7884.                         associated with this name.  Described in RFC 4701.
    7885. 

  7885.                       </p>
    7886. 

  7886.                     </td>
    7887. 

  7887. </tr>
    7888. 

  7888. <tr>
    7889. 

  7889. <td>
    7890. 

  7890.                       <p>
    7891. 

  7891.                         DNAME
    7892. 

  7892.                       </p>
    7893. 

  7893.                     </td>
    7894. 

  7894. <td>
    7895. 

  7895.                       <p>
    7896. 

  7896.                         Replaces the domain name specified with
    7897. 

  7897.                         another name to be looked up, effectively aliasing an
    7898. 

  7898.                         entire
    7899. 

  7899.                         subtree of the domain name space rather than a single
    7900. 

  7900.                         record
    7901. 

  7901.                         as in the case of the CNAME RR.
    7902. 

  7902.                         Described in RFC 2672.
    7903. 

  7903.                       </p>
    7904. 

  7904.                     </td>
    7905. 

  7905. </tr>
    7906. 

  7906. <tr>
    7907. 

  7907. <td>
    7908. 

  7908.                       <p>
    7909. 

  7909.                         DNSKEY
    7910. 

  7910.                       </p>
    7911. 

  7911.                     </td>
    7912. 

  7912. <td>
    7913. 

  7913.                       <p>
    7914. 

  7914.                         Stores a public key associated with a signed
    7915. 

  7915.                         DNS zone.  Described in RFC 4034.
    7916. 

  7916.                       </p>
    7917. 

  7917.                     </td>
    7918. 

  7918. </tr>
    7919. 

  7919. <tr>
    7920. 

  7920. <td>
    7921. 

  7921.                       <p>
    7922. 

  7922.                         DS
    7923. 

  7923.                       </p>
    7924. 

  7924.                     </td>
    7925. 

  7925. <td>
    7926. 

  7926.                       <p>
    7927. 

  7927.                         Stores the hash of a public key associated with a
    7928. 

  7928.                         signed DNS zone.  Described in RFC 4034.
    7929. 

  7929.                       </p>
    7930. 

  7930.                     </td>
    7931. 

  7931. </tr>
    7932. 

  7932. <tr>
    7933. 

  7933. <td>
    7934. 

  7934.                       <p>
    7935. 

  7935.                         GPOS
    7936. 

  7936.                       </p>
    7937. 

  7937.                     </td>
    7938. 

  7938. <td>
    7939. 

  7939.                       <p>
    7940. 

  7940.                         Specifies the global position.  Superseded by LOC.
    7941. 

  7941.                       </p>
    7942. 

  7942.                     </td>
    7943. 

  7943. </tr>
    7944. 

  7944. <tr>
    7945. 

  7945. <td>
    7946. 

  7946.                       <p>
    7947. 

  7947.                         HINFO
    7948. 

  7948.                       </p>
    7949. 

  7949.                     </td>
    7950. 

  7950. <td>
    7951. 

  7951.                       <p>
    7952. 

  7952.                         Identifies the CPU and OS used by a host.
    7953. 

  7953.                         Described in RFC 1035.
    7954. 

  7954.                       </p>
    7955. 

  7955.                     </td>
    7956. 

  7956. </tr>
    7957. 

  7957. <tr>
    7958. 

  7958. <td>
    7959. 

  7959.                       <p>
    7960. 

  7960.                         IPSECKEY
    7961. 

  7961.                       </p>
    7962. 

  7962.                     </td>
    7963. 

  7963. <td>
    7964. 

  7964.                       <p>
    7965. 

  7965.                         Provides a method for storing IPsec keying material in
    7966. 

  7966.                         DNS.  Described in RFC 4025.
    7967. 

  7967.                       </p>
    7968. 

  7968.                     </td>
    7969. 

  7969. </tr>
    7970. 

  7970. <tr>
    7971. 

  7971. <td>
    7972. 

  7972.                       <p>
    7973. 

  7973.                         ISDN
    7974. 

  7974.                       </p>
    7975. 

  7975.                     </td>
    7976. 

  7976. <td>
    7977. 

  7977.                       <p>
    7978. 

  7978.                         Representation of ISDN addresses.
    7979. 

  7979.                         Experimental.  Described in RFC 1183.
    7980. 

  7980.                       </p>
    7981. 

  7981.                     </td>
    7982. 

  7982. </tr>
    7983. 

  7983. <tr>
    7984. 

  7984. <td>
    7985. 

  7985.                       <p>
    7986. 

  7986.                         KEY
    7987. 

  7987.                       </p>
    7988. 

  7988.                     </td>
    7989. 

  7989. <td>
    7990. 

  7990.                       <p>
    7991. 

  7991.                         Stores a public key associated with a
    7992. 

  7992.                         DNS name.  Used in original DNSSEC; replaced
    7993. 

  7993.                         by DNSKEY in DNSSECbis, but still used with
    7994. 

  7994.                         SIG(0).  Described in RFCs 2535 and 2931.
    7995. 

  7995.                       </p>
    7996. 

  7996.                     </td>
    7997. 

  7997. </tr>
    7998. 

  7998. <tr>
    7999. 

  7999. <td>
    8000. 

  8000.                       <p>
    8001. 

  8001.                         KX
    8002. 

  8002.                       </p>
    8003. 

  8003.                     </td>
    8004. 

  8004. <td>
    8005. 

  8005.                       <p>
    8006. 

  8006.                         Identifies a key exchanger for this
    8007. 

  8007.                         DNS name.  Described in RFC 2230.
    8008. 

  8008.                       </p>
    8009. 

  8009.                     </td>
    8010. 

  8010. </tr>
    8011. 

  8011. <tr>
    8012. 

  8012. <td>
    8013. 

  8013.                       <p>
    8014. 

  8014.                         LOC
    8015. 

  8015.                       </p>
    8016. 

  8016.                     </td>
    8017. 

  8017. <td>
    8018. 

  8018.                       <p>
    8019. 

  8019.                         For storing GPS info.  Described in RFC 1876.
    8020. 

  8020.                         Experimental.
    8021. 

  8021.                       </p>
    8022. 

  8022.                     </td>
    8023. 

  8023. </tr>
    8024. 

  8024. <tr>
    8025. 

  8025. <td>
    8026. 

  8026.                       <p>
    8027. 

  8027.                         MX
    8028. 

  8028.                       </p>
    8029. 

  8029.                     </td>
    8030. 

  8030. <td>
    8031. 

  8031.                       <p>
    8032. 

  8032.                         Identifies a mail exchange for the domain with
    8033. 

  8033.                         a 16-bit preference value (lower is better)
    8034. 

  8034.                         followed by the host name of the mail exchange.
    8035. 

  8035.                         Described in RFC 974, RFC 1035.
    8036. 

  8036.                       </p>
    8037. 

  8037.                     </td>
    8038. 

  8038. </tr>
    8039. 

  8039. <tr>
    8040. 

  8040. <td>
    8041. 

  8041.                       <p>
    8042. 

  8042.                         NAPTR
    8043. 

  8043.                       </p>
    8044. 

  8044.                     </td>
    8045. 

  8045. <td>
    8046. 

  8046.                       <p>
    8047. 

  8047.                         Name authority pointer.  Described in RFC 2915.
    8048. 

  8048.                       </p>
    8049. 

  8049.                     </td>
    8050. 

  8050. </tr>
    8051. 

  8051. <tr>
    8052. 

  8052. <td>
    8053. 

  8053.                       <p>
    8054. 

  8054.                         NSAP
    8055. 

  8055.                       </p>
    8056. 

  8056.                     </td>
    8057. 

  8057. <td>
    8058. 

  8058.                       <p>
    8059. 

  8059.                         A network service access point.
    8060. 

  8060.                         Described in RFC 1706.
    8061. 

  8061.                       </p>
    8062. 

  8062.                     </td>
    8063. 

  8063. </tr>
    8064. 

  8064. <tr>
    8065. 

  8065. <td>
    8066. 

  8066.                       <p>
    8067. 

  8067.                         NS
    8068. 

  8068.                       </p>
    8069. 

  8069.                     </td>
    8070. 

  8070. <td>
    8071. 

  8071.                       <p>
    8072. 

  8072.                         The authoritative name server for the
    8073. 

  8073.                         domain.  Described in RFC 1035.
    8074. 

  8074.                       </p>
    8075. 

  8075.                     </td>
    8076. 

  8076. </tr>
    8077. 

  8077. <tr>
    8078. 

  8078. <td>
    8079. 

  8079.                       <p>
    8080. 

  8080.                         NSEC
    8081. 

  8081.                       </p>
    8082. 

  8082.                     </td>
    8083. 

  8083. <td>
    8084. 

  8084.                       <p>
    8085. 

  8085.                         Used in DNSSECbis to securely indicate that
    8086. 

  8086.                         RRs with an owner name in a certain name interval do
    8087. 

  8087.                         not exist in
    8088. 

  8088.                         a zone and indicate what RR types are present for an
    8089. 

  8089.                         existing name.
    8090. 

  8090.                         Described in RFC 4034.
    8091. 

  8091.                       </p>
    8092. 

  8092.                     </td>
    8093. 

  8093. </tr>
    8094. 

  8094. <tr>
    8095. 

  8095. <td>
    8096. 

  8096.                       <p>
    8097. 

  8097.                         NSEC3
    8098. 

  8098.                       </p>
    8099. 

  8099.                     </td>
    8100. 

  8100. <td>
    8101. 

  8101.                       <p>
    8102. 

  8102.                         Used in DNSSECbis to securely indicate that
    8103. 

  8103.                         RRs with an owner name in a certain name
    8104. 

  8104.                         interval do not exist in a zone and indicate
    8105. 

  8105.                         what RR types are present for an existing
    8106. 

  8106.                         name.  NSEC3 differs from NSEC in that it
    8107. 

  8107.                         prevents zone enumeration but is more
    8108. 

  8108.                         computationally expensive on both the server
    8109. 

  8109.                         and the client than NSEC.  Described in RFC
    8110. 

  8110.                         5155.
    8111. 

  8111.                       </p>
    8112. 

  8112.                     </td>
    8113. 

  8113. </tr>
    8114. 

  8114. <tr>
    8115. 

  8115. <td>
    8116. 

  8116.                       <p>
    8117. 

  8117.                         NSEC3PARAM
    8118. 

  8118.                       </p>
    8119. 

  8119.                     </td>
    8120. 

  8120. <td>
    8121. 

  8121.                       <p>
    8122. 

  8122.                         Used in DNSSECbis to tell the authoritative
    8123. 

  8123.                         server which NSEC3 chains are available to use.
    8124. 

  8124.                         Described in RFC 5155.
    8125. 

  8125.                       </p>
    8126. 

  8126.                     </td>
    8127. 

  8127. </tr>
    8128. 

  8128. <tr>
    8129. 

  8129. <td>
    8130. 

  8130.                       <p>
    8131. 

  8131.                         NXT
    8132. 

  8132.                       </p>
    8133. 

  8133.                     </td>
    8134. 

  8134. <td>
    8135. 

  8135.                       <p>
    8136. 

  8136.                         Used in DNSSEC to securely indicate that
    8137. 

  8137.                         RRs with an owner name in a certain name interval do
    8138. 

  8138.                         not exist in
    8139. 

  8139.                         a zone and indicate what RR types are present for an
    8140. 

  8140.                         existing name.
    8141. 

  8141.                         Used in original DNSSEC; replaced by NSEC in
    8142. 

  8142.                         DNSSECbis.
    8143. 

  8143.                         Described in RFC 2535.
    8144. 

  8144.                       </p>
    8145. 

  8145.                     </td>
    8146. 

  8146. </tr>
    8147. 

  8147. <tr>
    8148. 

  8148. <td>
    8149. 

  8149.                       <p>
    8150. 

  8150.                         PTR
    8151. 

  8151.                       </p>
    8152. 

  8152.                     </td>
    8153. 

  8153. <td>
    8154. 

  8154.                       <p>
    8155. 

  8155.                         A pointer to another part of the domain
    8156. 

  8156.                         name space.  Described in RFC 1035.
    8157. 

  8157.                       </p>
    8158. 

  8158.                     </td>
    8159. 

  8159. </tr>
    8160. 

  8160. <tr>
    8161. 

  8161. <td>
    8162. 

  8162.                       <p>
    8163. 

  8163.                         PX
    8164. 

  8164.                       </p>
    8165. 

  8165.                     </td>
    8166. 

  8166. <td>
    8167. 

  8167.                       <p>
    8168. 

  8168.                         Provides mappings between RFC 822 and X.400
    8169. 

  8169.                         addresses.  Described in RFC 2163.
    8170. 

  8170.                       </p>
    8171. 

  8171.                     </td>
    8172. 

  8172. </tr>
    8173. 

  8173. <tr>
    8174. 

  8174. <td>
    8175. 

  8175.                       <p>
    8176. 

  8176.                         RP
    8177. 

  8177.                       </p>
    8178. 

  8178.                     </td>
    8179. 

  8179. <td>
    8180. 

  8180.                       <p>
    8181. 

  8181.                         Information on persons responsible
    8182. 

  8182.                         for the domain.  Experimental.  Described in RFC 1183.
    8183. 

  8183.                       </p>
    8184. 

  8184.                     </td>
    8185. 

  8185. </tr>
    8186. 

  8186. <tr>
    8187. 

  8187. <td>
    8188. 

  8188.                       <p>
    8189. 

  8189.                         RRSIG
    8190. 

  8190.                       </p>
    8191. 

  8191.                     </td>
    8192. 

  8192. <td>
    8193. 

  8193.                       <p>
    8194. 

  8194.                         Contains DNSSECbis signature data.  Described
    8195. 

  8195.                         in RFC 4034.
    8196. 

  8196.                       </p>
    8197. 

  8197.                     </td>
    8198. 

  8198. </tr>
    8199. 

  8199. <tr>
    8200. 

  8200. <td>
    8201. 

  8201.                       <p>
    8202. 

  8202.                         RT
    8203. 

  8203.                       </p>
    8204. 

  8204.                     </td>
    8205. 

  8205. <td>
    8206. 

  8206.                       <p>
    8207. 

  8207.                         Route-through binding for hosts that
    8208. 

  8208.                         do not have their own direct wide area network
    8209. 

  8209.                         addresses.
    8210. 

  8210.                         Experimental.  Described in RFC 1183.
    8211. 

  8211.                       </p>
    8212. 

  8212.                     </td>
    8213. 

  8213. </tr>
    8214. 

  8214. <tr>
    8215. 

  8215. <td>
    8216. 

  8216.                       <p>
    8217. 

  8217.                         SIG
    8218. 

  8218.                       </p>
    8219. 

  8219.                     </td>
    8220. 

  8220. <td>
    8221. 

  8221.                       <p>
    8222. 

  8222.                         Contains DNSSEC signature data.  Used in
    8223. 

  8223.                         original DNSSEC; replaced by RRSIG in
    8224. 

  8224.                         DNSSECbis, but still used for SIG(0).
    8225. 

  8225.                         Described in RFCs 2535 and 2931.
    8226. 

  8226.                       </p>
    8227. 

  8227.                     </td>
    8228. 

  8228. </tr>
    8229. 

  8229. <tr>
    8230. 

  8230. <td>
    8231. 

  8231.                       <p>
    8232. 

  8232.                         SOA
    8233. 

  8233.                       </p>
    8234. 

  8234.                     </td>
    8235. 

  8235. <td>
    8236. 

  8236.                       <p>
    8237. 

  8237.                         Identifies the start of a zone of authority.
    8238. 

  8238.                         Described in RFC 1035.
    8239. 

  8239.                       </p>
    8240. 

  8240.                     </td>
    8241. 

  8241. </tr>
    8242. 

  8242. <tr>
    8243. 

  8243. <td>
    8244. 

  8244.                       <p>
    8245. 

  8245.                         SPF
    8246. 

  8246.                       </p>
    8247. 

  8247.                     </td>
    8248. 

  8248. <td>
    8249. 

  8249.                       <p>
    8250. 

  8250.                         Contains the Sender Policy Framework information
    8251. 

  8251.                         for a given email domain.  Described in RFC 4408.
    8252. 

  8252.                       </p>
    8253. 

  8253.                     </td>
    8254. 

  8254. </tr>
    8255. 

  8255. <tr>
    8256. 

  8256. <td>
    8257. 

  8257.                       <p>
    8258. 

  8258.                         SRV
    8259. 

  8259.                       </p>
    8260. 

  8260.                     </td>
    8261. 

  8261. <td>
    8262. 

  8262.                       <p>
    8263. 

  8263.                         Information about well known network
    8264. 

  8264.                         services (replaces WKS).  Described in RFC 2782.
    8265. 

  8265.                       </p>
    8266. 

  8266.                     </td>
    8267. 

  8267. </tr>
    8268. 

  8268. <tr>
    8269. 

  8269. <td>
    8270. 

  8270.                       <p>
    8271. 

  8271.                         SSHFP
    8272. 

  8272.                       </p>
    8273. 

  8273.                     </td>
    8274. 

  8274. <td>
    8275. 

  8275.                       <p>
    8276. 

  8276.                         Provides a way to securely publish a secure shell key's
    8277. 

  8277.                         fingerprint.  Described in RFC 4255.
    8278. 

  8278.                       </p>
    8279. 

  8279.                     </td>
    8280. 

  8280. </tr>
    8281. 

  8281. <tr>
    8282. 

  8282. <td>
    8283. 

  8283.                       <p>
    8284. 

  8284.                         TXT
    8285. 

  8285.                       </p>
    8286. 

  8286.                     </td>
    8287. 

  8287. <td>
    8288. 

  8288.                       <p>
    8289. 

  8289.                         Text records.  Described in RFC 1035.
    8290. 

  8290.                       </p>
    8291. 

  8291.                     </td>
    8292. 

  8292. </tr>
    8293. 

  8293. <tr>
    8294. 

  8294. <td>
    8295. 

  8295.                       <p>
    8296. 

  8296.                         WKS
    8297. 

  8297.                       </p>
    8298. 

  8298.                     </td>
    8299. 

  8299. <td>
    8300. 

  8300.                       <p>
    8301. 

  8301.                         Information about which well known
    8302. 

  8302.                         network services, such as SMTP, that a domain
    8303. 

  8303.                         supports. Historical.
    8304. 

  8304.                       </p>
    8305. 

  8305.                     </td>
    8306. 

  8306. </tr>
    8307. 

  8307. <tr>
    8308. 

  8308. <td>
    8309. 

  8309.                       <p>
    8310. 

  8310.                         X25
    8311. 

  8311.                       </p>
    8312. 

  8312.                     </td>
    8313. 

  8313. <td>
    8314. 

  8314.                       <p>
    8315. 

  8315.                         Representation of X.25 network addresses.
    8316. 

  8316.                         Experimental.  Described in RFC 1183.
    8317. 

  8317.                       </p>
    8318. 

  8318.                     </td>
    8319. 

  8319. </tr>
    8320. 

  8320. </tbody>
    8321. 

  8321. </table></div>
    8322. 

  8322. <p>
    8323. 

  8323.               The following <span class="emphasis"><em>classes</em></span> of resource records
    8324. 

  8324.               are currently valid in the DNS:
    8325. 

  8325.             </p>
    8326. 

  8326. <div class="informaltable"><table border="1">
    8327. 

  8327. <colgroup>
    8328. 

  8328. <col>
    8329. 

  8329. <col>
    8330. 

  8330. </colgroup>
    8331. 

  8331. <tbody>
    8332. 

  8332. <tr>
    8333. 

  8333. <td>
    8334. 

  8334.                       <p>
    8335. 

  8335.                         IN
    8336. 

  8336.                       </p>
    8337. 

  8337.                     </td>
    8338. 

  8338. <td>
    8339. 

  8339.                       <p>
    8340. 

  8340.                         The Internet.
    8341. 

  8341.                       </p>
    8342. 

  8342.                     </td>
    8343. 

  8343. </tr>
    8344. 

  8344. <tr>
    8345. 

  8345. <td>
    8346. 

  8346.                       <p>
    8347. 

  8347.                         CH
    8348. 

  8348.                       </p>
    8349. 

  8349.                     </td>
    8350. 

  8350. <td>
    8351. 

  8351.                       <p>
    8352. 

  8352.                         Chaosnet, a LAN protocol created at MIT in the
    8353. 

  8353.                         mid-1970s.
    8354. 

  8354.                         Rarely used for its historical purpose, but reused for
    8355. 

  8355.                         BIND's
    8356. 

  8356.                         built-in server information zones, e.g.,
    8357. 

  8357.                         <code class="literal">version.bind</code>.
    8358. 

  8358.                       </p>
    8359. 

  8359.                     </td>
    8360. 

  8360. </tr>
    8361. 

  8361. <tr>
    8362. 

  8362. <td>
    8363. 

  8363.                       <p>
    8364. 

  8364.                         HS
    8365. 

  8365.                       </p>
    8366. 

  8366.                     </td>
    8367. 

  8367. <td>
    8368. 

  8368.                       <p>
    8369. 

  8369.                         Hesiod, an information service
    8370. 

  8370.                         developed by MIT's Project Athena. It is used to share
    8371. 

  8371.                         information
    8372. 

  8372.                         about various systems databases, such as users,
    8373. 

  8373.                         groups, printers
    8374. 

  8374.                         and so on.
    8375. 

  8375.                       </p>
    8376. 

  8376.                     </td>
    8377. 

  8377. </tr>
    8378. 

  8378. </tbody>
    8379. 

  8379. </table></div>
    8380. 

  8380. <p>
    8381. 

  8381.               The owner name is often implicit, rather than forming an
    8382. 

  8382.               integral
    8383. 

  8383.               part of the RR.  For example, many name servers internally form
    8384. 

  8384.               tree
    8385. 

  8385.               or hash structures for the name space, and chain RRs off nodes.
    8386. 

  8386.               The remaining RR parts are the fixed header (type, class, TTL)
    8387. 

  8387.               which is consistent for all RRs, and a variable part (RDATA)
    8388. 

  8388.               that
    8389. 

  8389.               fits the needs of the resource being described.
    8390. 

  8390.             </p>
    8391. 

  8391. <p>
    8392. 

  8392.               The meaning of the TTL field is a time limit on how long an
    8393. 

  8393.               RR can be kept in a cache.  This limit does not apply to
    8394. 

  8394.               authoritative
    8395. 

  8395.               data in zones; it is also timed out, but by the refreshing
    8396. 

  8396.               policies
    8397. 

  8397.               for the zone.  The TTL is assigned by the administrator for the
    8398. 

  8398.               zone where the data originates.  While short TTLs can be used to
    8399. 

  8399.               minimize caching, and a zero TTL prohibits caching, the
    8400. 

  8400.               realities
    8401. 

  8401.               of Internet performance suggest that these times should be on
    8402. 

  8402.               the
    8403. 

  8403.               order of days for the typical host.  If a change can be
    8404. 

  8404.               anticipated,
    8405. 

  8405.               the TTL can be reduced prior to the change to minimize
    8406. 

  8406.               inconsistency
    8407. 

  8407.               during the change, and then increased back to its former value
    8408. 

  8408.               following
    8409. 

  8409.               the change.
    8410. 

  8410.             </p>
    8411. 

  8411. <p>
    8412. 

  8412.               The data in the RDATA section of RRs is carried as a combination
    8413. 

  8413.               of binary strings and domain names.  The domain names are
    8414. 

  8414.               frequently
    8415. 

  8415.               used as "pointers" to other data in the DNS.
    8416. 

  8416.             </p>
    8417. 

  8417. </div>
    8418. 

  8418. <div class="sect3" lang="en">
    8419. 

  8419. <div class="titlepage"><div><div><h4 class="title">
    8420. 

  8420. <a name="id2596826"></a>Textual expression of RRs</h4></div></div></div>
    8421. 

  8421. <p>
    8422. 

  8422.               RRs are represented in binary form in the packets of the DNS
    8423. 

  8423.               protocol, and are usually represented in highly encoded form
    8424. 

  8424.               when
    8425. 

  8425.               stored in a name server or resolver.  In the examples provided
    8426. 

  8426.               in
    8427. 

  8427.               RFC 1034, a style similar to that used in master files was
    8428. 

  8428.               employed
    8429. 

  8429.               in order to show the contents of RRs.  In this format, most RRs
    8430. 

  8430.               are shown on a single line, although continuation lines are
    8431. 

  8431.               possible
    8432. 

  8432.               using parentheses.
    8433. 

  8433.             </p>
    8434. 

  8434. <p>
    8435. 

  8435.               The start of the line gives the owner of the RR.  If a line
    8436. 

  8436.               begins with a blank, then the owner is assumed to be the same as
    8437. 

  8437.               that of the previous RR.  Blank lines are often included for
    8438. 

  8438.               readability.
    8439. 

  8439.             </p>
    8440. 

  8440. <p>
    8441. 

  8441.               Following the owner, we list the TTL, type, and class of the
    8442. 

  8442.               RR.  Class and type use the mnemonics defined above, and TTL is
    8443. 

  8443.               an integer before the type field.  In order to avoid ambiguity
    8444. 

  8444.               in
    8445. 

  8445.               parsing, type and class mnemonics are disjoint, TTLs are
    8446. 

  8446.               integers,
    8447. 

  8447.               and the type mnemonic is always last. The IN class and TTL
    8448. 

  8448.               values
    8449. 

  8449.               are often omitted from examples in the interests of clarity.
    8450. 

  8450.             </p>
    8451. 

  8451. <p>
    8452. 

  8452.               The resource data or RDATA section of the RR are given using
    8453. 

  8453.               knowledge of the typical representation for the data.
    8454. 

  8454.             </p>
    8455. 

  8455. <p>
    8456. 

  8456.               For example, we might show the RRs carried in a message as:
    8457. 

  8457.             </p>
    8458. 

  8458. <div class="informaltable"><table border="1">
    8459. 

  8459. <colgroup>
    8460. 

  8460. <col>
    8461. 

  8461. <col>
    8462. 

  8462. <col>
    8463. 

  8463. </colgroup>
    8464. 

  8464. <tbody>
    8465. 

  8465. <tr>
    8466. 

  8466. <td>
    8467. 

  8467.                       <p>
    8468. 

  8468.                         <code class="literal">ISI.EDU.</code>
    8469. 

  8469.                       </p>
    8470. 

  8470.                     </td>
    8471. 

  8471. <td>
    8472. 

  8472.                       <p>
    8473. 

  8473.                         <code class="literal">MX</code>
    8474. 

  8474.                       </p>
    8475. 

  8475.                     </td>
    8476. 

  8476. <td>
    8477. 

  8477.                       <p>
    8478. 

  8478.                         <code class="literal">10 VENERA.ISI.EDU.</code>
    8479. 

  8479.                       </p>
    8480. 

  8480.                     </td>
    8481. 

  8481. </tr>
    8482. 

  8482. <tr>
    8483. 

  8483. <td>
    8484. 

  8484.                       <p></p>
    8485. 

  8485.                     </td>
    8486. 

  8486. <td>
    8487. 

  8487.                       <p>
    8488. 

  8488.                         <code class="literal">MX</code>
    8489. 

  8489.                       </p>
    8490. 

  8490.                     </td>
    8491. 

  8491. <td>
    8492. 

  8492.                       <p>
    8493. 

  8493.                         <code class="literal">10 VAXA.ISI.EDU</code>
    8494. 

  8494.                       </p>
    8495. 

  8495.                     </td>
    8496. 

  8496. </tr>
    8497. 

  8497. <tr>
    8498. 

  8498. <td>
    8499. 

  8499.                       <p>
    8500. 

  8500.                         <code class="literal">VENERA.ISI.EDU</code>
    8501. 

  8501.                       </p>
    8502. 

  8502.                     </td>
    8503. 

  8503. <td>
    8504. 

  8504.                       <p>
    8505. 

  8505.                         <code class="literal">A</code>
    8506. 

  8506.                       </p>
    8507. 

  8507.                     </td>
    8508. 

  8508. <td>
    8509. 

  8509.                       <p>
    8510. 

  8510.                         <code class="literal">128.9.0.32</code>
    8511. 

  8511.                       </p>
    8512. 

  8512.                     </td>
    8513. 

  8513. </tr>
    8514. 

  8514. <tr>
    8515. 

  8515. <td>
    8516. 

  8516.                       <p></p>
    8517. 

  8517.                     </td>
    8518. 

  8518. <td>
    8519. 

  8519.                       <p>
    8520. 

  8520.                         <code class="literal">A</code>
    8521. 

  8521.                       </p>
    8522. 

  8522.                     </td>
    8523. 

  8523. <td>
    8524. 

  8524.                       <p>
    8525. 

  8525.                         <code class="literal">10.1.0.52</code>
    8526. 

  8526.                       </p>
    8527. 

  8527.                     </td>
    8528. 

  8528. </tr>
    8529. 

  8529. <tr>
    8530. 

  8530. <td>
    8531. 

  8531.                       <p>
    8532. 

  8532.                         <code class="literal">VAXA.ISI.EDU</code>
    8533. 

  8533.                       </p>
    8534. 

  8534.                     </td>
    8535. 

  8535. <td>
    8536. 

  8536.                       <p>
    8537. 

  8537.                         <code class="literal">A</code>
    8538. 

  8538.                       </p>
    8539. 

  8539.                     </td>
    8540. 

  8540. <td>
    8541. 

  8541.                       <p>
    8542. 

  8542.                         <code class="literal">10.2.0.27</code>
    8543. 

  8543.                       </p>
    8544. 

  8544.                     </td>
    8545. 

  8545. </tr>
    8546. 

  8546. <tr>
    8547. 

  8547. <td>
    8548. 

  8548.                       <p></p>
    8549. 

  8549.                     </td>
    8550. 

  8550. <td>
    8551. 

  8551.                       <p>
    8552. 

  8552.                         <code class="literal">A</code>
    8553. 

  8553.                       </p>
    8554. 

  8554.                     </td>
    8555. 

  8555. <td>
    8556. 

  8556.                       <p>
    8557. 

  8557.                         <code class="literal">128.9.0.33</code>
    8558. 

  8558.                       </p>
    8559. 

  8559.                     </td>
    8560. 

  8560. </tr>
    8561. 

  8561. </tbody>
    8562. 

  8562. </table></div>
    8563. 

  8563. <p>
    8564. 

  8564.               The MX RRs have an RDATA section which consists of a 16-bit
    8565. 

  8565.               number followed by a domain name.  The address RRs use a
    8566. 

  8566.               standard
    8567. 

  8567.               IP address format to contain a 32-bit internet address.
    8568. 

  8568.             </p>
    8569. 

  8569. <p>
    8570. 

  8570.               The above example shows six RRs, with two RRs at each of three
    8571. 

  8571.               domain names.
    8572. 

  8572.             </p>
    8573. 

  8573. <p>
    8574. 

  8574.               Similarly we might see:
    8575. 

  8575.             </p>
    8576. 

  8576. <div class="informaltable"><table border="1">
    8577. 

  8577. <colgroup>
    8578. 

  8578. <col>
    8579. 

  8579. <col>
    8580. 

  8580. <col>
    8581. 

  8581. </colgroup>
    8582. 

  8582. <tbody>
    8583. 

  8583. <tr>
    8584. 

  8584. <td>
    8585. 

  8585.                       <p>
    8586. 

  8586.                         <code class="literal">XX.LCS.MIT.EDU.</code>
    8587. 

  8587.                       </p>
    8588. 

  8588.                     </td>
    8589. 

  8589. <td>
    8590. 

  8590.                       <p>
    8591. 

  8591.                         <code class="literal">IN A</code>
    8592. 

  8592.                       </p>
    8593. 

  8593.                     </td>
    8594. 

  8594. <td>
    8595. 

  8595.                       <p>
    8596. 

  8596.                         <code class="literal">10.0.0.44</code>
    8597. 

  8597.                       </p>
    8598. 

  8598.                     </td>
    8599. 

  8599. </tr>
    8600. 

  8600. <tr>
    8601. 

  8601. <td> </td>
    8602. 

  8602. <td>
    8603. 

  8603.                       <p>
    8604. 

  8604.                         <code class="literal">CH A</code>
    8605. 

  8605.                       </p>
    8606. 

  8606.                     </td>
    8607. 

  8607. <td>
    8608. 

  8608.                       <p>
    8609. 

  8609.                         <code class="literal">MIT.EDU. 2420</code>
    8610. 

  8610.                       </p>
    8611. 

  8611.                     </td>
    8612. 

  8612. </tr>
    8613. 

  8613. </tbody>
    8614. 

  8614. </table></div>
    8615. 

  8615. <p>
    8616. 

  8616.               This example shows two addresses for
    8617. 

  8617.               <code class="literal">XX.LCS.MIT.EDU</code>, each of a different class.
    8618. 

  8618.             </p>
    8619. 

  8619. </div>
    8620. 

  8620. </div>
    8621. 

  8621. <div class="sect2" lang="en">
    8622. 

  8622. <div class="titlepage"><div><div><h3 class="title">
    8623. 

  8623. <a name="id2597415"></a>Discussion of MX Records</h3></div></div></div>
    8624. 

  8624. <p>
    8625. 

  8625.             As described above, domain servers store information as a
    8626. 

  8626.             series of resource records, each of which contains a particular
    8627. 

  8627.             piece of information about a given domain name (which is usually,
    8628. 

  8628.             but not always, a host). The simplest way to think of a RR is as
    8629. 

  8629.             a typed pair of data, a domain name matched with a relevant datum,
    8630. 

  8630.             and stored with some additional type information to help systems
    8631. 

  8631.             determine when the RR is relevant.
    8632. 

  8632.           </p>
    8633. 

  8633. <p>
    8634. 

  8634.             MX records are used to control delivery of email. The data
    8635. 

  8635.             specified in the record is a priority and a domain name. The
    8636. 

  8636.             priority
    8637. 

  8637.             controls the order in which email delivery is attempted, with the
    8638. 

  8638.             lowest number first. If two priorities are the same, a server is
    8639. 

  8639.             chosen randomly. If no servers at a given priority are responding,
    8640. 

  8640.             the mail transport agent will fall back to the next largest
    8641. 

  8641.             priority.
    8642. 

  8642.             Priority numbers do not have any absolute meaning &#8212; they are
    8643. 

  8643.             relevant
    8644. 

  8644.             only respective to other MX records for that domain name. The
    8645. 

  8645.             domain
    8646. 

  8646.             name given is the machine to which the mail will be delivered.
    8647. 

  8647.             It <span class="emphasis"><em>must</em></span> have an associated address record
    8648. 

  8648.             (A or AAAA) &#8212; CNAME is not sufficient.
    8649. 

  8649.           </p>
    8650. 

  8650. <p>
    8651. 

  8651.             For a given domain, if there is both a CNAME record and an
    8652. 

  8652.             MX record, the MX record is in error, and will be ignored.
    8653. 

  8653.             Instead,
    8654. 

  8654.             the mail will be delivered to the server specified in the MX
    8655. 

  8655.             record
    8656. 

  8656.             pointed to by the CNAME.
    8657. 

  8657.             For example:
    8658. 

  8658.           </p>
    8659. 

  8659. <div class="informaltable"><table border="1">
    8660. 

  8660. <colgroup>
    8661. 

  8661. <col>
    8662. 

  8662. <col>
    8663. 

  8663. <col>
    8664. 

  8664. <col>
    8665. 

  8665. <col>
    8666. 

  8666. </colgroup>
    8667. 

  8667. <tbody>
    8668. 

  8668. <tr>
    8669. 

  8669. <td>
    8670. 

  8670.                     <p>
    8671. 

  8671.                       <code class="literal">example.com.</code>
    8672. 

  8672.                     </p>
    8673. 

  8673.                   </td>
    8674. 

  8674. <td>
    8675. 

  8675.                     <p>
    8676. 

  8676.                       <code class="literal">IN</code>
    8677. 

  8677.                     </p>
    8678. 

  8678.                   </td>
    8679. 

  8679. <td>
    8680. 

  8680.                     <p>
    8681. 

  8681.                       <code class="literal">MX</code>
    8682. 

  8682.                     </p>
    8683. 

  8683.                   </td>
    8684. 

  8684. <td>
    8685. 

  8685.                     <p>
    8686. 

  8686.                       <code class="literal">10</code>
    8687. 

  8687.                     </p>
    8688. 

  8688.                   </td>
    8689. 

  8689. <td>
    8690. 

  8690.                     <p>
    8691. 

  8691.                       <code class="literal">mail.example.com.</code>
    8692. 

  8692.                     </p>
    8693. 

  8693.                   </td>
    8694. 

  8694. </tr>
    8695. 

  8695. <tr>
    8696. 

  8696. <td>
    8697. 

  8697.                     <p></p>
    8698. 

  8698.                   </td>
    8699. 

  8699. <td>
    8700. 

  8700.                     <p>
    8701. 

  8701.                       <code class="literal">IN</code>
    8702. 

  8702.                     </p>
    8703. 

  8703.                   </td>
    8704. 

  8704. <td>
    8705. 

  8705.                     <p>
    8706. 

  8706.                       <code class="literal">MX</code>
    8707. 

  8707.                     </p>
    8708. 

  8708.                   </td>
    8709. 

  8709. <td>
    8710. 

  8710.                     <p>
    8711. 

  8711.                       <code class="literal">10</code>
    8712. 

  8712.                     </p>
    8713. 

  8713.                   </td>
    8714. 

  8714. <td>
    8715. 

  8715.                     <p>
    8716. 

  8716.                       <code class="literal">mail2.example.com.</code>
    8717. 

  8717.                     </p>
    8718. 

  8718.                   </td>
    8719. 

  8719. </tr>
    8720. 

  8720. <tr>
    8721. 

  8721. <td>
    8722. 

  8722.                     <p></p>
    8723. 

  8723.                   </td>
    8724. 

  8724. <td>
    8725. 

  8725.                     <p>
    8726. 

  8726.                       <code class="literal">IN</code>
    8727. 

  8727.                     </p>
    8728. 

  8728.                   </td>
    8729. 

  8729. <td>
    8730. 

  8730.                     <p>
    8731. 

  8731.                       <code class="literal">MX</code>
    8732. 

  8732.                     </p>
    8733. 

  8733.                   </td>
    8734. 

  8734. <td>
    8735. 

  8735.                     <p>
    8736. 

  8736.                       <code class="literal">20</code>
    8737. 

  8737.                     </p>
    8738. 

  8738.                   </td>
    8739. 

  8739. <td>
    8740. 

  8740.                     <p>
    8741. 

  8741.                       <code class="literal">mail.backup.org.</code>
    8742. 

  8742.                     </p>
    8743. 

  8743.                   </td>
    8744. 

  8744. </tr>
    8745. 

  8745. <tr>
    8746. 

  8746. <td>
    8747. 

  8747.                     <p>
    8748. 

  8748.                       <code class="literal">mail.example.com.</code>
    8749. 

  8749.                     </p>
    8750. 

  8750.                   </td>
    8751. 

  8751. <td>
    8752. 

  8752.                     <p>
    8753. 

  8753.                       <code class="literal">IN</code>
    8754. 

  8754.                     </p>
    8755. 

  8755.                   </td>
    8756. 

  8756. <td>
    8757. 

  8757.                     <p>
    8758. 

  8758.                       <code class="literal">A</code>
    8759. 

  8759.                     </p>
    8760. 

  8760.                   </td>
    8761. 

  8761. <td>
    8762. 

  8762.                     <p>
    8763. 

  8763.                       <code class="literal">10.0.0.1</code>
    8764. 

  8764.                     </p>
    8765. 

  8765.                   </td>
    8766. 

  8766. <td>
    8767. 

  8767.                     <p></p>
    8768. 

  8768.                   </td>
    8769. 

  8769. </tr>
    8770. 

  8770. <tr>
    8771. 

  8771. <td>
    8772. 

  8772.                     <p>
    8773. 

  8773.                       <code class="literal">mail2.example.com.</code>
    8774. 

  8774.                     </p>
    8775. 

  8775.                   </td>
    8776. 

  8776. <td>
    8777. 

  8777.                     <p>
    8778. 

  8778.                       <code class="literal">IN</code>
    8779. 

  8779.                     </p>
    8780. 

  8780.                   </td>
    8781. 

  8781. <td>
    8782. 

  8782.                     <p>
    8783. 

  8783.                       <code class="literal">A</code>
    8784. 

  8784.                     </p>
    8785. 

  8785.                   </td>
    8786. 

  8786. <td>
    8787. 

  8787.                     <p>
    8788. 

  8788.                       <code class="literal">10.0.0.2</code>
    8789. 

  8789.                     </p>
    8790. 

  8790.                   </td>
    8791. 

  8791. <td>
    8792. 

  8792.                     <p></p>
    8793. 

  8793.                   </td>
    8794. 

  8794. </tr>
    8795. 

  8795. </tbody>
    8796. 

  8796. </table></div>
    8797. 

  8797. <p>
    8798. 

  8798.             Mail delivery will be attempted to <code class="literal">mail.example.com</code> and
    8799. 

  8799.             <code class="literal">mail2.example.com</code> (in
    8800. 

  8800.             any order), and if neither of those succeed, delivery to <code class="literal">mail.backup.org</code> will
    8801. 

  8801.             be attempted.
    8802. 

  8802.           </p>
    8803. 

  8803. </div>
    8804. 

  8804. <div class="sect2" lang="en">
    8805. 

  8805. <div class="titlepage"><div><div><h3 class="title">
    8806. 

  8806. <a name="Setting_TTLs"></a>Setting TTLs</h3></div></div></div>
    8807. 

  8807. <p>
    8808. 

  8808.             The time-to-live of the RR field is a 32-bit integer represented
    8809. 

  8809.             in units of seconds, and is primarily used by resolvers when they
    8810. 

  8810.             cache RRs. The TTL describes how long a RR can be cached before it
    8811. 

  8811.             should be discarded. The following three types of TTL are
    8812. 

  8812.             currently
    8813. 

  8813.             used in a zone file.
    8814. 

  8814.           </p>
    8815. 

  8815. <div class="informaltable"><table border="1">
    8816. 

  8816. <colgroup>
    8817. 

  8817. <col>
    8818. 

  8818. <col>
    8819. 

  8819. </colgroup>
    8820. 

  8820. <tbody>
    8821. 

  8821. <tr>
    8822. 

  8822. <td>
    8823. 

  8823.                     <p>
    8824. 

  8824.                       SOA
    8825. 

  8825.                     </p>
    8826. 

  8826.                   </td>
    8827. 

  8827. <td>
    8828. 

  8828.                     <p>
    8829. 

  8829.                       The last field in the SOA is the negative
    8830. 

  8830.                       caching TTL. This controls how long other servers will
    8831. 

  8831.                       cache no-such-domain
    8832. 

  8832.                       (NXDOMAIN) responses from you.
    8833. 

  8833.                     </p>
    8834. 

  8834.                     <p>
    8835. 

  8835.                       The maximum time for
    8836. 

  8836.                       negative caching is 3 hours (3h).
    8837. 

  8837.                     </p>
    8838. 

  8838.                   </td>
    8839. 

  8839. </tr>
    8840. 

  8840. <tr>
    8841. 

  8841. <td>
    8842. 

  8842.                     <p>
    8843. 

  8843.                       $TTL
    8844. 

  8844.                     </p>
    8845. 

  8845.                   </td>
    8846. 

  8846. <td>
    8847. 

  8847.                     <p>
    8848. 

  8848.                       The $TTL directive at the top of the
    8849. 

  8849.                       zone file (before the SOA) gives a default TTL for every
    8850. 

  8850.                       RR without
    8851. 

  8851.                       a specific TTL set.
    8852. 

  8852.                     </p>
    8853. 

  8853.                   </td>
    8854. 

  8854. </tr>
    8855. 

  8855. <tr>
    8856. 

  8856. <td>
    8857. 

  8857.                     <p>
    8858. 

  8858.                       RR TTLs
    8859. 

  8859.                     </p>
    8860. 

  8860.                   </td>
    8861. 

  8861. <td>
    8862. 

  8862.                     <p>
    8863. 

  8863.                       Each RR can have a TTL as the second
    8864. 

  8864.                       field in the RR, which will control how long other
    8865. 

  8865.                       servers can cache
    8866. 

  8866.                       the it.
    8867. 

  8867.                     </p>
    8868. 

  8868.                   </td>
    8869. 

  8869. </tr>
    8870. 

  8870. </tbody>
    8871. 

  8871. </table></div>
    8872. 

  8872. <p>
    8873. 

  8873.             All of these TTLs default to units of seconds, though units
    8874. 

  8874.             can be explicitly specified, for example, <code class="literal">1h30m</code>.
    8875. 

  8875.           </p>
    8876. 

  8876. </div>
    8877. 

  8877. <div class="sect2" lang="en">
    8878. 

  8878. <div class="titlepage"><div><div><h3 class="title">
    8879. 

  8879. <a name="id2597962"></a>Inverse Mapping in IPv4</h3></div></div></div>
    8880. 

  8880. <p>
    8881. 

  8881.             Reverse name resolution (that is, translation from IP address
    8882. 

  8882.             to name) is achieved by means of the <span class="emphasis"><em>in-addr.arpa</em></span> domain
    8883. 

  8883.             and PTR records. Entries in the in-addr.arpa domain are made in
    8884. 

  8884.             least-to-most significant order, read left to right. This is the
    8885. 

  8885.             opposite order to the way IP addresses are usually written. Thus,
    8886. 

  8886.             a machine with an IP address of 10.1.2.3 would have a
    8887. 

  8887.             corresponding
    8888. 

  8888.             in-addr.arpa name of
    8889. 

  8889.             3.2.1.10.in-addr.arpa. This name should have a PTR resource record
    8890. 

  8890.             whose data field is the name of the machine or, optionally,
    8891. 

  8891.             multiple
    8892. 

  8892.             PTR records if the machine has more than one name. For example,
    8893. 

  8893.             in the [<span class="optional">example.com</span>] domain:
    8894. 

  8894.           </p>
    8895. 

  8895. <div class="informaltable"><table border="1">
    8896. 

  8896. <colgroup>
    8897. 

  8897. <col>
    8898. 

  8898. <col>
    8899. 

  8899. </colgroup>
    8900. 

  8900. <tbody>
    8901. 

  8901. <tr>
    8902. 

  8902. <td>
    8903. 

  8903.                     <p>
    8904. 

  8904.                       <code class="literal">$ORIGIN</code>
    8905. 

  8905.                     </p>
    8906. 

  8906.                   </td>
    8907. 

  8907. <td>
    8908. 

  8908.                     <p>
    8909. 

  8909.                       <code class="literal">2.1.10.in-addr.arpa</code>
    8910. 

  8910.                     </p>
    8911. 

  8911.                   </td>
    8912. 

  8912. </tr>
    8913. 

  8913. <tr>
    8914. 

  8914. <td>
    8915. 

  8915.                     <p>
    8916. 

  8916.                       <code class="literal">3</code>
    8917. 

  8917.                     </p>
    8918. 

  8918.                   </td>
    8919. 

  8919. <td>
    8920. 

  8920.                     <p>
    8921. 

  8921.                       <code class="literal">IN PTR foo.example.com.</code>
    8922. 

  8922.                     </p>
    8923. 

  8923.                   </td>
    8924. 

  8924. </tr>
    8925. 

  8925. </tbody>
    8926. 

  8926. </table></div>
    8927. 

  8927. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    8928. 

  8928. <h3 class="title">Note</h3>
    8929. 

  8929. <p>
    8930. 

  8930.               The <span><strong class="command">$ORIGIN</strong></span> lines in the examples
    8931. 

  8931.               are for providing context to the examples only &#8212; they do not
    8932. 

  8932.               necessarily
    8933. 

  8933.               appear in the actual usage. They are only used here to indicate
    8934. 

  8934.               that the example is relative to the listed origin.
    8935. 

  8935.             </p>
    8936. 

  8936. </div>
    8937. 

  8937. </div>
    8938. 

  8938. <div class="sect2" lang="en">
    8939. 

  8939. <div class="titlepage"><div><div><h3 class="title">
    8940. 

  8940. <a name="id2598157"></a>Other Zone File Directives</h3></div></div></div>
    8941. 

  8941. <p>
    8942. 

  8942.             The Master File Format was initially defined in RFC 1035 and
    8943. 

  8943.             has subsequently been extended. While the Master File Format
    8944. 

  8944.             itself
    8945. 

  8945.             is class independent all records in a Master File must be of the
    8946. 

  8946.             same
    8947. 

  8947.             class.
    8948. 

  8948.           </p>
    8949. 

  8949. <p>
    8950. 

  8950.             Master File Directives include <span><strong class="command">$ORIGIN</strong></span>, <span><strong class="command">$INCLUDE</strong></span>,
    8951. 

  8951.             and <span><strong class="command">$TTL.</strong></span>
    8952. 

  8952.           </p>
    8953. 

  8953. <div class="sect3" lang="en">
    8954. 

  8954. <div class="titlepage"><div><div><h4 class="title">
    8955. 

  8955. <a name="id2598180"></a>The <span><strong class="command">@</strong></span> (at-sign)</h4></div></div></div>
    8956. 

  8956. <p>
    8957. 

  8957.               When used in the label (or name) field, the asperand or
    8958. 

  8958.               at-sign (@) symbol represents the current origin.
    8959. 

  8959.               At the start of the zone file, it is the 
    8960. 

  8960.               &lt;<code class="varname">zone_name</code>&gt; (followed by
    8961. 

  8961.               trailing dot).
    8962. 

  8962.             </p>
    8963. 

  8963. </div>
    8964. 

  8964. <div class="sect3" lang="en">
    8965. 

  8965. <div class="titlepage"><div><div><h4 class="title">
    8966. 

  8966. <a name="id2598196"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div>
    8967. 

  8967. <p>
    8968. 

  8968.               Syntax: <span><strong class="command">$ORIGIN</strong></span>
    8969. 

  8969.               <em class="replaceable"><code>domain-name</code></em>
    8970. 

  8970.               [<span class="optional"><em class="replaceable"><code>comment</code></em></span>]
    8971. 

  8971.             </p>
    8972. 

  8972. <p><span><strong class="command">$ORIGIN</strong></span>
    8973. 

  8973.               sets the domain name that will be appended to any
    8974. 

  8974.               unqualified records. When a zone is first read in there
    8975. 

  8975.               is an implicit <span><strong class="command">$ORIGIN</strong></span>
    8976. 

  8976.               &lt;<code class="varname">zone_name</code>&gt;<span><strong class="command">.</strong></span>
    8977. 

  8977.               (followed by trailing dot).
    8978. 

  8978.               The current <span><strong class="command">$ORIGIN</strong></span> is appended to
    8979. 

  8979.               the domain specified in the <span><strong class="command">$ORIGIN</strong></span>
    8980. 

  8980.               argument if it is not absolute.
    8981. 

  8981.             </p>
    8982. 

  8982. <pre class="programlisting">
    8983. 

  8983. $ORIGIN example.com.
    8984. 

  8984. WWW     CNAME   MAIN-SERVER
    8985. 

  8985. </pre>
    8986. 

  8986. <p>
    8987. 

  8987.               is equivalent to
    8988. 

  8988.             </p>
    8989. 

  8989. <pre class="programlisting">
    8990. 

  8990. WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.
    8991. 

  8991. </pre>
    8992. 

  8992. </div>
    8993. 

  8993. <div class="sect3" lang="en">
    8994. 

  8994. <div class="titlepage"><div><div><h4 class="title">
    8995. 

  8995. <a name="id2598325"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div>
    8996. 

  8996. <p>
    8997. 

  8997.               Syntax: <span><strong class="command">$INCLUDE</strong></span>
    8998. 

  8998.               <em class="replaceable"><code>filename</code></em>
    8999. 

  8999.               [<span class="optional">
    9000. 

  9000. <em class="replaceable"><code>origin</code></em> </span>]
    9001. 

  9001.               [<span class="optional"> <em class="replaceable"><code>comment</code></em> </span>]
    9002. 

  9002.             </p>
    9003. 

  9003. <p>
    9004. 

  9004.               Read and process the file <code class="filename">filename</code> as
    9005. 

  9005.               if it were included into the file at this point.  If <span><strong class="command">origin</strong></span> is
    9006. 

  9006.               specified the file is processed with <span><strong class="command">$ORIGIN</strong></span> set
    9007. 

  9007.               to that value, otherwise the current <span><strong class="command">$ORIGIN</strong></span> is
    9008. 

  9008.               used.
    9009. 

  9009.             </p>
    9010. 

  9010. <p>
    9011. 

  9011.               The origin and the current domain name
    9012. 

  9012.               revert to the values they had prior to the <span><strong class="command">$INCLUDE</strong></span> once
    9013. 

  9013.               the file has been read.
    9014. 

  9014.             </p>
    9015. 

  9015. <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    9016. 

  9016. <h3 class="title">Note</h3>
    9017. 

  9017. <p>
    9018. 

  9018.                 RFC 1035 specifies that the current origin should be restored
    9019. 

  9019.                 after
    9020. 

  9020.                 an <span><strong class="command">$INCLUDE</strong></span>, but it is silent
    9021. 

  9021.                 on whether the current
    9022. 

  9022.                 domain name should also be restored.  BIND 9 restores both of
    9023. 

  9023.                 them.
    9024. 

  9024.                 This could be construed as a deviation from RFC 1035, a
    9025. 

  9025.                 feature, or both.
    9026. 

  9026.               </p>
    9027. 

  9027. </div>
    9028. 

  9028. </div>
    9029. 

  9029. <div class="sect3" lang="en">
    9030. 

  9030. <div class="titlepage"><div><div><h4 class="title">
    9031. 

  9031. <a name="id2598394"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div>
    9032. 

  9032. <p>
    9033. 

  9033.               Syntax: <span><strong class="command">$TTL</strong></span>
    9034. 

  9034.               <em class="replaceable"><code>default-ttl</code></em>
    9035. 

  9035.               [<span class="optional">
    9036. 

  9036. <em class="replaceable"><code>comment</code></em> </span>]
    9037. 

  9037.             </p>
    9038. 

  9038. <p>
    9039. 

  9039.               Set the default Time To Live (TTL) for subsequent records
    9040. 

  9040.               with undefined TTLs. Valid TTLs are of the range 0-2147483647
    9041. 

  9041.               seconds.
    9042. 

  9042.             </p>
    9043. 

  9043. <p><span><strong class="command">$TTL</strong></span>
    9044. 

  9044.                is defined in RFC 2308.
    9045. 

  9045.             </p>
    9046. 

  9046. </div>
    9047. 

  9047. </div>
    9048. 

  9048. <div class="sect2" lang="en">
    9049. 

  9049. <div class="titlepage"><div><div><h3 class="title">
    9050. 

  9050. <a name="id2598430"></a><acronym class="acronym">BIND</acronym> Master File Extension: the  <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div>
    9051. 

  9051. <p>
    9052. 

  9052.             Syntax: <span><strong class="command">$GENERATE</strong></span>
    9053. 

  9053.             <em class="replaceable"><code>range</code></em>
    9054. 

  9054.             <em class="replaceable"><code>lhs</code></em>
    9055. 

  9055.             [<span class="optional"><em class="replaceable"><code>ttl</code></em></span>]
    9056. 

  9056.             [<span class="optional"><em class="replaceable"><code>class</code></em></span>]
    9057. 

  9057.             <em class="replaceable"><code>type</code></em>
    9058. 

  9058.             <em class="replaceable"><code>rhs</code></em>
    9059. 

  9059.             [<span class="optional"><em class="replaceable"><code>comment</code></em></span>]
    9060. 

  9060.           </p>
    9061. 

  9061. <p><span><strong class="command">$GENERATE</strong></span>
    9062. 

  9062.             is used to create a series of resource records that only
    9063. 

  9063.             differ from each other by an
    9064. 

  9064.             iterator. <span><strong class="command">$GENERATE</strong></span> can be used to
    9065. 

  9065.             easily generate the sets of records required to support
    9066. 

  9066.             sub /24 reverse delegations described in RFC 2317:
    9067. 

  9067.             Classless IN-ADDR.ARPA delegation.
    9068. 

  9068.           </p>
    9069. 

  9069. <pre class="programlisting">$ORIGIN 0.0.192.IN-ADDR.ARPA.
    9070. 

  9070. $GENERATE 1-2 @ NS SERVER$.EXAMPLE.
    9071. 

  9071. $GENERATE 1-127 $ CNAME $.0</pre>
    9072. 

  9072. <p>
    9073. 

  9073.             is equivalent to
    9074. 

  9074.           </p>
    9075. 

  9075. <pre class="programlisting">0.0.0.192.IN-ADDR.ARPA. NS SERVER1.EXAMPLE.
    9076. 

  9076. 0.0.0.192.IN-ADDR.ARPA. NS SERVER2.EXAMPLE.
    9077. 

  9077. 1.0.0.192.IN-ADDR.ARPA. CNAME 1.0.0.0.192.IN-ADDR.ARPA.
    9078. 

  9078. 2.0.0.192.IN-ADDR.ARPA. CNAME 2.0.0.0.192.IN-ADDR.ARPA.
    9079. 

  9079. ...
    9080. 

  9080. 127.0.0.192.IN-ADDR.ARPA. CNAME 127.0.0.0.192.IN-ADDR.ARPA.
    9081. 

  9081. </pre>
    9082. 

  9082. <p>
    9083. 

  9083.             Generate a set of A and MX records.  Note the MX's right hand
    9084. 

  9084.             side is a quoted string.  The quotes will be stripped when the
    9085. 

  9085.             right hand side is processed.
    9086. 

  9086.            </p>
    9087. 

  9087. <pre class="programlisting">
    9088. 

  9088. $ORIGIN EXAMPLE.
    9089. 

  9089. $GENERATE 1-127 HOST-$ A 1.2.3.$
    9090. 

  9090. $GENERATE 1-127 HOST-$ MX "0 ."</pre>
    9091. 

  9091. <p>
    9092. 

  9092.             is equivalent to
    9093. 

  9093.           </p>
    9094. 

  9094. <pre class="programlisting">HOST-1.EXAMPLE.   A  1.2.3.1
    9095. 

  9095. HOST-1.EXAMPLE.   MX 0 .
    9096. 

  9096. HOST-2.EXAMPLE.   A  1.2.3.2
    9097. 

  9097. HOST-2.EXAMPLE.   MX 0 .
    9098. 

  9098. HOST-3.EXAMPLE.   A  1.2.3.3
    9099. 

  9099. HOST-3.EXAMPLE.   MX 0 .
    9100. 

  9100. ...
    9101. 

  9101. HOST-127.EXAMPLE. A  1.2.3.127
    9102. 

  9102. HOST-127.EXAMPLE. MX 0 .
    9103. 

  9103. </pre>
    9104. 

  9104. <div class="informaltable"><table border="1">
    9105. 

  9105. <colgroup>
    9106. 

  9106. <col>
    9107. 

  9107. <col>
    9108. 

  9108. </colgroup>
    9109. 

  9109. <tbody>
    9110. 

  9110. <tr>
    9111. 

  9111. <td>
    9112. 

  9112.                     <p><span><strong class="command">range</strong></span></p>
    9113. 

  9113.                   </td>
    9114. 

  9114. <td>
    9115. 

  9115.                     <p>
    9116. 

  9116.                       This can be one of two forms: start-stop
    9117. 

  9117.                       or start-stop/step. If the first form is used, then step
    9118. 

  9118.                       is set to
    9119. 

  9119.                       1. All of start, stop and step must be positive.
    9120. 

  9120.                     </p>
    9121. 

  9121.                   </td>
    9122. 

  9122. </tr>
    9123. 

  9123. <tr>
    9124. 

  9124. <td>
    9125. 

  9125.                     <p><span><strong class="command">lhs</strong></span></p>
    9126. 

  9126.                   </td>
    9127. 

  9127. <td>
    9128. 

  9128.                     <p>This
    9129. 

  9129.                       describes the owner name of the resource records
    9130. 

  9130.                       to be created.  Any single <span><strong class="command">$</strong></span>
    9131. 

  9131.                       (dollar sign)
    9132. 

  9132.                       symbols within the <span><strong class="command">lhs</strong></span> string
    9133. 

  9133.                       are replaced by the iterator value.
    9134. 

    9135. 

  9135.                       To get a $ in the output, you need to escape the
    9136. 

  9136.                       <span><strong class="command">$</strong></span> using a backslash
    9137. 

  9137.                       <span><strong class="command">\</strong></span>,
    9138. 

  9138.                       e.g. <span><strong class="command">\$</strong></span>. The
    9139. 

  9139.                       <span><strong class="command">$</strong></span> may optionally be followed
    9140. 

  9140.                       by modifiers which change the offset from the
    9141. 

  9141.                       iterator, field width and base.
    9142. 

    9143. 

  9143.                       Modifiers are introduced by a
    9144. 

  9144.                       <span><strong class="command">{</strong></span> (left brace) immediately following the
    9145. 

  9145.                       <span><strong class="command">$</strong></span> as
    9146. 

  9146.                       <span><strong class="command">${offset[,width[,base]]}</strong></span>.
    9147. 

  9147.                       For example, <span><strong class="command">${-20,3,d}</strong></span>
    9148. 

  9148.                       subtracts 20 from the current value, prints the
    9149. 

  9149.                       result as a decimal in a zero-padded field of
    9150. 

  9150.                       width 3.
    9151. 

    9152. 

  9152.                       Available output forms are decimal
    9153. 

  9153.                       (<span><strong class="command">d</strong></span>), octal
    9154. 

  9154.                       (<span><strong class="command">o</strong></span>), hexadecimal
    9155. 

  9155.                       (<span><strong class="command">x</strong></span> or <span><strong class="command">X</strong></span>
    9156. 

  9156.                       for uppercase) and nibble
    9157. 

  9157.                       (<span><strong class="command">n</strong></span> or <span><strong class="command">N</strong></span>\
    9158. 

  9158.                       for uppercase).  The default modifier is
    9159. 

  9159.                       <span><strong class="command">${0,0,d}</strong></span>.  If the
    9160. 

  9160.                       <span><strong class="command">lhs</strong></span> is not absolute, the
    9161. 

  9161.                       current <span><strong class="command">$ORIGIN</strong></span> is appended
    9162. 

  9162.                       to the name.
    9163. 

  9163.                     </p>
    9164. 

  9164.                     <p>
    9165. 

  9165.                       In nibble mode the value will be treated as
    9166. 

  9166.                       if it was a reversed hexadecimal string
    9167. 

  9167.                       with each hexadecimal digit as a separate
    9168. 

  9168.                       label.  The width field includes the label
    9169. 

  9169.                       separator.
    9170. 

  9170.                     </p>
    9171. 

  9171.                     <p>
    9172. 

  9172.                       For compatibility with earlier versions,
    9173. 

  9173.                       <span><strong class="command">$$</strong></span> is still recognized as
    9174. 

  9174.                       indicating a literal $ in the output.
    9175. 

  9175.                     </p>
    9176. 

  9176.                   </td>
    9177. 

  9177. </tr>
    9178. 

  9178. <tr>
    9179. 

  9179. <td>
    9180. 

  9180.                     <p><span><strong class="command">ttl</strong></span></p>
    9181. 

  9181.                   </td>
    9182. 

  9182. <td>
    9183. 

  9183.                     <p>
    9184. 

  9184.                       Specifies the time-to-live of the generated records. If
    9185. 

  9185.                       not specified this will be inherited using the
    9186. 

  9186.                       normal TTL inheritance rules.
    9187. 

  9187.                     </p>
    9188. 

  9188.                     <p><span><strong class="command">class</strong></span>
    9189. 

  9189.                       and <span><strong class="command">ttl</strong></span> can be
    9190. 

  9190.                       entered in either order.
    9191. 

  9191.                     </p>
    9192. 

  9192.                   </td>
    9193. 

  9193. </tr>
    9194. 

  9194. <tr>
    9195. 

  9195. <td>
    9196. 

  9196.                     <p><span><strong class="command">class</strong></span></p>
    9197. 

  9197.                   </td>
    9198. 

  9198. <td>
    9199. 

  9199.                     <p>
    9200. 

  9200.                       Specifies the class of the generated records.
    9201. 

  9201.                       This must match the zone class if it is
    9202. 

  9202.                       specified.
    9203. 

  9203.                     </p>
    9204. 

  9204.                     <p><span><strong class="command">class</strong></span>
    9205. 

  9205.                       and <span><strong class="command">ttl</strong></span> can be
    9206. 

  9206.                       entered in either order.
    9207. 

  9207.                     </p>
    9208. 

  9208.                   </td>
    9209. 

  9209. </tr>
    9210. 

  9210. <tr>
    9211. 

  9211. <td>
    9212. 

  9212.                     <p><span><strong class="command">type</strong></span></p>
    9213. 

  9213.                   </td>
    9214. 

  9214. <td>
    9215. 

  9215.                     <p>
    9216. 

  9216.                       Any valid type.
    9217. 

  9217.                     </p>
    9218. 

  9218.                   </td>
    9219. 

  9219. </tr>
    9220. 

  9220. <tr>
    9221. 

  9221. <td>
    9222. 

  9222.                     <p><span><strong class="command">rhs</strong></span></p>
    9223. 

  9223.                   </td>
    9224. 

  9224. <td>
    9225. 

  9225.                     <p>
    9226. 

  9226.                       <span><strong class="command">rhs</strong></span>, optionally, quoted string.
    9227. 

  9227.                     </p>
    9228. 

  9228.                   </td>
    9229. 

  9229. </tr>
    9230. 

  9230. </tbody>
    9231. 

  9231. </table></div>
    9232. 

  9232. <p>
    9233. 

  9233.             The <span><strong class="command">$GENERATE</strong></span> directive is a <acronym class="acronym">BIND</acronym> extension
    9234. 

  9234.             and not part of the standard zone file format.
    9235. 

  9235.           </p>
    9236. 

  9236. <p>
    9237. 

  9237.             BIND 8 does not support the optional TTL and CLASS fields.
    9238. 

  9238.           </p>
    9239. 

  9239. </div>
    9240. 

  9240. <div class="sect2" lang="en">
    9241. 

  9241. <div class="titlepage"><div><div><h3 class="title">
    9242. 

  9242. <a name="zonefile_format"></a>Additional File Formats</h3></div></div></div>
    9243. 

  9243. <p>
    9244. 

  9244.             In addition to the standard textual format, BIND 9
    9245. 

  9245.             supports the ability to read or dump to zone files in
    9246. 

  9246.             other formats.  The <code class="constant">raw</code> format is
    9247. 

  9247.             currently available as an additional format.  It is a
    9248. 

  9248.             binary format representing BIND 9's internal data
    9249. 

  9249.             structure directly, thereby remarkably improving the
    9250. 

  9250.             loading time.
    9251. 

  9251.           </p>
    9252. 

  9252. <p>
    9253. 

  9253.             For a primary server, a zone file in the
    9254. 

  9254.             <code class="constant">raw</code> format is expected to be
    9255. 

  9255.             generated from a textual zone file by the
    9256. 

  9256.             <span><strong class="command">named-compilezone</strong></span> command.  For a
    9257. 

  9257.             secondary server or for a dynamic zone, it is automatically
    9258. 

  9258.             generated (if this format is specified by the
    9259. 

  9259.             <span><strong class="command">masterfile-format</strong></span> option) when
    9260. 

  9260.             <span><strong class="command">named</strong></span> dumps the zone contents after
    9261. 

  9261.             zone transfer or when applying prior updates.
    9262. 

  9262.           </p>
    9263. 

  9263. <p>
    9264. 

  9264.             If a zone file in a binary format needs manual modification,
    9265. 

  9265.             it first must be converted to a textual form by the
    9266. 

  9266.             <span><strong class="command">named-compilezone</strong></span> command.  All
    9267. 

  9267.             necessary modification should go to the text file, which
    9268. 

  9268.             should then be converted to the binary form by the
    9269. 

  9269.             <span><strong class="command">named-compilezone</strong></span> command again.
    9270. 

  9270.           </p>
    9271. 

  9271. <p>
    9272. 

  9272.              Although the <code class="constant">raw</code> format uses the
    9273. 

  9273.              network byte order and avoids architecture-dependent
    9274. 

  9274.              data alignment so that it is as much portable as
    9275. 

  9275.              possible, it is primarily expected to be used inside
    9276. 

  9276.              the same single system.  In order to export a zone
    9277. 

  9277.              file in the <code class="constant">raw</code> format or make a
    9278. 

  9278.              portable backup of the file, it is recommended to
    9279. 

  9279.              convert the file to the standard textual representation.
    9280. 

  9280.           </p>
    9281. 

  9281. </div>
    9282. 

  9282. </div>
    9283. 

  9283. <div class="sect1" lang="en">
    9284. 

  9284. <div class="titlepage"><div><div><h2 class="title" style="clear: both">
    9285. 

  9285. <a name="statistics"></a>BIND9 Statistics</h2></div></div></div>
    9286. 

  9286. <p>
    9287. 

  9287.           <acronym class="acronym">BIND</acronym> 9 maintains lots of statistics
    9288. 

  9288.           information and provides several interfaces for users to
    9289. 

  9289.           get access to the statistics.
    9290. 

  9290.           The available statistics include all statistics counters
    9291. 

  9291.           that were available in <acronym class="acronym">BIND</acronym> 8 and
    9292. 

  9292.           are meaningful in <acronym class="acronym">BIND</acronym> 9,
    9293. 

  9293.           and other information that is considered useful.
    9294. 

  9294.         </p>
    9295. 

  9295. <p>
    9296. 

  9296.           The statistics information is categorized into the following
    9297. 

  9297.           sections.
    9298. 

  9298.         </p>
    9299. 

  9299. <div class="informaltable"><table border="1">
    9300. 

  9300. <colgroup>
    9301. 

  9301. <col>
    9302. 

  9302. <col>
    9303. 

  9303. </colgroup>
    9304. 

  9304. <tbody>
    9305. 

  9305. <tr>
    9306. 

  9306. <td>
    9307. 

  9307.                   <p>Incoming Requests</p>
    9308. 

  9308.                 </td>
    9309. 

  9309. <td>
    9310. 

  9310.                   <p>
    9311. 

  9311.                     The number of incoming DNS requests for each OPCODE.
    9312. 

  9312.                   </p>
    9313. 

  9313.                 </td>
    9314. 

  9314. </tr>
    9315. 

  9315. <tr>
    9316. 

  9316. <td>
    9317. 

  9317.                   <p>Incoming Queries</p>
    9318. 

  9318.                 </td>
    9319. 

  9319. <td>
    9320. 

  9320.                   <p>
    9321. 

  9321.                     The number of incoming queries for each RR type.
    9322. 

  9322.                   </p>
    9323. 

  9323.                 </td>
    9324. 

  9324. </tr>
    9325. 

  9325. <tr>
    9326. 

  9326. <td>
    9327. 

  9327.                   <p>Outgoing Queries</p>
    9328. 

  9328.                 </td>
    9329. 

  9329. <td>
    9330. 

  9330.                   <p>
    9331. 

  9331.                     The number of outgoing queries for each RR
    9332. 

  9332.                     type sent from the internal resolver.
    9333. 

  9333.                     Maintained per view.
    9334. 

  9334.                   </p>
    9335. 

  9335.                 </td>
    9336. 

  9336. </tr>
    9337. 

  9337. <tr>
    9338. 

  9338. <td>
    9339. 

  9339.                   <p>Name Server Statistics</p>
    9340. 

  9340.                 </td>
    9341. 

  9341. <td>
    9342. 

  9342.                   <p>
    9343. 

  9343.                     Statistics counters about incoming request processing.
    9344. 

  9344.                   </p>
    9345. 

  9345.                 </td>
    9346. 

  9346. </tr>
    9347. 

  9347. <tr>
    9348. 

  9348. <td>
    9349. 

  9349.                   <p>Zone Maintenance Statistics</p>
    9350. 

  9350.                 </td>
    9351. 

  9351. <td>
    9352. 

  9352.                   <p>
    9353. 

  9353.                     Statistics counters regarding zone maintenance
    9354. 

  9354.                     operations such as zone transfers.
    9355. 

  9355.                   </p>
    9356. 

  9356.                 </td>
    9357. 

  9357. </tr>
    9358. 

  9358. <tr>
    9359. 

  9359. <td>
    9360. 

  9360.                   <p>Resolver Statistics</p>
    9361. 

  9361.                 </td>
    9362. 

  9362. <td>
    9363. 

  9363.                   <p>
    9364. 

  9364.                     Statistics counters about name resolution
    9365. 

  9365.                     performed in the internal resolver.
    9366. 

  9366.                     Maintained per view.
    9367. 

  9367.                   </p>
    9368. 

  9368.                 </td>
    9369. 

  9369. </tr>
    9370. 

  9370. <tr>
    9371. 

  9371. <td>
    9372. 

  9372.                   <p>Cache DB RRsets</p>
    9373. 

  9373.                 </td>
    9374. 

  9374. <td>
    9375. 

  9375.                   <p>
    9376. 

  9376.                     The number of RRsets per RR type and nonexistent
    9377. 

  9377.                     names stored in the cache database.
    9378. 

  9378.                     If the exclamation mark (!) is printed for a RR
    9379. 

  9379.                     type, it means that particular type of RRset is
    9380. 

  9380.                     known to be nonexistent (this is also known as
    9381. 

  9381.                     "NXRRSET").
    9382. 

  9382.                     Maintained per view.
    9383. 

  9383.                   </p>
    9384. 

  9384.                 </td>
    9385. 

  9385. </tr>
    9386. 

  9386. <tr>
    9387. 

  9387. <td>
    9388. 

  9388.                   <p>Socket I/O Statistics</p>
    9389. 

  9389.                 </td>
    9390. 

  9390. <td>
    9391. 

  9391.                   <p>
    9392. 

  9392.                     Statistics counters about network related events.
    9393. 

  9393.                   </p>
    9394. 

  9394.                 </td>
    9395. 

  9395. </tr>
    9396. 

  9396. </tbody>
    9397. 

  9397. </table></div>
    9398. 

  9398. <p>
    9399. 

  9399.           A subset of Name Server Statistics is collected and shown
    9400. 

  9400.           per zone for which the server has the authority when
    9401. 

  9401.           <span><strong class="command">zone-statistics</strong></span> is set to
    9402. 

  9402.           <strong class="userinput"><code>yes</code></strong>.
    9403. 

  9403.           These statistics counters are shown with their zone and view
    9404. 

  9404.           names.
    9405. 

  9405.           In some cases the view names are omitted for the default view.
    9406. 

  9406.         </p>
    9407. 

  9407. <p>
    9408. 

  9408.           There are currently two user interfaces to get access to the
    9409. 

  9409.           statistics.
    9410. 

  9410.           One is in the plain text format dumped to the file specified
    9411. 

  9411.           by the <span><strong class="command">statistics-file</strong></span> configuration option.
    9412. 

  9412.           The other is remotely accessible via a statistics channel
    9413. 

  9413.           when the <span><strong class="command">statistics-channels</strong></span> statement
    9414. 

  9414.           is specified in the configuration file
    9415. 

  9415.           (see <a href="Bv9ARM.ch06.html#statschannels" title="statistics-channels Statement Grammar">the section called &#8220;<span><strong class="command">statistics-channels</strong></span> Statement Grammar&#8221;</a>.)
    9416. 

  9416.         </p>
    9417. 

  9417. <div class="sect3" lang="en">
    9418. 

  9418. <div class="titlepage"><div><div><h4 class="title">
    9419. 

  9419. <a name="statsfile"></a>The Statistics File</h4></div></div></div>
    9420. 

  9420. <p>
    9421. 

  9421.             The text format statistics dump begins with a line, like:
    9422. 

  9422.           </p>
    9423. 

  9423. <p>
    9424. 

  9424.             <span><strong class="command">+++ Statistics Dump +++ (973798949)</strong></span>
    9425. 

  9425.           </p>
    9426. 

  9426. <p>
    9427. 

  9427.             The number in parentheses is a standard
    9428. 

  9428.             Unix-style timestamp, measured as seconds since January 1, 1970.
    9429. 

    9430. 

  9430.             Following
    9431. 

  9431.             that line is a set of statistics information, which is categorized
    9432. 

  9432.             as described above.
    9433. 

  9433.             Each section begins with a line, like:
    9434. 

  9434.           </p>
    9435. 

  9435. <p>
    9436. 

  9436.             <span><strong class="command">++ Name Server Statistics ++</strong></span>
    9437. 

  9437.           </p>
    9438. 

  9438. <p>
    9439. 

  9439.             Each section consists of lines, each containing the statistics
    9440. 

  9440.             counter value followed by its textual description.
    9441. 

  9441.             See below for available counters.
    9442. 

  9442.             For brevity, counters that have a value of 0 are not shown
    9443. 

  9443.             in the statistics file.
    9444. 

  9444.           </p>
    9445. 

  9445. <p>
    9446. 

  9446.             The statistics dump ends with the line where the
    9447. 

  9447.             number is identical to the number in the beginning line; for example:
    9448. 

  9448.           </p>
    9449. 

  9449. <p>
    9450. 

  9450.             <span><strong class="command">--- Statistics Dump --- (973798949)</strong></span>
    9451. 

  9451.           </p>
    9452. 

  9452. </div>
    9453. 

  9453. <div class="sect2" lang="en">
    9454. 

  9454. <div class="titlepage"><div><div><h3 class="title">
    9455. 

  9455. <a name="statistics_counters"></a>Statistics Counters</h3></div></div></div>
    9456. 

  9456. <p>
    9457. 

  9457.             The following tables summarize statistics counters that
    9458. 

  9458.             <acronym class="acronym">BIND</acronym> 9 provides.
    9459. 

  9459.             For each row of the tables, the leftmost column is the
    9460. 

  9460.             abbreviated symbol name of that counter.
    9461. 

  9461.             These symbols are shown in the statistics information
    9462. 

  9462.             accessed via an HTTP statistics channel.
    9463. 

  9463.             The rightmost column gives the description of the counter,
    9464. 

  9464.             which is also shown in the statistics file
    9465. 

  9465.             (but, in this document, possibly with slight modification
    9466. 

  9466.             for better readability).
    9467. 

  9467.             Additional notes may also be provided in this column.
    9468. 

  9468.             When a middle column exists between these two columns,
    9469. 

  9469.             it gives the corresponding counter name of the
    9470. 

  9470.             <acronym class="acronym">BIND</acronym> 8 statistics, if applicable.
    9471. 

  9471.           </p>
    9472. 

  9472. <div class="sect3" lang="en">
    9473. 

  9473. <div class="titlepage"><div><div><h4 class="title">
    9474. 

  9474. <a name="id2599384"></a>Name Server Statistics Counters</h4></div></div></div>
    9475. 

  9475. <div class="informaltable"><table border="1">
    9476. 

  9476. <colgroup>
    9477. 

  9477. <col>
    9478. 

  9478. <col>
    9479. 

  9479. <col>
    9480. 

  9480. </colgroup>
    9481. 

  9481. <tbody>
    9482. 

  9482. <tr>
    9483. 

  9483. <td>
    9484. 

  9484.                       <p>
    9485. 

  9485.                         <span class="emphasis"><em>Symbol</em></span>
    9486. 

  9486.                       </p>
    9487. 

  9487.                     </td>
    9488. 

  9488. <td>
    9489. 

  9489.                       <p>
    9490. 

  9490.                         <span class="emphasis"><em>BIND8 Symbol</em></span>
    9491. 

  9491.                       </p>
    9492. 

  9492.                     </td>
    9493. 

  9493. <td>
    9494. 

  9494.                       <p>
    9495. 

  9495.                         <span class="emphasis"><em>Description</em></span>
    9496. 

  9496.                       </p>
    9497. 

  9497.                     </td>
    9498. 

  9498. </tr>
    9499. 

  9499. <tr>
    9500. 

  9500. <td>
    9501. 

  9501.                       <p><span><strong class="command">Requestv4</strong></span></p>
    9502. 

  9502.                     </td>
    9503. 

  9503. <td>
    9504. 

  9504.                       <p><span><strong class="command">RQ</strong></span></p>
    9505. 

  9505.                     </td>
    9506. 

  9506. <td>
    9507. 

  9507.                       <p>
    9508. 

  9508.                         IPv4 requests received.
    9509. 

  9509.                         Note: this also counts non query requests.
    9510. 

  9510.                       </p>
    9511. 

  9511.                     </td>
    9512. 

  9512. </tr>
    9513. 

  9513. <tr>
    9514. 

  9514. <td>
    9515. 

  9515.                       <p><span><strong class="command">Requestv6</strong></span></p>
    9516. 

  9516.                     </td>
    9517. 

  9517. <td>
    9518. 

  9518.                       <p><span><strong class="command">RQ</strong></span></p>
    9519. 

  9519.                     </td>
    9520. 

  9520. <td>
    9521. 

  9521.                       <p>
    9522. 

  9522.                         IPv6 requests received.
    9523. 

  9523.                         Note: this also counts non query requests.
    9524. 

  9524.                       </p>
    9525. 

  9525.                     </td>
    9526. 

  9526. </tr>
    9527. 

  9527. <tr>
    9528. 

  9528. <td>
    9529. 

  9529.                       <p><span><strong class="command">ReqEdns0</strong></span></p>
    9530. 

  9530.                     </td>
    9531. 

  9531. <td>
    9532. 

  9532.                       <p><span><strong class="command"></strong></span></p>
    9533. 

  9533.                     </td>
    9534. 

  9534. <td>
    9535. 

  9535.                       <p>
    9536. 

  9536.                         Requests with EDNS(0) received.
    9537. 

  9537.                       </p>
    9538. 

  9538.                     </td>
    9539. 

  9539. </tr>
    9540. 

  9540. <tr>
    9541. 

  9541. <td>
    9542. 

  9542.                       <p><span><strong class="command">ReqBadEDNSVer</strong></span></p>
    9543. 

  9543.                     </td>
    9544. 

  9544. <td>
    9545. 

  9545.                       <p><span><strong class="command"></strong></span></p>
    9546. 

  9546.                     </td>
    9547. 

  9547. <td>
    9548. 

  9548.                       <p>
    9549. 

  9549.                         Requests with unsupported EDNS version received.
    9550. 

  9550.                       </p>
    9551. 

  9551.                     </td>
    9552. 

  9552. </tr>
    9553. 

  9553. <tr>
    9554. 

  9554. <td>
    9555. 

  9555.                       <p><span><strong class="command">ReqTSIG</strong></span></p>
    9556. 

  9556.                     </td>
    9557. 

  9557. <td>
    9558. 

  9558.                       <p><span><strong class="command"></strong></span></p>
    9559. 

  9559.                     </td>
    9560. 

  9560. <td>
    9561. 

  9561.                       <p>
    9562. 

  9562.                         Requests with TSIG received.
    9563. 

  9563.                       </p>
    9564. 

  9564.                     </td>
    9565. 

  9565. </tr>
    9566. 

  9566. <tr>
    9567. 

  9567. <td>
    9568. 

  9568.                       <p><span><strong class="command">ReqSIG0</strong></span></p>
    9569. 

  9569.                     </td>
    9570. 

  9570. <td>
    9571. 

  9571.                       <p><span><strong class="command"></strong></span></p>
    9572. 

  9572.                     </td>
    9573. 

  9573. <td>
    9574. 

  9574.                       <p>
    9575. 

  9575.                         Requests with SIG(0) received.
    9576. 

  9576.                       </p>
    9577. 

  9577.                     </td>
    9578. 

  9578. </tr>
    9579. 

  9579. <tr>
    9580. 

  9580. <td>
    9581. 

  9581.                       <p><span><strong class="command">ReqBadSIG</strong></span></p>
    9582. 

  9582.                     </td>
    9583. 

  9583. <td>
    9584. 

  9584.                       <p><span><strong class="command"></strong></span></p>
    9585. 

  9585.                     </td>
    9586. 

  9586. <td>
    9587. 

  9587.                       <p>
    9588. 

  9588.                         Requests with invalid (TSIG or SIG(0)) signature.
    9589. 

  9589.                       </p>
    9590. 

  9590.                     </td>
    9591. 

  9591. </tr>
    9592. 

  9592. <tr>
    9593. 

  9593. <td>
    9594. 

  9594.                       <p><span><strong class="command">ReqTCP</strong></span></p>
    9595. 

  9595.                     </td>
    9596. 

  9596. <td>
    9597. 

  9597.                       <p><span><strong class="command">RTCP</strong></span></p>
    9598. 

  9598.                     </td>
    9599. 

  9599. <td>
    9600. 

  9600.                       <p>
    9601. 

  9601.                         TCP requests received.
    9602. 

  9602.                       </p>
    9603. 

  9603.                     </td>
    9604. 

  9604. </tr>
    9605. 

  9605. <tr>
    9606. 

  9606. <td>
    9607. 

  9607.                       <p><span><strong class="command">AuthQryRej</strong></span></p>
    9608. 

  9608.                     </td>
    9609. 

  9609. <td>
    9610. 

  9610.                       <p><span><strong class="command">RUQ</strong></span></p>
    9611. 

  9611.                     </td>
    9612. 

  9612. <td>
    9613. 

  9613.                       <p>
    9614. 

  9614.                         Authoritative (non recursive) queries rejected.
    9615. 

  9615.                       </p>
    9616. 

  9616.                     </td>
    9617. 

  9617. </tr>
    9618. 

  9618. <tr>
    9619. 

  9619. <td>
    9620. 

  9620.                       <p><span><strong class="command">RecQryRej</strong></span></p>
    9621. 

  9621.                     </td>
    9622. 

  9622. <td>
    9623. 

  9623.                       <p><span><strong class="command">RURQ</strong></span></p>
    9624. 

  9624.                     </td>
    9625. 

  9625. <td>
    9626. 

  9626.                       <p>
    9627. 

  9627.                         Recursive queries rejected.
    9628. 

  9628.                       </p>
    9629. 

  9629.                     </td>
    9630. 

  9630. </tr>
    9631. 

  9631. <tr>
    9632. 

  9632. <td>
    9633. 

  9633.                       <p><span><strong class="command">XfrRej</strong></span></p>
    9634. 

  9634.                     </td>
    9635. 

  9635. <td>
    9636. 

  9636.                       <p><span><strong class="command">RUXFR</strong></span></p>
    9637. 

  9637.                     </td>
    9638. 

  9638. <td>
    9639. 

  9639.                       <p>
    9640. 

  9640.                         Zone transfer requests rejected.
    9641. 

  9641.                       </p>
    9642. 

  9642.                     </td>
    9643. 

  9643. </tr>
    9644. 

  9644. <tr>
    9645. 

  9645. <td>
    9646. 

  9646.                       <p><span><strong class="command">UpdateRej</strong></span></p>
    9647. 

  9647.                     </td>
    9648. 

  9648. <td>
    9649. 

  9649.                       <p><span><strong class="command">RUUpd</strong></span></p>
    9650. 

  9650.                     </td>
    9651. 

  9651. <td>
    9652. 

  9652.                       <p>
    9653. 

  9653.                         Dynamic update requests rejected.
    9654. 

  9654.                       </p>
    9655. 

  9655.                     </td>
    9656. 

  9656. </tr>
    9657. 

  9657. <tr>
    9658. 

  9658. <td>
    9659. 

  9659.                       <p><span><strong class="command">Response</strong></span></p>
    9660. 

  9660.                     </td>
    9661. 

  9661. <td>
    9662. 

  9662.                       <p><span><strong class="command">SAns</strong></span></p>
    9663. 

  9663.                     </td>
    9664. 

  9664. <td>
    9665. 

  9665.                       <p>
    9666. 

  9666.                         Responses sent.
    9667. 

  9667.                       </p>
    9668. 

  9668.                     </td>
    9669. 

  9669. </tr>
    9670. 

  9670. <tr>
    9671. 

  9671. <td>
    9672. 

  9672.                       <p><span><strong class="command">RespTruncated</strong></span></p>
    9673. 

  9673.                     </td>
    9674. 

  9674. <td>
    9675. 

  9675.                       <p><span><strong class="command"></strong></span></p>
    9676. 

  9676.                     </td>
    9677. 

  9677. <td>
    9678. 

  9678.                       <p>
    9679. 

  9679.                         Truncated responses sent.
    9680. 

  9680.                       </p>
    9681. 

  9681.                     </td>
    9682. 

  9682. </tr>
    9683. 

  9683. <tr>
    9684. 

  9684. <td>
    9685. 

  9685.                       <p><span><strong class="command">RespEDNS0</strong></span></p>
    9686. 

  9686.                     </td>
    9687. 

  9687. <td>
    9688. 

  9688.                       <p><span><strong class="command"></strong></span></p>
    9689. 

  9689.                     </td>
    9690. 

  9690. <td>
    9691. 

  9691.                       <p>
    9692. 

  9692.                         Responses with EDNS(0) sent.
    9693. 

  9693.                       </p>
    9694. 

  9694.                     </td>
    9695. 

  9695. </tr>
    9696. 

  9696. <tr>
    9697. 

  9697. <td>
    9698. 

  9698.                       <p><span><strong class="command">RespTSIG</strong></span></p>
    9699. 

  9699.                     </td>
    9700. 

  9700. <td>
    9701. 

  9701.                       <p><span><strong class="command"></strong></span></p>
    9702. 

  9702.                     </td>
    9703. 

  9703. <td>
    9704. 

  9704.                       <p>
    9705. 

  9705.                         Responses with TSIG sent.
    9706. 

  9706.                       </p>
    9707. 

  9707.                     </td>
    9708. 

  9708. </tr>
    9709. 

  9709. <tr>
    9710. 

  9710. <td>
    9711. 

  9711.                       <p><span><strong class="command">RespSIG0</strong></span></p>
    9712. 

  9712.                     </td>
    9713. 

  9713. <td>
    9714. 

  9714.                       <p><span><strong class="command"></strong></span></p>
    9715. 

  9715.                     </td>
    9716. 

  9716. <td>
    9717. 

  9717.                       <p>
    9718. 

  9718.                         Responses with SIG(0) sent.
    9719. 

  9719.                       </p>
    9720. 

  9720.                     </td>
    9721. 

  9721. </tr>
    9722. 

  9722. <tr>
    9723. 

  9723. <td>
    9724. 

  9724.                       <p><span><strong class="command">QrySuccess</strong></span></p>
    9725. 

  9725.                     </td>
    9726. 

  9726. <td>
    9727. 

  9727.                       <p><span><strong class="command"></strong></span></p>
    9728. 

  9728.                     </td>
    9729. 

  9729. <td>
    9730. 

  9730.                       <p>
    9731. 

  9731.                         Queries resulted in a successful answer.
    9732. 

  9732.                         This means the query which returns a NOERROR response
    9733. 

  9733.                         with at least one answer RR.
    9734. 

  9734.                         This corresponds to the
    9735. 

  9735.                         <span><strong class="command">success</strong></span> counter
    9736. 

  9736.                         of previous versions of
    9737. 

  9737.                         <acronym class="acronym">BIND</acronym> 9.
    9738. 

  9738.                       </p>
    9739. 

  9739.                     </td>
    9740. 

  9740. </tr>
    9741. 

  9741. <tr>
    9742. 

  9742. <td>
    9743. 

  9743.                       <p><span><strong class="command">QryAuthAns</strong></span></p>
    9744. 

  9744.                     </td>
    9745. 

  9745. <td>
    9746. 

  9746.                       <p><span><strong class="command"></strong></span></p>
    9747. 

  9747.                     </td>
    9748. 

  9748. <td>
    9749. 

  9749.                       <p>
    9750. 

  9750.                         Queries resulted in authoritative answer.
    9751. 

  9751.                       </p>
    9752. 

  9752.                     </td>
    9753. 

  9753. </tr>
    9754. 

  9754. <tr>
    9755. 

  9755. <td>
    9756. 

  9756.                       <p><span><strong class="command">QryNoauthAns</strong></span></p>
    9757. 

  9757.                     </td>
    9758. 

  9758. <td>
    9759. 

  9759.                       <p><span><strong class="command">SNaAns</strong></span></p>
    9760. 

  9760.                     </td>
    9761. 

  9761. <td>
    9762. 

  9762.                       <p>
    9763. 

  9763.                         Queries resulted in non authoritative answer.
    9764. 

  9764.                       </p>
    9765. 

  9765.                     </td>
    9766. 

  9766. </tr>
    9767. 

  9767. <tr>
    9768. 

  9768. <td>
    9769. 

  9769.                       <p><span><strong class="command">QryReferral</strong></span></p>
    9770. 

  9770.                     </td>
    9771. 

  9771. <td>
    9772. 

  9772.                       <p><span><strong class="command"></strong></span></p>
    9773. 

  9773.                     </td>
    9774. 

  9774. <td>
    9775. 

  9775.                       <p>
    9776. 

  9776.                         Queries resulted in referral answer.
    9777. 

  9777.                         This corresponds to the
    9778. 

  9778.                         <span><strong class="command">referral</strong></span> counter
    9779. 

  9779.                         of previous versions of
    9780. 

  9780.                         <acronym class="acronym">BIND</acronym> 9.
    9781. 

  9781.                       </p>
    9782. 

  9782.                     </td>
    9783. 

  9783. </tr>
    9784. 

  9784. <tr>
    9785. 

  9785. <td>
    9786. 

  9786.                       <p><span><strong class="command">QryNxrrset</strong></span></p>
    9787. 

  9787.                     </td>
    9788. 

  9788. <td>
    9789. 

  9789.                       <p><span><strong class="command"></strong></span></p>
    9790. 

  9790.                     </td>
    9791. 

  9791. <td>
    9792. 

  9792.                       <p>
    9793. 

  9793.                         Queries resulted in NOERROR responses with no data.
    9794. 

  9794.                         This corresponds to the
    9795. 

  9795.                         <span><strong class="command">nxrrset</strong></span> counter
    9796. 

  9796.                         of previous versions of
    9797. 

  9797.                         <acronym class="acronym">BIND</acronym> 9.
    9798. 

  9798.                       </p>
    9799. 

  9799.                     </td>
    9800. 

  9800. </tr>
    9801. 

  9801. <tr>
    9802. 

  9802. <td>
    9803. 

  9803.                       <p><span><strong class="command">QrySERVFAIL</strong></span></p>
    9804. 

  9804.                     </td>
    9805. 

  9805. <td>
    9806. 

  9806.                       <p><span><strong class="command">SFail</strong></span></p>
    9807. 

  9807.                     </td>
    9808. 

  9808. <td>
    9809. 

  9809.                       <p>
    9810. 

  9810.                         Queries resulted in SERVFAIL.
    9811. 

  9811.                       </p>
    9812. 

  9812.                     </td>
    9813. 

  9813. </tr>
    9814. 

  9814. <tr>
    9815. 

  9815. <td>
    9816. 

  9816.                       <p><span><strong class="command">QryFORMERR</strong></span></p>
    9817. 

  9817.                     </td>
    9818. 

  9818. <td>
    9819. 

  9819.                       <p><span><strong class="command">SFErr</strong></span></p>
    9820. 

  9820.                     </td>
    9821. 

  9821. <td>
    9822. 

  9822.                       <p>
    9823. 

  9823.                         Queries resulted in FORMERR.
    9824. 

  9824.                       </p>
    9825. 

  9825.                     </td>
    9826. 

  9826. </tr>
    9827. 

  9827. <tr>
    9828. 

  9828. <td>
    9829. 

  9829.                       <p><span><strong class="command">QryNXDOMAIN</strong></span></p>
    9830. 

  9830.                     </td>
    9831. 

  9831. <td>
    9832. 

  9832.                       <p><span><strong class="command">SNXD</strong></span></p>
    9833. 

  9833.                     </td>
    9834. 

  9834. <td>
    9835. 

  9835.                       <p>
    9836. 

  9836.                         Queries resulted in NXDOMAIN.
    9837. 

  9837.                         This corresponds to the
    9838. 

  9838.                         <span><strong class="command">nxdomain</strong></span> counter
    9839. 

  9839.                         of previous versions of
    9840. 

  9840.                         <acronym class="acronym">BIND</acronym> 9.
    9841. 

  9841.                       </p>
    9842. 

  9842.                     </td>
    9843. 

  9843. </tr>
    9844. 

  9844. <tr>
    9845. 

  9845. <td>
    9846. 

  9846.                       <p><span><strong class="command">QryRecursion</strong></span></p>
    9847. 

  9847.                     </td>
    9848. 

  9848. <td>
    9849. 

  9849.                       <p><span><strong class="command">RFwdQ</strong></span></p>
    9850. 

  9850.                     </td>
    9851. 

  9851. <td>
    9852. 

  9852.                       <p>
    9853. 

  9853.                         Queries which caused the server
    9854. 

  9854.                         to perform recursion in order to find the final answer.
    9855. 

  9855.                         This corresponds to the
    9856. 

  9856.                         <span><strong class="command">recursion</strong></span> counter
    9857. 

  9857.                         of previous versions of
    9858. 

  9858.                         <acronym class="acronym">BIND</acronym> 9.
    9859. 

  9859.                       </p>
    9860. 

  9860.                     </td>
    9861. 

  9861. </tr>
    9862. 

  9862. <tr>
    9863. 

  9863. <td>
    9864. 

  9864.                       <p><span><strong class="command">QryDuplicate</strong></span></p>
    9865. 

  9865.                     </td>
    9866. 

  9866. <td>
    9867. 

  9867.                       <p><span><strong class="command">RDupQ</strong></span></p>
    9868. 

  9868.                     </td>
    9869. 

  9869. <td>
    9870. 

  9870.                       <p>
    9871. 

  9871.                         Queries which the server attempted to
    9872. 

  9872.                         recurse but discovered an existing query with the same
    9873. 

  9873.                         IP address, port, query ID, name, type and class
    9874. 

  9874.                         already being processed.
    9875. 

  9875.                         This corresponds to the
    9876. 

  9876.                         <span><strong class="command">duplicate</strong></span> counter
    9877. 

  9877.                         of previous versions of
    9878. 

  9878.                         <acronym class="acronym">BIND</acronym> 9.
    9879. 

  9879.                       </p>
    9880. 

  9880.                     </td>
    9881. 

  9881. </tr>
    9882. 

  9882. <tr>
    9883. 

  9883. <td>
    9884. 

  9884.                       <p><span><strong class="command">QryDropped</strong></span></p>
    9885. 

  9885.                     </td>
    9886. 

  9886. <td>
    9887. 

  9887.                       <p><span><strong class="command"></strong></span></p>
    9888. 

  9888.                     </td>
    9889. 

  9889. <td>
    9890. 

  9890.                       <p>
    9891. 

  9891.                         Recursive queries for which the server
    9892. 

  9892.                         discovered an excessive number of existing
    9893. 

  9893.                         recursive queries for the same name, type and
    9894. 

  9894.                         class and were subsequently dropped.
    9895. 

  9895.                         This is the number of dropped queries due to
    9896. 

  9896.                         the reason explained with the
    9897. 

  9897.                         <span><strong class="command">clients-per-query</strong></span>
    9898. 

  9898.                         and
    9899. 

  9899.                         <span><strong class="command">max-clients-per-query</strong></span>
    9900. 

  9900.                         options
    9901. 

  9901.                         (see the description about
    9902. 

  9902.                         <a href="Bv9ARM.ch06.html#clients-per-query"><span><strong class="command">clients-per-query</strong></span></a>.)
    9903. 

  9903.                         This corresponds to the
    9904. 

  9904.                         <span><strong class="command">dropped</strong></span> counter
    9905. 

  9905.                         of previous versions of
    9906. 

  9906.                         <acronym class="acronym">BIND</acronym> 9.
    9907. 

  9907.                       </p>
    9908. 

  9908.                     </td>
    9909. 

  9909. </tr>
    9910. 

  9910. <tr>
    9911. 

  9911. <td>
    9912. 

  9912.                       <p><span><strong class="command">QryFailure</strong></span></p>
    9913. 

  9913.                     </td>
    9914. 

  9914. <td>
    9915. 

  9915.                       <p><span><strong class="command"></strong></span></p>
    9916. 

  9916.                     </td>
    9917. 

  9917. <td>
    9918. 

  9918.                       <p>
    9919. 

  9919.                         Other query failures.
    9920. 

  9920.                         This corresponds to the
    9921. 

  9921.                         <span><strong class="command">failure</strong></span> counter
    9922. 

  9922.                         of previous versions of
    9923. 

  9923.                         <acronym class="acronym">BIND</acronym> 9.
    9924. 

  9924.                         Note: this counter is provided mainly for
    9925. 

  9925.                         backward compatibility with the previous versions.
    9926. 

  9926.                         Normally a more fine-grained counters such as
    9927. 

  9927.                         <span><strong class="command">AuthQryRej</strong></span> and
    9928. 

  9928.                         <span><strong class="command">RecQryRej</strong></span>
    9929. 

  9929.                         that would also fall into this counter are provided,
    9930. 

  9930.                         and so this counter would not be of much
    9931. 

  9931.                         interest in practice.
    9932. 

  9932.                       </p>
    9933. 

  9933.                     </td>
    9934. 

  9934. </tr>
    9935. 

  9935. <tr>
    9936. 

  9936. <td>
    9937. 

  9937.                       <p><span><strong class="command">XfrReqDone</strong></span></p>
    9938. 

  9938.                     </td>
    9939. 

  9939. <td>
    9940. 

  9940.                       <p><span><strong class="command"></strong></span></p>
    9941. 

  9941.                     </td>
    9942. 

  9942. <td>
    9943. 

  9943.                       <p>
    9944. 

  9944.                         Requested zone transfers completed.
    9945. 

  9945.                       </p>
    9946. 

  9946.                     </td>
    9947. 

  9947. </tr>
    9948. 

  9948. <tr>
    9949. 

  9949. <td>
    9950. 

  9950.                       <p><span><strong class="command">UpdateReqFwd</strong></span></p>
    9951. 

  9951.                     </td>
    9952. 

  9952. <td>
    9953. 

  9953.                       <p><span><strong class="command"></strong></span></p>
    9954. 

  9954.                     </td>
    9955. 

  9955. <td>
    9956. 

  9956.                       <p>
    9957. 

  9957.                         Update requests forwarded.
    9958. 

  9958.                       </p>
    9959. 

  9959.                     </td>
    9960. 

  9960. </tr>
    9961. 

  9961. <tr>
    9962. 

  9962. <td>
    9963. 

  9963.                       <p><span><strong class="command">UpdateRespFwd</strong></span></p>
    9964. 

  9964.                     </td>
    9965. 

  9965. <td>
    9966. 

  9966.                       <p><span><strong class="command"></strong></span></p>
    9967. 

  9967.                     </td>
    9968. 

  9968. <td>
    9969. 

  9969.                       <p>
    9970. 

  9970.                         Update responses forwarded.
    9971. 

  9971.                       </p>
    9972. 

  9972.                     </td>
    9973. 

  9973. </tr>
    9974. 

  9974. <tr>
    9975. 

  9975. <td>
    9976. 

  9976.                       <p><span><strong class="command">UpdateFwdFail</strong></span></p>
    9977. 

  9977.                     </td>
    9978. 

  9978. <td>
    9979. 

  9979.                       <p><span><strong class="command"></strong></span></p>
    9980. 

  9980.                     </td>
    9981. 

  9981. <td>
    9982. 

  9982.                       <p>
    9983. 

  9983.                         Dynamic update forward failed.
    9984. 

  9984.                       </p>
    9985. 

  9985.                     </td>
    9986. 

  9986. </tr>
    9987. 

  9987. <tr>
    9988. 

  9988. <td>
    9989. 

  9989.                       <p><span><strong class="command">UpdateDone</strong></span></p>
    9990. 

  9990.                     </td>
    9991. 

  9991. <td>
    9992. 

  9992.                       <p><span><strong class="command"></strong></span></p>
    9993. 

  9993.                     </td>
    9994. 

  9994. <td>
    9995. 

  9995.                       <p>
    9996. 

  9996.                         Dynamic updates completed.
    9997. 

  9997.                       </p>
    9998. 

  9998.                     </td>
    9999. 

  9999. </tr>
    10000. 

  10000. <tr>
    10001. 

  10001. <td>
    10002. 

  10002.                       <p><span><strong class="command">UpdateFail</strong></span></p>
    10003. 

  10003.                     </td>
    10004. 

  10004. <td>
    10005. 

  10005.                       <p><span><strong class="command"></strong></span></p>
    10006. 

  10006.                     </td>
    10007. 

  10007. <td>
    10008. 

  10008.                       <p>
    10009. 

  10009.                         Dynamic updates failed.
    10010. 

  10010.                       </p>
    10011. 

  10011.                     </td>
    10012. 

  10012. </tr>
    10013. 

  10013. <tr>
    10014. 

  10014. <td>
    10015. 

  10015.                       <p><span><strong class="command">UpdateBadPrereq</strong></span></p>
    10016. 

  10016.                     </td>
    10017. 

  10017. <td>
    10018. 

  10018.                       <p><span><strong class="command"></strong></span></p>
    10019. 

  10019.                     </td>
    10020. 

  10020. <td>
    10021. 

  10021.                       <p>
    10022. 

  10022.                         Dynamic updates rejected due to prerequisite failure.
    10023. 

  10023.                       </p>
    10024. 

  10024.                     </td>
    10025. 

  10025. </tr>
    10026. 

  10026. </tbody>
    10027. 

  10027. </table></div>
    10028. 

  10028. </div>
    10029. 

  10029. <div class="sect3" lang="en">
    10030. 

  10030. <div class="titlepage"><div><div><h4 class="title">
    10031. 

  10031. <a name="id2600857"></a>Zone Maintenance Statistics Counters</h4></div></div></div>
    10032. 

  10032. <div class="informaltable"><table border="1">
    10033. 

  10033. <colgroup>
    10034. 

  10034. <col>
    10035. 

  10035. <col>
    10036. 

  10036. </colgroup>
    10037. 

  10037. <tbody>
    10038. 

  10038. <tr>
    10039. 

  10039. <td>
    10040. 

  10040.                       <p>
    10041. 

  10041.                         <span class="emphasis"><em>Symbol</em></span>
    10042. 

  10042.                       </p>
    10043. 

  10043.                     </td>
    10044. 

  10044. <td>
    10045. 

  10045.                       <p>
    10046. 

  10046.                         <span class="emphasis"><em>Description</em></span>
    10047. 

  10047.                       </p>
    10048. 

  10048.                     </td>
    10049. 

  10049. </tr>
    10050. 

  10050. <tr>
    10051. 

  10051. <td>
    10052. 

  10052.                       <p><span><strong class="command">NotifyOutv4</strong></span></p>
    10053. 

  10053.                     </td>
    10054. 

  10054. <td>
    10055. 

  10055.                       <p>
    10056. 

  10056.                         IPv4 notifies sent.
    10057. 

  10057.                       </p>
    10058. 

  10058.                     </td>
    10059. 

  10059. </tr>
    10060. 

  10060. <tr>
    10061. 

  10061. <td>
    10062. 

  10062.                       <p><span><strong class="command">NotifyOutv6</strong></span></p>
    10063. 

  10063.                     </td>
    10064. 

  10064. <td>
    10065. 

  10065.                       <p>
    10066. 

  10066.                         IPv6 notifies sent.
    10067. 

  10067.                       </p>
    10068. 

  10068.                     </td>
    10069. 

  10069. </tr>
    10070. 

  10070. <tr>
    10071. 

  10071. <td>
    10072. 

  10072.                       <p><span><strong class="command">NotifyInv4</strong></span></p>
    10073. 

  10073.                     </td>
    10074. 

  10074. <td>
    10075. 

  10075.                       <p
    10076.