.\" Man page generated from reStructuredText.
.
.
.nr rst2man-indent-level 0
.
.de1 rstReportMargin
\\$1 \\n[an-margin]
level \\n[rst2man-indent-level]
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
\\n[rst2man-indent0]
\\n[rst2man-indent1]
\\n[rst2man-indent2]
..
.de1 INDENT
.\" .rstReportMargin pre:
. RS \\$1
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
. nr rst2man-indent-level +1
.\" .rstReportMargin post:
..
.de UNINDENT
. RE
.\" indent \\n[an-margin]
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
.nr rst2man-indent-level -1
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "NAMED.CONF" "5" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
.SH NAME
named.conf \- configuration file for **named**
.SH SYNOPSIS
.sp
\fBnamed.conf\fP
.SH DESCRIPTION
.sp
\fBnamed.conf\fP is the configuration file for \fI\%named\fP\&.
.sp
For complete documentation about the configuration statements, please refer to
the Configuration Reference section in the BIND 9 Administrator Reference
Manual.
.sp
Statements are enclosed in braces and terminated with a semi\-colon.
Clauses in the statements are also semi\-colon terminated. The usual
comment styles are supported:
.sp
C style: /* */
.sp
C++ style: // to end of line
.sp
Unix style: # to end of line
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
acl <string> { <address_match_element>; ... }; // may occur multiple times
controls {
inet ( <ipv4_address> | <ipv6_address> | * ) [ port ( <integer> | * ) ] allow { <address_match_element>; ... } [ keys { <string>; ... } ] [ read\-only <boolean> ]; // may occur multiple times
unix <quoted_string> perm <integer> owner <integer> group <integer> [ keys { <string>; ... } ] [ read\-only <boolean> ]; // may occur multiple times
}; // may occur multiple times
dlz <string> {
database <string>;
search <boolean>;
}; // may occur multiple times
dnssec\-policy <string> {
dnskey\-ttl <duration>;
keys { ( csk | ksk | zsk ) [ ( key\-directory ) ] lifetime <duration_or_unlimited> algorithm <string> [ <integer> ]; ... };
max\-zone\-ttl <duration>;
nsec3param [ iterations <integer> ] [ optout <boolean> ] [ salt\-length <integer> ];
parent\-ds\-ttl <duration>;
parent\-propagation\-delay <duration>;
parent\-registration\-delay <duration>; // obsolete
publish\-safety <duration>;
purge\-keys <duration>;
retire\-safety <duration>;
signatures\-refresh <duration>;
signatures\-validity <duration>;
signatures\-validity\-dnskey <duration>;
zone\-propagation\-delay <duration>;
}; // may occur multiple times
dyndb <string> <quoted_string> { <unspecified\-text> }; // may occur multiple times
http <string> {
endpoints { <quoted_string>; ... };
listener\-clients <integer>;
streams\-per\-connection <integer>;
}; // may occur multiple times
key <string> {
algorithm <string>;
secret <string>;
}; // may occur multiple times
logging {
category <string> { <string>; ... }; // may occur multiple times
channel <string> {
buffered <boolean>;
file <quoted_string> [ versions ( unlimited | <integer> ) ] [ size <size> ] [ suffix ( increment | timestamp ) ];
null;
print\-category <boolean>;
print\-severity <boolean>;
print\-time ( iso8601 | iso8601\-utc | local | <boolean> );
severity <log_severity>;
stderr;
syslog [ <syslog_facility> ];
}; // may occur multiple times
};
managed\-keys { <string> ( static\-key | initial\-key | static\-ds | initial\-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
options {
allow\-new\-zones <boolean>;
allow\-notify { <address_match_element>; ... };
allow\-query { <address_match_element>; ... };
allow\-query\-cache { <address_match_element>; ... };
allow\-query\-cache\-on { <address_match_element>; ... };
allow\-query\-on { <address_match_element>; ... };
allow\-recursion { <address_match_element>; ... };
allow\-recursion\-on { <address_match_element>; ... };
allow\-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
allow\-update { <address_match_element>; ... };
allow\-update\-forwarding { <address_match_element>; ... };
also\-notify [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
alt\-transfer\-source ( <ipv4_address> | * ) ; // deprecated
alt\-transfer\-source\-v6 ( <ipv6_address> | * ) ; // deprecated
answer\-cookie <boolean>;
attach\-cache <string>;
auth\-nxdomain <boolean>;
auto\-dnssec ( allow | maintain | off ); // deprecated
automatic\-interface\-scan <boolean>;
avoid\-v4\-udp\-ports { <portrange>; ... }; // deprecated
avoid\-v6\-udp\-ports { <portrange>; ... }; // deprecated
bindkeys\-file <quoted_string>;
blackhole { <address_match_element>; ... };
catalog\-zones { zone <string> [ default\-primaries [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone\-directory <quoted_string> ] [ in\-memory <boolean> ] [ min\-update\-interval <duration> ]; ... };
check\-dup\-records ( fail | warn | ignore );
check\-integrity <boolean>;
check\-mx ( fail | warn | ignore );
check\-mx\-cname ( fail | warn | ignore );
check\-names ( primary | master | secondary | slave | response ) ( fail | warn | ignore ); // may occur multiple times
check\-sibling <boolean>;
check\-spf ( warn | ignore );
check\-srv\-cname ( fail | warn | ignore );
check\-wildcard <boolean>;
clients\-per\-query <integer>;
cookie\-algorithm ( aes | siphash24 );
cookie\-secret <string>; // may occur multiple times
coresize ( default | unlimited | <sizeval> ); // deprecated
datasize ( default | unlimited | <sizeval> ); // deprecated
deny\-answer\-addresses { <address_match_element>; ... } [ except\-from { <string>; ... } ];
deny\-answer\-aliases { <string>; ... } [ except\-from { <string>; ... } ];
dialup ( notify | notify\-passive | passive | refresh | <boolean> ); // deprecated
directory <quoted_string>;
disable\-algorithms <string> { <string>; ... }; // may occur multiple times
disable\-ds\-digests <string> { <string>; ... }; // may occur multiple times
disable\-empty\-zone <string>; // may occur multiple times
dns64 <netprefix> {
break\-dnssec <boolean>;
clients { <address_match_element>; ... };
exclude { <address_match_element>; ... };
mapped { <address_match_element>; ... };
recursive\-only <boolean>;
suffix <ipv6_address>;
}; // may occur multiple times
dns64\-contact <string>;
dns64\-server <string>;
dnskey\-sig\-validity <integer>;
dnsrps\-enable <boolean>; // not configured
dnsrps\-options { <unspecified\-text> }; // not configured
dnssec\-accept\-expired <boolean>;
dnssec\-dnskey\-kskonly <boolean>;
dnssec\-loadkeys\-interval <integer>;
dnssec\-must\-be\-secure <string> <boolean>; // may occur multiple times, deprecated
dnssec\-policy <string>;
dnssec\-secure\-to\-insecure <boolean>;
dnssec\-update\-mode ( maintain | no\-resign );
dnssec\-validation ( yes | no | auto );
dnstap { ( all | auth | client | forwarder | resolver | update ) [ ( query | response ) ]; ... }; // not configured
dnstap\-identity ( <quoted_string> | none | hostname ); // not configured
dnstap\-output ( file | unix ) <quoted_string> [ size ( unlimited | <size> ) ] [ versions ( unlimited | <integer> ) ] [ suffix ( increment | timestamp ) ]; // not configured
dnstap\-version ( <quoted_string> | none ); // not configured
dscp <integer>; // obsolete
dual\-stack\-servers [ port <integer> ] { ( <quoted_string> [ port <integer> ] | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ); ... };
dump\-file <quoted_string>;
edns\-udp\-size <integer>;
empty\-contact <string>;
empty\-server <string>;
empty\-zones\-enable <boolean>;
fetch\-quota\-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
fetches\-per\-server <integer> [ ( drop | fail ) ];
fetches\-per\-zone <integer> [ ( drop | fail ) ];
files ( default | unlimited | <sizeval> ); // deprecated
flush\-zones\-on\-shutdown <boolean>;
forward ( first | only );
forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
fstrm\-set\-buffer\-hint <integer>; // not configured
fstrm\-set\-flush\-timeout <integer>; // not configured
fstrm\-set\-input\-queue\-size <integer>; // not configured
fstrm\-set\-output\-notify\-threshold <integer>; // not configured
fstrm\-set\-output\-queue\-model ( mpsc | spsc ); // not configured
fstrm\-set\-output\-queue\-size <integer>; // not configured
fstrm\-set\-reopen\-interval <duration>; // not configured
geoip\-directory ( <quoted_string> | none );
glue\-cache <boolean>; // deprecated
heartbeat\-interval <integer>; // deprecated
hostname ( <quoted_string> | none );
http\-listener\-clients <integer>;
http\-port <integer>;
http\-streams\-per\-connection <integer>;
https\-port <integer>;
interface\-interval <duration>;
ipv4only\-contact <string>;
ipv4only\-enable <boolean>;
ipv4only\-server <string>;
ixfr\-from\-differences ( primary | master | secondary | slave | <boolean> );
keep\-response\-order { <address_match_element>; ... };
key\-directory <quoted_string>;
lame\-ttl <duration>;
listen\-on [ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>; ... }; // may occur multiple times
listen\-on\-v6 [ port <integer> ] [ tls <string> ] [ http <string> ] { <address_match_element>; ... }; // may occur multiple times
lmdb\-mapsize <sizeval>;
lock\-file ( <quoted_string> | none );
managed\-keys\-directory <quoted_string>;
masterfile\-format ( raw | text );
masterfile\-style ( full | relative );
match\-mapped\-addresses <boolean>;
max\-cache\-size ( default | unlimited | <sizeval> | <percentage> );
max\-cache\-ttl <duration>;
max\-clients\-per\-query <integer>;
max\-ixfr\-ratio ( unlimited | <percentage> );
max\-journal\-size ( default | unlimited | <sizeval> );
max\-ncache\-ttl <duration>;
max\-records <integer>;
max\-recursion\-depth <integer>;
max\-recursion\-queries <integer>;
max\-refresh\-time <integer>;
max\-retry\-time <integer>;
max\-rsa\-exponent\-size <integer>;
max\-stale\-ttl <duration>;
max\-transfer\-idle\-in <integer>;
max\-transfer\-idle\-out <integer>;
max\-transfer\-time\-in <integer>;
max\-transfer\-time\-out <integer>;
max\-udp\-size <integer>;
max\-zone\-ttl ( unlimited | <duration> );
memstatistics <boolean>;
memstatistics\-file <quoted_string>;
message\-compression <boolean>;
min\-cache\-ttl <duration>;
min\-ncache\-ttl <duration>;
min\-refresh\-time <integer>;
min\-retry\-time <integer>;
minimal\-any <boolean>;
minimal\-responses ( no\-auth | no\-auth\-recursive | <boolean> );
multi\-master <boolean>;
new\-zones\-directory <quoted_string>;
no\-case\-compress { <address_match_element>; ... };
nocookie\-udp\-size <integer>;
notify ( explicit | master\-only | primary\-only | <boolean> );
notify\-delay <integer>;
notify\-rate <integer>;
notify\-source ( <ipv4_address> | * ) ;
notify\-source\-v6 ( <ipv6_address> | * ) ;
notify\-to\-soa <boolean>;
nsec3\-test\-zone <boolean>; // test only
nta\-lifetime <duration>;
nta\-recheck <duration>;
nxdomain\-redirect <string>;
parental\-source ( <ipv4_address> | * ) ;
parental\-source\-v6 ( <ipv6_address> | * ) ;
pid\-file ( <quoted_string> | none );
port <integer>;
preferred\-glue <string>;
prefetch <integer> [ <integer> ];
provide\-ixfr <boolean>;
qname\-minimization ( strict | relaxed | disabled | off );
query\-source [ address ] ( <ipv4_address> | * );
query\-source\-v6 [ address ] ( <ipv6_address> | * );
querylog <boolean>;
random\-device ( <quoted_string> | none ); // obsolete
rate\-limit {
all\-per\-second <integer>;
errors\-per\-second <integer>;
exempt\-clients { <address_match_element>; ... };
ipv4\-prefix\-length <integer>;
ipv6\-prefix\-length <integer>;
log\-only <boolean>;
max\-table\-size <integer>;
min\-table\-size <integer>;
nodata\-per\-second <integer>;
nxdomains\-per\-second <integer>;
qps\-scale <integer>;
referrals\-per\-second <integer>;
responses\-per\-second <integer>;
slip <integer>;
window <integer>;
};
recursing\-file <quoted_string>;
recursion <boolean>;
recursive\-clients <integer>;
request\-expire <boolean>;
request\-ixfr <boolean>;
request\-nsid <boolean>;
require\-server\-cookie <boolean>;
reserved\-sockets <integer>; // deprecated
resolver\-nonbackoff\-tries <integer>; // deprecated
resolver\-query\-timeout <integer>;
resolver\-retry\-interval <integer>; // deprecated
response\-padding { <address_match_element>; ... } block\-size <integer>;
response\-policy { zone <string> [ add\-soa <boolean> ] [ log <boolean> ] [ max\-policy\-ttl <duration> ] [ min\-update\-interval <duration> ] [ policy ( cname | disabled | drop | given | no\-op | nodata | nxdomain | passthru | tcp\-only <quoted_string> ) ] [ recursive\-only <boolean> ] [ nsip\-enable <boolean> ] [ nsdname\-enable <boolean> ]; ... } [ add\-soa <boolean> ] [ break\-dnssec <boolean> ] [ max\-policy\-ttl <duration> ] [ min\-update\-interval <duration> ] [ min\-ns\-dots <integer> ] [ nsip\-wait\-recurse <boolean> ] [ nsdname\-wait\-recurse <boolean> ] [ qname\-wait\-recurse <boolean> ] [ recursive\-only <boolean> ] [ nsip\-enable <boolean> ] [ nsdname\-enable <boolean> ] [ dnsrps\-enable <boolean> ] [ dnsrps\-options { <unspecified\-text> } ];
reuseport <boolean>;
root\-delegation\-only [ exclude { <string>; ... } ]; // deprecated
root\-key\-sentinel <boolean>;
rrset\-order { [ class <string> ] [ type <string> ] [ name <quoted_string> ] <string> <string>; ... };
secroots\-file <quoted_string>;
send\-cookie <boolean>;
serial\-query\-rate <integer>;
serial\-update\-method ( date | increment | unixtime );
server\-id ( <quoted_string> | none | hostname );
servfail\-ttl <duration>;
session\-keyalg <string>;
session\-keyfile ( <quoted_string> | none );
session\-keyname <string>;
sig\-signing\-nodes <integer>;
sig\-signing\-signatures <integer>;
sig\-signing\-type <integer>;
sig\-validity\-interval <integer> [ <integer> ];
sortlist { <address_match_element>; ... };
stacksize ( default | unlimited | <sizeval> ); // deprecated
stale\-answer\-client\-timeout ( disabled | off | <integer> );
stale\-answer\-enable <boolean>;
stale\-answer\-ttl <duration>;
stale\-cache\-enable <boolean>;
stale\-refresh\-time <duration>;
startup\-notify\-rate <integer>;
statistics\-file <quoted_string>;
suppress\-initial\-notify <boolean>; // obsolete
synth\-from\-dnssec <boolean>;
tcp\-advertised\-timeout <integer>;
tcp\-clients <integer>;
tcp\-idle\-timeout <integer>;
tcp\-initial\-timeout <integer>;
tcp\-keepalive\-timeout <integer>;
tcp\-listen\-queue <integer>;
tcp\-receive\-buffer <integer>;
tcp\-send\-buffer <integer>;
tkey\-dhkey <quoted_string> <integer>; // deprecated
tkey\-domain <quoted_string>;
tkey\-gssapi\-credential <quoted_string>;
tkey\-gssapi\-keytab <quoted_string>;
tls\-port <integer>;
transfer\-format ( many\-answers | one\-answer );
transfer\-message\-size <integer>;
transfer\-source ( <ipv4_address> | * ) ;
transfer\-source\-v6 ( <ipv6_address> | * ) ;
transfers\-in <integer>;
transfers\-out <integer>;
transfers\-per\-ns <integer>;
trust\-anchor\-telemetry <boolean>;
try\-tcp\-refresh <boolean>;
udp\-receive\-buffer <integer>;
udp\-send\-buffer <integer>;
update\-check\-ksk <boolean>;
update\-quota <integer>;
use\-alt\-transfer\-source <boolean>; // deprecated
use\-v4\-udp\-ports { <portrange>; ... }; // deprecated
use\-v6\-udp\-ports { <portrange>; ... }; // deprecated
v6\-bias <integer>;
validate\-except { <string>; ... };
version ( <quoted_string> | none );
zero\-no\-soa\-ttl <boolean>;
zero\-no\-soa\-ttl\-cache <boolean>;
zone\-statistics ( full | terse | none | <boolean> );
};
parental\-agents <string> [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times
plugin ( query ) <string> [ { <unspecified\-text> } ]; // may occur multiple times
primaries <string> [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times
server <netprefix> {
bogus <boolean>;
edns <boolean>;
edns\-udp\-size <integer>;
edns\-version <integer>;
keys <server_key>;
max\-udp\-size <integer>;
notify\-source ( <ipv4_address> | * ) ;
notify\-source\-v6 ( <ipv6_address> | * ) ;
padding <integer>;
provide\-ixfr <boolean>;
query\-source [ address ] ( <ipv4_address> | * );
query\-source\-v6 [ address ] ( <ipv6_address> | * );
request\-expire <boolean>;
request\-ixfr <boolean>;
request\-nsid <boolean>;
send\-cookie <boolean>;
tcp\-keepalive <boolean>;
tcp\-only <boolean>;
transfer\-format ( many\-answers | one\-answer );
transfer\-source ( <ipv4_address> | * ) ;
transfer\-source\-v6 ( <ipv6_address> | * ) ;
transfers <integer>;
}; // may occur multiple times
statistics\-channels {
inet ( <ipv4_address> | <ipv6_address> | * ) [ port ( <integer> | * ) ] [ allow { <address_match_element>; ... } ]; // may occur multiple times
}; // may occur multiple times
tls <string> {
ca\-file <quoted_string>;
cert\-file <quoted_string>;
ciphers <string>;
dhparam\-file <quoted_string>;
key\-file <quoted_string>;
prefer\-server\-ciphers <boolean>;
protocols { <string>; ... };
remote\-hostname <quoted_string>;
session\-tickets <boolean>;
}; // may occur multiple times
trust\-anchors { <string> ( static\-key | initial\-key | static\-ds | initial\-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times
trusted\-keys { <string> <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
view <string> [ <class> ] {
allow\-new\-zones <boolean>;
allow\-notify { <address_match_element>; ... };
allow\-query { <address_match_element>; ... };
allow\-query\-cache { <address_match_element>; ... };
allow\-query\-cache\-on { <address_match_element>; ... };
allow\-query\-on { <address_match_element>; ... };
allow\-recursion { <address_match_element>; ... };
allow\-recursion\-on { <address_match_element>; ... };
allow\-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
allow\-update { <address_match_element>; ... };
allow\-update\-forwarding { <address_match_element>; ... };
also\-notify [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
alt\-transfer\-source ( <ipv4_address> | * ) ; // deprecated
alt\-transfer\-source\-v6 ( <ipv6_address> | * ) ; // deprecated
attach\-cache <string>;
auth\-nxdomain <boolean>;
auto\-dnssec ( allow | maintain | off ); // deprecated
catalog\-zones { zone <string> [ default\-primaries [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone\-directory <quoted_string> ] [ in\-memory <boolean> ] [ min\-update\-interval <duration> ]; ... };
check\-dup\-records ( fail | warn | ignore );
check\-integrity <boolean>;
check\-mx ( fail | warn | ignore );
check\-mx\-cname ( fail | warn | ignore );
check\-names ( primary | master | secondary | slave | response ) ( fail | warn | ignore ); // may occur multiple times
check\-sibling <boolean>;
check\-spf ( warn | ignore );
check\-srv\-cname ( fail | warn | ignore );
check\-wildcard <boolean>;
clients\-per\-query <integer>;
deny\-answer\-addresses { <address_match_element>; ... } [ except\-from { <string>; ... } ];
deny\-answer\-aliases { <string>; ... } [ except\-from { <string>; ... } ];
dialup ( notify | notify\-passive | passive | refresh | <boolean> ); // deprecated
disable\-algorithms <string> { <string>; ... }; // may occur multiple times
disable\-ds\-digests <string> { <string>; ... }; // may occur multiple times
disable\-empty\-zone <string>; // may occur multiple times
dlz <string> {
database <string>;
search <boolean>;
}; // may occur multiple times
dns64 <netprefix> {
break\-dnssec <boolean>;
clients { <address_match_element>; ... };
exclude { <address_match_element>; ... };
mapped { <address_match_element>; ... };
recursive\-only <boolean>;
suffix <ipv6_address>;
}; // may occur multiple times
dns64\-contact <string>;
dns64\-server <string>;
dnskey\-sig\-validity <integer>;
dnsrps\-enable <boolean>; // not configured
dnsrps\-options { <unspecified\-text> }; // not configured
dnssec\-accept\-expired <boolean>;
dnssec\-dnskey\-kskonly <boolean>;
dnssec\-loadkeys\-interval <integer>;
dnssec\-must\-be\-secure <string> <boolean>; // may occur multiple times, deprecated
dnssec\-policy <string>;
dnssec\-secure\-to\-insecure <boolean>;
dnssec\-update\-mode ( maintain | no\-resign );
dnssec\-validation ( yes | no | auto );
dnstap { ( all | auth | client | forwarder | resolver | update ) [ ( query | response ) ]; ... }; // not configured
dual\-stack\-servers [ port <integer> ] { ( <quoted_string> [ port <integer> ] | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ); ... };
dyndb <string> <quoted_string> { <unspecified\-text> }; // may occur multiple times
edns\-udp\-size <integer>;
empty\-contact <string>;
empty\-server <string>;
empty\-zones\-enable <boolean>;
fetch\-quota\-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
fetches\-per\-server <integer> [ ( drop | fail ) ];
fetches\-per\-zone <integer> [ ( drop | fail ) ];
forward ( first | only );
forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
glue\-cache <boolean>; // deprecated
ipv4only\-contact <string>;
ipv4only\-enable <boolean>;
ipv4only\-server <string>;
ixfr\-from\-differences ( primary | master | secondary | slave | <boolean> );
key <string> {
algorithm <string>;
secret <string>;
}; // may occur multiple times
key\-directory <quoted_string>;
lame\-ttl <duration>;
lmdb\-mapsize <sizeval>;
managed\-keys { <string> ( static\-key | initial\-key | static\-ds | initial\-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
masterfile\-format ( raw | text );
masterfile\-style ( full | relative );
match\-clients { <address_match_element>; ... };
match\-destinations { <address_match_element>; ... };
match\-recursive\-only <boolean>;
max\-cache\-size ( default | unlimited | <sizeval> | <percentage> );
max\-cache\-ttl <duration>;
max\-clients\-per\-query <integer>;
max\-ixfr\-ratio ( unlimited | <percentage> );
max\-journal\-size ( default | unlimited | <sizeval> );
max\-ncache\-ttl <duration>;
max\-records <integer>;
max\-recursion\-depth <integer>;
max\-recursion\-queries <integer>;
max\-refresh\-time <integer>;
max\-retry\-time <integer>;
max\-stale\-ttl <duration>;
max\-transfer\-idle\-in <integer>;
max\-transfer\-idle\-out <integer>;
max\-transfer\-time\-in <integer>;
max\-transfer\-time\-out <integer>;
max\-udp\-size <integer>;
max\-zone\-ttl ( unlimited | <duration> );
message\-compression <boolean>;
min\-cache\-ttl <duration>;
min\-ncache\-ttl <duration>;
min\-refresh\-time <integer>;
min\-retry\-time <integer>;
minimal\-any <boolean>;
minimal\-responses ( no\-auth | no\-auth\-recursive | <boolean> );
multi\-master <boolean>;
new\-zones\-directory <quoted_string>;
no\-case\-compress { <address_match_element>; ... };
nocookie\-udp\-size <integer>;
notify ( explicit | master\-only | primary\-only | <boolean> );
notify\-delay <integer>;
notify\-source ( <ipv4_address> | * ) ;
notify\-source\-v6 ( <ipv6_address> | * ) ;
notify\-to\-soa <boolean>;
nsec3\-test\-zone <boolean>; // test only
nta\-lifetime <duration>;
nta\-recheck <duration>;
nxdomain\-redirect <string>;
parental\-source ( <ipv4_address> | * ) ;
parental\-source\-v6 ( <ipv6_address> | * ) ;
plugin ( query ) <string> [ { <unspecified\-text> } ]; // may occur multiple times
preferred\-glue <string>;
prefetch <integer> [ <integer> ];
provide\-ixfr <boolean>;
qname\-minimization ( strict | relaxed | disabled | off );
query\-source [ address ] ( <ipv4_address> | * );
query\-source\-v6 [ address ] ( <ipv6_address> | * );
rate\-limit {
all\-per\-second <integer>;
errors\-per\-second <integer>;
exempt\-clients { <address_match_element>; ... };
ipv4\-prefix\-length <integer>;
ipv6\-prefix\-length <integer>;
log\-only <boolean>;
max\-table\-size <integer>;
min\-table\-size <integer>;
nodata\-per\-second <integer>;
nxdomains\-per\-second <integer>;
qps\-scale <integer>;
referrals\-per\-second <integer>;
responses\-per\-second <integer>;
slip <integer>;
window <integer>;
};
recursion <boolean>;
request\-expire <boolean>;
request\-ixfr <boolean>;
request\-nsid <boolean>;
require\-server\-cookie <boolean>;
resolver\-nonbackoff\-tries <integer>; // deprecated
resolver\-query\-timeout <integer>;
resolver\-retry\-interval <integer>; // deprecated
response\-padding { <address_match_element>; ... } block\-size <integer>;
response\-policy { zone <string> [ add\-soa <boolean> ] [ log <boolean> ] [ max\-policy\-ttl <duration> ] [ min\-update\-interval <duration> ] [ policy ( cname | disabled | drop | given | no\-op | nodata | nxdomain | passthru | tcp\-only <quoted_string> ) ] [ recursive\-only <boolean> ] [ nsip\-enable <boolean> ] [ nsdname\-enable <boolean> ]; ... } [ add\-soa <boolean> ] [ break\-dnssec <boolean> ] [ max\-policy\-ttl <duration> ] [ min\-update\-interval <duration> ] [ min\-ns\-dots <integer> ] [ nsip\-wait\-recurse <boolean> ] [ nsdname\-wait\-recurse <boolean> ] [ qname\-wait\-recurse <boolean> ] [ recursive\-only <boolean> ] [ nsip\-enable <boolean> ] [ nsdname\-enable <boolean> ] [ dnsrps\-enable <boolean> ] [ dnsrps\-options { <unspecified\-text> } ];
root\-delegation\-only [ exclude { <string>; ... } ]; // deprecated
root\-key\-sentinel <boolean>;
rrset\-order { [ class <string> ] [ type <string> ] [ name <quoted_string> ] <string> <string>; ... };
send\-cookie <boolean>;
serial\-update\-method ( date | increment | unixtime );
server <netprefix> {
bogus <boolean>;
edns <boolean>;
edns\-udp\-size <integer>;
edns\-version <integer>;
keys <server_key>;
max\-udp\-size <integer>;
notify\-source ( <ipv4_address> | * ) ;
notify\-source\-v6 ( <ipv6_address> | * ) ;
padding <integer>;
provide\-ixfr <boolean>;
query\-source [ address ] ( <ipv4_address> | * );
query\-source\-v6 [ address ] ( <ipv6_address> | * );
request\-expire <boolean>;
request\-ixfr <boolean>;
request\-nsid <boolean>;
send\-cookie <boolean>;
tcp\-keepalive <boolean>;
tcp\-only <boolean>;
transfer\-format ( many\-answers | one\-answer );
transfer\-source ( <ipv4_address> | * ) ;
transfer\-source\-v6 ( <ipv6_address> | * ) ;
transfers <integer>;
}; // may occur multiple times
servfail\-ttl <duration>;
sig\-signing\-nodes <integer>;
sig\-signing\-signatures <integer>;
sig\-signing\-type <integer>;
sig\-validity\-interval <integer> [ <integer> ];
sortlist { <address_match_element>; ... };
stale\-answer\-client\-timeout ( disabled | off | <integer> );
stale\-answer\-enable <boolean>;
stale\-answer\-ttl <duration>;
stale\-cache\-enable <boolean>;
stale\-refresh\-time <duration>;
suppress\-initial\-notify <boolean>; // obsolete
synth\-from\-dnssec <boolean>;
transfer\-format ( many\-answers | one\-answer );
transfer\-source ( <ipv4_address> | * ) ;
transfer\-source\-v6 ( <ipv6_address> | * ) ;
trust\-anchor\-telemetry <boolean>;
trust\-anchors { <string> ( static\-key | initial\-key | static\-ds | initial\-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times
trusted\-keys { <string> <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated
try\-tcp\-refresh <boolean>;
update\-check\-ksk <boolean>;
use\-alt\-transfer\-source <boolean>; // deprecated
v6\-bias <integer>;
validate\-except { <string>; ... };
zero\-no\-soa\-ttl <boolean>;
zero\-no\-soa\-ttl\-cache <boolean>;
zone\-statistics ( full | terse | none | <boolean> );
}; // may occur multiple times
.ft P
.fi
.UNINDENT
.UNINDENT
.sp
Any of these zone statements can also be set inside the view statement.
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
zone <string> [ <class> ] {
type primary;
allow\-query { <address_match_element>; ... };
allow\-query\-on { <address_match_element>; ... };
allow\-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
allow\-update { <address_match_element>; ... };
also\-notify [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
alt\-transfer\-source ( <ipv4_address> | * ) ; // deprecated
alt\-transfer\-source\-v6 ( <ipv6_address> | * ) ; // deprecated
auto\-dnssec ( allow | maintain | off ); // deprecated
check\-dup\-records ( fail | warn | ignore );
check\-integrity <boolean>;
check\-mx ( fail | warn | ignore );
check\-mx\-cname ( fail | warn | ignore );
check\-names ( fail | warn | ignore );
check\-sibling <boolean>;
check\-spf ( warn | ignore );
check\-srv\-cname ( fail | warn | ignore );
check\-wildcard <boolean>;
database <string>;
dialup ( notify | notify\-passive | passive | refresh | <boolean> ); // deprecated
dlz <string>;
dnskey\-sig\-validity <integer>;
dnssec\-dnskey\-kskonly <boolean>;
dnssec\-loadkeys\-interval <integer>;
dnssec\-policy <string>;
dnssec\-secure\-to\-insecure <boolean>;
dnssec\-update\-mode ( maintain | no\-resign );
file <quoted_string>;
forward ( first | only );
forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
inline\-signing <boolean>;
ixfr\-from\-differences <boolean>;
journal <quoted_string>;
key\-directory <quoted_string>;
masterfile\-format ( raw | text );
masterfile\-style ( full | relative );
max\-ixfr\-ratio ( unlimited | <percentage> );
max\-journal\-size ( default | unlimited | <sizeval> );
max\-records <integer>;
max\-transfer\-idle\-out <integer>;
max\-transfer\-time\-out <integer>;
max\-zone\-ttl ( unlimited | <duration> );
notify ( explicit | master\-only | primary\-only | <boolean> );
notify\-delay <integer>;
notify\-source ( <ipv4_address> | * ) ;
notify\-source\-v6 ( <ipv6_address> | * ) ;
notify\-to\-soa <boolean>;
nsec3\-test\-zone <boolean>; // test only
parental\-agents [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
parental\-source ( <ipv4_address> | * ) ;
parental\-source\-v6 ( <ipv6_address> | * ) ;
serial\-update\-method ( date | increment | unixtime );
sig\-signing\-nodes <integer>;
sig\-signing\-signatures <integer>;
sig\-signing\-type <integer>;
sig\-validity\-interval <integer> [ <integer> ];
update\-check\-ksk <boolean>;
update\-policy ( local | { ( deny | grant ) <string> ( 6to4\-self | external | krb5\-self | krb5\-selfsub | krb5\-subdomain | krb5\-subdomain\-self\-rhs | ms\-self | ms\-selfsub | ms\-subdomain | ms\-subdomain\-self\-rhs | name | self | selfsub | selfwild | subdomain | tcp\-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... } );
zero\-no\-soa\-ttl <boolean>;
zone\-statistics ( full | terse | none | <boolean> );
};
.ft P
.fi
.UNINDENT
.UNINDENT
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
zone <string> [ <class> ] {
type secondary;
allow\-notify { <address_match_element>; ... };
allow\-query { <address_match_element>; ... };
allow\-query\-on { <address_match_element>; ... };
allow\-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
allow\-update\-forwarding { <address_match_element>; ... };
also\-notify [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
alt\-transfer\-source ( <ipv4_address> | * ) ; // deprecated
alt\-transfer\-source\-v6 ( <ipv6_address> | * ) ; // deprecated
auto\-dnssec ( allow | maintain | off ); // deprecated
check\-names ( fail | warn | ignore );
database <string>;
dialup ( notify | notify\-passive | passive | refresh | <boolean> ); // deprecated
dlz <string>;
dnskey\-sig\-validity <integer>;
dnssec\-dnskey\-kskonly <boolean>;
dnssec\-loadkeys\-interval <integer>;
dnssec\-policy <string>;
dnssec\-update\-mode ( maintain | no\-resign );
file <quoted_string>;
forward ( first | only );
forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
inline\-signing <boolean>;
ixfr\-from\-differences <boolean>;
journal <quoted_string>;
key\-directory <quoted_string>;
masterfile\-format ( raw | text );
masterfile\-style ( full | relative );
max\-ixfr\-ratio ( unlimited | <percentage> );
max\-journal\-size ( default | unlimited | <sizeval> );
max\-records <integer>;
max\-refresh\-time <integer>;
max\-retry\-time <integer>;
max\-transfer\-idle\-in <integer>;
max\-transfer\-idle\-out <integer>;
max\-transfer\-time\-in <integer>;
max\-transfer\-time\-out <integer>;
min\-refresh\-time <integer>;
min\-retry\-time <integer>;
multi\-master <boolean>;
notify ( explicit | master\-only | primary\-only | <boolean> );
notify\-delay <integer>;
notify\-source ( <ipv4_address> | * ) ;
notify\-source\-v6 ( <ipv6_address> | * ) ;
notify\-to\-soa <boolean>;
nsec3\-test\-zone <boolean>; // test only
parental\-agents [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
parental\-source ( <ipv4_address> | * ) ;
parental\-source\-v6 ( <ipv6_address> | * ) ;
primaries [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
request\-expire <boolean>;
request\-ixfr <boolean>;
sig\-signing\-nodes <integer>;
sig\-signing\-signatures <integer>;
sig\-signing\-type <integer>;
sig\-validity\-interval <integer> [ <integer> ];
transfer\-source ( <ipv4_address> | * ) ;
transfer\-source\-v6 ( <ipv6_address> | * ) ;
try\-tcp\-refresh <boolean>;
update\-check\-ksk <boolean>;
use\-alt\-transfer\-source <boolean>; // deprecated
zero\-no\-soa\-ttl <boolean>;
zone\-statistics ( full | terse | none | <boolean> );
};
.ft P
.fi
.UNINDENT
.UNINDENT
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
zone <string> [ <class> ] {
type mirror;
allow\-notify { <address_match_element>; ... };
allow\-query { <address_match_element>; ... };
allow\-query\-on { <address_match_element>; ... };
allow\-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
allow\-update\-forwarding { <address_match_element>; ... };
also\-notify [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
alt\-transfer\-source ( <ipv4_address> | * ) ; // deprecated
alt\-transfer\-source\-v6 ( <ipv6_address> | * ) ; // deprecated
check\-names ( fail | warn | ignore );
database <string>;
file <quoted_string>;
ixfr\-from\-differences <boolean>;
journal <quoted_string>;
masterfile\-format ( raw | text );
masterfile\-style ( full | relative );
max\-ixfr\-ratio ( unlimited | <percentage> );
max\-journal\-size ( default | unlimited | <sizeval> );
max\-records <integer>;
max\-refresh\-time <integer>;
max\-retry\-time <integer>;
max\-transfer\-idle\-in <integer>;
max\-transfer\-idle\-out <integer>;
max\-transfer\-time\-in <integer>;
max\-transfer\-time\-out <integer>;
min\-refresh\-time <integer>;
min\-retry\-time <integer>;
multi\-master <boolean>;
notify ( explicit | master\-only | primary\-only | <boolean> );
notify\-delay <integer>;
notify\-source ( <ipv4_address> | * ) ;
notify\-source\-v6 ( <ipv6_address> | * ) ;
primaries [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
request\-expire <boolean>;
request\-ixfr <boolean>;
transfer\-source ( <ipv4_address> | * ) ;
transfer\-source\-v6 ( <ipv6_address> | * ) ;
try\-tcp\-refresh <boolean>;
use\-alt\-transfer\-source <boolean>; // deprecated
zero\-no\-soa\-ttl <boolean>;
zone\-statistics ( full | terse | none | <boolean> );
};
.ft P
.fi
.UNINDENT
.UNINDENT
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
zone <string> [ <class> ] {
type forward;
delegation\-only <boolean>; // deprecated
forward ( first | only );
forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
};
.ft P
.fi
.UNINDENT
.UNINDENT
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
zone <string> [ <class> ] {
type hint;
check\-names ( fail | warn | ignore );
delegation\-only <boolean>; // deprecated
file <quoted_string>;
};
.ft P
.fi
.UNINDENT
.UNINDENT
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
zone <string> [ <class> ] {
type redirect;
allow\-query { <address_match_element>; ... };
allow\-query\-on { <address_match_element>; ... };
dlz <string>;
file <quoted_string>;
masterfile\-format ( raw | text );
masterfile\-style ( full | relative );
max\-records <integer>;
max\-zone\-ttl ( unlimited | <duration> );
primaries [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
zone\-statistics ( full | terse | none | <boolean> );
};
.ft P
.fi
.UNINDENT
.UNINDENT
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
zone <string> [ <class> ] {
type static\-stub;
allow\-query { <address_match_element>; ... };
allow\-query\-on { <address_match_element>; ... };
forward ( first | only );
forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
max\-records <integer>;
server\-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
server\-names { <string>; ... };
zone\-statistics ( full | terse | none | <boolean> );
};
.ft P
.fi
.UNINDENT
.UNINDENT
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
zone <string> [ <class> ] {
type stub;
allow\-query { <address_match_element>; ... };
allow\-query\-on { <address_match_element>; ... };
check\-names ( fail | warn | ignore );
database <string>;
delegation\-only <boolean>; // deprecated
dialup ( notify | notify\-passive | passive | refresh | <boolean> ); // deprecated
file <quoted_string>;
forward ( first | only );
forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
masterfile\-format ( raw | text );
masterfile\-style ( full | relative );
max\-records <integer>;
max\-refresh\-time <integer>;
max\-retry\-time <integer>;
max\-transfer\-idle\-in <integer>;
max\-transfer\-time\-in <integer>;
min\-refresh\-time <integer>;
min\-retry\-time <integer>;
multi\-master <boolean>;
primaries [ port <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
transfer\-source ( <ipv4_address> | * ) ;
transfer\-source\-v6 ( <ipv6_address> | * ) ;
use\-alt\-transfer\-source <boolean>; // deprecated
zone\-statistics ( full | terse | none | <boolean> );
};
.ft P
.fi
.UNINDENT
.UNINDENT
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
zone <string> [ <class> ] {
type delegation\-only;
};
.ft P
.fi
.UNINDENT
.UNINDENT
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
zone <string> [ <class> ] {
in\-view <string>;
};
.ft P
.fi
.UNINDENT
.UNINDENT
.SH FILES
.sp
\fB@sysconfdir@/named.conf\fP
.SH SEE ALSO
.sp
\fI\%named(8)\fP, \fI\%named\-checkconf(8)\fP, \fI\%rndc(8)\fP, \fI\%rndc\-confgen(8)\fP, \fI\%tsig\-keygen(8)\fP, BIND 9 Administrator Reference Manual.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
2024, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.