Scroll to navigation

NAMED.CONF(5) BIND 9 NAMED.CONF(5)

NAME

named.conf - configuration file for **named**

SYNOPSIS

named.conf

DESCRIPTION

named.conf is the configuration file for named. Statements are enclosed in braces and terminated with a semi-colon. Clauses in the statements are also semi-colon terminated. The usual comment styles are supported:

C style: /* */

C++ style: // to end of line


Unix style: # to end of line

ACL

acl string { address_match_element; ... };


CONTROLS

controls {
      inet ( ipv4_address | ipv6_address |
          * ) [ port ( integer | * ) ] allow
          { address_match_element; ... } [
          keys { string; ... } ] [ read-only
          boolean ];
      unix quoted_string perm integer
          owner integer group integer [
          keys { string; ... } ] [ read-only
          boolean ];
};


DLZ

dlz string {
      database string;
      search boolean;
};


DNSSEC-POLICY

dnssec-policy string {
      dnskey-ttl duration;
      keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
          duration_or_unlimited algorithm string [ integer ]; ... };
      max-zone-ttl duration;
      nsec3param [ iterations integer ] [ optout boolean ] [
          salt-length integer ];
      parent-ds-ttl duration;
      parent-propagation-delay duration;
      publish-safety duration;
      purge-keys duration;
      retire-safety duration;
      signatures-refresh duration;
      signatures-validity duration;
      signatures-validity-dnskey duration;
      zone-propagation-delay duration;
};


DYNDB

dyndb string quoted_string {
    unspecified-text };


KEY

key string {
      algorithm string;
      secret string;
};


LOGGING

logging {
      category string { string; ... };
      channel string {
              buffered boolean;
              file quoted_string [ versions ( unlimited | integer ) ]
                  [ size size ] [ suffix ( increment | timestamp ) ];
              null;
              print-category boolean;
              print-severity boolean;
              print-time ( iso8601 | iso8601-utc | local | boolean );
              severity log_severity;
              stderr;
              syslog [ syslog_facility ];
      };
};


MANAGED-KEYS

See DNSSEC-KEYS. 

managed-keys { string ( static-key
    | initial-key | static-ds |
    initial-ds ) integer integer
    integer quoted_string; ... };, deprecated


MASTERS

masters string [ port integer ] [ dscp
    integer ] { ( primaries | ipv4_address
    [ port integer ] | ipv6_address [ port
    integer ] ) [ key string ]; ... };


OPTIONS

options {
      allow-new-zones boolean;
      allow-notify { address_match_element; ... };
      allow-query { address_match_element; ... };
      allow-query-cache { address_match_element; ... };
      allow-query-cache-on { address_match_element; ... };
      allow-query-on { address_match_element; ... };
      allow-recursion { address_match_element; ... };
      allow-recursion-on { address_match_element; ... };
      allow-transfer { address_match_element; ... };
      allow-update { address_match_element; ... };
      allow-update-forwarding { address_match_element; ... };
      also-notify [ port integer ] [ dscp integer ] { ( primaries |
          ipv4_address [ port integer ] | ipv6_address [ port
          integer ] ) [ key string ]; ... };
      alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
          ] [ dscp integer ];
      alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
          * ) ] [ dscp integer ];
      answer-cookie boolean;
      attach-cache string;
      auth-nxdomain boolean; // default changed
      auto-dnssec ( allow | maintain | off );
      automatic-interface-scan boolean;
      avoid-v4-udp-ports { portrange; ... };
      avoid-v6-udp-ports { portrange; ... };
      bindkeys-file quoted_string;
      blackhole { address_match_element; ... };
      cache-file quoted_string;
      catalog-zones { zone string [ default-masters [ port integer ]
          [ dscp integer ] { ( primaries | ipv4_address [ port
          integer ] | ipv6_address [ port integer ] ) [ key
          string ]; ... } ] [ zone-directory quoted_string ] [
          in-memory boolean ] [ min-update-interval duration ]; ... };
      check-dup-records ( fail | warn | ignore );
      check-integrity boolean;
      check-mx ( fail | warn | ignore );
      check-mx-cname ( fail | warn | ignore );
      check-names ( primary | master |
          secondary | slave | response ) (
          fail | warn | ignore );
      check-sibling boolean;
      check-spf ( warn | ignore );
      check-srv-cname ( fail | warn | ignore );
      check-wildcard boolean;
      clients-per-query integer;
      cookie-algorithm ( aes | siphash24 );
      cookie-secret string;
      coresize ( default | unlimited | sizeval );
      datasize ( default | unlimited | sizeval );
      deny-answer-addresses { address_match_element; ... } [
          except-from { string; ... } ];
      deny-answer-aliases { string; ... } [ except-from { string; ...
          } ];
      dialup ( notify | notify-passive | passive | refresh | boolean );
      directory quoted_string;
      disable-algorithms string { string;
          ... };
      disable-ds-digests string { string;
          ... };
      disable-empty-zone string;
      dns64 netprefix {
              break-dnssec boolean;
              clients { address_match_element; ... };
              exclude { address_match_element; ... };
              mapped { address_match_element; ... };
              recursive-only boolean;
              suffix ipv6_address;
      };
      dns64-contact string;
      dns64-server string;
      dnskey-sig-validity integer;
      dnsrps-enable boolean;
      dnsrps-options { unspecified-text };
      dnssec-accept-expired boolean;
      dnssec-dnskey-kskonly boolean;
      dnssec-loadkeys-interval integer;
      dnssec-must-be-secure string boolean;
      dnssec-policy string;
      dnssec-secure-to-insecure boolean;
      dnssec-update-mode ( maintain | no-resign );
      dnssec-validation ( yes | no | auto );
      dnstap { ( all | auth | client | forwarder |
          resolver | update ) [ ( query | response ) ];
          ... };
      dnstap-identity ( quoted_string | none |
          hostname );
      dnstap-output ( file | unix ) quoted_string [
          size ( unlimited | size ) ] [ versions (
          unlimited | integer ) ] [ suffix ( increment
          | timestamp ) ];
      dnstap-version ( quoted_string | none );
      dscp integer;
      dual-stack-servers [ port integer ] { ( quoted_string [ port
          integer ] [ dscp integer ] | ipv4_address [ port
          integer ] [ dscp integer ] | ipv6_address [ port
          integer ] [ dscp integer ] ); ... };
      dump-file quoted_string;
      edns-udp-size integer;
      empty-contact string;
      empty-server string;
      empty-zones-enable boolean;
      fetch-quota-params integer fixedpoint fixedpoint fixedpoint;
      fetches-per-server integer [ ( drop | fail ) ];
      fetches-per-zone integer [ ( drop | fail ) ];
      files ( default | unlimited | sizeval );
      flush-zones-on-shutdown boolean;
      forward ( first | only );
      forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
          | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
      fstrm-set-buffer-hint integer;
      fstrm-set-flush-timeout integer;
      fstrm-set-input-queue-size integer;
      fstrm-set-output-notify-threshold integer;
      fstrm-set-output-queue-model ( mpsc | spsc );
      fstrm-set-output-queue-size integer;
      fstrm-set-reopen-interval duration;
      geoip-directory ( quoted_string | none );
      glue-cache boolean;
      heartbeat-interval integer;
      hostname ( quoted_string | none );
      inline-signing boolean;
      interface-interval duration;
      ixfr-from-differences ( primary | master | secondary | slave |
          boolean );
      keep-response-order { address_match_element; ... };
      key-directory quoted_string;
      lame-ttl duration;
      listen-on [ port integer ] [ dscp
          integer ] {
          address_match_element; ... };
      listen-on-v6 [ port integer ] [ dscp
          integer ] {
          address_match_element; ... };
      lmdb-mapsize sizeval;
      lock-file ( quoted_string | none );
      managed-keys-directory quoted_string;
      masterfile-format ( map | raw | text );
      masterfile-style ( full | relative );
      match-mapped-addresses boolean;
      max-cache-size ( default | unlimited | sizeval | percentage );
      max-cache-ttl duration;
      max-clients-per-query integer;
      max-journal-size ( default | unlimited | sizeval );
      max-ncache-ttl duration;
      max-records integer;
      max-recursion-depth integer;
      max-recursion-queries integer;
      max-refresh-time integer;
      max-retry-time integer;
      max-rsa-exponent-size integer;
      max-stale-ttl duration;
      max-transfer-idle-in integer;
      max-transfer-idle-out integer;
      max-transfer-time-in integer;
      max-transfer-time-out integer;
      max-udp-size integer;
      max-zone-ttl ( unlimited | duration );
      memstatistics boolean;
      memstatistics-file quoted_string;
      message-compression boolean;
      min-cache-ttl duration;
      min-ncache-ttl duration;
      min-refresh-time integer;
      min-retry-time integer;
      minimal-any boolean;
      minimal-responses ( no-auth | no-auth-recursive | boolean );
      multi-master boolean;
      new-zones-directory quoted_string;
      no-case-compress { address_match_element; ... };
      nocookie-udp-size integer;
      notify ( explicit | master-only | primary-only | boolean );
      notify-delay integer;
      notify-rate integer;
      notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
          [ dscp integer ];
      notify-to-soa boolean;
      nta-lifetime duration;
      nta-recheck duration;
      nxdomain-redirect string;
      pid-file ( quoted_string | none );
      port integer;
      preferred-glue string;
      prefetch integer [ integer ];
      provide-ixfr boolean;
      qname-minimization ( strict | relaxed | disabled | off );
      query-source ( ( [ address ] ( ipv4_address | * ) [ port (
          integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
          port ( integer | * ) ) ) [ dscp integer ];
      query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
          integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
          port ( integer | * ) ) ) [ dscp integer ];
      querylog boolean;
      random-device ( quoted_string | none );
      rate-limit {
              all-per-second integer;
              errors-per-second integer;
              exempt-clients { address_match_element; ... };
              ipv4-prefix-length integer;
              ipv6-prefix-length integer;
              log-only boolean;
              max-table-size integer;
              min-table-size integer;
              nodata-per-second integer;
              nxdomains-per-second integer;
              qps-scale integer;
              referrals-per-second integer;
              responses-per-second integer;
              slip integer;
              window integer;
      };
      recursing-file quoted_string;
      recursion boolean;
      recursive-clients integer;
      request-expire boolean;
      request-ixfr boolean;
      request-nsid boolean;
      require-server-cookie boolean;
      reserved-sockets integer;
      resolver-nonbackoff-tries integer;
      resolver-query-timeout integer;
      resolver-retry-interval integer;
      response-padding { address_match_element; ... } block-size
          integer;
      response-policy { zone string [ add-soa boolean ] [ log
          boolean ] [ max-policy-ttl duration ] [ min-update-interval
          duration ] [ policy ( cname | disabled | drop | given | no-op
          | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
          recursive-only boolean ] [ nsip-enable boolean ] [
          nsdname-enable boolean ]; ... } [ add-soa boolean ] [
          break-dnssec boolean ] [ max-policy-ttl duration ] [
          min-update-interval duration ] [ min-ns-dots integer ] [
          nsip-wait-recurse boolean ] [ qname-wait-recurse boolean ]
          [ recursive-only boolean ] [ nsip-enable boolean ] [
          nsdname-enable boolean ] [ dnsrps-enable boolean ] [
          dnsrps-options { unspecified-text } ];
      root-delegation-only [ exclude { string; ... } ];
      root-key-sentinel boolean;
      rrset-order { [ class string ] [ type string ] [ name
          quoted_string ] string string; ... };
      secroots-file quoted_string;
      send-cookie boolean;
      serial-query-rate integer;
      serial-update-method ( date | increment | unixtime );
      server-id ( quoted_string | none | hostname );
      servfail-ttl duration;
      session-keyalg string;
      session-keyfile ( quoted_string | none );
      session-keyname string;
      sig-signing-nodes integer;
      sig-signing-signatures integer;
      sig-signing-type integer;
      sig-validity-interval integer [ integer ];
      sortlist { address_match_element; ... };
      stacksize ( default | unlimited | sizeval );
      stale-answer-client-timeout ( disabled | off | integer );
      stale-answer-enable boolean;
      stale-answer-ttl duration;
      stale-cache-enable boolean;
      stale-refresh-time duration;
      startup-notify-rate integer;
      statistics-file quoted_string;
      synth-from-dnssec boolean;
      tcp-advertised-timeout integer;
      tcp-clients integer;
      tcp-idle-timeout integer;
      tcp-initial-timeout integer;
      tcp-keepalive-timeout integer;
      tcp-listen-queue integer;
      tkey-dhkey quoted_string integer;
      tkey-domain quoted_string;
      tkey-gssapi-credential quoted_string;
      tkey-gssapi-keytab quoted_string;
      transfer-format ( many-answers | one-answer );
      transfer-message-size integer;
      transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
          ] [ dscp integer ];
      transfers-in integer;
      transfers-out integer;
      transfers-per-ns integer;
      trust-anchor-telemetry boolean; // experimental
      try-tcp-refresh boolean;
      update-check-ksk boolean;
      use-alt-transfer-source boolean;
      use-v4-udp-ports { portrange; ... };
      use-v6-udp-ports { portrange; ... };
      v6-bias integer;
      validate-except { string; ... };
      version ( quoted_string | none );
      zero-no-soa-ttl boolean;
      zero-no-soa-ttl-cache boolean;
      zone-statistics ( full | terse | none | boolean );
};


PLUGIN

plugin ( query ) string [ { unspecified-text
    } ];


PRIMARIES

primaries string [ port integer ] [ dscp
    integer ] { ( primaries | ipv4_address
    [ port integer ] | ipv6_address [ port
    integer ] ) [ key string ]; ... };


SERVER

server netprefix {
      bogus boolean;
      edns boolean;
      edns-udp-size integer;
      edns-version integer;
      keys server_key;
      max-udp-size integer;
      notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
          [ dscp integer ];
      padding integer;
      provide-ixfr boolean;
      query-source ( ( [ address ] ( ipv4_address | * ) [ port (
          integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
          port ( integer | * ) ) ) [ dscp integer ];
      query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
          integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
          port ( integer | * ) ) ) [ dscp integer ];
      request-expire boolean;
      request-ixfr boolean;
      request-nsid boolean;
      send-cookie boolean;
      tcp-keepalive boolean;
      tcp-only boolean;
      transfer-format ( many-answers | one-answer );
      transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
          ] [ dscp integer ];
      transfers integer;
};


STATISTICS-CHANNELS

statistics-channels {
      inet ( ipv4_address | ipv6_address |
          * ) [ port ( integer | * ) ] [
          allow { address_match_element; ...
          } ];
};


TRUST-ANCHORS

trust-anchors { string ( static-key |
    initial-key | static-ds | initial-ds )
    integer integer integer
    quoted_string; ... };


TRUSTED-KEYS

Deprecated - see DNSSEC-KEYS. 

trusted-keys { string integer
    integer integer
    quoted_string; ... };, deprecated


VIEW

view string [ class ] {
      allow-new-zones boolean;
      allow-notify { address_match_element; ... };
      allow-query { address_match_element; ... };
      allow-query-cache { address_match_element; ... };
      allow-query-cache-on { address_match_element; ... };
      allow-query-on { address_match_element; ... };
      allow-recursion { address_match_element; ... };
      allow-recursion-on { address_match_element; ... };
      allow-transfer { address_match_element; ... };
      allow-update { address_match_element; ... };
      allow-update-forwarding { address_match_element; ... };
      also-notify [ port integer ] [ dscp integer ] { ( primaries |
          ipv4_address [ port integer ] | ipv6_address [ port
          integer ] ) [ key string ]; ... };
      alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
          ] [ dscp integer ];
      alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
          * ) ] [ dscp integer ];
      attach-cache string;
      auth-nxdomain boolean; // default changed
      auto-dnssec ( allow | maintain | off );
      cache-file quoted_string;
      catalog-zones { zone string [ default-masters [ port integer ]
          [ dscp integer ] { ( primaries | ipv4_address [ port
          integer ] | ipv6_address [ port integer ] ) [ key
          string ]; ... } ] [ zone-directory quoted_string ] [
          in-memory boolean ] [ min-update-interval duration ]; ... };
      check-dup-records ( fail | warn | ignore );
      check-integrity boolean;
      check-mx ( fail | warn | ignore );
      check-mx-cname ( fail | warn | ignore );
      check-names ( primary | master |
          secondary | slave | response ) (
          fail | warn | ignore );
      check-sibling boolean;
      check-spf ( warn | ignore );
      check-srv-cname ( fail | warn | ignore );
      check-wildcard boolean;
      clients-per-query integer;
      deny-answer-addresses { address_match_element; ... } [
          except-from { string; ... } ];
      deny-answer-aliases { string; ... } [ except-from { string; ...
          } ];
      dialup ( notify | notify-passive | passive | refresh | boolean );
      disable-algorithms string { string;
          ... };
      disable-ds-digests string { string;
          ... };
      disable-empty-zone string;
      dlz string {
              database string;
              search boolean;
      };
      dns64 netprefix {
              break-dnssec boolean;
              clients { address_match_element; ... };
              exclude { address_match_element; ... };
              mapped { address_match_element; ... };
              recursive-only boolean;
              suffix ipv6_address;
      };
      dns64-contact string;
      dns64-server string;
      dnskey-sig-validity integer;
      dnsrps-enable boolean;
      dnsrps-options { unspecified-text };
      dnssec-accept-expired boolean;
      dnssec-dnskey-kskonly boolean;
      dnssec-loadkeys-interval integer;
      dnssec-must-be-secure string boolean;
      dnssec-policy string;
      dnssec-secure-to-insecure boolean;
      dnssec-update-mode ( maintain | no-resign );
      dnssec-validation ( yes | no | auto );
      dnstap { ( all | auth | client | forwarder |
          resolver | update ) [ ( query | response ) ];
          ... };
      dual-stack-servers [ port integer ] { ( quoted_string [ port
          integer ] [ dscp integer ] | ipv4_address [ port
          integer ] [ dscp integer ] | ipv6_address [ port
          integer ] [ dscp integer ] ); ... };
      dyndb string quoted_string {
          unspecified-text };
      edns-udp-size integer;
      empty-contact string;
      empty-server string;
      empty-zones-enable boolean;
      fetch-quota-params integer fixedpoint fixedpoint fixedpoint;
      fetches-per-server integer [ ( drop | fail ) ];
      fetches-per-zone integer [ ( drop | fail ) ];
      forward ( first | only );
      forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
          | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
      glue-cache boolean;
      inline-signing boolean;
      ixfr-from-differences ( primary | master | secondary | slave |
          boolean );
      key string {
              algorithm string;
              secret string;
      };
      key-directory quoted_string;
      lame-ttl duration;
      lmdb-mapsize sizeval;
      managed-keys { string (
          static-key | initial-key
          | static-ds | initial-ds
          ) integer integer
          integer
          quoted_string; ... };, deprecated
      masterfile-format ( map | raw | text );
      masterfile-style ( full | relative );
      match-clients { address_match_element; ... };
      match-destinations { address_match_element; ... };
      match-recursive-only boolean;
      max-cache-size ( default | unlimited | sizeval | percentage );
      max-cache-ttl duration;
      max-clients-per-query integer;
      max-journal-size ( default | unlimited | sizeval );
      max-ncache-ttl duration;
      max-records integer;
      max-recursion-depth integer;
      max-recursion-queries integer;
      max-refresh-time integer;
      max-retry-time integer;
      max-stale-ttl duration;
      max-transfer-idle-in integer;
      max-transfer-idle-out integer;
      max-transfer-time-in integer;
      max-transfer-time-out integer;
      max-udp-size integer;
      max-zone-ttl ( unlimited | duration );
      message-compression boolean;
      min-cache-ttl duration;
      min-ncache-ttl duration;
      min-refresh-time integer;
      min-retry-time integer;
      minimal-any boolean;
      minimal-responses ( no-auth | no-auth-recursive | boolean );
      multi-master boolean;
      new-zones-directory quoted_string;
      no-case-compress { address_match_element; ... };
      nocookie-udp-size integer;
      notify ( explicit | master-only | primary-only | boolean );
      notify-delay integer;
      notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
          [ dscp integer ];
      notify-to-soa boolean;
      nta-lifetime duration;
      nta-recheck duration;
      nxdomain-redirect string;
      plugin ( query ) string [ {
          unspecified-text } ];
      preferred-glue string;
      prefetch integer [ integer ];
      provide-ixfr boolean;
      qname-minimization ( strict | relaxed | disabled | off );
      query-source ( ( [ address ] ( ipv4_address | * ) [ port (
          integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
          port ( integer | * ) ) ) [ dscp integer ];
      query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
          integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
          port ( integer | * ) ) ) [ dscp integer ];
      rate-limit {
              all-per-second integer;
              errors-per-second integer;
              exempt-clients { address_match_element; ... };
              ipv4-prefix-length integer;
              ipv6-prefix-length integer;
              log-only boolean;
              max-table-size integer;
              min-table-size integer;
              nodata-per-second integer;
              nxdomains-per-second integer;
              qps-scale integer;
              referrals-per-second integer;
              responses-per-second integer;
              slip integer;
              window integer;
      };
      recursion boolean;
      request-expire boolean;
      request-ixfr boolean;
      request-nsid boolean;
      require-server-cookie boolean;
      resolver-nonbackoff-tries integer;
      resolver-query-timeout integer;
      resolver-retry-interval integer;
      response-padding { address_match_element; ... } block-size
          integer;
      response-policy { zone string [ add-soa boolean ] [ log
          boolean ] [ max-policy-ttl duration ] [ min-update-interval
          duration ] [ policy ( cname | disabled | drop | given | no-op
          | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
          recursive-only boolean ] [ nsip-enable boolean ] [
          nsdname-enable boolean ]; ... } [ add-soa boolean ] [
          break-dnssec boolean ] [ max-policy-ttl duration ] [
          min-update-interval duration ] [ min-ns-dots integer ] [
          nsip-wait-recurse boolean ] [ qname-wait-recurse boolean ]
          [ recursive-only boolean ] [ nsip-enable boolean ] [
          nsdname-enable boolean ] [ dnsrps-enable boolean ] [
          dnsrps-options { unspecified-text } ];
      root-delegation-only [ exclude { string; ... } ];
      root-key-sentinel boolean;
      rrset-order { [ class string ] [ type string ] [ name
          quoted_string ] string string; ... };
      send-cookie boolean;
      serial-update-method ( date | increment | unixtime );
      server netprefix {
              bogus boolean;
              edns boolean;
              edns-udp-size integer;
              edns-version integer;
              keys server_key;
              max-udp-size integer;
              notify-source ( ipv4_address | * ) [ port ( integer | *
                  ) ] [ dscp integer ];
              notify-source-v6 ( ipv6_address | * ) [ port ( integer
                  | * ) ] [ dscp integer ];
              padding integer;
              provide-ixfr boolean;
              query-source ( ( [ address ] ( ipv4_address | * ) [ port
                  ( integer | * ) ] ) | ( [ [ address ] (
                  ipv4_address | * ) ] port ( integer | * ) ) ) [
                  dscp integer ];
              query-source-v6 ( ( [ address ] ( ipv6_address | * ) [
                  port ( integer | * ) ] ) | ( [ [ address ] (
                  ipv6_address | * ) ] port ( integer | * ) ) ) [
                  dscp integer ];
              request-expire boolean;
              request-ixfr boolean;
              request-nsid boolean;
              send-cookie boolean;
              tcp-keepalive boolean;
              tcp-only boolean;
              transfer-format ( many-answers | one-answer );
              transfer-source ( ipv4_address | * ) [ port ( integer |
                  * ) ] [ dscp integer ];
              transfer-source-v6 ( ipv6_address | * ) [ port (
                  integer | * ) ] [ dscp integer ];
              transfers integer;
      };
      servfail-ttl duration;
      sig-signing-nodes integer;
      sig-signing-signatures integer;
      sig-signing-type integer;
      sig-validity-interval integer [ integer ];
      sortlist { address_match_element; ... };
      stale-answer-client-timeout ( disabled | off | integer );
      stale-answer-enable boolean;
      stale-answer-ttl duration;
      stale-cache-enable boolean;
      stale-refresh-time duration;
      synth-from-dnssec boolean;
      transfer-format ( many-answers | one-answer );
      transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
          ] [ dscp integer ];
      trust-anchor-telemetry boolean; // experimental
      trust-anchors { string ( static-key |
          initial-key | static-ds | initial-ds
          ) integer integer integer
          quoted_string; ... };
      trusted-keys { string
          integer integer
          integer
          quoted_string; ... };, deprecated
      try-tcp-refresh boolean;
      update-check-ksk boolean;
      use-alt-transfer-source boolean;
      v6-bias integer;
      validate-except { string; ... };
      zero-no-soa-ttl boolean;
      zero-no-soa-ttl-cache boolean;
      zone string [ class ] {
              allow-notify { address_match_element; ... };
              allow-query { address_match_element; ... };
              allow-query-on { address_match_element; ... };
              allow-transfer { address_match_element; ... };
              allow-update { address_match_element; ... };
              allow-update-forwarding { address_match_element; ... };
              also-notify [ port integer ] [ dscp integer ] { (
                  primaries | ipv4_address [ port integer ] |
                  ipv6_address [ port integer ] ) [ key string ];
                  ... };
              alt-transfer-source ( ipv4_address | * ) [ port (
                  integer | * ) ] [ dscp integer ];
              alt-transfer-source-v6 ( ipv6_address | * ) [ port (
                  integer | * ) ] [ dscp integer ];
              auto-dnssec ( allow | maintain | off );
              check-dup-records ( fail | warn | ignore );
              check-integrity boolean;
              check-mx ( fail | warn | ignore );
              check-mx-cname ( fail | warn | ignore );
              check-names ( fail | warn | ignore );
              check-sibling boolean;
              check-spf ( warn | ignore );
              check-srv-cname ( fail | warn | ignore );
              check-wildcard boolean;
              database string;
              delegation-only boolean;
              dialup ( notify | notify-passive | passive | refresh |
                  boolean );
              dlz string;
              dnskey-sig-validity integer;
              dnssec-dnskey-kskonly boolean;
              dnssec-loadkeys-interval integer;
              dnssec-policy string;
              dnssec-secure-to-insecure boolean;
              dnssec-update-mode ( maintain | no-resign );
              file quoted_string;
              forward ( first | only );
              forwarders [ port integer ] [ dscp integer ] { (
                  ipv4_address | ipv6_address ) [ port integer ] [
                  dscp integer ]; ... };
              in-view string;
              inline-signing boolean;
              ixfr-from-differences boolean;
              journal quoted_string;
              key-directory quoted_string;
              masterfile-format ( map | raw | text );
              masterfile-style ( full | relative );
              masters [ port integer ] [ dscp integer ] { ( primaries
                  | ipv4_address [ port integer ] | ipv6_address [
                  port integer ] ) [ key string ]; ... };
              max-journal-size ( default | unlimited | sizeval );
              max-records integer;
              max-refresh-time integer;
              max-retry-time integer;
              max-transfer-idle-in integer;
              max-transfer-idle-out integer;
              max-transfer-time-in integer;
              max-transfer-time-out integer;
              max-zone-ttl ( unlimited | duration );
              min-refresh-time integer;
              min-retry-time integer;
              multi-master boolean;
              notify ( explicit | master-only | primary-only | boolean );
              notify-delay integer;
              notify-source ( ipv4_address | * ) [ port ( integer | *
                  ) ] [ dscp integer ];
              notify-source-v6 ( ipv6_address | * ) [ port ( integer
                  | * ) ] [ dscp integer ];
              notify-to-soa boolean;
              primaries [ port integer ] [ dscp integer ] { (
                  primaries | ipv4_address [ port integer ] |
                  ipv6_address [ port integer ] ) [ key string ];
                  ... };
              request-expire boolean;
              request-ixfr boolean;
              serial-update-method ( date | increment | unixtime );
              server-addresses { ( ipv4_address | ipv6_address ); ... };
              server-names { string; ... };
              sig-signing-nodes integer;
              sig-signing-signatures integer;
              sig-signing-type integer;
              sig-validity-interval integer [ integer ];
              transfer-source ( ipv4_address | * ) [ port ( integer |
                  * ) ] [ dscp integer ];
              transfer-source-v6 ( ipv6_address | * ) [ port (
                  integer | * ) ] [ dscp integer ];
              try-tcp-refresh boolean;
              type ( primary | master | secondary | slave | mirror |
                  delegation-only | forward | hint | redirect |
                  static-stub | stub );
              update-check-ksk boolean;
              update-policy ( local | { ( deny | grant ) string (
                  6to4-self | external | krb5-self | krb5-selfsub |
                  krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
                  name | self | selfsub | selfwild | subdomain | tcp-self
                  | wildcard | zonesub ) [ string ] rrtypelist; ... };
              use-alt-transfer-source boolean;
              zero-no-soa-ttl boolean;
              zone-statistics ( full | terse | none | boolean );
      };
      zone-statistics ( full | terse | none | boolean );
};


ZONE

zone string [ class ] {
      allow-notify { address_match_element; ... };
      allow-query { address_match_element; ... };
      allow-query-on { address_match_element; ... };
      allow-transfer { address_match_element; ... };
      allow-update { address_match_element; ... };
      allow-update-forwarding { address_match_element; ... };
      also-notify [ port integer ] [ dscp integer ] { ( primaries |
          ipv4_address [ port integer ] | ipv6_address [ port
          integer ] ) [ key string ]; ... };
      alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
          ] [ dscp integer ];
      alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
          * ) ] [ dscp integer ];
      auto-dnssec ( allow | maintain | off );
      check-dup-records ( fail | warn | ignore );
      check-integrity boolean;
      check-mx ( fail | warn | ignore );
      check-mx-cname ( fail | warn | ignore );
      check-names ( fail | warn | ignore );
      check-sibling boolean;
      check-spf ( warn | ignore );
      check-srv-cname ( fail | warn | ignore );
      check-wildcard boolean;
      database string;
      delegation-only boolean;
      dialup ( notify | notify-passive | passive | refresh | boolean );
      dlz string;
      dnskey-sig-validity integer;
      dnssec-dnskey-kskonly boolean;
      dnssec-loadkeys-interval integer;
      dnssec-policy string;
      dnssec-secure-to-insecure boolean;
      dnssec-update-mode ( maintain | no-resign );
      file quoted_string;
      forward ( first | only );
      forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
          | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
      in-view string;
      inline-signing boolean;
      ixfr-from-differences boolean;
      journal quoted_string;
      key-directory quoted_string;
      masterfile-format ( map | raw | text );
      masterfile-style ( full | relative );
      masters [ port integer ] [ dscp integer ] { ( primaries |
          ipv4_address [ port integer ] | ipv6_address [ port
          integer ] ) [ key string ]; ... };
      max-journal-size ( default | unlimited | sizeval );
      max-records integer;
      max-refresh-time integer;
      max-retry-time integer;
      max-transfer-idle-in integer;
      max-transfer-idle-out integer;
      max-transfer-time-in integer;
      max-transfer-time-out integer;
      max-zone-ttl ( unlimited | duration );
      min-refresh-time integer;
      min-retry-time integer;
      multi-master boolean;
      notify ( explicit | master-only | primary-only | boolean );
      notify-delay integer;
      notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
          [ dscp integer ];
      notify-to-soa boolean;
      primaries [ port integer ] [ dscp integer ] { ( primaries |
          ipv4_address [ port integer ] | ipv6_address [ port
          integer ] ) [ key string ]; ... };
      request-expire boolean;
      request-ixfr boolean;
      serial-update-method ( date | increment | unixtime );
      server-addresses { ( ipv4_address | ipv6_address ); ... };
      server-names { string; ... };
      sig-signing-nodes integer;
      sig-signing-signatures integer;
      sig-signing-type integer;
      sig-validity-interval integer [ integer ];
      transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
          ] [ dscp integer ];
      try-tcp-refresh boolean;
      type ( primary | master | secondary | slave | mirror |
          delegation-only | forward | hint | redirect | static-stub |
          stub );
      update-check-ksk boolean;
      update-policy ( local | { ( deny | grant ) string ( 6to4-self |
          external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
          | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
          | subdomain | tcp-self | wildcard | zonesub ) [ string ]
          rrtypelist; ... };
      use-alt-transfer-source boolean;
      zero-no-soa-ttl boolean;
      zone-statistics ( full | terse | none | boolean );
};


FILES

/etc/named.conf

SEE ALSO

ddns-confgen(8), named(8), named-checkconf(8), rndc(8), rndc-confgen(8), BIND 9 Administrator Reference Manual.

AUTHOR

Internet Systems Consortium

COPYRIGHT

2021, Internet Systems Consortium
2021-04-19 9.16.15-Debian