NAMED.CONF(5)

NAME
named.conf - configuration file for **named**

SYNOPSIS

named.conf

DESCRIPTION

named.conf is the configuration file for named. Statements are enclosed in braces and terminated with a semi-colon. Clauses in the statements are also semi-colon terminated. The usual comment styles are supported:

C style: /* */
        C++ style: // to end of line

Unix style: # to end of line

  ACL

        acl string { address_match_element; ... };

  CONTROLS

        controls {
              inet ( ipv4_address | ipv6_address |
                  * ) [ port ( integer | * ) ] allow
                  { address_match_element; ... } [
                  keys { string; ... } ] [ read-only
                  boolean ];
              unix quoted_string perm integer
                  owner integer group integer [
                  keys { string; ... } ] [ read-only
                  boolean ];
        };

  DLZ

        dlz string {
              database string;
              search boolean;
        };

  DNSSEC-POLICY

        dnssec-policy string {
              dnskey-ttl duration;
              keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
                  duration_or_unlimited algorithm string [ integer ]; ... };
              max-zone-ttl duration;
              nsec3param [ iterations integer ] [ optout boolean ] [
                  salt-length integer ];
              parent-ds-ttl duration;
              parent-propagation-delay duration;
              publish-safety duration;
              purge-keys duration;
              retire-safety duration;
              signatures-refresh duration;
              signatures-validity duration;
              signatures-validity-dnskey duration;
              zone-propagation-delay duration;
        };

  DYNDB

        dyndb string quoted_string {
            unspecified-text };

  KEY

        key string {
              algorithm string;
              secret string;
        };

  LOGGING

        logging {
              category string { string; ... };
              channel string {
                      buffered boolean;
                      file quoted_string [ versions ( unlimited | integer ) ]
                          [ size size ] [ suffix ( increment | timestamp ) ];
                      null;
                      print-category boolean;
                      print-severity boolean;
                      print-time ( iso8601 | iso8601-utc | local | boolean );
                      severity log_severity;
                      stderr;
                      syslog [ syslog_facility ];
              };
        };

  MANAGED-KEYS

See DNSSEC-KEYS.

        managed-keys { string ( static-key
            | initial-key | static-ds |
            initial-ds ) integer integer
            integer quoted_string; ... };, deprecated

  MASTERS

        masters string [ port integer ] [ dscp
            integer ] { ( primaries | ipv4_address
            [ port integer ] | ipv6_address [ port
            integer ] ) [ key string ]; ... };

  OPTIONS

        options {
              allow-new-zones boolean;
              allow-notify { address_match_element; ... };
              allow-query { address_match_element; ... };
              allow-query-cache { address_match_element; ... };
              allow-query-cache-on { address_match_element; ... };
              allow-query-on { address_match_element; ... };
              allow-recursion { address_match_element; ... };
              allow-recursion-on { address_match_element; ... };
              allow-transfer { address_match_element; ... };
              allow-update { address_match_element; ... };
              allow-update-forwarding { address_match_element; ... };
              also-notify [ port integer ] [ dscp integer ] { ( primaries |
                  ipv4_address [ port integer ] | ipv6_address [ port
                  integer ] ) [ key string ]; ... };
              alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
                  ] [ dscp integer ];
              alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
                  * ) ] [ dscp integer ];
              answer-cookie boolean;
              attach-cache string;
              auth-nxdomain boolean; // default changed
              auto-dnssec ( allow | maintain | off );
              automatic-interface-scan boolean;
              avoid-v4-udp-ports { portrange; ... };
              avoid-v6-udp-ports { portrange; ... };
              bindkeys-file quoted_string;
              blackhole { address_match_element; ... };
              cache-file quoted_string;
              catalog-zones { zone string [ default-masters [ port integer ]
                  [ dscp integer ] { ( primaries | ipv4_address [ port
                  integer ] | ipv6_address [ port integer ] ) [ key
                  string ]; ... } ] [ zone-directory quoted_string ] [
                  in-memory boolean ] [ min-update-interval duration ]; ... };
              check-dup-records ( fail | warn | ignore );
              check-integrity boolean;
              check-mx ( fail | warn | ignore );
              check-mx-cname ( fail | warn | ignore );
              check-names ( primary | master |
                  secondary | slave | response ) (
                  fail | warn | ignore );
              check-sibling boolean;
              check-spf ( warn | ignore );
              check-srv-cname ( fail | warn | ignore );
              check-wildcard boolean;
              clients-per-query integer;
              cookie-algorithm ( aes | siphash24 );
              cookie-secret string;
              coresize ( default | unlimited | sizeval );
              datasize ( default | unlimited | sizeval );
              deny-answer-addresses { address_match_element; ... } [
                  except-from { string; ... } ];
              deny-answer-aliases { string; ... } [ except-from { string; ...
                  } ];
              dialup ( notify | notify-passive | passive | refresh | boolean );
              directory quoted_string;
              disable-algorithms string { string;
                  ... };
              disable-ds-digests string { string;
                  ... };
              disable-empty-zone string;
              dns64 netprefix {
                      break-dnssec boolean;
                      clients { address_match_element; ... };
                      exclude { address_match_element; ... };
                      mapped { address_match_element; ... };
                      recursive-only boolean;
                      suffix ipv6_address;
              };
              dns64-contact string;
              dns64-server string;
              dnskey-sig-validity integer;
              dnsrps-enable boolean;
              dnsrps-options { unspecified-text };
              dnssec-accept-expired boolean;
              dnssec-dnskey-kskonly boolean;
              dnssec-loadkeys-interval integer;
              dnssec-must-be-secure string boolean;
              dnssec-policy string;
              dnssec-secure-to-insecure boolean;
              dnssec-update-mode ( maintain | no-resign );
              dnssec-validation ( yes | no | auto );
              dnstap { ( all | auth | client | forwarder |
                  resolver | update ) [ ( query | response ) ];
                  ... };
              dnstap-identity ( quoted_string | none |
                  hostname );
              dnstap-output ( file | unix ) quoted_string [
                  size ( unlimited | size ) ] [ versions (
                  unlimited | integer ) ] [ suffix ( increment
                  | timestamp ) ];
              dnstap-version ( quoted_string | none );
              dscp integer;
              dual-stack-servers [ port integer ] { ( quoted_string [ port
                  integer ] [ dscp integer ] | ipv4_address [ port
                  integer ] [ dscp integer ] | ipv6_address [ port
                  integer ] [ dscp integer ] ); ... };
              dump-file quoted_string;
              edns-udp-size integer;
              empty-contact string;
              empty-server string;
              empty-zones-enable boolean;
              fetch-quota-params integer fixedpoint fixedpoint fixedpoint;
              fetches-per-server integer [ ( drop | fail ) ];
              fetches-per-zone integer [ ( drop | fail ) ];
              files ( default | unlimited | sizeval );
              flush-zones-on-shutdown boolean;
              forward ( first | only );
              forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
                  | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
              fstrm-set-buffer-hint integer;
              fstrm-set-flush-timeout integer;
              fstrm-set-input-queue-size integer;
              fstrm-set-output-notify-threshold integer;
              fstrm-set-output-queue-model ( mpsc | spsc );
              fstrm-set-output-queue-size integer;
              fstrm-set-reopen-interval duration;
              geoip-directory ( quoted_string | none );
              glue-cache boolean;
              heartbeat-interval integer;
              hostname ( quoted_string | none );
              inline-signing boolean;
              interface-interval duration;
              ixfr-from-differences ( primary | master | secondary | slave |
                  boolean );
              keep-response-order { address_match_element; ... };
              key-directory quoted_string;
              lame-ttl duration;
              listen-on [ port integer ] [ dscp
                  integer ] {
                  address_match_element; ... };
              listen-on-v6 [ port integer ] [ dscp
                  integer ] {
                  address_match_element; ... };
              lmdb-mapsize sizeval;
              lock-file ( quoted_string | none );
              managed-keys-directory quoted_string;
              masterfile-format ( map | raw | text );
              masterfile-style ( full | relative );
              match-mapped-addresses boolean;
              max-cache-size ( default | unlimited | sizeval | percentage );
              max-cache-ttl duration;
              max-clients-per-query integer;
              max-journal-size ( default | unlimited | sizeval );
              max-ncache-ttl duration;
              max-records integer;
              max-recursion-depth integer;
              max-recursion-queries integer;
              max-refresh-time integer;
              max-retry-time integer;
              max-rsa-exponent-size integer;
              max-stale-ttl duration;
              max-transfer-idle-in integer;
              max-transfer-idle-out integer;
              max-transfer-time-in integer;
              max-transfer-time-out integer;
              max-udp-size integer;
              max-zone-ttl ( unlimited | duration );
              memstatistics boolean;
              memstatistics-file quoted_string;
              message-compression boolean;
              min-cache-ttl duration;
              min-ncache-ttl duration;
              min-refresh-time integer;
              min-retry-time integer;
              minimal-any boolean;
              minimal-responses ( no-auth | no-auth-recursive | boolean );
              multi-master boolean;
              new-zones-directory quoted_string;
              no-case-compress { address_match_element; ... };
              nocookie-udp-size integer;
              notify ( explicit | master-only | primary-only | boolean );
              notify-delay integer;
              notify-rate integer;
              notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
                  dscp integer ];
              notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
                  [ dscp integer ];
              notify-to-soa boolean;
              nta-lifetime duration;
              nta-recheck duration;
              nxdomain-redirect string;
              pid-file ( quoted_string | none );
              port integer;
              preferred-glue string;
              prefetch integer [ integer ];
              provide-ixfr boolean;
              qname-minimization ( strict | relaxed | disabled | off );
              query-source ( ( [ address ] ( ipv4_address | * ) [ port (
                  integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
                  port ( integer | * ) ) ) [ dscp integer ];
              query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
                  integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
                  port ( integer | * ) ) ) [ dscp integer ];
              querylog boolean;
              random-device ( quoted_string | none );
              rate-limit {
                      all-per-second integer;
                      errors-per-second integer;
                      exempt-clients { address_match_element; ... };
                      ipv4-prefix-length integer;
                      ipv6-prefix-length integer;
                      log-only boolean;
                      max-table-size integer;
                      min-table-size integer;
                      nodata-per-second integer;
                      nxdomains-per-second integer;
                      qps-scale integer;
                      referrals-per-second integer;
                      responses-per-second integer;
                      slip integer;
                      window integer;
              };
              recursing-file quoted_string;
              recursion boolean;
              recursive-clients integer;
              request-expire boolean;
              request-ixfr boolean;
              request-nsid boolean;
              require-server-cookie boolean;
              reserved-sockets integer;
              resolver-nonbackoff-tries integer;
              resolver-query-timeout integer;
              resolver-retry-interval integer;
              response-padding { address_match_element; ... } block-size
                  integer;
              response-policy { zone string [ add-soa boolean ] [ log
                  boolean ] [ max-policy-ttl duration ] [ min-update-interval
                  duration ] [ policy ( cname | disabled | drop | given | no-op
                  | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
                  recursive-only boolean ] [ nsip-enable boolean ] [
                  nsdname-enable boolean ]; ... } [ add-soa boolean ] [
                  break-dnssec boolean ] [ max-policy-ttl duration ] [
                  min-update-interval duration ] [ min-ns-dots integer ] [
                  nsip-wait-recurse boolean ] [ qname-wait-recurse boolean ]
                  [ recursive-only boolean ] [ nsip-enable boolean ] [
                  nsdname-enable boolean ] [ dnsrps-enable boolean ] [
                  dnsrps-options { unspecified-text } ];
              root-delegation-only [ exclude { string; ... } ];
              root-key-sentinel boolean;
              rrset-order { [ class string ] [ type string ] [ name
                  quoted_string ] string string; ... };
              secroots-file quoted_string;
              send-cookie boolean;
              serial-query-rate integer;
              serial-update-method ( date | increment | unixtime );
              server-id ( quoted_string | none | hostname );
              servfail-ttl duration;
              session-keyalg string;
              session-keyfile ( quoted_string | none );
              session-keyname string;
              sig-signing-nodes integer;
              sig-signing-signatures integer;
              sig-signing-type integer;
              sig-validity-interval integer [ integer ];
              sortlist { address_match_element; ... };
              stacksize ( default | unlimited | sizeval );
              stale-answer-client-timeout ( disabled | off | integer );
              stale-answer-enable boolean;
              stale-answer-ttl duration;
              stale-cache-enable boolean;
              stale-refresh-time duration;
              startup-notify-rate integer;
              statistics-file quoted_string;
              synth-from-dnssec boolean;
              tcp-advertised-timeout integer;
              tcp-clients integer;
              tcp-idle-timeout integer;
              tcp-initial-timeout integer;
              tcp-keepalive-timeout integer;
              tcp-listen-queue integer;
              tkey-dhkey quoted_string integer;
              tkey-domain quoted_string;
              tkey-gssapi-credential quoted_string;
              tkey-gssapi-keytab quoted_string;
              transfer-format ( many-answers | one-answer );
              transfer-message-size integer;
              transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
                  dscp integer ];
              transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
                  ] [ dscp integer ];
              transfers-in integer;
              transfers-out integer;
              transfers-per-ns integer;
              trust-anchor-telemetry boolean; // experimental
              try-tcp-refresh boolean;
              update-check-ksk boolean;
              use-alt-transfer-source boolean;
              use-v4-udp-ports { portrange; ... };
              use-v6-udp-ports { portrange; ... };
              v6-bias integer;
              validate-except { string; ... };
              version ( quoted_string | none );
              zero-no-soa-ttl boolean;
              zero-no-soa-ttl-cache boolean;
              zone-statistics ( full | terse | none | boolean );
        };

  PLUGIN

        plugin ( query ) string [ { unspecified-text
            } ];

  PRIMARIES

        primaries string [ port integer ] [ dscp
            integer ] { ( primaries | ipv4_address
            [ port integer ] | ipv6_address [ port
            integer ] ) [ key string ]; ... };

  SERVER

        server netprefix {
              bogus boolean;
              edns boolean;
              edns-udp-size integer;
              edns-version integer;
              keys server_key;
              max-udp-size integer;
              notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
                  dscp integer ];
              notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
                  [ dscp integer ];
              padding integer;
              provide-ixfr boolean;
              query-source ( ( [ address ] ( ipv4_address | * ) [ port (
                  integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
                  port ( integer | * ) ) ) [ dscp integer ];
              query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
                  integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
                  port ( integer | * ) ) ) [ dscp integer ];
              request-expire boolean;
              request-ixfr boolean;
              request-nsid boolean;
              send-cookie boolean;
              tcp-keepalive boolean;
              tcp-only boolean;
              transfer-format ( many-answers | one-answer );
              transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
                  dscp integer ];
              transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
                  ] [ dscp integer ];
              transfers integer;
        };

  STATISTICS-CHANNELS

        statistics-channels {
              inet ( ipv4_address | ipv6_address |
                  * ) [ port ( integer | * ) ] [
                  allow { address_match_element; ...
                  } ];
        };

  TRUST-ANCHORS

        trust-anchors { string ( static-key |
            initial-key | static-ds | initial-ds )
            integer integer integer
            quoted_string; ... };

  TRUSTED-KEYS

Deprecated - see DNSSEC-KEYS.

        trusted-keys { string integer
            integer integer
            quoted_string; ... };, deprecated

  VIEW

        view string [ class ] {
              allow-new-zones boolean;
              allow-notify { address_match_element; ... };
              allow-query { address_match_element; ... };
              allow-query-cache { address_match_element; ... };
              allow-query-cache-on { address_match_element; ... };
              allow-query-on { address_match_element; ... };
              allow-recursion { address_match_element; ... };
              allow-recursion-on { address_match_element; ... };
              allow-transfer { address_match_element; ... };
              allow-update { address_match_element; ... };
              allow-update-forwarding { address_match_element; ... };
              also-notify [ port integer ] [ dscp integer ] { ( primaries |
                  ipv4_address [ port integer ] | ipv6_address [ port
                  integer ] ) [ key string ]; ... };
              alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
                  ] [ dscp integer ];
              alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
                  * ) ] [ dscp integer ];
              attach-cache string;
              auth-nxdomain boolean; // default changed
              auto-dnssec ( allow | maintain | off );
              cache-file quoted_string;
              catalog-zones { zone string [ default-masters [ port integer ]
                  [ dscp integer ] { ( primaries | ipv4_address [ port
                  integer ] | ipv6_address [ port integer ] ) [ key
                  string ]; ... } ] [ zone-directory quoted_string ] [
                  in-memory boolean ] [ min-update-interval duration ]; ... };
              check-dup-records ( fail | warn | ignore );
              check-integrity boolean;
              check-mx ( fail | warn | ignore );
              check-mx-cname ( fail | warn | ignore );
              check-names ( primary | master |
                  secondary | slave | response ) (
                  fail | warn | ignore );
              check-sibling boolean;
              check-spf ( warn | ignore );
              check-srv-cname ( fail | warn | ignore );
              check-wildcard boolean;
              clients-per-query integer;
              deny-answer-addresses { address_match_element; ... } [
                  except-from { string; ... } ];
              deny-answer-aliases { string; ... } [ except-from { string; ...
                  } ];
              dialup ( notify | notify-passive | passive | refresh | boolean );
              disable-algorithms string { string;
                  ... };
              disable-ds-digests string { string;
                  ... };
              disable-empty-zone string;
              dlz string {
                      database string;
                      search boolean;
              };
              dns64 netprefix {
                      break-dnssec boolean;
                      clients { address_match_element; ... };
                      exclude { address_match_element; ... };
                      mapped { address_match_element; ... };
                      recursive-only boolean;
                      suffix ipv6_address;
              };
              dns64-contact string;
              dns64-server string;
              dnskey-sig-validity integer;
              dnsrps-enable boolean;
              dnsrps-options { unspecified-text };
              dnssec-accept-expired boolean;
              dnssec-dnskey-kskonly boolean;
              dnssec-loadkeys-interval integer;
              dnssec-must-be-secure string boolean;
              dnssec-policy string;
              dnssec-secure-to-insecure boolean;
              dnssec-update-mode ( maintain | no-resign );
              dnssec-validation ( yes | no | auto );
              dnstap { ( all | auth | client | forwarder |
                  resolver | update ) [ ( query | response ) ];
                  ... };
              dual-stack-servers [ port integer ] { ( quoted_string [ port
                  integer ] [ dscp integer ] | ipv4_address [ port
                  integer ] [ dscp integer ] | ipv6_address [ port
                  integer ] [ dscp integer ] ); ... };
              dyndb string quoted_string {
                  unspecified-text };
              edns-udp-size integer;
              empty-contact string;
              empty-server string;
              empty-zones-enable boolean;
              fetch-quota-params integer fixedpoint fixedpoint fixedpoint;
              fetches-per-server integer [ ( drop | fail ) ];
              fetches-per-zone integer [ ( drop | fail ) ];
              forward ( first | only );
              forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
                  | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
              glue-cache boolean;
              inline-signing boolean;
              ixfr-from-differences ( primary | master | secondary | slave |
                  boolean );
              key string {
                      algorithm string;
                      secret string;
              };
              key-directory quoted_string;
              lame-ttl duration;
              lmdb-mapsize sizeval;
              managed-keys { string (
                  static-key | initial-key
                  | static-ds | initial-ds
                  ) integer integer
                  integer
                  quoted_string; ... };, deprecated
              masterfile-format ( map | raw | text );
              masterfile-style ( full | relative );
              match-clients { address_match_element; ... };
              match-destinations { address_match_element; ... };
              match-recursive-only boolean;
              max-cache-size ( default | unlimited | sizeval | percentage );
              max-cache-ttl duration;
              max-clients-per-query integer;
              max-journal-size ( default | unlimited | sizeval );
              max-ncache-ttl duration;
              max-records integer;
              max-recursion-depth integer;
              max-recursion-queries integer;
              max-refresh-time integer;
              max-retry-time integer;
              max-stale-ttl duration;
              max-transfer-idle-in integer;
              max-transfer-idle-out integer;
              max-transfer-time-in integer;
              max-transfer-time-out integer;
              max-udp-size integer;
              max-zone-ttl ( unlimited | duration );
              message-compression boolean;
              min-cache-ttl duration;
              min-ncache-ttl duration;
              min-refresh-time integer;
              min-retry-time integer;
              minimal-any boolean;
              minimal-responses ( no-auth | no-auth-recursive | boolean );
              multi-master boolean;
              new-zones-directory quoted_string;
              no-case-compress { address_match_element; ... };
              nocookie-udp-size integer;
              notify ( explicit | master-only | primary-only | boolean );
              notify-delay integer;
              notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
                  dscp integer ];
              notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
                  [ dscp integer ];
              notify-to-soa boolean;
              nta-lifetime duration;
              nta-recheck duration;
              nxdomain-redirect string;
              plugin ( query ) string [ {
                  unspecified-text } ];
              preferred-glue string;
              prefetch integer [ integer ];
              provide-ixfr boolean;
              qname-minimization ( strict | relaxed | disabled | off );
              query-source ( ( [ address ] ( ipv4_address | * ) [ port (
                  integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
                  port ( integer | * ) ) ) [ dscp integer ];
              query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
                  integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
                  port ( integer | * ) ) ) [ dscp integer ];
              rate-limit {
                      all-per-second integer;
                      errors-per-second integer;
                      exempt-clients { address_match_element; ... };
                      ipv4-prefix-length integer;
                      ipv6-prefix-length integer;
                      log-only boolean;
                      max-table-size integer;
                      min-table-size integer;
                      nodata-per-second integer;
                      nxdomains-per-second integer;
                      qps-scale integer;
                      referrals-per-second integer;
                      responses-per-second integer;
                      slip integer;
                      window integer;
              };
              recursion boolean;
              request-expire boolean;
              request-ixfr boolean;
              request-nsid boolean;
              require-server-cookie boolean;
              resolver-nonbackoff-tries integer;
              resolver-query-timeout integer;
              resolver-retry-interval integer;
              response-padding { address_match_element; ... } block-size
                  integer;
              response-policy { zone string [ add-soa boolean ] [ log
                  boolean ] [ max-policy-ttl duration ] [ min-update-interval
                  duration ] [ policy ( cname | disabled | drop | given | no-op
                  | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
                  recursive-only boolean ] [ nsip-enable boolean ] [
                  nsdname-enable boolean ]; ... } [ add-soa boolean ] [
                  break-dnssec boolean ] [ max-policy-ttl duration ] [
                  min-update-interval duration ] [ min-ns-dots integer ] [
                  nsip-wait-recurse boolean ] [ qname-wait-recurse boolean ]
                  [ recursive-only boolean ] [ nsip-enable boolean ] [
                  nsdname-enable boolean ] [ dnsrps-enable boolean ] [
                  dnsrps-options { unspecified-text } ];
              root-delegation-only [ exclude { string; ... } ];
              root-key-sentinel boolean;
              rrset-order { [ class string ] [ type string ] [ name
                  quoted_string ] string string; ... };
              send-cookie boolean;
              serial-update-method ( date | increment | unixtime );
              server netprefix {
                      bogus boolean;
                      edns boolean;
                      edns-udp-size integer;
                      edns-version integer;
                      keys server_key;
                      max-udp-size integer;
                      notify-source ( ipv4_address | * ) [ port ( integer | *
                          ) ] [ dscp integer ];
                      notify-source-v6 ( ipv6_address | * ) [ port ( integer
                          | * ) ] [ dscp integer ];
                      padding integer;
                      provide-ixfr boolean;
                      query-source ( ( [ address ] ( ipv4_address | * ) [ port
                          ( integer | * ) ] ) | ( [ [ address ] (
                          ipv4_address | * ) ] port ( integer | * ) ) ) [
                          dscp integer ];
                      query-source-v6 ( ( [ address ] ( ipv6_address | * ) [
                          port ( integer | * ) ] ) | ( [ [ address ] (
                          ipv6_address | * ) ] port ( integer | * ) ) ) [
                          dscp integer ];
                      request-expire boolean;
                      request-ixfr boolean;
                      request-nsid boolean;
                      send-cookie boolean;
                      tcp-keepalive boolean;
                      tcp-only boolean;
                      transfer-format ( many-answers | one-answer );
                      transfer-source ( ipv4_address | * ) [ port ( integer |
                          * ) ] [ dscp integer ];
                      transfer-source-v6 ( ipv6_address | * ) [ port (
                          integer | * ) ] [ dscp integer ];
                      transfers integer;
              };
              servfail-ttl duration;
              sig-signing-nodes integer;
              sig-signing-signatures integer;
              sig-signing-type integer;
              sig-validity-interval integer [ integer ];
              sortlist { address_match_element; ... };
              stale-answer-client-timeout ( disabled | off | integer );
              stale-answer-enable boolean;
              stale-answer-ttl duration;
              stale-cache-enable boolean;
              stale-refresh-time duration;
              synth-from-dnssec boolean;
              transfer-format ( many-answers | one-answer );
              transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
                  dscp integer ];
              transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
                  ] [ dscp integer ];
              trust-anchor-telemetry boolean; // experimental
              trust-anchors { string ( static-key |
                  initial-key | static-ds | initial-ds
                  ) integer integer integer
                  quoted_string; ... };
              trusted-keys { string
                  integer integer
                  integer
                  quoted_string; ... };, deprecated
              try-tcp-refresh boolean;
              update-check-ksk boolean;
              use-alt-transfer-source boolean;
              v6-bias integer;
              validate-except { string; ... };
              zero-no-soa-ttl boolean;
              zero-no-soa-ttl-cache boolean;
              zone string [ class ] {
                      allow-notify { address_match_element; ... };
                      allow-query { address_match_element; ... };
                      allow-query-on { address_match_element; ... };
                      allow-transfer { address_match_element; ... };
                      allow-update { address_match_element; ... };
                      allow-update-forwarding { address_match_element; ... };
                      also-notify [ port integer ] [ dscp integer ] { (
                          primaries | ipv4_address [ port integer ] |
                          ipv6_address [ port integer ] ) [ key string ];
                          ... };
                      alt-transfer-source ( ipv4_address | * ) [ port (
                          integer | * ) ] [ dscp integer ];
                      alt-transfer-source-v6 ( ipv6_address | * ) [ port (
                          integer | * ) ] [ dscp integer ];
                      auto-dnssec ( allow | maintain | off );
                      check-dup-records ( fail | warn | ignore );
                      check-integrity boolean;
                      check-mx ( fail | warn | ignore );
                      check-mx-cname ( fail | warn | ignore );
                      check-names ( fail | warn | ignore );
                      check-sibling boolean;
                      check-spf ( warn | ignore );
                      check-srv-cname ( fail | warn | ignore );
                      check-wildcard boolean;
                      database string;
                      delegation-only boolean;
                      dialup ( notify | notify-passive | passive | refresh |
                          boolean );
                      dlz string;
                      dnskey-sig-validity integer;
                      dnssec-dnskey-kskonly boolean;
                      dnssec-loadkeys-interval integer;
                      dnssec-policy string;
                      dnssec-secure-to-insecure boolean;
                      dnssec-update-mode ( maintain | no-resign );
                      file quoted_string;
                      forward ( first | only );
                      forwarders [ port integer ] [ dscp integer ] { (
                          ipv4_address | ipv6_address ) [ port integer ] [
                          dscp integer ]; ... };
                      in-view string;
                      inline-signing boolean;
                      ixfr-from-differences boolean;
                      journal quoted_string;
                      key-directory quoted_string;
                      masterfile-format ( map | raw | text );
                      masterfile-style ( full | relative );
                      masters [ port integer ] [ dscp integer ] { ( primaries
                          | ipv4_address [ port integer ] | ipv6_address [
                          port integer ] ) [ key string ]; ... };
                      max-journal-size ( default | unlimited | sizeval );
                      max-records integer;
                      max-refresh-time integer;
                      max-retry-time integer;
                      max-transfer-idle-in integer;
                      max-transfer-idle-out integer;
                      max-transfer-time-in integer;
                      max-transfer-time-out integer;
                      max-zone-ttl ( unlimited | duration );
                      min-refresh-time integer;
                      min-retry-time integer;
                      multi-master boolean;
                      notify ( explicit | master-only | primary-only | boolean );
                      notify-delay integer;
                      notify-source ( ipv4_address | * ) [ port ( integer | *
                          ) ] [ dscp integer ];
                      notify-source-v6 ( ipv6_address | * ) [ port ( integer
                          | * ) ] [ dscp integer ];
                      notify-to-soa boolean;
                      primaries [ port integer ] [ dscp integer ] { (
                          primaries | ipv4_address [ port integer ] |
                          ipv6_address [ port integer ] ) [ key string ];
                          ... };
                      request-expire boolean;
                      request-ixfr boolean;
                      serial-update-method ( date | increment | unixtime );
                      server-addresses { ( ipv4_address | ipv6_address ); ... };
                      server-names { string; ... };
                      sig-signing-nodes integer;
                      sig-signing-signatures integer;
                      sig-signing-type integer;
                      sig-validity-interval integer [ integer ];
                      transfer-source ( ipv4_address | * ) [ port ( integer |
                          * ) ] [ dscp integer ];
                      transfer-source-v6 ( ipv6_address | * ) [ port (
                          integer | * ) ] [ dscp integer ];
                      try-tcp-refresh boolean;
                      type ( primary | master | secondary | slave | mirror |
                          delegation-only | forward | hint | redirect |
                          static-stub | stub );
                      update-check-ksk boolean;
                      update-policy ( local | { ( deny | grant ) string (
                          6to4-self | external | krb5-self | krb5-selfsub |
                          krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
                          name | self | selfsub | selfwild | subdomain | tcp-self
                          | wildcard | zonesub ) [ string ] rrtypelist; ... };
                      use-alt-transfer-source boolean;
                      zero-no-soa-ttl boolean;
                      zone-statistics ( full | terse | none | boolean );
              };
              zone-statistics ( full | terse | none | boolean );
        };

  ZONE

        zone string [ class ] {
              allow-notify { address_match_element; ... };
              allow-query { address_match_element; ... };
              allow-query-on { address_match_element; ... };
              allow-transfer { address_match_element; ... };
              allow-update { address_match_element; ... };
              allow-update-forwarding { address_match_element; ... };
              also-notify [ port integer ] [ dscp integer ] { ( primaries |
                  ipv4_address [ port integer ] | ipv6_address [ port
                  integer ] ) [ key string ]; ... };
              alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
                  ] [ dscp integer ];
              alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
                  * ) ] [ dscp integer ];
              auto-dnssec ( allow | maintain | off );
              check-dup-records ( fail | warn | ignore );
              check-integrity boolean;
              check-mx ( fail | warn | ignore );
              check-mx-cname ( fail | warn | ignore );
              check-names ( fail | warn | ignore );
              check-sibling boolean;
              check-spf ( warn | ignore );
              check-srv-cname ( fail | warn | ignore );
              check-wildcard boolean;
              database string;
              delegation-only boolean;
              dialup ( notify | notify-passive | passive | refresh | boolean );
              dlz string;
              dnskey-sig-validity integer;
              dnssec-dnskey-kskonly boolean;
              dnssec-loadkeys-interval integer;
              dnssec-policy string;
              dnssec-secure-to-insecure boolean;
              dnssec-update-mode ( maintain | no-resign );
              file quoted_string;
              forward ( first | only );
              forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
                  | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
              in-view string;
              inline-signing boolean;
              ixfr-from-differences boolean;
              journal quoted_string;
              key-directory quoted_string;
              masterfile-format ( map | raw | text );
              masterfile-style ( full | relative );
              masters [ port integer ] [ dscp integer ] { ( primaries |
                  ipv4_address [ port integer ] | ipv6_address [ port
                  integer ] ) [ key string ]; ... };
              max-journal-size ( default | unlimited | sizeval );
              max-records integer;
              max-refresh-time integer;
              max-retry-time integer;
              max-transfer-idle-in integer;
              max-transfer-idle-out integer;
              max-transfer-time-in integer;
              max-transfer-time-out integer;
              max-zone-ttl ( unlimited | duration );
              min-refresh-time integer;
              min-retry-time integer;
              multi-master boolean;
              notify ( explicit | master-only | primary-only | boolean );
              notify-delay integer;
              notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
                  dscp integer ];
              notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
                  [ dscp integer ];
              notify-to-soa boolean;
              primaries [ port integer ] [ dscp integer ] { ( primaries |
                  ipv4_address [ port integer ] | ipv6_address [ port
                  integer ] ) [ key string ]; ... };
              request-expire boolean;
              request-ixfr boolean;
              serial-update-method ( date | increment | unixtime );
              server-addresses { ( ipv4_address | ipv6_address ); ... };
              server-names { string; ... };
              sig-signing-nodes integer;
              sig-signing-signatures integer;
              sig-signing-type integer;
              sig-validity-interval integer [ integer ];
              transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
                  dscp integer ];
              transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
                  ] [ dscp integer ];
              try-tcp-refresh boolean;
              type ( primary | master | secondary | slave | mirror |
                  delegation-only | forward | hint | redirect | static-stub |
                  stub );
              update-check-ksk boolean;
              update-policy ( local | { ( deny | grant ) string ( 6to4-self |
                  external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
                  | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
                  | subdomain | tcp-self | wildcard | zonesub ) [ string ]
                  rrtypelist; ... };
              use-alt-transfer-source boolean;
              zero-no-soa-ttl boolean;
              zone-statistics ( full | terse | none | boolean );
        };

FILES

/etc/named.conf

SEE ALSO

ddns-confgen(8), named(8), named-checkconf(8), rndc(8), rndc-confgen(8), BIND 9 Administrator Reference Manual.

AUTHOR
Internet Systems Consortium

COPYRIGHT
2021, Internet Systems Consortium