1<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" 2 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" 3 [<!ENTITY mdash "—">]> 4<!-- 5 - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") 6 - Copyright (C) 2000-2003 Internet Software Consortium. 7 - 8 - Permission to use, copy, modify, and/or distribute this software for any 9 - purpose with or without fee is hereby granted, provided that the above 10 - copyright notice and this permission notice appear in all copies. 11 - 12 - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 13 - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 14 - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 15 - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 16 - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 17 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 18 - PERFORMANCE OF THIS SOFTWARE. 19--> 20 21<book xmlns:xi="http://www.w3.org/2001/XInclude"> 22 <title>BIND 9 Administrator Reference Manual</title> 23 24 <bookinfo> 25 <copyright> 26 <year>2004</year> 27 <year>2005</year> 28 <year>2006</year> 29 <year>2007</year> 30 <year>2008</year> 31 <year>2009</year> 32 <year>2010</year> 33 <year>2011</year> 34 <year>2012</year> 35 <year>2013</year> 36 <year>2014</year> 37 <year>2015</year> 38 <holder>Internet Systems Consortium, Inc. ("ISC")</holder> 39 </copyright> 40 <copyright> 41 <year>2000</year> 42 <year>2001</year> 43 <year>2002</year> 44 <year>2003</year> 45 <holder>Internet Software Consortium.</holder> 46 </copyright> 47 <xi:include href="releaseinfo.xml"/> 48 </bookinfo> 49 50 <chapter id="Bv9ARM.ch01"> 51 <title>Introduction</title> 52 <para> 53 The Internet Domain Name System (<acronym>DNS</acronym>) 54 consists of the syntax 55 to specify the names of entities in the Internet in a hierarchical 56 manner, the rules used for delegating authority over names, and the 57 system implementation that actually maps names to Internet 58 addresses. <acronym>DNS</acronym> data is maintained in a 59 group of distributed 60 hierarchical databases. 61 </para> 62 63 <sect1> 64 <title>Scope of Document</title> 65 66 <para> 67 The Berkeley Internet Name Domain 68 (<acronym>BIND</acronym>) implements a 69 domain name server for a number of operating systems. This 70 document provides basic information about the installation and 71 care of the Internet Systems Consortium (<acronym>ISC</acronym>) 72 <acronym>BIND</acronym> version 9 software package for 73 system administrators. 74 </para> 75 <xi:include href="pkgversion.xml"/> 76 </sect1> 77 78 <sect1> 79 <title>Organization of This Document</title> 80 <para> 81 In this document, <emphasis>Chapter 1</emphasis> introduces 82 the basic <acronym>DNS</acronym> and <acronym>BIND</acronym> concepts. <emphasis>Chapter 2</emphasis> 83 describes resource requirements for running <acronym>BIND</acronym> in various 84 environments. Information in <emphasis>Chapter 3</emphasis> is 85 <emphasis>task-oriented</emphasis> in its presentation and is 86 organized functionally, to aid in the process of installing the 87 <acronym>BIND</acronym> 9 software. The task-oriented 88 section is followed by 89 <emphasis>Chapter 4</emphasis>, which contains more advanced 90 concepts that the system administrator may need for implementing 91 certain options. <emphasis>Chapter 5</emphasis> 92 describes the <acronym>BIND</acronym> 9 lightweight 93 resolver. The contents of <emphasis>Chapter 6</emphasis> are 94 organized as in a reference manual to aid in the ongoing 95 maintenance of the software. <emphasis>Chapter 7</emphasis> addresses 96 security considerations, and 97 <emphasis>Chapter 8</emphasis> contains troubleshooting help. The 98 main body of the document is followed by several 99 <emphasis>appendices</emphasis> which contain useful reference 100 information, such as a <emphasis>bibliography</emphasis> and 101 historic information related to <acronym>BIND</acronym> 102 and the Domain Name 103 System. 104 </para> 105 </sect1> 106 <sect1> 107 <title>Conventions Used in This Document</title> 108 109 <para> 110 In this document, we use the following general typographic 111 conventions: 112 </para> 113 114 <informaltable> 115 <tgroup cols="2"> 116 <colspec colname="1" colnum="1" colwidth="3.000in"/> 117 <colspec colname="2" colnum="2" colwidth="2.625in"/> 118 <tbody> 119 <row> 120 <entry colname="1"> 121 <para> 122 <emphasis>To describe:</emphasis> 123 </para> 124 </entry> 125 <entry colname="2"> 126 <para> 127 <emphasis>We use the style:</emphasis> 128 </para> 129 </entry> 130 </row> 131 <row> 132 <entry colname="1"> 133 <para> 134 a pathname, filename, URL, hostname, 135 mailing list name, or new term or concept 136 </para> 137 </entry> 138 <entry colname="2"> 139 <para> 140 <filename>Fixed width</filename> 141 </para> 142 </entry> 143 </row> 144 <row> 145 <entry colname="1"> 146 <para> 147 literal user 148 input 149 </para> 150 </entry> 151 <entry colname="2"> 152 <para> 153 <userinput>Fixed Width Bold</userinput> 154 </para> 155 </entry> 156 </row> 157 <row> 158 <entry colname="1"> 159 <para> 160 program output 161 </para> 162 </entry> 163 <entry colname="2"> 164 <para> 165 <computeroutput>Fixed Width</computeroutput> 166 </para> 167 </entry> 168 </row> 169 </tbody> 170 </tgroup> 171 </informaltable> 172 173 <para> 174 The following conventions are used in descriptions of the 175 <acronym>BIND</acronym> configuration file:<informaltable colsep="0" frame="all" rowsep="0"> 176 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="2Level-table"> 177 <colspec colname="1" colnum="1" colsep="0" colwidth="3.000in"/> 178 <colspec colname="2" colnum="2" colsep="0" colwidth="2.625in"/> 179 <tbody> 180 <row rowsep="0"> 181 <entry colname="1" colsep="1" rowsep="1"> 182 <para> 183 <emphasis>To describe:</emphasis> 184 </para> 185 </entry> 186 <entry colname="2" rowsep="1"> 187 <para> 188 <emphasis>We use the style:</emphasis> 189 </para> 190 </entry> 191 </row> 192 <row rowsep="0"> 193 <entry colname="1" colsep="1" rowsep="1"> 194 <para> 195 keywords 196 </para> 197 </entry> 198 <entry colname="2" rowsep="1"> 199 <para> 200 <literal>Fixed Width</literal> 201 </para> 202 </entry> 203 </row> 204 <row rowsep="0"> 205 <entry colname="1" colsep="1" rowsep="1"> 206 <para> 207 variables 208 </para> 209 </entry> 210 <entry colname="2" rowsep="1"> 211 <para> 212 <varname>Fixed Width</varname> 213 </para> 214 </entry> 215 </row> 216 <row rowsep="0"> 217 <entry colname="1" colsep="1"> 218 <para> 219 Optional input 220 </para> 221 </entry> 222 <entry colname="2"> 223 <para> 224 <optional>Text is enclosed in square brackets</optional> 225 </para> 226 </entry> 227 </row> 228 </tbody> 229 </tgroup> 230 </informaltable> 231 </para> 232 </sect1> 233 <sect1> 234 <title>The Domain Name System (<acronym>DNS</acronym>)</title> 235 <para> 236 The purpose of this document is to explain the installation 237 and upkeep of the <acronym>BIND</acronym> (Berkeley Internet 238 Name Domain) software package, and we 239 begin by reviewing the fundamentals of the Domain Name System 240 (<acronym>DNS</acronym>) as they relate to <acronym>BIND</acronym>. 241 </para> 242 243 <sect2> 244 <title>DNS Fundamentals</title> 245 246 <para> 247 The Domain Name System (DNS) is a hierarchical, distributed 248 database. It stores information for mapping Internet host names to 249 IP 250 addresses and vice versa, mail routing information, and other data 251 used by Internet applications. 252 </para> 253 254 <para> 255 Clients look up information in the DNS by calling a 256 <emphasis>resolver</emphasis> library, which sends queries to one or 257 more <emphasis>name servers</emphasis> and interprets the responses. 258 The <acronym>BIND</acronym> 9 software distribution 259 contains a 260 name server, <command>named</command>, and a resolver 261 library, <command>liblwres</command>. The older 262 <command>libbind</command> resolver library is also available 263 from ISC as a separate download. 264 </para> 265 266 </sect2><sect2> 267 <title>Domains and Domain Names</title> 268 269 <para> 270 The data stored in the DNS is identified by <emphasis>domain names</emphasis> that are organized as a tree according to 271 organizational or administrative boundaries. Each node of the tree, 272 called a <emphasis>domain</emphasis>, is given a label. The domain 273 name of the 274 node is the concatenation of all the labels on the path from the 275 node to the <emphasis>root</emphasis> node. This is represented 276 in written form as a string of labels listed from right to left and 277 separated by dots. A label need only be unique within its parent 278 domain. 279 </para> 280 281 <para> 282 For example, a domain name for a host at the 283 company <emphasis>Example, Inc.</emphasis> could be 284 <literal>ourhost.example.com</literal>, 285 where <literal>com</literal> is the 286 top level domain to which 287 <literal>ourhost.example.com</literal> belongs, 288 <literal>example</literal> is 289 a subdomain of <literal>com</literal>, and 290 <literal>ourhost</literal> is the 291 name of the host. 292 </para> 293 294 <para> 295 For administrative purposes, the name space is partitioned into 296 areas called <emphasis>zones</emphasis>, each starting at a node and 297 extending down to the leaf nodes or to nodes where other zones 298 start. 299 The data for each zone is stored in a <emphasis>name server</emphasis>, which answers queries about the zone using the 300 <emphasis>DNS protocol</emphasis>. 301 </para> 302 303 <para> 304 The data associated with each domain name is stored in the 305 form of <emphasis>resource records</emphasis> (<acronym>RR</acronym>s). 306 Some of the supported resource record types are described in 307 <xref linkend="types_of_resource_records_and_when_to_use_them"/>. 308 </para> 309 310 <para> 311 For more detailed information about the design of the DNS and 312 the DNS protocol, please refer to the standards documents listed in 313 <xref linkend="rfcs"/>. 314 </para> 315 </sect2> 316 317 <sect2> 318 <title>Zones</title> 319 <para> 320 To properly operate a name server, it is important to understand 321 the difference between a <emphasis>zone</emphasis> 322 and a <emphasis>domain</emphasis>. 323 </para> 324 325 <para> 326 As stated previously, a zone is a point of delegation in 327 the <acronym>DNS</acronym> tree. A zone consists of 328 those contiguous parts of the domain 329 tree for which a name server has complete information and over which 330 it has authority. It contains all domain names from a certain point 331 downward in the domain tree except those which are delegated to 332 other zones. A delegation point is marked by one or more 333 <emphasis>NS records</emphasis> in the 334 parent zone, which should be matched by equivalent NS records at 335 the root of the delegated zone. 336 </para> 337 338 <para> 339 For instance, consider the <literal>example.com</literal> 340 domain which includes names 341 such as <literal>host.aaa.example.com</literal> and 342 <literal>host.bbb.example.com</literal> even though 343 the <literal>example.com</literal> zone includes 344 only delegations for the <literal>aaa.example.com</literal> and 345 <literal>bbb.example.com</literal> zones. A zone can 346 map 347 exactly to a single domain, but could also include only part of a 348 domain, the rest of which could be delegated to other 349 name servers. Every name in the <acronym>DNS</acronym> 350 tree is a 351 <emphasis>domain</emphasis>, even if it is 352 <emphasis>terminal</emphasis>, that is, has no 353 <emphasis>subdomains</emphasis>. Every subdomain is a domain and 354 every domain except the root is also a subdomain. The terminology is 355 not intuitive and we suggest that you read RFCs 1033, 1034 and 1035 356 to 357 gain a complete understanding of this difficult and subtle 358 topic. 359 </para> 360 361 <para> 362 Though <acronym>BIND</acronym> is called a "domain name 363 server", 364 it deals primarily in terms of zones. The master and slave 365 declarations in the <filename>named.conf</filename> file 366 specify 367 zones, not domains. When you ask some other site if it is willing to 368 be a slave server for your <emphasis>domain</emphasis>, you are 369 actually asking for slave service for some collection of zones. 370 </para> 371 </sect2> 372 373 <sect2> 374 <title>Authoritative Name Servers</title> 375 376 <para> 377 Each zone is served by at least 378 one <emphasis>authoritative name server</emphasis>, 379 which contains the complete data for the zone. 380 To make the DNS tolerant of server and network failures, 381 most zones have two or more authoritative servers, on 382 different networks. 383 </para> 384 385 <para> 386 Responses from authoritative servers have the "authoritative 387 answer" (AA) bit set in the response packets. This makes them 388 easy to identify when debugging DNS configurations using tools like 389 <command>dig</command> (<xref linkend="diagnostic_tools"/>). 390 </para> 391 392 <sect3> 393 <title>The Primary Master</title> 394 395 <para> 396 The authoritative server where the master copy of the zone 397 data is maintained is called the 398 <emphasis>primary master</emphasis> server, or simply the 399 <emphasis>primary</emphasis>. Typically it loads the zone 400 contents from some local file edited by humans or perhaps 401 generated mechanically from some other local file which is 402 edited by humans. This file is called the 403 <emphasis>zone file</emphasis> or 404 <emphasis>master file</emphasis>. 405 </para> 406 407 <para> 408 In some cases, however, the master file may not be edited 409 by humans at all, but may instead be the result of 410 <emphasis>dynamic update</emphasis> operations. 411 </para> 412 </sect3> 413 414 <sect3> 415 <title>Slave Servers</title> 416 <para> 417 The other authoritative servers, the <emphasis>slave</emphasis> 418 servers (also known as <emphasis>secondary</emphasis> servers) 419 load 420 the zone contents from another server using a replication process 421 known as a <emphasis>zone transfer</emphasis>. Typically the data 422 are 423 transferred directly from the primary master, but it is also 424 possible 425 to transfer it from another slave. In other words, a slave server 426 may itself act as a master to a subordinate slave server. 427 </para> 428 </sect3> 429 430 <sect3> 431 <title>Stealth Servers</title> 432 433 <para> 434 Usually all of the zone's authoritative servers are listed in 435 NS records in the parent zone. These NS records constitute 436 a <emphasis>delegation</emphasis> of the zone from the parent. 437 The authoritative servers are also listed in the zone file itself, 438 at the <emphasis>top level</emphasis> or <emphasis>apex</emphasis> 439 of the zone. You can list servers in the zone's top-level NS 440 records that are not in the parent's NS delegation, but you cannot 441 list servers in the parent's delegation that are not present at 442 the zone's top level. 443 </para> 444 445 <para> 446 A <emphasis>stealth server</emphasis> is a server that is 447 authoritative for a zone but is not listed in that zone's NS 448 records. Stealth servers can be used for keeping a local copy of 449 a 450 zone to speed up access to the zone's records or to make sure that 451 the 452 zone is available even if all the "official" servers for the zone 453 are 454 inaccessible. 455 </para> 456 457 <para> 458 A configuration where the primary master server itself is a 459 stealth server is often referred to as a "hidden primary" 460 configuration. One use for this configuration is when the primary 461 master 462 is behind a firewall and therefore unable to communicate directly 463 with the outside world. 464 </para> 465 466 </sect3> 467 468 </sect2> 469 <sect2> 470 471 <title>Caching Name Servers</title> 472 473 <!-- 474 - Terminology here is inconsistent. Probably ought to 475 - convert to using "recursive name server" everywhere 476 - with just a note about "caching" terminology. 477 --> 478 479 <para> 480 The resolver libraries provided by most operating systems are 481 <emphasis>stub resolvers</emphasis>, meaning that they are not 482 capable of 483 performing the full DNS resolution process by themselves by talking 484 directly to the authoritative servers. Instead, they rely on a 485 local 486 name server to perform the resolution on their behalf. Such a 487 server 488 is called a <emphasis>recursive</emphasis> name server; it performs 489 <emphasis>recursive lookups</emphasis> for local clients. 490 </para> 491 492 <para> 493 To improve performance, recursive servers cache the results of 494 the lookups they perform. Since the processes of recursion and 495 caching are intimately connected, the terms 496 <emphasis>recursive server</emphasis> and 497 <emphasis>caching server</emphasis> are often used synonymously. 498 </para> 499 500 <para> 501 The length of time for which a record may be retained in 502 the cache of a caching name server is controlled by the 503 Time To Live (TTL) field associated with each resource record. 504 </para> 505 506 <sect3> 507 <title>Forwarding</title> 508 509 <para> 510 Even a caching name server does not necessarily perform 511 the complete recursive lookup itself. Instead, it can 512 <emphasis>forward</emphasis> some or all of the queries 513 that it cannot satisfy from its cache to another caching name 514 server, 515 commonly referred to as a <emphasis>forwarder</emphasis>. 516 </para> 517 518 <para> 519 There may be one or more forwarders, 520 and they are queried in turn until the list is exhausted or an 521 answer 522 is found. Forwarders are typically used when you do not 523 wish all the servers at a given site to interact directly with the 524 rest of 525 the Internet servers. A typical scenario would involve a number 526 of internal <acronym>DNS</acronym> servers and an 527 Internet firewall. Servers unable 528 to pass packets through the firewall would forward to the server 529 that can do it, and that server would query the Internet <acronym>DNS</acronym> servers 530 on the internal server's behalf. 531 </para> 532 </sect3> 533 534 </sect2> 535 536 <sect2> 537 <title>Name Servers in Multiple Roles</title> 538 539 <para> 540 The <acronym>BIND</acronym> name server can 541 simultaneously act as 542 a master for some zones, a slave for other zones, and as a caching 543 (recursive) server for a set of local clients. 544 </para> 545 546 <para> 547 However, since the functions of authoritative name service 548 and caching/recursive name service are logically separate, it is 549 often advantageous to run them on separate server machines. 550 551 A server that only provides authoritative name service 552 (an <emphasis>authoritative-only</emphasis> server) can run with 553 recursion disabled, improving reliability and security. 554 555 A server that is not authoritative for any zones and only provides 556 recursive service to local 557 clients (a <emphasis>caching-only</emphasis> server) 558 does not need to be reachable from the Internet at large and can 559 be placed inside a firewall. 560 </para> 561 562 </sect2> 563 </sect1> 564 565 </chapter> 566 567 <chapter id="Bv9ARM.ch02"> 568 <title><acronym>BIND</acronym> Resource Requirements</title> 569 570 <sect1> 571 <title>Hardware requirements</title> 572 573 <para> 574 <acronym>DNS</acronym> hardware requirements have 575 traditionally been quite modest. 576 For many installations, servers that have been pensioned off from 577 active duty have performed admirably as <acronym>DNS</acronym> servers. 578 </para> 579 <para> 580 The DNSSEC features of <acronym>BIND</acronym> 9 581 may prove to be quite 582 CPU intensive however, so organizations that make heavy use of these 583 features may wish to consider larger systems for these applications. 584 <acronym>BIND</acronym> 9 is fully multithreaded, allowing 585 full utilization of 586 multiprocessor systems for installations that need it. 587 </para> 588 </sect1> 589 <sect1> 590 <title>CPU Requirements</title> 591 <para> 592 CPU requirements for <acronym>BIND</acronym> 9 range from 593 i486-class machines 594 for serving of static zones without caching, to enterprise-class 595 machines if you intend to process many dynamic updates and DNSSEC 596 signed zones, serving many thousands of queries per second. 597 </para> 598 </sect1> 599 600 <sect1> 601 <title>Memory Requirements</title> 602 <para> 603 The memory of the server has to be large enough to fit the 604 cache and zones loaded off disk. The <command>max-cache-size</command> 605 option can be used to limit the amount of memory used by the cache, 606 at the expense of reducing cache hit rates and causing more <acronym>DNS</acronym> 607 traffic. 608 Additionally, if additional section caching 609 (<xref linkend="acache"/>) is enabled, 610 the <command>max-acache-size</command> option can be used to 611 limit the amount 612 of memory used by the mechanism. 613 It is still good practice to have enough memory to load 614 all zone and cache data into memory — unfortunately, the best 615 way 616 to determine this for a given installation is to watch the name server 617 in operation. After a few weeks the server process should reach 618 a relatively stable size where entries are expiring from the cache as 619 fast as they are being inserted. 620 </para> 621 <!-- 622 - Add something here about leaving overhead for attacks? 623 - How much overhead? Percentage? 624 --> 625 </sect1> 626 627 <sect1> 628 <title>Name Server Intensive Environment Issues</title> 629 <para> 630 For name server intensive environments, there are two alternative 631 configurations that may be used. The first is where clients and 632 any second-level internal name servers query a main name server, which 633 has enough memory to build a large cache. This approach minimizes 634 the bandwidth used by external name lookups. The second alternative 635 is to set up second-level internal name servers to make queries 636 independently. 637 In this configuration, none of the individual machines needs to 638 have as much memory or CPU power as in the first alternative, but 639 this has the disadvantage of making many more external queries, 640 as none of the name servers share their cached data. 641 </para> 642 </sect1> 643 644 <sect1> 645 <title>Supported Operating Systems</title> 646 <para> 647 ISC <acronym>BIND</acronym> 9 compiles and runs on a large 648 number 649 of Unix-like operating systems and on 650 Microsoft Windows Server 2003 and 2008, and Windows XP and Vista. 651 For an up-to-date 652 list of supported systems, see the README file in the top level 653 directory 654 of the BIND 9 source distribution. 655 </para> 656 </sect1> 657 </chapter> 658 659 <chapter id="Bv9ARM.ch03"> 660 <title>Name Server Configuration</title> 661 <para> 662 In this chapter we provide some suggested configurations along 663 with guidelines for their use. We suggest reasonable values for 664 certain option settings. 665 </para> 666 667 <sect1 id="sample_configuration"> 668 <title>Sample Configurations</title> 669 <sect2> 670 <title>A Caching-only Name Server</title> 671 <para> 672 The following sample configuration is appropriate for a caching-only 673 name server for use by clients internal to a corporation. All 674 queries 675 from outside clients are refused using the <command>allow-query</command> 676 option. Alternatively, the same effect could be achieved using 677 suitable 678 firewall rules. 679 </para> 680 681<programlisting> 682// Two corporate subnets we wish to allow queries from. 683acl corpnets { 192.168.4.0/24; 192.168.7.0/24; }; 684options { 685 // Working directory 686 directory "/etc/namedb"; 687 688 allow-query { corpnets; }; 689}; 690// Provide a reverse mapping for the loopback 691// address 127.0.0.1 692zone "0.0.127.in-addr.arpa" { 693 type master; 694 file "localhost.rev"; 695 notify no; 696}; 697</programlisting> 698 699 </sect2> 700 701 <sect2> 702 <title>An Authoritative-only Name Server</title> 703 <para> 704 This sample configuration is for an authoritative-only server 705 that is the master server for "<filename>example.com</filename>" 706 and a slave for the subdomain "<filename>eng.example.com</filename>". 707 </para> 708 709<programlisting> 710options { 711 // Working directory 712 directory "/etc/namedb"; 713 // Do not allow access to cache 714 allow-query-cache { none; }; 715 // This is the default 716 allow-query { any; }; 717 // Do not provide recursive service 718 recursion no; 719}; 720 721// Provide a reverse mapping for the loopback 722// address 127.0.0.1 723zone "0.0.127.in-addr.arpa" { 724 type master; 725 file "localhost.rev"; 726 notify no; 727}; 728// We are the master server for example.com 729zone "example.com" { 730 type master; 731 file "example.com.db"; 732 // IP addresses of slave servers allowed to 733 // transfer example.com 734 allow-transfer { 735 192.168.4.14; 736 192.168.5.53; 737 }; 738}; 739// We are a slave server for eng.example.com 740zone "eng.example.com" { 741 type slave; 742 file "eng.example.com.bk"; 743 // IP address of eng.example.com master server 744 masters { 192.168.4.12; }; 745}; 746</programlisting> 747 748 </sect2> 749 </sect1> 750 751 <sect1> 752 <title>Load Balancing</title> 753 <!-- 754 - Add explanation of why load balancing is fragile at best 755 - and completely pointless in the general case. 756 --> 757 758 <para> 759 A primitive form of load balancing can be achieved in 760 the <acronym>DNS</acronym> by using multiple records 761 (such as multiple A records) for one name. 762 </para> 763 764 <para> 765 For example, if you have three WWW servers with network addresses 766 of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the 767 following means that clients will connect to each machine one third 768 of the time: 769 </para> 770 771 <informaltable colsep="0" rowsep="0"> 772 <tgroup cols="5" colsep="0" rowsep="0" tgroupstyle="2Level-table"> 773 <colspec colname="1" colnum="1" colsep="0" colwidth="0.875in"/> 774 <colspec colname="2" colnum="2" colsep="0" colwidth="0.500in"/> 775 <colspec colname="3" colnum="3" colsep="0" colwidth="0.750in"/> 776 <colspec colname="4" colnum="4" colsep="0" colwidth="0.750in"/> 777 <colspec colname="5" colnum="5" colsep="0" colwidth="2.028in"/> 778 <tbody> 779 <row rowsep="0"> 780 <entry colname="1"> 781 <para> 782 Name 783 </para> 784 </entry> 785 <entry colname="2"> 786 <para> 787 TTL 788 </para> 789 </entry> 790 <entry colname="3"> 791 <para> 792 CLASS 793 </para> 794 </entry> 795 <entry colname="4"> 796 <para> 797 TYPE 798 </para> 799 </entry> 800 <entry colname="5"> 801 <para> 802 Resource Record (RR) Data 803 </para> 804 </entry> 805 </row> 806 <row rowsep="0"> 807 <entry colname="1"> 808 <para> 809 <literal>www</literal> 810 </para> 811 </entry> 812 <entry colname="2"> 813 <para> 814 <literal>600</literal> 815 </para> 816 </entry> 817 <entry colname="3"> 818 <para> 819 <literal>IN</literal> 820 </para> 821 </entry> 822 <entry colname="4"> 823 <para> 824 <literal>A</literal> 825 </para> 826 </entry> 827 <entry colname="5"> 828 <para> 829 <literal>10.0.0.1</literal> 830 </para> 831 </entry> 832 </row> 833 <row rowsep="0"> 834 <entry colname="1"> 835 <para/> 836 </entry> 837 <entry colname="2"> 838 <para> 839 <literal>600</literal> 840 </para> 841 </entry> 842 <entry colname="3"> 843 <para> 844 <literal>IN</literal> 845 </para> 846 </entry> 847 <entry colname="4"> 848 <para> 849 <literal>A</literal> 850 </para> 851 </entry> 852 <entry colname="5"> 853 <para> 854 <literal>10.0.0.2</literal> 855 </para> 856 </entry> 857 </row> 858 <row rowsep="0"> 859 <entry colname="1"> 860 <para/> 861 </entry> 862 <entry colname="2"> 863 <para> 864 <literal>600</literal> 865 </para> 866 </entry> 867 <entry colname="3"> 868 <para> 869 <literal>IN</literal> 870 </para> 871 </entry> 872 <entry colname="4"> 873 <para> 874 <literal>A</literal> 875 </para> 876 </entry> 877 <entry colname="5"> 878 <para> 879 <literal>10.0.0.3</literal> 880 </para> 881 </entry> 882 </row> 883 </tbody> 884 </tgroup> 885 </informaltable> 886 <para> 887 When a resolver queries for these records, <acronym>BIND</acronym> will rotate 888 them and respond to the query with the records in a different 889 order. In the example above, clients will randomly receive 890 records in the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Most clients 891 will use the first record returned and discard the rest. 892 </para> 893 <para> 894 For more detail on ordering responses, check the 895 <command>rrset-order</command> sub-statement in the 896 <command>options</command> statement, see 897 <xref endterm="rrset_ordering_title" linkend="rrset_ordering"/>. 898 </para> 899 900 </sect1> 901 902 <sect1> 903 <title>Name Server Operations</title> 904 905 <sect2> 906 <title>Tools for Use With the Name Server Daemon</title> 907 <para> 908 This section describes several indispensable diagnostic, 909 administrative and monitoring tools available to the system 910 administrator for controlling and debugging the name server 911 daemon. 912 </para> 913 <sect3 id="diagnostic_tools"> 914 <title>Diagnostic Tools</title> 915 <para> 916 The <command>dig</command>, <command>host</command>, and 917 <command>nslookup</command> programs are all command 918 line tools 919 for manually querying name servers. They differ in style and 920 output format. 921 </para> 922 923 <variablelist> 924 <varlistentry> 925 <term id="dig"><command>dig</command></term> 926 <listitem> 927 <para> 928 The domain information groper (<command>dig</command>) 929 is the most versatile and complete of these lookup tools. 930 It has two modes: simple interactive 931 mode for a single query, and batch mode which executes a 932 query for 933 each in a list of several query lines. All query options are 934 accessible 935 from the command line. 936 </para> 937 <cmdsynopsis label="Usage"> 938 <command>dig</command> 939 <arg>@<replaceable>server</replaceable></arg> 940 <arg choice="plain"><replaceable>domain</replaceable></arg> 941 <arg><replaceable>query-type</replaceable></arg> 942 <arg><replaceable>query-class</replaceable></arg> 943 <arg>+<replaceable>query-option</replaceable></arg> 944 <arg>-<replaceable>dig-option</replaceable></arg> 945 <arg>%<replaceable>comment</replaceable></arg> 946 </cmdsynopsis> 947 <para> 948 The usual simple use of <command>dig</command> will take the form 949 </para> 950 <simpara> 951 <command>dig @server domain query-type query-class</command> 952 </simpara> 953 <para> 954 For more information and a list of available commands and 955 options, see the <command>dig</command> man 956 page. 957 </para> 958 </listitem> 959 </varlistentry> 960 961 <varlistentry> 962 <term><command>host</command></term> 963 <listitem> 964 <para> 965 The <command>host</command> utility emphasizes 966 simplicity 967 and ease of use. By default, it converts 968 between host names and Internet addresses, but its 969 functionality 970 can be extended with the use of options. 971 </para> 972 <cmdsynopsis label="Usage"> 973 <command>host</command> 974 <arg>-aCdlnrsTwv</arg> 975 <arg>-c <replaceable>class</replaceable></arg> 976 <arg>-N <replaceable>ndots</replaceable></arg> 977 <arg>-t <replaceable>type</replaceable></arg> 978 <arg>-W <replaceable>timeout</replaceable></arg> 979 <arg>-R <replaceable>retries</replaceable></arg> 980 <arg>-m <replaceable>flag</replaceable></arg> 981 <arg>-4</arg> 982 <arg>-6</arg> 983 <arg choice="plain"><replaceable>hostname</replaceable></arg> 984 <arg><replaceable>server</replaceable></arg> 985 </cmdsynopsis> 986 <para> 987 For more information and a list of available commands and 988 options, see the <command>host</command> man 989 page. 990 </para> 991 </listitem> 992 </varlistentry> 993 994 <varlistentry> 995 <term><command>nslookup</command></term> 996 <listitem> 997 <para><command>nslookup</command> 998 has two modes: interactive and 999 non-interactive. Interactive mode allows the user to 1000 query name servers for information about various 1001 hosts and domains or to print a list of hosts in a 1002 domain. Non-interactive mode is used to print just 1003 the name and requested information for a host or 1004 domain. 1005 </para> 1006 <cmdsynopsis label="Usage"> 1007 <command>nslookup</command> 1008 <arg rep="repeat">-option</arg> 1009 <group> 1010 <arg><replaceable>host-to-find</replaceable></arg> 1011 <arg>- <arg>server</arg></arg> 1012 </group> 1013 </cmdsynopsis> 1014 <para> 1015 Interactive mode is entered when no arguments are given (the 1016 default name server will be used) or when the first argument 1017 is a 1018 hyphen (`-') and the second argument is the host name or 1019 Internet address 1020 of a name server. 1021 </para> 1022 <para> 1023 Non-interactive mode is used when the name or Internet 1024 address 1025 of the host to be looked up is given as the first argument. 1026 The 1027 optional second argument specifies the host name or address 1028 of a name server. 1029 </para> 1030 <para> 1031 Due to its arcane user interface and frequently inconsistent 1032 behavior, we do not recommend the use of <command>nslookup</command>. 1033 Use <command>dig</command> instead. 1034 </para> 1035 </listitem> 1036 1037 </varlistentry> 1038 </variablelist> 1039 </sect3> 1040 1041 <sect3 id="admin_tools"> 1042 <title>Administrative Tools</title> 1043 <para> 1044 Administrative tools play an integral part in the management 1045 of a server. 1046 </para> 1047 <variablelist> 1048 <varlistentry id="named-checkconf" xreflabel="Named Configuration Checking application"> 1049 1050 <term><command>named-checkconf</command></term> 1051 <listitem> 1052 <para> 1053 The <command>named-checkconf</command> program 1054 checks the syntax of a <filename>named.conf</filename> file. 1055 </para> 1056 <cmdsynopsis label="Usage"> 1057 <command>named-checkconf</command> 1058 <arg>-jvz</arg> 1059 <arg>-t <replaceable>directory</replaceable></arg> 1060 <arg><replaceable>filename</replaceable></arg> 1061 </cmdsynopsis> 1062 </listitem> 1063 </varlistentry> 1064 <varlistentry id="named-checkzone" xreflabel="Zone Checking application"> 1065 1066 <term><command>named-checkzone</command></term> 1067 <listitem> 1068 <para> 1069 The <command>named-checkzone</command> program 1070 checks a master file for 1071 syntax and consistency. 1072 </para> 1073 <cmdsynopsis label="Usage"> 1074 <command>named-checkzone</command> 1075 <arg>-djqvD</arg> 1076 <arg>-c <replaceable>class</replaceable></arg> 1077 <arg>-o <replaceable>output</replaceable></arg> 1078 <arg>-t <replaceable>directory</replaceable></arg> 1079 <arg>-w <replaceable>directory</replaceable></arg> 1080 <arg>-k <replaceable>(ignore|warn|fail)</replaceable></arg> 1081 <arg>-n <replaceable>(ignore|warn|fail)</replaceable></arg> 1082 <arg>-W <replaceable>(ignore|warn)</replaceable></arg> 1083 <arg choice="plain"><replaceable>zone</replaceable></arg> 1084 <arg><replaceable>filename</replaceable></arg> 1085 </cmdsynopsis> 1086 </listitem> 1087 </varlistentry> 1088 <varlistentry id="named-compilezone" xreflabel="Zone Compilation application"> 1089 <term><command>named-compilezone</command></term> 1090 <listitem> 1091 <para> 1092 Similar to <command>named-checkzone,</command> but 1093 it always dumps the zone content to a specified file 1094 (typically in a different format). 1095 </para> 1096 </listitem> 1097 </varlistentry> 1098 <varlistentry id="rndc" xreflabel="Remote Name Daemon Control application"> 1099 1100 <term><command>rndc</command></term> 1101 <listitem> 1102 <para> 1103 The remote name daemon control 1104 (<command>rndc</command>) program allows the 1105 system 1106 administrator to control the operation of a name server. 1107 Since <acronym>BIND</acronym> 9.2, <command>rndc</command> 1108 supports all the commands of the BIND 8 <command>ndc</command> 1109 utility except <command>ndc start</command> and 1110 <command>ndc restart</command>, which were also 1111 not supported in <command>ndc</command>'s 1112 channel mode. 1113 If you run <command>rndc</command> without any 1114 options 1115 it will display a usage message as follows: 1116 </para> 1117 <cmdsynopsis label="Usage"> 1118 <command>rndc</command> 1119 <arg>-c <replaceable>config</replaceable></arg> 1120 <arg>-s <replaceable>server</replaceable></arg> 1121 <arg>-p <replaceable>port</replaceable></arg> 1122 <arg>-y <replaceable>key</replaceable></arg> 1123 <arg choice="plain"><replaceable>command</replaceable></arg> 1124 <arg rep="repeat"><replaceable>command</replaceable></arg> 1125 </cmdsynopsis> 1126 1127 <para>See <xref linkend="man.rndc"/> for details of 1128 the available <command>rndc</command> commands. 1129 </para> 1130 1131 <para> 1132 <command>rndc</command> requires a configuration file, 1133 since all 1134 communication with the server is authenticated with 1135 digital signatures that rely on a shared secret, and 1136 there is no way to provide that secret other than with a 1137 configuration file. The default location for the 1138 <command>rndc</command> configuration file is 1139 <filename>/etc/rndc.conf</filename>, but an 1140 alternate 1141 location can be specified with the <option>-c</option> 1142 option. If the configuration file is not found, 1143 <command>rndc</command> will also look in 1144 <filename>/etc/rndc.key</filename> (or whatever 1145 <varname>sysconfdir</varname> was defined when 1146 the <acronym>BIND</acronym> build was 1147 configured). 1148 The <filename>rndc.key</filename> file is 1149 generated by 1150 running <command>rndc-confgen -a</command> as 1151 described in 1152 <xref linkend="controls_statement_definition_and_usage"/>. 1153 </para> 1154 1155 <para> 1156 The format of the configuration file is similar to 1157 that of <filename>named.conf</filename>, but 1158 limited to 1159 only four statements, the <command>options</command>, 1160 <command>key</command>, <command>server</command> and 1161 <command>include</command> 1162 statements. These statements are what associate the 1163 secret keys to the servers with which they are meant to 1164 be shared. The order of statements is not 1165 significant. 1166 </para> 1167 1168 <para> 1169 The <command>options</command> statement has 1170 three clauses: 1171 <command>default-server</command>, <command>default-key</command>, 1172 and <command>default-port</command>. 1173 <command>default-server</command> takes a 1174 host name or address argument and represents the server 1175 that will 1176 be contacted if no <option>-s</option> 1177 option is provided on the command line. 1178 <command>default-key</command> takes 1179 the name of a key as its argument, as defined by a <command>key</command> statement. 1180 <command>default-port</command> specifies the 1181 port to which 1182 <command>rndc</command> should connect if no 1183 port is given on the command line or in a 1184 <command>server</command> statement. 1185 </para> 1186 1187 <para> 1188 The <command>key</command> statement defines a 1189 key to be used 1190 by <command>rndc</command> when authenticating 1191 with 1192 <command>named</command>. Its syntax is 1193 identical to the 1194 <command>key</command> statement in <filename>named.conf</filename>. 1195 The keyword <userinput>key</userinput> is 1196 followed by a key name, which must be a valid 1197 domain name, though it need not actually be hierarchical; 1198 thus, 1199 a string like "<userinput>rndc_key</userinput>" is a valid 1200 name. 1201 The <command>key</command> statement has two 1202 clauses: 1203 <command>algorithm</command> and <command>secret</command>. 1204 While the configuration parser will accept any string as the 1205 argument 1206 to algorithm, currently only the strings 1207 "<userinput>hmac-md5</userinput>", 1208 "<userinput>hmac-sha1</userinput>", 1209 "<userinput>hmac-sha224</userinput>", 1210 "<userinput>hmac-sha256</userinput>", 1211 "<userinput>hmac-sha384</userinput>" 1212 and "<userinput>hmac-sha512</userinput>" 1213 have any meaning. The secret is a base-64 encoded string 1214 as specified in RFC 3548. 1215 </para> 1216 1217 <para> 1218 The <command>server</command> statement 1219 associates a key 1220 defined using the <command>key</command> 1221 statement with a server. 1222 The keyword <userinput>server</userinput> is followed by a 1223 host name or address. The <command>server</command> statement 1224 has two clauses: <command>key</command> and <command>port</command>. 1225 The <command>key</command> clause specifies the 1226 name of the key 1227 to be used when communicating with this server, and the 1228 <command>port</command> clause can be used to 1229 specify the port <command>rndc</command> should 1230 connect 1231 to on the server. 1232 </para> 1233 1234 <para> 1235 A sample minimal configuration file is as follows: 1236 </para> 1237 1238<programlisting> 1239key rndc_key { 1240 algorithm "hmac-sha256"; 1241 secret 1242 "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K"; 1243}; 1244options { 1245 default-server 127.0.0.1; 1246 default-key rndc_key; 1247}; 1248</programlisting> 1249 1250 <para> 1251 This file, if installed as <filename>/etc/rndc.conf</filename>, 1252 would allow the command: 1253 </para> 1254 1255 <para> 1256 <prompt>$ </prompt><userinput>rndc reload</userinput> 1257 </para> 1258 1259 <para> 1260 to connect to 127.0.0.1 port 953 and cause the name server 1261 to reload, if a name server on the local machine were 1262 running with 1263 following controls statements: 1264 </para> 1265 1266<programlisting> 1267controls { 1268 inet 127.0.0.1 1269 allow { localhost; } keys { rndc_key; }; 1270}; 1271</programlisting> 1272 1273 <para> 1274 and it had an identical key statement for 1275 <literal>rndc_key</literal>. 1276 </para> 1277 1278 <para> 1279 Running the <command>rndc-confgen</command> 1280 program will 1281 conveniently create a <filename>rndc.conf</filename> 1282 file for you, and also display the 1283 corresponding <command>controls</command> 1284 statement that you need to 1285 add to <filename>named.conf</filename>. 1286 Alternatively, 1287 you can run <command>rndc-confgen -a</command> 1288 to set up 1289 a <filename>rndc.key</filename> file and not 1290 modify 1291 <filename>named.conf</filename> at all. 1292 </para> 1293 1294 </listitem> 1295 </varlistentry> 1296 </variablelist> 1297 1298 </sect3> 1299 </sect2> 1300 <sect2> 1301 1302 <title>Signals</title> 1303 <para> 1304 Certain UNIX signals cause the name server to take specific 1305 actions, as described in the following table. These signals can 1306 be sent using the <command>kill</command> command. 1307 </para> 1308 <informaltable frame="all"> 1309 <tgroup cols="2"> 1310 <colspec colname="1" colnum="1" colsep="0" colwidth="1.125in"/> 1311 <colspec colname="2" colnum="2" colsep="0" colwidth="4.000in"/> 1312 <tbody> 1313 <row rowsep="0"> 1314 <entry colname="1"> 1315 <para><command>SIGHUP</command></para> 1316 </entry> 1317 <entry colname="2"> 1318 <para> 1319 Causes the server to read <filename>named.conf</filename> and 1320 reload the database. 1321 </para> 1322 </entry> 1323 </row> 1324 <row rowsep="0"> 1325 <entry colname="1"> 1326 <para><command>SIGTERM</command></para> 1327 </entry> 1328 <entry colname="2"> 1329 <para> 1330 Causes the server to clean up and exit. 1331 </para> 1332 </entry> 1333 </row> 1334 <row rowsep="0"> 1335 <entry colname="1"> 1336 <para><command>SIGINT</command></para> 1337 </entry> 1338 <entry colname="2"> 1339 <para> 1340 Causes the server to clean up and exit. 1341 </para> 1342 </entry> 1343 </row> 1344 </tbody> 1345 </tgroup> 1346 </informaltable> 1347 </sect2> 1348 </sect1> 1349 </chapter> 1350 1351 <chapter id="Bv9ARM.ch04"> 1352 <title>Advanced DNS Features</title> 1353 1354 <sect1 id="notify"> 1355 1356 <title>Notify</title> 1357 <para> 1358 <acronym>DNS</acronym> NOTIFY is a mechanism that allows master 1359 servers to notify their slave servers of changes to a zone's data. In 1360 response to a <command>NOTIFY</command> from a master server, the 1361 slave will check to see that its version of the zone is the 1362 current version and, if not, initiate a zone transfer. 1363 </para> 1364 1365 <para> 1366 For more information about <acronym>DNS</acronym> 1367 <command>NOTIFY</command>, see the description of the 1368 <command>notify</command> option in <xref linkend="boolean_options"/> and 1369 the description of the zone option <command>also-notify</command> in 1370 <xref linkend="zone_transfers"/>. The <command>NOTIFY</command> 1371 protocol is specified in RFC 1996. 1372 </para> 1373 1374 <note> 1375 As a slave zone can also be a master to other slaves, <command>named</command>, 1376 by default, sends <command>NOTIFY</command> messages for every zone 1377 it loads. Specifying <command>notify master-only;</command> will 1378 cause <command>named</command> to only send <command>NOTIFY</command> for master 1379 zones that it loads. 1380 </note> 1381 1382 </sect1> 1383 1384 <sect1 id="dynamic_update"> 1385 <title>Dynamic Update</title> 1386 1387 <para> 1388 Dynamic Update is a method for adding, replacing or deleting 1389 records in a master server by sending it a special form of DNS 1390 messages. The format and meaning of these messages is specified 1391 in RFC 2136. 1392 </para> 1393 1394 <para> 1395 Dynamic update is enabled by including an 1396 <command>allow-update</command> or an <command>update-policy</command> 1397 clause in the <command>zone</command> statement. 1398 </para> 1399 1400 <para> 1401 If the zone's <command>update-policy</command> is set to 1402 <userinput>local</userinput>, updates to the zone 1403 will be permitted for the key <varname>local-ddns</varname>, 1404 which will be generated by <command>named</command> at startup. 1405 See <xref linkend="dynamic_update_policies"/> for more details. 1406 </para> 1407 1408 <para> 1409 Dynamic updates using Kerberos signed requests can be made 1410 using the TKEY/GSS protocol by setting either the 1411 <command>tkey-gssapi-keytab</command> option, or alternatively 1412 by setting both the <command>tkey-gssapi-credential</command> 1413 and <command>tkey-domain</command> options. Once enabled, 1414 Kerberos signed requests will be matched against the update 1415 policies for the zone, using the Kerberos principal as the 1416 signer for the request. 1417 </para> 1418 1419 <para> 1420 Updating of secure zones (zones using DNSSEC) follows RFC 1421 3007: RRSIG, NSEC and NSEC3 records affected by updates are 1422 automatically regenerated by the server using an online 1423 zone key. Update authorization is based on transaction 1424 signatures and an explicit server policy. 1425 </para> 1426 1427 <sect2 id="journal"> 1428 <title>The journal file</title> 1429 1430 <para> 1431 All changes made to a zone using dynamic update are stored 1432 in the zone's journal file. This file is automatically created 1433 by the server when the first dynamic update takes place. 1434 The name of the journal file is formed by appending the extension 1435 <filename>.jnl</filename> to the name of the 1436 corresponding zone 1437 file unless specifically overridden. The journal file is in a 1438 binary format and should not be edited manually. 1439 </para> 1440 1441 <para> 1442 The server will also occasionally write ("dump") 1443 the complete contents of the updated zone to its zone file. 1444 This is not done immediately after 1445 each dynamic update, because that would be too slow when a large 1446 zone is updated frequently. Instead, the dump is delayed by 1447 up to 15 minutes, allowing additional updates to take place. 1448 During the dump process, transient files will be created 1449 with the extensions <filename>.jnw</filename> and 1450 <filename>.jbk</filename>; under ordinary circumstances, these 1451 will be removed when the dump is complete, and can be safely 1452 ignored. 1453 </para> 1454 1455 <para> 1456 When a server is restarted after a shutdown or crash, it will replay 1457 the journal file to incorporate into the zone any updates that 1458 took 1459 place after the last zone dump. 1460 </para> 1461 1462 <para> 1463 Changes that result from incoming incremental zone transfers are 1464 also 1465 journalled in a similar way. 1466 </para> 1467 1468 <para> 1469 The zone files of dynamic zones cannot normally be edited by 1470 hand because they are not guaranteed to contain the most recent 1471 dynamic changes — those are only in the journal file. 1472 The only way to ensure that the zone file of a dynamic zone 1473 is up to date is to run <command>rndc stop</command>. 1474 </para> 1475 1476 <para> 1477 If you have to make changes to a dynamic zone 1478 manually, the following procedure will work: 1479 Disable dynamic updates to the zone using 1480 <command>rndc freeze <replaceable>zone</replaceable></command>. 1481 This will update the zone's master file with the changes 1482 stored in its <filename>.jnl</filename> file. 1483 Edit the zone file. Run 1484 <command>rndc thaw <replaceable>zone</replaceable></command> 1485 to reload the changed zone and re-enable dynamic updates. 1486 </para> 1487 1488 <para> 1489 <command>rndc sync <replaceable>zone</replaceable></command> 1490 will update the zone file with changes from the journal file 1491 without stopping dynamic updates; this may be useful for viewing 1492 the current zone state. To remove the <filename>.jnl</filename> 1493 file after updating the zone file, use 1494 <command>rndc sync -clean</command>. 1495 </para> 1496 1497 </sect2> 1498 1499 </sect1> 1500 1501 <sect1 id="incremental_zone_transfers"> 1502 <title>Incremental Zone Transfers (IXFR)</title> 1503 1504 <para> 1505 The incremental zone transfer (IXFR) protocol is a way for 1506 slave servers to transfer only changed data, instead of having to 1507 transfer the entire zone. The IXFR protocol is specified in RFC 1508 1995. See <xref linkend="proposed_standards"/>. 1509 </para> 1510 1511 <para> 1512 When acting as a master, <acronym>BIND</acronym> 9 1513 supports IXFR for those zones 1514 where the necessary change history information is available. These 1515 include master zones maintained by dynamic update and slave zones 1516 whose data was obtained by IXFR. For manually maintained master 1517 zones, and for slave zones obtained by performing a full zone 1518 transfer (AXFR), IXFR is supported only if the option 1519 <command>ixfr-from-differences</command> is set 1520 to <userinput>yes</userinput>. 1521 </para> 1522 1523 <para> 1524 When acting as a slave, <acronym>BIND</acronym> 9 will 1525 attempt to use IXFR unless 1526 it is explicitly disabled. For more information about disabling 1527 IXFR, see the description of the <command>request-ixfr</command> clause 1528 of the <command>server</command> statement. 1529 </para> 1530 </sect1> 1531 1532 <sect1> 1533 <title>Split DNS</title> 1534 <para> 1535 Setting up different views, or visibility, of the DNS space to 1536 internal and external resolvers is usually referred to as a 1537 <emphasis>Split DNS</emphasis> setup. There are several 1538 reasons an organization would want to set up its DNS this way. 1539 </para> 1540 <para> 1541 One common reason for setting up a DNS system this way is 1542 to hide "internal" DNS information from "external" clients on the 1543 Internet. There is some debate as to whether or not this is actually 1544 useful. 1545 Internal DNS information leaks out in many ways (via email headers, 1546 for example) and most savvy "attackers" can find the information 1547 they need using other means. 1548 However, since listing addresses of internal servers that 1549 external clients cannot possibly reach can result in 1550 connection delays and other annoyances, an organization may 1551 choose to use a Split DNS to present a consistent view of itself 1552 to the outside world. 1553 </para> 1554 <para> 1555 Another common reason for setting up a Split DNS system is 1556 to allow internal networks that are behind filters or in RFC 1918 1557 space (reserved IP space, as documented in RFC 1918) to resolve DNS 1558 on the Internet. Split DNS can also be used to allow mail from outside 1559 back in to the internal network. 1560 </para> 1561 <sect2> 1562 <title>Example split DNS setup</title> 1563 <para> 1564 Let's say a company named <emphasis>Example, Inc.</emphasis> 1565 (<literal>example.com</literal>) 1566 has several corporate sites that have an internal network with 1567 reserved 1568 Internet Protocol (IP) space and an external demilitarized zone (DMZ), 1569 or "outside" section of a network, that is available to the public. 1570 </para> 1571 <para> 1572 <emphasis>Example, Inc.</emphasis> wants its internal clients 1573 to be able to resolve external hostnames and to exchange mail with 1574 people on the outside. The company also wants its internal resolvers 1575 to have access to certain internal-only zones that are not available 1576 at all outside of the internal network. 1577 </para> 1578 <para> 1579 In order to accomplish this, the company will set up two sets 1580 of name servers. One set will be on the inside network (in the 1581 reserved 1582 IP space) and the other set will be on bastion hosts, which are 1583 "proxy" 1584 hosts that can talk to both sides of its network, in the DMZ. 1585 </para> 1586 <para> 1587 The internal servers will be configured to forward all queries, 1588 except queries for <filename>site1.internal</filename>, <filename>site2.internal</filename>, <filename>site1.example.com</filename>, 1589 and <filename>site2.example.com</filename>, to the servers 1590 in the 1591 DMZ. These internal servers will have complete sets of information 1592 for <filename>site1.example.com</filename>, <filename>site2.example.com</filename>, <filename>site1.internal</filename>, 1593 and <filename>site2.internal</filename>. 1594 </para> 1595 <para> 1596 To protect the <filename>site1.internal</filename> and <filename>site2.internal</filename> domains, 1597 the internal name servers must be configured to disallow all queries 1598 to these domains from any external hosts, including the bastion 1599 hosts. 1600 </para> 1601 <para> 1602 The external servers, which are on the bastion hosts, will 1603 be configured to serve the "public" version of the <filename>site1</filename> and <filename>site2.example.com</filename> zones. 1604 This could include things such as the host records for public servers 1605 (<filename>www.example.com</filename> and <filename>ftp.example.com</filename>), 1606 and mail exchange (MX) records (<filename>a.mx.example.com</filename> and <filename>b.mx.example.com</filename>). 1607 </para> 1608 <para> 1609 In addition, the public <filename>site1</filename> and <filename>site2.example.com</filename> zones 1610 should have special MX records that contain wildcard (`*') records 1611 pointing to the bastion hosts. This is needed because external mail 1612 servers do not have any other way of looking up how to deliver mail 1613 to those internal hosts. With the wildcard records, the mail will 1614 be delivered to the bastion host, which can then forward it on to 1615 internal hosts. 1616 </para> 1617 <para> 1618 Here's an example of a wildcard MX record: 1619 </para> 1620 <programlisting>* IN MX 10 external1.example.com.</programlisting> 1621 <para> 1622 Now that they accept mail on behalf of anything in the internal 1623 network, the bastion hosts will need to know how to deliver mail 1624 to internal hosts. In order for this to work properly, the resolvers 1625 on 1626 the bastion hosts will need to be configured to point to the internal 1627 name servers for DNS resolution. 1628 </para> 1629 <para> 1630 Queries for internal hostnames will be answered by the internal 1631 servers, and queries for external hostnames will be forwarded back 1632 out to the DNS servers on the bastion hosts. 1633 </para> 1634 <para> 1635 In order for all this to work properly, internal clients will 1636 need to be configured to query <emphasis>only</emphasis> the internal 1637 name servers for DNS queries. This could also be enforced via 1638 selective 1639 filtering on the network. 1640 </para> 1641 <para> 1642 If everything has been set properly, <emphasis>Example, Inc.</emphasis>'s 1643 internal clients will now be able to: 1644 </para> 1645 <itemizedlist> 1646 <listitem> 1647 <simpara> 1648 Look up any hostnames in the <literal>site1</literal> 1649 and 1650 <literal>site2.example.com</literal> zones. 1651 </simpara> 1652 </listitem> 1653 <listitem> 1654 <simpara> 1655 Look up any hostnames in the <literal>site1.internal</literal> and 1656 <literal>site2.internal</literal> domains. 1657 </simpara> 1658 </listitem> 1659 <listitem> 1660 <simpara>Look up any hostnames on the Internet.</simpara> 1661 </listitem> 1662 <listitem> 1663 <simpara>Exchange mail with both internal and external people.</simpara> 1664 </listitem> 1665 </itemizedlist> 1666 <para> 1667 Hosts on the Internet will be able to: 1668 </para> 1669 <itemizedlist> 1670 <listitem> 1671 <simpara> 1672 Look up any hostnames in the <literal>site1</literal> 1673 and 1674 <literal>site2.example.com</literal> zones. 1675 </simpara> 1676 </listitem> 1677 <listitem> 1678 <simpara> 1679 Exchange mail with anyone in the <literal>site1</literal> and 1680 <literal>site2.example.com</literal> zones. 1681 </simpara> 1682 </listitem> 1683 </itemizedlist> 1684 1685 <para> 1686 Here is an example configuration for the setup we just 1687 described above. Note that this is only configuration information; 1688 for information on how to configure your zone files, see <xref linkend="sample_configuration"/>. 1689 </para> 1690 1691 <para> 1692 Internal DNS server config: 1693 </para> 1694 1695<programlisting> 1696 1697acl internals { 172.16.72.0/24; 192.168.1.0/24; }; 1698 1699acl externals { <varname>bastion-ips-go-here</varname>; }; 1700 1701options { 1702 ... 1703 ... 1704 forward only; 1705 // forward to external servers 1706 forwarders { 1707 <varname>bastion-ips-go-here</varname>; 1708 }; 1709 // sample allow-transfer (no one) 1710 allow-transfer { none; }; 1711 // restrict query access 1712 allow-query { internals; externals; }; 1713 // restrict recursion 1714 allow-recursion { internals; }; 1715 ... 1716 ... 1717}; 1718 1719// sample master zone 1720zone "site1.example.com" { 1721 type master; 1722 file "m/site1.example.com"; 1723 // do normal iterative resolution (do not forward) 1724 forwarders { }; 1725 allow-query { internals; externals; }; 1726 allow-transfer { internals; }; 1727}; 1728 1729// sample slave zone 1730zone "site2.example.com" { 1731 type slave; 1732 file "s/site2.example.com"; 1733 masters { 172.16.72.3; }; 1734 forwarders { }; 1735 allow-query { internals; externals; }; 1736 allow-transfer { internals; }; 1737}; 1738 1739zone "site1.internal" { 1740 type master; 1741 file "m/site1.internal"; 1742 forwarders { }; 1743 allow-query { internals; }; 1744 allow-transfer { internals; } 1745}; 1746 1747zone "site2.internal" { 1748 type slave; 1749 file "s/site2.internal"; 1750 masters { 172.16.72.3; }; 1751 forwarders { }; 1752 allow-query { internals }; 1753 allow-transfer { internals; } 1754}; 1755</programlisting> 1756 1757 <para> 1758 External (bastion host) DNS server config: 1759 </para> 1760 1761<programlisting> 1762acl internals { 172.16.72.0/24; 192.168.1.0/24; }; 1763 1764acl externals { bastion-ips-go-here; }; 1765 1766options { 1767 ... 1768 ... 1769 // sample allow-transfer (no one) 1770 allow-transfer { none; }; 1771 // default query access 1772 allow-query { any; }; 1773 // restrict cache access 1774 allow-query-cache { internals; externals; }; 1775 // restrict recursion 1776 allow-recursion { internals; externals; }; 1777 ... 1778 ... 1779}; 1780 1781// sample slave zone 1782zone "site1.example.com" { 1783 type master; 1784 file "m/site1.foo.com"; 1785 allow-transfer { internals; externals; }; 1786}; 1787 1788zone "site2.example.com" { 1789 type slave; 1790 file "s/site2.foo.com"; 1791 masters { another_bastion_host_maybe; }; 1792 allow-transfer { internals; externals; } 1793}; 1794</programlisting> 1795 1796 <para> 1797 In the <filename>resolv.conf</filename> (or equivalent) on 1798 the bastion host(s): 1799 </para> 1800 1801<programlisting> 1802search ... 1803nameserver 172.16.72.2 1804nameserver 172.16.72.3 1805nameserver 172.16.72.4 1806</programlisting> 1807 1808 </sect2> 1809 </sect1> 1810 <sect1 id="tsig"> 1811 <title>TSIG</title> 1812 <para> 1813 This is a short guide to setting up Transaction SIGnatures 1814 (TSIG) based transaction security in <acronym>BIND</acronym>. It describes changes 1815 to the configuration file as well as what changes are required for 1816 different features, including the process of creating transaction 1817 keys and using transaction signatures with <acronym>BIND</acronym>. 1818 </para> 1819 <para> 1820 <acronym>BIND</acronym> primarily supports TSIG for server 1821 to server communication. 1822 This includes zone transfer, notify, and recursive query messages. 1823 Resolvers based on newer versions of <acronym>BIND</acronym> 8 have limited support 1824 for TSIG. 1825 </para> 1826 1827 <para> 1828 TSIG can also be useful for dynamic update. A primary 1829 server for a dynamic zone should control access to the dynamic 1830 update service, but IP-based access control is insufficient. 1831 The cryptographic access control provided by TSIG 1832 is far superior. The <command>nsupdate</command> 1833 program supports TSIG via the <option>-k</option> and 1834 <option>-y</option> command line options or inline by use 1835 of the <command>key</command>. 1836 </para> 1837 1838 <sect2> 1839 <title>Generate Shared Keys for Each Pair of Hosts</title> 1840 <para> 1841 A shared secret is generated to be shared between <emphasis>host1</emphasis> and <emphasis>host2</emphasis>. 1842 An arbitrary key name is chosen: "host1-host2.". The key name must 1843 be the same on both hosts. 1844 </para> 1845 <sect3> 1846 <title>Automatic Generation</title> 1847 <para> 1848 The following command will generate a 128-bit (16 byte) HMAC-SHA256 1849 key as described above. Longer keys are better, but shorter keys 1850 are easier to read. Note that the maximum key length is the digest 1851 length, here 256 bits. 1852 </para> 1853 <para> 1854 <userinput>dnssec-keygen -a hmac-sha256 -b 128 -n HOST host1-host2.</userinput> 1855 </para> 1856 <para> 1857 The key is in the file <filename>Khost1-host2.+163+00000.private</filename>. 1858 Nothing directly uses this file, but the base-64 encoded string 1859 following "<literal>Key:</literal>" 1860 can be extracted from the file and used as a shared secret: 1861 </para> 1862 <programlisting>Key: La/E5CjG9O+os1jq0a2jdA==</programlisting> 1863 <para> 1864 The string "<literal>La/E5CjG9O+os1jq0a2jdA==</literal>" can 1865 be used as the shared secret. 1866 </para> 1867 </sect3> 1868 <sect3> 1869 <title>Manual Generation</title> 1870 <para> 1871 The shared secret is simply a random sequence of bits, encoded 1872 in base-64. Most ASCII strings are valid base-64 strings (assuming 1873 the length is a multiple of 4 and only valid characters are used), 1874 so the shared secret can be manually generated. 1875 </para> 1876 <para> 1877 Also, a known string can be run through <command>mmencode</command> or 1878 a similar program to generate base-64 encoded data. 1879 </para> 1880 </sect3> 1881 </sect2> 1882 <sect2> 1883 <title>Copying the Shared Secret to Both Machines</title> 1884 <para> 1885 This is beyond the scope of DNS. A secure transport mechanism 1886 should be used. This could be secure FTP, ssh, telephone, etc. 1887 </para> 1888 </sect2> 1889 <sect2> 1890 <title>Informing the Servers of the Key's Existence</title> 1891 <para> 1892 Imagine <emphasis>host1</emphasis> and <emphasis>host 2</emphasis> 1893 are 1894 both servers. The following is added to each server's <filename>named.conf</filename> file: 1895 </para> 1896 1897<programlisting> 1898key host1-host2. { 1899 algorithm hmac-sha256; 1900 secret "La/E5CjG9O+os1jq0a2jdA=="; 1901}; 1902</programlisting> 1903 1904 <para> 1905 The secret is the one generated above. Since this is a secret, it 1906 is recommended that either <filename>named.conf</filename> be 1907 non-world readable, or the key directive be added to a non-world 1908 readable file that is included by <filename>named.conf</filename>. 1909 </para> 1910 <para> 1911 At this point, the key is recognized. This means that if the 1912 server receives a message signed by this key, it can verify the 1913 signature. If the signature is successfully verified, the 1914 response is signed by the same key. 1915 </para> 1916 </sect2> 1917 1918 <sect2> 1919 <title>Instructing the Server to Use the Key</title> 1920 <para> 1921 Since keys are shared between two hosts only, the server must 1922 be told when keys are to be used. The following is added to the <filename>named.conf</filename> file 1923 for <emphasis>host1</emphasis>, if the IP address of <emphasis>host2</emphasis> is 1924 10.1.2.3: 1925 </para> 1926 1927<programlisting> 1928server 10.1.2.3 { 1929 keys { host1-host2. ;}; 1930}; 1931</programlisting> 1932 1933 <para> 1934 Multiple keys may be present, but only the first is used. 1935 This directive does not contain any secrets, so it may be in a 1936 world-readable 1937 file. 1938 </para> 1939 <para> 1940 If <emphasis>host1</emphasis> sends a message that is a request 1941 to that address, the message will be signed with the specified key. <emphasis>host1</emphasis> will 1942 expect any responses to signed messages to be signed with the same 1943 key. 1944 </para> 1945 <para> 1946 A similar statement must be present in <emphasis>host2</emphasis>'s 1947 configuration file (with <emphasis>host1</emphasis>'s address) for <emphasis>host2</emphasis> to 1948 sign request messages to <emphasis>host1</emphasis>. 1949 </para> 1950 </sect2> 1951 <sect2> 1952 <title>TSIG Key Based Access Control</title> 1953 <para> 1954 <acronym>BIND</acronym> allows IP addresses and ranges 1955 to be specified in ACL 1956 definitions and 1957 <command>allow-{ query | transfer | update }</command> 1958 directives. 1959 This has been extended to allow TSIG keys also. The above key would 1960 be denoted <command>key host1-host2.</command> 1961 </para> 1962 <para> 1963 An example of an <command>allow-update</command> directive would be: 1964 </para> 1965 1966<programlisting> 1967allow-update { key host1-host2. ;}; 1968</programlisting> 1969 1970 <para> 1971 This allows dynamic updates to succeed only if the request 1972 was signed by a key named "<command>host1-host2.</command>". 1973 </para> 1974 1975 <para> 1976 See <xref linkend="dynamic_update_policies"/> for a discussion of 1977 the more flexible <command>update-policy</command> statement. 1978 </para> 1979 1980 </sect2> 1981 <sect2> 1982 <title>Errors</title> 1983 1984 <para> 1985 The processing of TSIG signed messages can result in 1986 several errors. If a signed message is sent to a non-TSIG aware 1987 server, a FORMERR (format error) will be returned, since the server will not 1988 understand the record. This is a result of misconfiguration, 1989 since the server must be explicitly configured to send a TSIG 1990 signed message to a specific server. 1991 </para> 1992 1993 <para> 1994 If a TSIG aware server receives a message signed by an 1995 unknown key, the response will be unsigned with the TSIG 1996 extended error code set to BADKEY. If a TSIG aware server 1997 receives a message with a signature that does not validate, the 1998 response will be unsigned with the TSIG extended error code set 1999 to BADSIG. If a TSIG aware server receives a message with a time 2000 outside of the allowed range, the response will be signed with 2001 the TSIG extended error code set to BADTIME, and the time values 2002 will be adjusted so that the response can be successfully 2003 verified. In any of these cases, the message's rcode (response code) is set to 2004 NOTAUTH (not authenticated). 2005 </para> 2006 2007 </sect2> 2008 </sect1> 2009 <sect1> 2010 <title>TKEY</title> 2011 2012 <para><command>TKEY</command> 2013 is a mechanism for automatically generating a shared secret 2014 between two hosts. There are several "modes" of 2015 <command>TKEY</command> that specify how the key is generated 2016 or assigned. <acronym>BIND</acronym> 9 implements only one of 2017 these modes, the Diffie-Hellman key exchange. Both hosts are 2018 required to have a Diffie-Hellman KEY record (although this 2019 record is not required to be present in a zone). The 2020 <command>TKEY</command> process must use signed messages, 2021 signed either by TSIG or SIG(0). The result of 2022 <command>TKEY</command> is a shared secret that can be used to 2023 sign messages with TSIG. <command>TKEY</command> can also be 2024 used to delete shared secrets that it had previously 2025 generated. 2026 </para> 2027 2028 <para> 2029 The <command>TKEY</command> process is initiated by a 2030 client 2031 or server by sending a signed <command>TKEY</command> 2032 query 2033 (including any appropriate KEYs) to a TKEY-aware server. The 2034 server response, if it indicates success, will contain a 2035 <command>TKEY</command> record and any appropriate keys. 2036 After 2037 this exchange, both participants have enough information to 2038 determine the shared secret; the exact process depends on the 2039 <command>TKEY</command> mode. When using the 2040 Diffie-Hellman 2041 <command>TKEY</command> mode, Diffie-Hellman keys are 2042 exchanged, 2043 and the shared secret is derived by both participants. 2044 </para> 2045 2046 </sect1> 2047 <sect1> 2048 <title>SIG(0)</title> 2049 2050 <para> 2051 <acronym>BIND</acronym> 9 partially supports DNSSEC SIG(0) 2052 transaction signatures as specified in RFC 2535 and RFC 2931. 2053 SIG(0) 2054 uses public/private keys to authenticate messages. Access control 2055 is performed in the same manner as TSIG keys; privileges can be 2056 granted or denied based on the key name. 2057 </para> 2058 2059 <para> 2060 When a SIG(0) signed message is received, it will only be 2061 verified if the key is known and trusted by the server; the server 2062 will not attempt to locate and/or validate the key. 2063 </para> 2064 2065 <para> 2066 SIG(0) signing of multiple-message TCP streams is not 2067 supported. 2068 </para> 2069 2070 <para> 2071 The only tool shipped with <acronym>BIND</acronym> 9 that 2072 generates SIG(0) signed messages is <command>nsupdate</command>. 2073 </para> 2074 2075 </sect1> 2076 <sect1 id="DNSSEC"> 2077 <title>DNSSEC</title> 2078 2079 <para> 2080 Cryptographic authentication of DNS information is possible 2081 through the DNS Security (<emphasis>DNSSEC-bis</emphasis>) extensions, 2082 defined in RFC 4033, RFC 4034, and RFC 4035. 2083 This section describes the creation and use of DNSSEC signed zones. 2084 </para> 2085 2086 <para> 2087 In order to set up a DNSSEC secure zone, there are a series 2088 of steps which must be followed. <acronym>BIND</acronym> 2089 9 ships 2090 with several tools 2091 that are used in this process, which are explained in more detail 2092 below. In all cases, the <option>-h</option> option prints a 2093 full list of parameters. Note that the DNSSEC tools require the 2094 keyset files to be in the working directory or the 2095 directory specified by the <option>-d</option> option, and 2096 that the tools shipped with BIND 9.2.x and earlier are not compatible 2097 with the current ones. 2098 </para> 2099 2100 <para> 2101 There must also be communication with the administrators of 2102 the parent and/or child zone to transmit keys. A zone's security 2103 status must be indicated by the parent zone for a DNSSEC capable 2104 resolver to trust its data. This is done through the presence 2105 or absence of a <literal>DS</literal> record at the 2106 delegation 2107 point. 2108 </para> 2109 2110 <para> 2111 For other servers to trust data in this zone, they must 2112 either be statically configured with this zone's zone key or the 2113 zone key of another zone above this one in the DNS tree. 2114 </para> 2115 2116 <sect2> 2117 <title>Generating Keys</title> 2118 2119 <para> 2120 The <command>dnssec-keygen</command> program is used to 2121 generate keys. 2122 </para> 2123 2124 <para> 2125 A secure zone must contain one or more zone keys. The 2126 zone keys will sign all other records in the zone, as well as 2127 the zone keys of any secure delegated zones. Zone keys must 2128 have the same name as the zone, a name type of 2129 <command>ZONE</command>, and must be usable for 2130 authentication. 2131 It is recommended that zone keys use a cryptographic algorithm 2132 designated as "mandatory to implement" by the IETF; currently 2133 the only one is RSASHA1. 2134 </para> 2135 2136 <para> 2137 The following command will generate a 768-bit RSASHA1 key for 2138 the <filename>child.example</filename> zone: 2139 </para> 2140 2141 <para> 2142 <userinput>dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example.</userinput> 2143 </para> 2144 2145 <para> 2146 Two output files will be produced: 2147 <filename>Kchild.example.+005+12345.key</filename> and 2148 <filename>Kchild.example.+005+12345.private</filename> 2149 (where 2150 12345 is an example of a key tag). The key filenames contain 2151 the key name (<filename>child.example.</filename>), 2152 algorithm (3 2153 is DSA, 1 is RSAMD5, 5 is RSASHA1, etc.), and the key tag (12345 in 2154 this case). 2155 The private key (in the <filename>.private</filename> 2156 file) is 2157 used to generate signatures, and the public key (in the 2158 <filename>.key</filename> file) is used for signature 2159 verification. 2160 </para> 2161 2162 <para> 2163 To generate another key with the same properties (but with 2164 a different key tag), repeat the above command. 2165 </para> 2166 2167 <para> 2168 The <command>dnssec-keyfromlabel</command> program is used 2169 to get a key pair from a crypto hardware and build the key 2170 files. Its usage is similar to <command>dnssec-keygen</command>. 2171 </para> 2172 2173 <para> 2174 The public keys should be inserted into the zone file by 2175 including the <filename>.key</filename> files using 2176 <command>$INCLUDE</command> statements. 2177 </para> 2178 2179 </sect2> 2180 <sect2> 2181 <title>Signing the Zone</title> 2182 2183 <para> 2184 The <command>dnssec-signzone</command> program is used 2185 to sign a zone. 2186 </para> 2187 2188 <para> 2189 Any <filename>keyset</filename> files corresponding to 2190 secure subzones should be present. The zone signer will 2191 generate <literal>NSEC</literal>, <literal>NSEC3</literal> 2192 and <literal>RRSIG</literal> records for the zone, as 2193 well as <literal>DS</literal> for the child zones if 2194 <literal>'-g'</literal> is specified. If <literal>'-g'</literal> 2195 is not specified, then DS RRsets for the secure child 2196 zones need to be added manually. 2197 </para> 2198 2199 <para> 2200 The following command signs the zone, assuming it is in a 2201 file called <filename>zone.child.example</filename>. By 2202 default, all zone keys which have an available private key are 2203 used to generate signatures. 2204 </para> 2205 2206 <para> 2207 <userinput>dnssec-signzone -o child.example zone.child.example</userinput> 2208 </para> 2209 2210 <para> 2211 One output file is produced: 2212 <filename>zone.child.example.signed</filename>. This 2213 file 2214 should be referenced by <filename>named.conf</filename> 2215 as the 2216 input file for the zone. 2217 </para> 2218 2219 <para><command>dnssec-signzone</command> 2220 will also produce a keyset and dsset files and optionally a 2221 dlvset file. These are used to provide the parent zone 2222 administrators with the <literal>DNSKEYs</literal> (or their 2223 corresponding <literal>DS</literal> records) that are the 2224 secure entry point to the zone. 2225 </para> 2226 2227 </sect2> 2228 2229 <sect2> 2230 <title>Configuring Servers</title> 2231 2232 <para> 2233 To enable <command>named</command> to respond appropriately 2234 to DNS requests from DNSSEC aware clients, 2235 <command>dnssec-enable</command> must be set to yes. 2236 (This is the default setting.) 2237 </para> 2238 2239 <para> 2240 To enable <command>named</command> to validate answers from 2241 other servers, the <command>dnssec-enable</command> option 2242 must be set to <userinput>yes</userinput>, and the 2243 <command>dnssec-validation</command> options must be set to 2244 <userinput>yes</userinput> or <userinput>auto</userinput>. 2245 </para> 2246 2247 <para> 2248 If <command>dnssec-validation</command> is set to 2249 <userinput>auto</userinput>, then a default 2250 trust anchor for the DNS root zone will be used. 2251 If it is set to <userinput>yes</userinput>, however, 2252 then at least one trust anchor must be configured 2253 with a <command>trusted-keys</command> or 2254 <command>managed-keys</command> statement in 2255 <filename>named.conf</filename>, or DNSSEC validation 2256 will not occur. The default setting is 2257 <userinput>yes</userinput>. 2258 </para> 2259 2260 <para> 2261 <command>trusted-keys</command> are copies of DNSKEY RRs 2262 for zones that are used to form the first link in the 2263 cryptographic chain of trust. All keys listed in 2264 <command>trusted-keys</command> (and corresponding zones) 2265 are deemed to exist and only the listed keys will be used 2266 to validated the DNSKEY RRset that they are from. 2267 </para> 2268 2269 <para> 2270 <command>managed-keys</command> are trusted keys which are 2271 automatically kept up to date via RFC 5011 trust anchor 2272 maintenance. 2273 </para> 2274 2275 <para> 2276 <command>trusted-keys</command> and 2277 <command>managed-keys</command> are described in more detail 2278 later in this document. 2279 </para> 2280 2281 <para> 2282 Unlike <acronym>BIND</acronym> 8, <acronym>BIND</acronym> 2283 9 does not verify signatures on load, so zone keys for 2284 authoritative zones do not need to be specified in the 2285 configuration file. 2286 </para> 2287 2288 <para> 2289 After DNSSEC gets established, a typical DNSSEC configuration 2290 will look something like the following. It has one or 2291 more public keys for the root. This allows answers from 2292 outside the organization to be validated. It will also 2293 have several keys for parts of the namespace the organization 2294 controls. These are here to ensure that <command>named</command> 2295 is immune to compromises in the DNSSEC components of the security 2296 of parent zones. 2297 </para> 2298 2299<programlisting> 2300managed-keys { 2301 /* Root Key */ 2302 "." initial-key 257 3 3 "BNY4wrWM1nCfJ+CXd0rVXyYmobt7sEEfK3clRbGaTwS 2303 JxrGkxJWoZu6I7PzJu/E9gx4UC1zGAHlXKdE4zYIpRh 2304 aBKnvcC2U9mZhkdUpd1Vso/HAdjNe8LmMlnzY3zy2Xy 2305 4klWOADTPzSv9eamj8V18PHGjBLaVtYvk/ln5ZApjYg 2306 hf+6fElrmLkdaz MQ2OCnACR817DF4BBa7UR/beDHyp 2307 5iWTXWSi6XmoJLbG9Scqc7l70KDqlvXR3M/lUUVRbke 2308 g1IPJSidmK3ZyCllh4XSKbje/45SKucHgnwU5jefMtq 2309 66gKodQj+MiA21AfUVe7u99WzTLzY3qlxDhxYQQ20FQ 2310 97S+LKUTpQcq27R7AT3/V5hRQxScINqwcz4jYqZD2fQ 2311 dgxbcDTClU0CRBdiieyLMNzXG3"; 2312}; 2313 2314trusted-keys { 2315 /* Key for our organization's forward zone */ 2316 example.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM6 2317 5KbhTjrW1ZaARmPhEZZe3Y9ifgEuq7vZ/z 2318 GZUdEGNWy+JZzus0lUptwgjGwhUS1558Hb 2319 4JKUbbOTcM8pwXlj0EiX3oDFVmjHO444gL 2320 kBOUKUf/mC7HvfwYH/Be22GnClrinKJp1O 2321 g4ywzO9WglMk7jbfW33gUKvirTHr25GL7S 2322 TQUzBb5Usxt8lgnyTUHs1t3JwCY5hKZ6Cq 2323 FxmAVZP20igTixin/1LcrgX/KMEGd/biuv 2324 F4qJCyduieHukuY3H4XMAcR+xia2nIUPvm 2325 /oyWR8BW/hWdzOvnSCThlHf3xiYleDbt/o 2326 1OTQ09A0="; 2327 2328 /* Key for our reverse zone. */ 2329 2.0.192.IN-ADDRPA.NET. 257 3 5 "AQOnS4xn/IgOUpBPJ3bogzwc 2330 xOdNax071L18QqZnQQQAVVr+i 2331 LhGTnNGp3HoWQLUIzKrJVZ3zg 2332 gy3WwNT6kZo6c0tszYqbtvchm 2333 gQC8CzKojM/W16i6MG/eafGU3 2334 siaOdS0yOI6BgPsw+YZdzlYMa 2335 IJGf4M4dyoKIhzdZyQ2bYQrjy 2336 Q4LB0lC7aOnsMyYKHHYeRvPxj 2337 IQXmdqgOJGq+vsevG06zW+1xg 2338 YJh9rCIfnm1GX/KMgxLPG2vXT 2339 D/RnLX+D3T3UL7HJYHJhAZD5L 2340 59VvjSPsZJHeDCUyWYrvPZesZ 2341 DIRvhDD52SKvbheeTJUm6Ehkz 2342 ytNN2SN96QRk8j/iI8ib"; 2343}; 2344 2345options { 2346 ... 2347 dnssec-enable yes; 2348 dnssec-validation yes; 2349}; 2350</programlisting> 2351 2352 <note> 2353 None of the keys listed in this example are valid. In particular, 2354 the root key is not valid. 2355 </note> 2356 2357 <para> 2358 When DNSSEC validation is enabled and properly configured, 2359 the resolver will reject any answers from signed, secure zones 2360 which fail to validate, and will return SERVFAIL to the client. 2361 </para> 2362 2363 <para> 2364 Responses may fail to validate for any of several reasons, 2365 including missing, expired, or invalid signatures, a key which 2366 does not match the DS RRset in the parent zone, or an insecure 2367 response from a zone which, according to its parent, should have 2368 been secure. 2369 </para> 2370 2371 <note> 2372 <para> 2373 When the validator receives a response from an unsigned zone 2374 that has a signed parent, it must confirm with the parent 2375 that the zone was intentionally left unsigned. It does 2376 this by verifying, via signed and validated NSEC/NSEC3 records, 2377 that the parent zone contains no DS records for the child. 2378 </para> 2379 <para> 2380 If the validator <emphasis>can</emphasis> prove that the zone 2381 is insecure, then the response is accepted. However, if it 2382 cannot, then it must assume an insecure response to be a 2383 forgery; it rejects the response and logs an error. 2384 </para> 2385 <para> 2386 The logged error reads "insecurity proof failed" and 2387 "got insecure response; parent indicates it should be secure". 2388 (Prior to BIND 9.7, the logged error was "not insecure". 2389 This referred to the zone, not the response.) 2390 </para> 2391 </note> 2392 </sect2> 2393 2394 </sect1> 2395 2396 <xi:include href="dnssec.xml"/> 2397 2398 <xi:include href="managed-keys.xml"/> 2399 2400 <xi:include href="pkcs11.xml"/> 2401 2402 <xi:include href="dlz.xml"/> 2403 2404 <sect1> 2405 <title>IPv6 Support in <acronym>BIND</acronym> 9</title> 2406 2407 <para> 2408 <acronym>BIND</acronym> 9 fully supports all currently 2409 defined forms of IPv6 name to address and address to name 2410 lookups. It will also use IPv6 addresses to make queries when 2411 running on an IPv6 capable system. 2412 </para> 2413 2414 <para> 2415 For forward lookups, <acronym>BIND</acronym> 9 supports 2416 only AAAA records. RFC 3363 deprecated the use of A6 records, 2417 and client-side support for A6 records was accordingly removed 2418 from <acronym>BIND</acronym> 9. 2419 However, authoritative <acronym>BIND</acronym> 9 name servers still 2420 load zone files containing A6 records correctly, answer queries 2421 for A6 records, and accept zone transfer for a zone containing A6 2422 records. 2423 </para> 2424 2425 <para> 2426 For IPv6 reverse lookups, <acronym>BIND</acronym> 9 supports 2427 the traditional "nibble" format used in the 2428 <emphasis>ip6.arpa</emphasis> domain, as well as the older, deprecated 2429 <emphasis>ip6.int</emphasis> domain. 2430 Older versions of <acronym>BIND</acronym> 9 2431 supported the "binary label" (also known as "bitstring") format, 2432 but support of binary labels has been completely removed per 2433 RFC 3363. 2434 Many applications in <acronym>BIND</acronym> 9 do not understand 2435 the binary label format at all any more, and will return an 2436 error if given. 2437 In particular, an authoritative <acronym>BIND</acronym> 9 2438 name server will not load a zone file containing binary labels. 2439 </para> 2440 2441 <para> 2442 For an overview of the format and structure of IPv6 addresses, 2443 see <xref linkend="ipv6addresses"/>. 2444 </para> 2445 2446 <sect2> 2447 <title>Address Lookups Using AAAA Records</title> 2448 2449 <para> 2450 The IPv6 AAAA record is a parallel to the IPv4 A record, 2451 and, unlike the deprecated A6 record, specifies the entire 2452 IPv6 address in a single record. For example, 2453 </para> 2454 2455<programlisting> 2456$ORIGIN example.com. 2457host 3600 IN AAAA 2001:db8::1 2458</programlisting> 2459 2460 <para> 2461 Use of IPv4-in-IPv6 mapped addresses is not recommended. 2462 If a host has an IPv4 address, use an A record, not 2463 a AAAA, with <literal>::ffff:192.168.42.1</literal> as 2464 the address. 2465 </para> 2466 </sect2> 2467 <sect2> 2468 <title>Address to Name Lookups Using Nibble Format</title> 2469 2470 <para> 2471 When looking up an address in nibble format, the address 2472 components are simply reversed, just as in IPv4, and 2473 <literal>ip6.arpa.</literal> is appended to the 2474 resulting name. 2475 For example, the following would provide reverse name lookup for 2476 a host with address 2477 <literal>2001:db8::1</literal>. 2478 </para> 2479 2480<programlisting> 2481$ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. 24821.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 14400 IN PTR ( 2483 host.example.com. ) 2484</programlisting> 2485 2486 </sect2> 2487 </sect1> 2488 </chapter> 2489 2490 <chapter id="Bv9ARM.ch05"> 2491 <title>The <acronym>BIND</acronym> 9 Lightweight Resolver</title> 2492 <sect1> 2493 <title>The Lightweight Resolver Library</title> 2494 <para> 2495 Traditionally applications have been linked with a stub resolver 2496 library that sends recursive DNS queries to a local caching name 2497 server. 2498 </para> 2499 <para> 2500 IPv6 once introduced new complexity into the resolution process, 2501 such as following A6 chains and DNAME records, and simultaneous 2502 lookup of IPv4 and IPv6 addresses. Though most of the complexity was 2503 then removed, these are hard or impossible 2504 to implement in a traditional stub resolver. 2505 </para> 2506 <para> 2507 <acronym>BIND</acronym> 9 therefore can also provide resolution 2508 services to local clients 2509 using a combination of a lightweight resolver library and a resolver 2510 daemon process running on the local host. These communicate using 2511 a simple UDP-based protocol, the "lightweight resolver protocol" 2512 that is distinct from and simpler than the full DNS protocol. 2513 </para> 2514 </sect1> 2515 <sect1 id="lwresd"> 2516 <title>Running a Resolver Daemon</title> 2517 2518 <para> 2519 To use the lightweight resolver interface, the system must 2520 run the resolver daemon <command>lwresd</command> or a 2521 local 2522 name server configured with a <command>lwres</command> 2523 statement. 2524 </para> 2525 2526 <para> 2527 By default, applications using the lightweight resolver library will 2528 make 2529 UDP requests to the IPv4 loopback address (127.0.0.1) on port 921. 2530 The 2531 address can be overridden by <command>lwserver</command> 2532 lines in 2533 <filename>/etc/resolv.conf</filename>. 2534 </para> 2535 2536 <para> 2537 The daemon currently only looks in the DNS, but in the future 2538 it may use other sources such as <filename>/etc/hosts</filename>, 2539 NIS, etc. 2540 </para> 2541 2542 <para> 2543 The <command>lwresd</command> daemon is essentially a 2544 caching-only name server that responds to requests using the 2545 lightweight 2546 resolver protocol rather than the DNS protocol. Because it needs 2547 to run on each host, it is designed to require no or minimal 2548 configuration. 2549 Unless configured otherwise, it uses the name servers listed on 2550 <command>nameserver</command> lines in <filename>/etc/resolv.conf</filename> 2551 as forwarders, but is also capable of doing the resolution 2552 autonomously if 2553 none are specified. 2554 </para> 2555 <para> 2556 The <command>lwresd</command> daemon may also be 2557 configured with a 2558 <filename>named.conf</filename> style configuration file, 2559 in 2560 <filename>/etc/lwresd.conf</filename> by default. A name 2561 server may also 2562 be configured to act as a lightweight resolver daemon using the 2563 <command>lwres</command> statement in <filename>named.conf</filename>. 2564 </para> 2565 </sect1> 2566 </chapter> 2567 2568 <chapter id="Bv9ARM.ch06"> 2569 <title><acronym>BIND</acronym> 9 Configuration Reference</title> 2570 2571 <para> 2572 <acronym>BIND</acronym> 9 configuration is broadly similar 2573 to <acronym>BIND</acronym> 8; however, there are a few new 2574 areas 2575 of configuration, such as views. <acronym>BIND</acronym> 2576 8 configuration files should work with few alterations in <acronym>BIND</acronym> 2577 9, although more complex configurations should be reviewed to check 2578 if they can be more efficiently implemented using the new features 2579 found in <acronym>BIND</acronym> 9. 2580 </para> 2581 2582 <para> 2583 <acronym>BIND</acronym> 4 configuration files can be 2584 converted to the new format 2585 using the shell script 2586 <filename>contrib/named-bootconf/named-bootconf.sh</filename>. 2587 </para> 2588 <sect1 id="configuration_file_elements"> 2589 <title>Configuration File Elements</title> 2590 <para> 2591 Following is a list of elements used throughout the <acronym>BIND</acronym> configuration 2592 file documentation: 2593 </para> 2594 <informaltable colsep="0" rowsep="0"> 2595 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="2Level-table"> 2596 <colspec colname="1" colnum="1" colsep="0" colwidth="1.855in"/> 2597 <colspec colname="2" colnum="2" colsep="0" colwidth="3.770in"/> 2598 <tbody> 2599 <row rowsep="0"> 2600 <entry colname="1"> 2601 <para> 2602 <varname>acl_name</varname> 2603 </para> 2604 </entry> 2605 <entry colname="2"> 2606 <para> 2607 The name of an <varname>address_match_list</varname> as 2608 defined by the <command>acl</command> statement. 2609 </para> 2610 </entry> 2611 </row> 2612 <row rowsep="0"> 2613 <entry colname="1"> 2614 <para> 2615 <varname>address_match_list</varname> 2616 </para> 2617 </entry> 2618 <entry colname="2"> 2619 <para> 2620 A list of one or more 2621 <varname>ip_addr</varname>, 2622 <varname>ip_prefix</varname>, <varname>key_id</varname>, 2623 or <varname>acl_name</varname> elements, see 2624 <xref linkend="address_match_lists"/>. 2625 </para> 2626 </entry> 2627 </row> 2628 <row rowsep="0"> 2629 <entry colname="1"> 2630 <para> 2631 <varname>masters_list</varname> 2632 </para> 2633 </entry> 2634 <entry colname="2"> 2635 <para> 2636 A named list of one or more <varname>ip_addr</varname> 2637 with optional <varname>key_id</varname> and/or 2638 <varname>ip_port</varname>. 2639 A <varname>masters_list</varname> may include other 2640 <varname>masters_lists</varname>. 2641 </para> 2642 </entry> 2643 </row> 2644 <row rowsep="0"> 2645 <entry colname="1"> 2646 <para> 2647 <varname>domain_name</varname> 2648 </para> 2649 </entry> 2650 <entry colname="2"> 2651 <para> 2652 A quoted string which will be used as 2653 a DNS name, for example "<literal>my.test.domain</literal>". 2654 </para> 2655 </entry> 2656 </row> 2657 <row rowsep="0"> 2658 <entry colname="1"> 2659 <para> 2660 <varname>namelist</varname> 2661 </para> 2662 </entry> 2663 <entry colname="2"> 2664 <para> 2665 A list of one or more <varname>domain_name</varname> 2666 elements. 2667 </para> 2668 </entry> 2669 </row> 2670 <row rowsep="0"> 2671 <entry colname="1"> 2672 <para> 2673 <varname>dotted_decimal</varname> 2674 </para> 2675 </entry> 2676 <entry colname="2"> 2677 <para> 2678 One to four integers valued 0 through 2679 255 separated by dots (`.'), such as <command>123</command>, 2680 <command>45.67</command> or <command>89.123.45.67</command>. 2681 </para> 2682 </entry> 2683 </row> 2684 <row rowsep="0"> 2685 <entry colname="1"> 2686 <para> 2687 <varname>ip4_addr</varname> 2688 </para> 2689 </entry> 2690 <entry colname="2"> 2691 <para> 2692 An IPv4 address with exactly four elements 2693 in <varname>dotted_decimal</varname> notation. 2694 </para> 2695 </entry> 2696 </row> 2697 <row rowsep="0"> 2698 <entry colname="1"> 2699 <para> 2700 <varname>ip6_addr</varname> 2701 </para> 2702 </entry> 2703 <entry colname="2"> 2704 <para> 2705 An IPv6 address, such as <command>2001:db8::1234</command>. 2706 IPv6 scoped addresses that have ambiguity on their 2707 scope zones must be disambiguated by an appropriate 2708 zone ID with the percent character (`%') as 2709 delimiter. It is strongly recommended to use 2710 string zone names rather than numeric identifiers, 2711 in order to be robust against system configuration 2712 changes. However, since there is no standard 2713 mapping for such names and identifier values, 2714 currently only interface names as link identifiers 2715 are supported, assuming one-to-one mapping between 2716 interfaces and links. For example, a link-local 2717 address <command>fe80::1</command> on the link 2718 attached to the interface <command>ne0</command> 2719 can be specified as <command>fe80::1%ne0</command>. 2720 Note that on most systems link-local addresses 2721 always have the ambiguity, and need to be 2722 disambiguated. 2723 </para> 2724 </entry> 2725 </row> 2726 <row rowsep="0"> 2727 <entry colname="1"> 2728 <para> 2729 <varname>ip_addr</varname> 2730 </para> 2731 </entry> 2732 <entry colname="2"> 2733 <para> 2734 An <varname>ip4_addr</varname> or <varname>ip6_addr</varname>. 2735 </para> 2736 </entry> 2737 </row> 2738 <row rowsep="0"> 2739 <entry colname="1"> 2740 <para> 2741 <varname>ip_dscp</varname> 2742 </para> 2743 </entry> 2744 <entry colname="2"> 2745 <para> 2746 A <varname>number</varname> between 0 and 63, used 2747 to select a differentiated services code point (DSCP) 2748 value for use with outgoing traffic on operating systems 2749 that support DSCP. 2750 </para> 2751 </entry> 2752 </row> 2753 <row rowsep="0"> 2754 <entry colname="1"> 2755 <para> 2756 <varname>ip_port</varname> 2757 </para> 2758 </entry> 2759 <entry colname="2"> 2760 <para> 2761 An IP port <varname>number</varname>. 2762 The <varname>number</varname> is limited to 0 2763 through 65535, with values 2764 below 1024 typically restricted to use by processes running 2765 as root. 2766 In some cases, an asterisk (`*') character can be used as a 2767 placeholder to 2768 select a random high-numbered port. 2769 </para> 2770 </entry> 2771 </row> 2772 <row rowsep="0"> 2773 <entry colname="1"> 2774 <para> 2775 <varname>ip_prefix</varname> 2776 </para> 2777 </entry> 2778 <entry colname="2"> 2779 <para> 2780 An IP network specified as an <varname>ip_addr</varname>, 2781 followed by a slash (`/') and then the number of bits in the 2782 netmask. 2783 Trailing zeros in a <varname>ip_addr</varname> 2784 may omitted. 2785 For example, <command>127/8</command> is the 2786 network <command>127.0.0.0</command> with 2787 netmask <command>255.0.0.0</command> and <command>1.2.3.0/28</command> is 2788 network <command>1.2.3.0</command> with netmask <command>255.255.255.240</command>. 2789 </para> 2790 <para> 2791 When specifying a prefix involving a IPv6 scoped address 2792 the scope may be omitted. In that case the prefix will 2793 match packets from any scope. 2794 </para> 2795 </entry> 2796 </row> 2797 <row rowsep="0"> 2798 <entry colname="1"> 2799 <para> 2800 <varname>key_id</varname> 2801 </para> 2802 </entry> 2803 <entry colname="2"> 2804 <para> 2805 A <varname>domain_name</varname> representing 2806 the name of a shared key, to be used for transaction 2807 security. 2808 </para> 2809 </entry> 2810 </row> 2811 <row rowsep="0"> 2812 <entry colname="1"> 2813 <para> 2814 <varname>key_list</varname> 2815 </para> 2816 </entry> 2817 <entry colname="2"> 2818 <para> 2819 A list of one or more 2820 <varname>key_id</varname>s, 2821 separated by semicolons and ending with a semicolon. 2822 </para> 2823 </entry> 2824 </row> 2825 <row rowsep="0"> 2826 <entry colname="1"> 2827 <para> 2828 <varname>number</varname> 2829 </para> 2830 </entry> 2831 <entry colname="2"> 2832 <para> 2833 A non-negative 32-bit integer 2834 (i.e., a number between 0 and 4294967295, inclusive). 2835 Its acceptable value might further 2836 be limited by the context in which it is used. 2837 </para> 2838 </entry> 2839 </row> 2840 <row rowsep="0"> 2841 <entry colname="1"> 2842 <para> 2843 <varname>path_name</varname> 2844 </para> 2845 </entry> 2846 <entry colname="2"> 2847 <para> 2848 A quoted string which will be used as 2849 a pathname, such as <filename>zones/master/my.test.domain</filename>. 2850 </para> 2851 </entry> 2852 </row> 2853 <row rowsep="0"> 2854 <entry colname="1"> 2855 <para> 2856 <varname>port_list</varname> 2857 </para> 2858 </entry> 2859 <entry colname="2"> 2860 <para> 2861 A list of an <varname>ip_port</varname> or a port 2862 range. 2863 A port range is specified in the form of 2864 <userinput>range</userinput> followed by 2865 two <varname>ip_port</varname>s, 2866 <varname>port_low</varname> and 2867 <varname>port_high</varname>, which represents 2868 port numbers from <varname>port_low</varname> through 2869 <varname>port_high</varname>, inclusive. 2870 <varname>port_low</varname> must not be larger than 2871 <varname>port_high</varname>. 2872 For example, 2873 <userinput>range 1024 65535</userinput> represents 2874 ports from 1024 through 65535. 2875 In either case an asterisk (`*') character is not 2876 allowed as a valid <varname>ip_port</varname>. 2877 </para> 2878 </entry> 2879 </row> 2880 <row rowsep="0"> 2881 <entry colname="1"> 2882 <para> 2883 <varname>size_spec</varname> 2884 </para> 2885 </entry> 2886 <entry colname="2"> 2887 <para> 2888 A 64-bit unsigned integer, or the keywords 2889 <userinput>unlimited</userinput> or 2890 <userinput>default</userinput>. 2891 </para> 2892 <para> 2893 Integers may take values 2894 0 <= value <= 18446744073709551615, though 2895 certain parameters 2896 (such as <command>max-journal-size</command>) may 2897 use a more limited range within these extremes. 2898 In most cases, setting a value to 0 does not 2899 literally mean zero; it means "undefined" or 2900 "as big as possible", depending on the context. 2901 See the explanations of particular parameters 2902 that use <varname>size_spec</varname> 2903 for details on how they interpret its use. 2904 </para> 2905 <para> 2906 Numeric values can optionally be followed by a 2907 scaling factor: 2908 <userinput>K</userinput> or <userinput>k</userinput> 2909 for kilobytes, 2910 <userinput>M</userinput> or <userinput>m</userinput> 2911 for megabytes, and 2912 <userinput>G</userinput> or <userinput>g</userinput> 2913 for gigabytes, which scale by 1024, 1024*1024, and 2914 1024*1024*1024 respectively. 2915 </para> 2916 <para> 2917 <varname>unlimited</varname> generally means 2918 "as big as possible", and is usually the best 2919 way to safely set a very large number. 2920 </para> 2921 <para> 2922 <varname>default</varname> 2923 uses the limit that was in force when the server was started. 2924 </para> 2925 </entry> 2926 </row> 2927 <row rowsep="0"> 2928 <entry colname="1"> 2929 <para> 2930 <varname>yes_or_no</varname> 2931 </para> 2932 </entry> 2933 <entry colname="2"> 2934 <para> 2935 Either <userinput>yes</userinput> or <userinput>no</userinput>. 2936 The words <userinput>true</userinput> and <userinput>false</userinput> are 2937 also accepted, as are the numbers <userinput>1</userinput> 2938 and <userinput>0</userinput>. 2939 </para> 2940 </entry> 2941 </row> 2942 <row rowsep="0"> 2943 <entry colname="1"> 2944 <para> 2945 <varname>dialup_option</varname> 2946 </para> 2947 </entry> 2948 <entry colname="2"> 2949 <para> 2950 One of <userinput>yes</userinput>, 2951 <userinput>no</userinput>, <userinput>notify</userinput>, 2952 <userinput>notify-passive</userinput>, <userinput>refresh</userinput> or 2953 <userinput>passive</userinput>. 2954 When used in a zone, <userinput>notify-passive</userinput>, 2955 <userinput>refresh</userinput>, and <userinput>passive</userinput> 2956 are restricted to slave and stub zones. 2957 </para> 2958 </entry> 2959 </row> 2960 </tbody> 2961 </tgroup> 2962 </informaltable> 2963 <sect2 id="address_match_lists"> 2964 <title>Address Match Lists</title> 2965 <sect3> 2966 <title>Syntax</title> 2967 2968<programlisting><varname>address_match_list</varname> = address_match_list_element ; 2969 <optional> address_match_list_element; ... </optional> 2970<varname>address_match_list_element</varname> = <optional> ! </optional> (ip_address <optional>/length</optional> | 2971 key key_id | acl_name | { address_match_list } ) 2972</programlisting> 2973 2974 </sect3> 2975 <sect3> 2976 <title>Definition and Usage</title> 2977 <para> 2978 Address match lists are primarily used to determine access 2979 control for various server operations. They are also used in 2980 the <command>listen-on</command> and <command>sortlist</command> 2981 statements. The elements which constitute an address match 2982 list can be any of the following: 2983 </para> 2984 <itemizedlist> 2985 <listitem> 2986 <simpara>an IP address (IPv4 or IPv6)</simpara> 2987 </listitem> 2988 <listitem> 2989 <simpara>an IP prefix (in `/' notation)</simpara> 2990 </listitem> 2991 <listitem> 2992 <simpara> 2993 a key ID, as defined by the <command>key</command> 2994 statement 2995 </simpara> 2996 </listitem> 2997 <listitem> 2998 <simpara>the name of an address match list defined with 2999 the <command>acl</command> statement 3000 </simpara> 3001 </listitem> 3002 <listitem> 3003 <simpara>a nested address match list enclosed in braces</simpara> 3004 </listitem> 3005 </itemizedlist> 3006 3007 <para> 3008 Elements can be negated with a leading exclamation mark (`!'), 3009 and the match list names "any", "none", "localhost", and 3010 "localnets" are predefined. More information on those names 3011 can be found in the description of the acl statement. 3012 </para> 3013 3014 <para> 3015 The addition of the key clause made the name of this syntactic 3016 element something of a misnomer, since security keys can be used 3017 to validate access without regard to a host or network address. 3018 Nonetheless, the term "address match list" is still used 3019 throughout the documentation. 3020 </para> 3021 3022 <para> 3023 When a given IP address or prefix is compared to an address 3024 match list, the comparison takes place in approximately O(1) 3025 time. However, key comparisons require that the list of keys 3026 be traversed until a matching key is found, and therefore may 3027 be somewhat slower. 3028 </para> 3029 3030 <para> 3031 The interpretation of a match depends on whether the list is being 3032 used for access control, defining <command>listen-on</command> ports, or in a 3033 <command>sortlist</command>, and whether the element was negated. 3034 </para> 3035 3036 <para> 3037 When used as an access control list, a non-negated match 3038 allows access and a negated match denies access. If 3039 there is no match, access is denied. The clauses 3040 <command>allow-notify</command>, 3041 <command>allow-recursion</command>, 3042 <command>allow-recursion-on</command>, 3043 <command>allow-query</command>, 3044 <command>allow-query-on</command>, 3045 <command>allow-query-cache</command>, 3046 <command>allow-query-cache-on</command>, 3047 <command>allow-transfer</command>, 3048 <command>allow-update</command>, 3049 <command>allow-update-forwarding</command>, and 3050 <command>blackhole</command> all use address match 3051 lists. Similarly, the <command>listen-on</command> option will cause the 3052 server to refuse queries on any of the machine's 3053 addresses which do not match the list. 3054 </para> 3055 3056 <para> 3057 Order of insertion is significant. If more than one element 3058 in an ACL is found to match a given IP address or prefix, 3059 preference will be given to the one that came 3060 <emphasis>first</emphasis> in the ACL definition. 3061 Because of this first-match behavior, an element that 3062 defines a subset of another element in the list should 3063 come before the broader element, regardless of whether 3064 either is negated. For example, in 3065 <command>1.2.3/24; ! 1.2.3.13;</command> 3066 the 1.2.3.13 element is completely useless because the 3067 algorithm will match any lookup for 1.2.3.13 to the 1.2.3/24 3068 element. Using <command>! 1.2.3.13; 1.2.3/24</command> fixes 3069 that problem by having 1.2.3.13 blocked by the negation, but 3070 all other 1.2.3.* hosts fall through. 3071 </para> 3072 </sect3> 3073 </sect2> 3074 3075 <sect2> 3076 <title>Comment Syntax</title> 3077 3078 <para> 3079 The <acronym>BIND</acronym> 9 comment syntax allows for 3080 comments to appear 3081 anywhere that whitespace may appear in a <acronym>BIND</acronym> configuration 3082 file. To appeal to programmers of all kinds, they can be written 3083 in the C, C++, or shell/perl style. 3084 </para> 3085 3086 <sect3> 3087 <title>Syntax</title> 3088 3089 <para> 3090 <programlisting>/* This is a <acronym>BIND</acronym> comment as in C */</programlisting> 3091 <programlisting>// This is a <acronym>BIND</acronym> comment as in C++</programlisting> 3092 <programlisting># This is a <acronym>BIND</acronym> comment as in common UNIX shells 3093# and perl</programlisting> 3094 </para> 3095 </sect3> 3096 <sect3> 3097 <title>Definition and Usage</title> 3098 <para> 3099 Comments may appear anywhere that whitespace may appear in 3100 a <acronym>BIND</acronym> configuration file. 3101 </para> 3102 <para> 3103 C-style comments start with the two characters /* (slash, 3104 star) and end with */ (star, slash). Because they are completely 3105 delimited with these characters, they can be used to comment only 3106 a portion of a line or to span multiple lines. 3107 </para> 3108 <para> 3109 C-style comments cannot be nested. For example, the following 3110 is not valid because the entire comment ends with the first */: 3111 </para> 3112 <para> 3113 3114<programlisting>/* This is the start of a comment. 3115 This is still part of the comment. 3116/* This is an incorrect attempt at nesting a comment. */ 3117 This is no longer in any comment. */ 3118</programlisting> 3119 3120 </para> 3121 3122 <para> 3123 C++-style comments start with the two characters // (slash, 3124 slash) and continue to the end of the physical line. They cannot 3125 be continued across multiple physical lines; to have one logical 3126 comment span multiple lines, each line must use the // pair. 3127 For example: 3128 </para> 3129 <para> 3130 3131<programlisting>// This is the start of a comment. The next line 3132// is a new comment, even though it is logically 3133// part of the previous comment. 3134</programlisting> 3135 3136 </para> 3137 <para> 3138 Shell-style (or perl-style, if you prefer) comments start 3139 with the character <literal>#</literal> (number sign) 3140 and continue to the end of the 3141 physical line, as in C++ comments. 3142 For example: 3143 </para> 3144 3145 <para> 3146 3147<programlisting># This is the start of a comment. The next line 3148# is a new comment, even though it is logically 3149# part of the previous comment. 3150</programlisting> 3151 3152 </para> 3153 3154 <warning> 3155 <para> 3156 You cannot use the semicolon (`;') character 3157 to start a comment such as you would in a zone file. The 3158 semicolon indicates the end of a configuration 3159 statement. 3160 </para> 3161 </warning> 3162 </sect3> 3163 </sect2> 3164 </sect1> 3165 3166 <sect1 id="Configuration_File_Grammar"> 3167 <title>Configuration File Grammar</title> 3168 3169 <para> 3170 A <acronym>BIND</acronym> 9 configuration consists of 3171 statements and comments. 3172 Statements end with a semicolon. Statements and comments are the 3173 only elements that can appear without enclosing braces. Many 3174 statements contain a block of sub-statements, which are also 3175 terminated with a semicolon. 3176 </para> 3177 3178 <para> 3179 The following statements are supported: 3180 </para> 3181 3182 <informaltable colsep="0" rowsep="0"> 3183 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="2Level-table"> 3184 <colspec colname="1" colnum="1" colsep="0" colwidth="1.336in"/> 3185 <colspec colname="2" colnum="2" colsep="0" colwidth="3.778in"/> 3186 <tbody> 3187 <row rowsep="0"> 3188 <entry colname="1"> 3189 <para><command>acl</command></para> 3190 </entry> 3191 <entry colname="2"> 3192 <para> 3193 defines a named IP address 3194 matching list, for access control and other uses. 3195 </para> 3196 </entry> 3197 </row> 3198 <row rowsep="0"> 3199 <entry colname="1"> 3200 <para><command>controls</command></para> 3201 </entry> 3202 <entry colname="2"> 3203 <para> 3204 declares control channels to be used 3205 by the <command>rndc</command> utility. 3206 </para> 3207 </entry> 3208 </row> 3209 <row rowsep="0"> 3210 <entry colname="1"> 3211 <para><command>include</command></para> 3212 </entry> 3213 <entry colname="2"> 3214 <para> 3215 includes a file. 3216 </para> 3217 </entry> 3218 </row> 3219 <row rowsep="0"> 3220 <entry colname="1"> 3221 <para><command>key</command></para> 3222 </entry> 3223 <entry colname="2"> 3224 <para> 3225 specifies key information for use in 3226 authentication and authorization using TSIG. 3227 </para> 3228 </entry> 3229 </row> 3230 <row rowsep="0"> 3231 <entry colname="1"> 3232 <para><command>logging</command></para> 3233 </entry> 3234 <entry colname="2"> 3235 <para> 3236 specifies what the server logs, and where 3237 the log messages are sent. 3238 </para> 3239 </entry> 3240 </row> 3241 <row rowsep="0"> 3242 <entry colname="1"> 3243 <para><command>lwres</command></para> 3244 </entry> 3245 <entry colname="2"> 3246 <para> 3247 configures <command>named</command> to 3248 also act as a light-weight resolver daemon (<command>lwresd</command>). 3249 </para> 3250 </entry> 3251 </row> 3252 <row rowsep="0"> 3253 <entry colname="1"> 3254 <para><command>masters</command></para> 3255 </entry> 3256 <entry colname="2"> 3257 <para> 3258 defines a named masters list for 3259 inclusion in stub and slave zones' 3260 <command>masters</command> or 3261 <command>also-notify</command> lists. 3262 </para> 3263 </entry> 3264 </row> 3265 <row rowsep="0"> 3266 <entry colname="1"> 3267 <para><command>options</command></para> 3268 </entry> 3269 <entry colname="2"> 3270 <para> 3271 controls global server configuration 3272 options and sets defaults for other statements. 3273 </para> 3274 </entry> 3275 </row> 3276 <row rowsep="0"> 3277 <entry colname="1"> 3278 <para><command>server</command></para> 3279 </entry> 3280 <entry colname="2"> 3281 <para> 3282 sets certain configuration options on 3283 a per-server basis. 3284 </para> 3285 </entry> 3286 </row> 3287 <row rowsep="0"> 3288 <entry colname="1"> 3289 <para><command>statistics-channels</command></para> 3290 </entry> 3291 <entry colname="2"> 3292 <para> 3293 declares communication channels to get access to 3294 <command>named</command> statistics. 3295 </para> 3296 </entry> 3297 </row> 3298 <row rowsep="0"> 3299 <entry colname="1"> 3300 <para><command>trusted-keys</command></para> 3301 </entry> 3302 <entry colname="2"> 3303 <para> 3304 defines trusted DNSSEC keys. 3305 </para> 3306 </entry> 3307 </row> 3308 <row rowsep="0"> 3309 <entry colname="1"> 3310 <para><command>managed-keys</command></para> 3311 </entry> 3312 <entry colname="2"> 3313 <para> 3314 lists DNSSEC keys to be kept up to date 3315 using RFC 5011 trust anchor maintenance. 3316 </para> 3317 </entry> 3318 </row> 3319 <row rowsep="0"> 3320 <entry colname="1"> 3321 <para><command>view</command></para> 3322 </entry> 3323 <entry colname="2"> 3324 <para> 3325 defines a view. 3326 </para> 3327 </entry> 3328 </row> 3329 <row rowsep="0"> 3330 <entry colname="1"> 3331 <para><command>zone</command></para> 3332 </entry> 3333 <entry colname="2"> 3334 <para> 3335 defines a zone. 3336 </para> 3337 </entry> 3338 </row> 3339 </tbody> 3340 </tgroup> 3341 </informaltable> 3342 3343 <para> 3344 The <command>logging</command> and 3345 <command>options</command> statements may only occur once 3346 per 3347 configuration. 3348 </para> 3349 3350 <sect2> 3351 <title><command>acl</command> Statement Grammar</title> 3352 3353<programlisting><command>acl</command> acl-name { 3354 address_match_list 3355}; 3356</programlisting> 3357 3358 </sect2> 3359 <sect2 id="acl"> 3360 <title><command>acl</command> Statement Definition and 3361 Usage</title> 3362 3363 <para> 3364 The <command>acl</command> statement assigns a symbolic 3365 name to an address match list. It gets its name from a primary 3366 use of address match lists: Access Control Lists (ACLs). 3367 </para> 3368 3369 <para> 3370 The following ACLs are built-in: 3371 </para> 3372 3373 <informaltable colsep="0" rowsep="0"> 3374 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="3Level-table"> 3375 <colspec colname="1" colnum="1" colsep="0" colwidth="1.130in"/> 3376 <colspec colname="2" colnum="2" colsep="0" colwidth="4.000in"/> 3377 <tbody> 3378 <row rowsep="0"> 3379 <entry colname="1"> 3380 <para><command>any</command></para> 3381 </entry> 3382 <entry colname="2"> 3383 <para> 3384 Matches all hosts. 3385 </para> 3386 </entry> 3387 </row> 3388 <row rowsep="0"> 3389 <entry colname="1"> 3390 <para><command>none</command></para> 3391 </entry> 3392 <entry colname="2"> 3393 <para> 3394 Matches no hosts. 3395 </para> 3396 </entry> 3397 </row> 3398 <row rowsep="0"> 3399 <entry colname="1"> 3400 <para><command>localhost</command></para> 3401 </entry> 3402 <entry colname="2"> 3403 <para> 3404 Matches the IPv4 and IPv6 addresses of all network 3405 interfaces on the system. When addresses are 3406 added or removed, the <command>localhost</command> 3407 ACL element is updated to reflect the changes. 3408 </para> 3409 </entry> 3410 </row> 3411 <row rowsep="0"> 3412 <entry colname="1"> 3413 <para><command>localnets</command></para> 3414 </entry> 3415 <entry colname="2"> 3416 <para> 3417 Matches any host on an IPv4 or IPv6 network 3418 for which the system has an interface. 3419 When addresses are added or removed, 3420 the <command>localnets</command> 3421 ACL element is updated to reflect the changes. 3422 Some systems do not provide a way to determine the prefix 3423 lengths of 3424 local IPv6 addresses. 3425 In such a case, <command>localnets</command> 3426 only matches the local 3427 IPv6 addresses, just like <command>localhost</command>. 3428 </para> 3429 </entry> 3430 </row> 3431 </tbody> 3432 </tgroup> 3433 </informaltable> 3434 3435 <para> 3436 When <acronym>BIND</acronym> 9 is built with GeoIP support, 3437 ACLs can also be used for geographic access restrictions. 3438 This is done by specifying an ACL element of the form: 3439 <command>geoip <optional>db <replaceable>database</replaceable></optional> <replaceable>field</replaceable> <replaceable>value</replaceable></command> 3440 </para> 3441 <para> 3442 The <replaceable>field</replaceable> indicates which field 3443 to search for a match. Available fields are "country", 3444 "region", "city", "continent", "postal" (postal code), 3445 "metro" (metro code), "area" (area code), "tz" (timezone), 3446 "isp", "org", "asnum", "domain" and "netspeed". 3447 </para> 3448 <para> 3449 <replaceable>value</replaceable> is the value to search 3450 for within the database. A string may be quoted if it 3451 contains spaces or other special characters. If this is 3452 an "asnum" search, then the leading "ASNNNN" string can be 3453 used, otherwise the full description must be used (e.g. 3454 "ASNNNN Example Company Name"). If this is a "country" 3455 search and the string is two characters long, then it must 3456 be a standard ISO-3166-1 two-letter country code, and if it 3457 is three characters long then it must be an ISO-3166-1 3458 three-letter country code; otherwise it is the full name 3459 of the country. Similarly, if this is a "region" search 3460 and the string is two characters long, then it must be a 3461 standard two-letter state or province abbreviation; 3462 otherwise it is the full name of the state or province. 3463 </para> 3464 <para> 3465 The <replaceable>database</replaceable> field indicates which 3466 GeoIP database to search for a match. In most cases this is 3467 unnecessary, because most search fields can only be found in 3468 a single database. However, searches for country can be 3469 answered from the "city", "region", or "country" databases, 3470 and searches for region (i.e., state or province) can be 3471 answered from the "city" or "region" databases. For these 3472 search types, specifying a <replaceable>database</replaceable> 3473 will force the query to be answered from that database and no 3474 other. If <replaceable>database</replaceable> is not 3475 specified, then these queries will be answered from the "city", 3476 database if it is installed, or the "region" database if it is 3477 installed, or the "country" database, in that order. 3478 </para> 3479 <para> 3480 Some example GeoIP ACLs: 3481 </para> 3482 <programlisting>geoip country US; 3483geoip country JAP; 3484geoip db country country Canada; 3485geoip db region region WA; 3486geoip city "San Francisco"; 3487geoip region Oklahoma; 3488geoip postal 95062; 3489geoip tz "America/Los_Angeles"; 3490geoip org "Internet Systems Consortium"; 3491</programlisting> 3492 3493 3494 </sect2> 3495 <sect2> 3496 <title><command>controls</command> Statement Grammar</title> 3497 3498<programlisting><command>controls</command> { 3499 [ inet ( ip_addr | * ) [ port ip_port ] 3500 allow { <replaceable> address_match_list </replaceable> } 3501 keys { <replaceable>key_list</replaceable> }; ] 3502 [ inet ...; ] 3503 [ unix <replaceable>path</replaceable> perm <replaceable>number</replaceable> owner <replaceable>number</replaceable> group <replaceable>number</replaceable> 3504 keys { <replaceable>key_list</replaceable> }; ] 3505 [ unix ...; ] 3506}; 3507</programlisting> 3508 3509 </sect2> 3510 3511 <sect2 id="controls_statement_definition_and_usage"> 3512 <title><command>controls</command> Statement Definition and 3513 Usage</title> 3514 3515 <para> 3516 The <command>controls</command> statement declares control 3517 channels to be used by system administrators to control the 3518 operation of the name server. These control channels are 3519 used by the <command>rndc</command> utility to send 3520 commands to and retrieve non-DNS results from a name server. 3521 </para> 3522 3523 <para> 3524 An <command>inet</command> control channel is a TCP socket 3525 listening at the specified <command>ip_port</command> on the 3526 specified <command>ip_addr</command>, which can be an IPv4 or IPv6 3527 address. An <command>ip_addr</command> of <literal>*</literal> (asterisk) is 3528 interpreted as the IPv4 wildcard address; connections will be 3529 accepted on any of the system's IPv4 addresses. 3530 To listen on the IPv6 wildcard address, 3531 use an <command>ip_addr</command> of <literal>::</literal>. 3532 If you will only use <command>rndc</command> on the local host, 3533 using the loopback address (<literal>127.0.0.1</literal> 3534 or <literal>::1</literal>) is recommended for maximum security. 3535 </para> 3536 3537 <para> 3538 If no port is specified, port 953 is used. The asterisk 3539 "<literal>*</literal>" cannot be used for <command>ip_port</command>. 3540 </para> 3541 3542 <para> 3543 The ability to issue commands over the control channel is 3544 restricted by the <command>allow</command> and 3545 <command>keys</command> clauses. 3546 Connections to the control channel are permitted based on the 3547 <command>address_match_list</command>. This is for simple 3548 IP address based filtering only; any <command>key_id</command> 3549 elements of the <command>address_match_list</command> 3550 are ignored. 3551 </para> 3552 3553 <para> 3554 A <command>unix</command> control channel is a UNIX domain 3555 socket listening at the specified path in the file system. 3556 Access to the socket is specified by the <command>perm</command>, 3557 <command>owner</command> and <command>group</command> clauses. 3558 Note on some platforms (SunOS and Solaris) the permissions 3559 (<command>perm</command>) are applied to the parent directory 3560 as the permissions on the socket itself are ignored. 3561 </para> 3562 3563 <para> 3564 The primary authorization mechanism of the command 3565 channel is the <command>key_list</command>, which 3566 contains a list of <command>key_id</command>s. 3567 Each <command>key_id</command> in the <command>key_list</command> 3568 is authorized to execute commands over the control channel. 3569 See <xref linkend="rndc"/> in <xref linkend="admin_tools"/>) 3570 for information about configuring keys in <command>rndc</command>. 3571 </para> 3572 3573 <para> 3574 If no <command>controls</command> statement is present, 3575 <command>named</command> will set up a default 3576 control channel listening on the loopback address 127.0.0.1 3577 and its IPv6 counterpart ::1. 3578 In this case, and also when the <command>controls</command> statement 3579 is present but does not have a <command>keys</command> clause, 3580 <command>named</command> will attempt to load the command channel key 3581 from the file <filename>rndc.key</filename> in 3582 <filename>/etc</filename> (or whatever <varname>sysconfdir</varname> 3583 was specified as when <acronym>BIND</acronym> was built). 3584 To create a <filename>rndc.key</filename> file, run 3585 <userinput>rndc-confgen -a</userinput>. 3586 </para> 3587 3588 <para> 3589 The <filename>rndc.key</filename> feature was created to 3590 ease the transition of systems from <acronym>BIND</acronym> 8, 3591 which did not have digital signatures on its command channel 3592 messages and thus did not have a <command>keys</command> clause. 3593 3594 It makes it possible to use an existing <acronym>BIND</acronym> 8 3595 configuration file in <acronym>BIND</acronym> 9 unchanged, 3596 and still have <command>rndc</command> work the same way 3597 <command>ndc</command> worked in BIND 8, simply by executing the 3598 command <userinput>rndc-confgen -a</userinput> after BIND 9 is 3599 installed. 3600 </para> 3601 3602 <para> 3603 Since the <filename>rndc.key</filename> feature 3604 is only intended to allow the backward-compatible usage of 3605 <acronym>BIND</acronym> 8 configuration files, this 3606 feature does not 3607 have a high degree of configurability. You cannot easily change 3608 the key name or the size of the secret, so you should make a 3609 <filename>rndc.conf</filename> with your own key if you 3610 wish to change 3611 those things. The <filename>rndc.key</filename> file 3612 also has its 3613 permissions set such that only the owner of the file (the user that 3614 <command>named</command> is running as) can access it. 3615 If you 3616 desire greater flexibility in allowing other users to access 3617 <command>rndc</command> commands, then you need to create 3618 a 3619 <filename>rndc.conf</filename> file and make it group 3620 readable by a group 3621 that contains the users who should have access. 3622 </para> 3623 3624 <para> 3625 To disable the command channel, use an empty 3626 <command>controls</command> statement: 3627 <command>controls { };</command>. 3628 </para> 3629 3630 </sect2> 3631 <sect2> 3632 <title><command>include</command> Statement Grammar</title> 3633 <programlisting><command>include</command> <replaceable>filename</replaceable>;</programlisting> 3634 </sect2> 3635 <sect2> 3636 <title><command>include</command> Statement Definition and 3637 Usage</title> 3638 3639 <para> 3640 The <command>include</command> statement inserts the 3641 specified file at the point where the <command>include</command> 3642 statement is encountered. The <command>include</command> 3643 statement facilitates the administration of configuration 3644 files 3645 by permitting the reading or writing of some things but not 3646 others. For example, the statement could include private keys 3647 that are readable only by the name server. 3648 </para> 3649 3650 </sect2> 3651 <sect2> 3652 <title><command>key</command> Statement Grammar</title> 3653 3654<programlisting><command>key</command> <replaceable>key_id</replaceable> { 3655 algorithm <replaceable>string</replaceable>; 3656 secret <replaceable>string</replaceable>; 3657}; 3658</programlisting> 3659 3660 </sect2> 3661 3662 <sect2> 3663 <title><command>key</command> Statement Definition and Usage</title> 3664 3665 <para> 3666 The <command>key</command> statement defines a shared 3667 secret key for use with TSIG (see <xref linkend="tsig"/>) 3668 or the command channel 3669 (see <xref linkend="controls_statement_definition_and_usage"/>). 3670 </para> 3671 3672 <para> 3673 The <command>key</command> statement can occur at the 3674 top level 3675 of the configuration file or inside a <command>view</command> 3676 statement. Keys defined in top-level <command>key</command> 3677 statements can be used in all views. Keys intended for use in 3678 a <command>controls</command> statement 3679 (see <xref linkend="controls_statement_definition_and_usage"/>) 3680 must be defined at the top level. 3681 </para> 3682 3683 <para> 3684 The <replaceable>key_id</replaceable>, also known as the 3685 key name, is a domain name uniquely identifying the key. It can 3686 be used in a <command>server</command> 3687 statement to cause requests sent to that 3688 server to be signed with this key, or in address match lists to 3689 verify that incoming requests have been signed with a key 3690 matching this name, algorithm, and secret. 3691 </para> 3692 3693 <para> 3694 The <replaceable>algorithm_id</replaceable> is a string 3695 that specifies a security/authentication algorithm. Named 3696 supports <literal>hmac-md5</literal>, 3697 <literal>hmac-sha1</literal>, <literal>hmac-sha224</literal>, 3698 <literal>hmac-sha256</literal>, <literal>hmac-sha384</literal> 3699 and <literal>hmac-sha512</literal> TSIG authentication. 3700 Truncated hashes are supported by appending the minimum 3701 number of required bits preceded by a dash, e.g. 3702 <literal>hmac-sha1-80</literal>. The 3703 <replaceable>secret_string</replaceable> is the secret 3704 to be used by the algorithm, and is treated as a base-64 3705 encoded string. 3706 </para> 3707 3708 </sect2> 3709 <sect2> 3710 <title><command>logging</command> Statement Grammar</title> 3711 3712<programlisting><command>logging</command> { 3713 [ <command>channel</command> <replaceable>channel_name</replaceable> { 3714 ( <command>file</command> <replaceable>path_name</replaceable> 3715 [ <command>versions</command> ( <replaceable>number</replaceable> | <command>unlimited</command> ) ] 3716 [ <command>size</command> <replaceable>size_spec</replaceable> ] 3717 | <command>syslog</command> <replaceable>syslog_facility</replaceable> 3718 | <command>stderr</command> 3719 | <command>null</command> ); 3720 [ <command>severity</command> (<option>critical</option> | <option>error</option> | <option>warning</option> | <option>notice</option> | 3721 <option>info</option> | <option>debug</option> [ <replaceable>level</replaceable> ] | <option>dynamic</option> ); ] 3722 [ <command>print-category</command> <option>yes</option> or <option>no</option>; ] 3723 [ <command>print-severity</command> <option>yes</option> or <option>no</option>; ] 3724 [ <command>print-time</command> <option>yes</option> or <option>no</option>; ] 3725 }; ] 3726 [ <command>category</command> <replaceable>category_name</replaceable> { 3727 <replaceable>channel_name</replaceable> ; [ <replaceable>channel_name</replaceable> ; ... ] 3728 }; ] 3729 ... 3730}; 3731</programlisting> 3732 3733 </sect2> 3734 3735 <sect2> 3736 <title><command>logging</command> Statement Definition and 3737 Usage</title> 3738 3739 <para> 3740 The <command>logging</command> statement configures a 3741 wide 3742 variety of logging options for the name server. Its <command>channel</command> phrase 3743 associates output methods, format options and severity levels with 3744 a name that can then be used with the <command>category</command> phrase 3745 to select how various classes of messages are logged. 3746 </para> 3747 <para> 3748 Only one <command>logging</command> statement is used to 3749 define 3750 as many channels and categories as are wanted. If there is no <command>logging</command> statement, 3751 the logging configuration will be: 3752 </para> 3753 3754<programlisting>logging { 3755 category default { default_syslog; default_debug; }; 3756 category unmatched { null; }; 3757}; 3758</programlisting> 3759 3760 <para> 3761 In <acronym>BIND</acronym> 9, the logging configuration 3762 is only established when 3763 the entire configuration file has been parsed. In <acronym>BIND</acronym> 8, it was 3764 established as soon as the <command>logging</command> 3765 statement 3766 was parsed. When the server is starting up, all logging messages 3767 regarding syntax errors in the configuration file go to the default 3768 channels, or to standard error if the "<option>-g</option>" option 3769 was specified. 3770 </para> 3771 3772 <sect3> 3773 <title>The <command>channel</command> Phrase</title> 3774 3775 <para> 3776 All log output goes to one or more <emphasis>channels</emphasis>; 3777 you can make as many of them as you want. 3778 </para> 3779 3780 <para> 3781 Every channel definition must include a destination clause that 3782 says whether messages selected for the channel go to a file, to a 3783 particular syslog facility, to the standard error stream, or are 3784 discarded. It can optionally also limit the message severity level 3785 that will be accepted by the channel (the default is 3786 <command>info</command>), and whether to include a 3787 <command>named</command>-generated time stamp, the 3788 category name 3789 and/or severity level (the default is not to include any). 3790 </para> 3791 3792 <para> 3793 The <command>null</command> destination clause 3794 causes all messages sent to the channel to be discarded; 3795 in that case, other options for the channel are meaningless. 3796 </para> 3797 3798 <para> 3799 The <command>file</command> destination clause directs 3800 the channel 3801 to a disk file. It can include limitations 3802 both on how large the file is allowed to become, and how many 3803 versions 3804 of the file will be saved each time the file is opened. 3805 </para> 3806 3807 <para> 3808 If you use the <command>versions</command> log file 3809 option, then 3810 <command>named</command> will retain that many backup 3811 versions of the file by 3812 renaming them when opening. For example, if you choose to keep 3813 three old versions 3814 of the file <filename>lamers.log</filename>, then just 3815 before it is opened 3816 <filename>lamers.log.1</filename> is renamed to 3817 <filename>lamers.log.2</filename>, <filename>lamers.log.0</filename> is renamed 3818 to <filename>lamers.log.1</filename>, and <filename>lamers.log</filename> is 3819 renamed to <filename>lamers.log.0</filename>. 3820 You can say <command>versions unlimited</command> to 3821 not limit 3822 the number of versions. 3823 If a <command>size</command> option is associated with 3824 the log file, 3825 then renaming is only done when the file being opened exceeds the 3826 indicated size. No backup versions are kept by default; any 3827 existing 3828 log file is simply appended. 3829 </para> 3830 3831 <para> 3832 The <command>size</command> option for files is used 3833 to limit log 3834 growth. If the file ever exceeds the size, then <command>named</command> will 3835 stop writing to the file unless it has a <command>versions</command> option 3836 associated with it. If backup versions are kept, the files are 3837 rolled as 3838 described above and a new one begun. If there is no 3839 <command>versions</command> option, no more data will 3840 be written to the log 3841 until some out-of-band mechanism removes or truncates the log to 3842 less than the 3843 maximum size. The default behavior is not to limit the size of 3844 the 3845 file. 3846 </para> 3847 3848 <para> 3849 Example usage of the <command>size</command> and 3850 <command>versions</command> options: 3851 </para> 3852 3853<programlisting>channel an_example_channel { 3854 file "example.log" versions 3 size 20m; 3855 print-time yes; 3856 print-category yes; 3857}; 3858</programlisting> 3859 3860 <para> 3861 The <command>syslog</command> destination clause 3862 directs the 3863 channel to the system log. Its argument is a 3864 syslog facility as described in the <command>syslog</command> man 3865 page. Known facilities are <command>kern</command>, <command>user</command>, 3866 <command>mail</command>, <command>daemon</command>, <command>auth</command>, 3867 <command>syslog</command>, <command>lpr</command>, <command>news</command>, 3868 <command>uucp</command>, <command>cron</command>, <command>authpriv</command>, 3869 <command>ftp</command>, <command>local0</command>, <command>local1</command>, 3870 <command>local2</command>, <command>local3</command>, <command>local4</command>, 3871 <command>local5</command>, <command>local6</command> and 3872 <command>local7</command>, however not all facilities 3873 are supported on 3874 all operating systems. 3875 How <command>syslog</command> will handle messages 3876 sent to 3877 this facility is described in the <command>syslog.conf</command> man 3878 page. If you have a system which uses a very old version of <command>syslog</command> that 3879 only uses two arguments to the <command>openlog()</command> function, 3880 then this clause is silently ignored. 3881 </para> 3882 <para> 3883 On Windows machines syslog messages are directed to the EventViewer. 3884 </para> 3885 <para> 3886 The <command>severity</command> clause works like <command>syslog</command>'s 3887 "priorities", except that they can also be used if you are writing 3888 straight to a file rather than using <command>syslog</command>. 3889 Messages which are not at least of the severity level given will 3890 not be selected for the channel; messages of higher severity 3891 levels 3892 will be accepted. 3893 </para> 3894 <para> 3895 If you are using <command>syslog</command>, then the <command>syslog.conf</command> priorities 3896 will also determine what eventually passes through. For example, 3897 defining a channel facility and severity as <command>daemon</command> and <command>debug</command> but 3898 only logging <command>daemon.warning</command> via <command>syslog.conf</command> will 3899 cause messages of severity <command>info</command> and 3900 <command>notice</command> to 3901 be dropped. If the situation were reversed, with <command>named</command> writing 3902 messages of only <command>warning</command> or higher, 3903 then <command>syslogd</command> would 3904 print all messages it received from the channel. 3905 </para> 3906 3907 <para> 3908 The <command>stderr</command> destination clause 3909 directs the 3910 channel to the server's standard error stream. This is intended 3911 for 3912 use when the server is running as a foreground process, for 3913 example 3914 when debugging a configuration. 3915 </para> 3916 3917 <para> 3918 The server can supply extensive debugging information when 3919 it is in debugging mode. If the server's global debug level is 3920 greater 3921 than zero, then debugging mode will be active. The global debug 3922 level is set either by starting the <command>named</command> server 3923 with the <option>-d</option> flag followed by a positive integer, 3924 or by running <command>rndc trace</command>. 3925 The global debug level 3926 can be set to zero, and debugging mode turned off, by running <command>rndc 3927notrace</command>. All debugging messages in the server have a debug 3928 level, and higher debug levels give more detailed output. Channels 3929 that specify a specific debug severity, for example: 3930 </para> 3931 3932<programlisting>channel specific_debug_level { 3933 file "foo"; 3934 severity debug 3; 3935}; 3936</programlisting> 3937 3938 <para> 3939 will get debugging output of level 3 or less any time the 3940 server is in debugging mode, regardless of the global debugging 3941 level. Channels with <command>dynamic</command> 3942 severity use the 3943 server's global debug level to determine what messages to print. 3944 </para> 3945 <para> 3946 If <command>print-time</command> has been turned on, 3947 then 3948 the date and time will be logged. <command>print-time</command> may 3949 be specified for a <command>syslog</command> channel, 3950 but is usually 3951 pointless since <command>syslog</command> also logs 3952 the date and 3953 time. If <command>print-category</command> is 3954 requested, then the 3955 category of the message will be logged as well. Finally, if <command>print-severity</command> is 3956 on, then the severity level of the message will be logged. The <command>print-</command> options may 3957 be used in any combination, and will always be printed in the 3958 following 3959 order: time, category, severity. Here is an example where all 3960 three <command>print-</command> options 3961 are on: 3962 </para> 3963 3964 <para> 3965 <computeroutput>28-Feb-2000 15:05:32.863 general: notice: running</computeroutput> 3966 </para> 3967 3968 <para> 3969 There are four predefined channels that are used for 3970 <command>named</command>'s default logging as follows. 3971 How they are 3972 used is described in <xref linkend="the_category_phrase"/>. 3973 </para> 3974 3975<programlisting>channel default_syslog { 3976 // send to syslog's daemon facility 3977 syslog daemon; 3978 // only send priority info and higher 3979 severity info; 3980 3981channel default_debug { 3982 // write to named.run in the working directory 3983 // Note: stderr is used instead of "named.run" if 3984 // the server is started with the '-f' option. 3985 file "named.run"; 3986 // log at the server's current debug level 3987 severity dynamic; 3988}; 3989 3990channel default_stderr { 3991 // writes to stderr 3992 stderr; 3993 // only send priority info and higher 3994 severity info; 3995}; 3996 3997channel null { 3998 // toss anything sent to this channel 3999 null; 4000}; 4001</programlisting> 4002 4003 <para> 4004 The <command>default_debug</command> channel has the 4005 special 4006 property that it only produces output when the server's debug 4007 level is 4008 nonzero. It normally writes to a file called <filename>named.run</filename> 4009 in the server's working directory. 4010 </para> 4011 4012 <para> 4013 For security reasons, when the "<option>-u</option>" 4014 command line option is used, the <filename>named.run</filename> file 4015 is created only after <command>named</command> has 4016 changed to the 4017 new UID, and any debug output generated while <command>named</command> is 4018 starting up and still running as root is discarded. If you need 4019 to capture this output, you must run the server with the "<option>-g</option>" 4020 option and redirect standard error to a file. 4021 </para> 4022 4023 <para> 4024 Once a channel is defined, it cannot be redefined. Thus you 4025 cannot alter the built-in channels directly, but you can modify 4026 the default logging by pointing categories at channels you have 4027 defined. 4028 </para> 4029 </sect3> 4030 4031 <sect3 id="the_category_phrase"> 4032 <title>The <command>category</command> Phrase</title> 4033 4034 <para> 4035 There are many categories, so you can send the logs you want 4036 to see wherever you want, without seeing logs you don't want. If 4037 you don't specify a list of channels for a category, then log 4038 messages 4039 in that category will be sent to the <command>default</command> category 4040 instead. If you don't specify a default category, the following 4041 "default default" is used: 4042 </para> 4043 4044<programlisting>category default { default_syslog; default_debug; }; 4045</programlisting> 4046 4047 <para> 4048 As an example, let's say you want to log security events to 4049 a file, but you also want keep the default logging behavior. You'd 4050 specify the following: 4051 </para> 4052 4053<programlisting>channel my_security_channel { 4054 file "my_security_file"; 4055 severity info; 4056}; 4057category security { 4058 my_security_channel; 4059 default_syslog; 4060 default_debug; 4061};</programlisting> 4062 4063 <para> 4064 To discard all messages in a category, specify the <command>null</command> channel: 4065 </para> 4066 4067<programlisting>category xfer-out { null; }; 4068category notify { null; }; 4069</programlisting> 4070 4071 <para> 4072 Following are the available categories and brief descriptions 4073 of the types of log information they contain. More 4074 categories may be added in future <acronym>BIND</acronym> releases. 4075 </para> 4076 <informaltable colsep="0" rowsep="0"> 4077 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="4Level-table"> 4078 <colspec colname="1" colnum="1" colsep="0" colwidth="1.150in"/> 4079 <colspec colname="2" colnum="2" colsep="0" colwidth="3.350in"/> 4080 <tbody> 4081 <row rowsep="0"> 4082 <entry colname="1"> 4083 <para><command>default</command></para> 4084 </entry> 4085 <entry colname="2"> 4086 <para> 4087 The default category defines the logging 4088 options for those categories where no specific 4089 configuration has been 4090 defined. 4091 </para> 4092 </entry> 4093 </row> 4094 <row rowsep="0"> 4095 <entry colname="1"> 4096 <para><command>general</command></para> 4097 </entry> 4098 <entry colname="2"> 4099 <para> 4100 The catch-all. Many things still aren't 4101 classified into categories, and they all end up here. 4102 </para> 4103 </entry> 4104 </row> 4105 <row rowsep="0"> 4106 <entry colname="1"> 4107 <para><command>database</command></para> 4108 </entry> 4109 <entry colname="2"> 4110 <para> 4111 Messages relating to the databases used 4112 internally by the name server to store zone and cache 4113 data. 4114 </para> 4115 </entry> 4116 </row> 4117 <row rowsep="0"> 4118 <entry colname="1"> 4119 <para><command>security</command></para> 4120 </entry> 4121 <entry colname="2"> 4122 <para> 4123 Approval and denial of requests. 4124 </para> 4125 </entry> 4126 </row> 4127 <row rowsep="0"> 4128 <entry colname="1"> 4129 <para><command>config</command></para> 4130 </entry> 4131 <entry colname="2"> 4132 <para> 4133 Configuration file parsing and processing. 4134 </para> 4135 </entry> 4136 </row> 4137 <row rowsep="0"> 4138 <entry colname="1"> 4139 <para><command>resolver</command></para> 4140 </entry> 4141 <entry colname="2"> 4142 <para> 4143 DNS resolution, such as the recursive 4144 lookups performed on behalf of clients by a caching name 4145 server. 4146 </para> 4147 </entry> 4148 </row> 4149 <row rowsep="0"> 4150 <entry colname="1"> 4151 <para><command>xfer-in</command></para> 4152 </entry> 4153 <entry colname="2"> 4154 <para> 4155 Zone transfers the server is receiving. 4156 </para> 4157 </entry> 4158 </row> 4159 <row rowsep="0"> 4160 <entry colname="1"> 4161 <para><command>xfer-out</command></para> 4162 </entry> 4163 <entry colname="2"> 4164 <para> 4165 Zone transfers the server is sending. 4166 </para> 4167 </entry> 4168 </row> 4169 <row rowsep="0"> 4170 <entry colname="1"> 4171 <para><command>notify</command></para> 4172 </entry> 4173 <entry colname="2"> 4174 <para> 4175 The NOTIFY protocol. 4176 </para> 4177 </entry> 4178 </row> 4179 <row rowsep="0"> 4180 <entry colname="1"> 4181 <para><command>client</command></para> 4182 </entry> 4183 <entry colname="2"> 4184 <para> 4185 Processing of client requests. 4186 </para> 4187 </entry> 4188 </row> 4189 <row rowsep="0"> 4190 <entry colname="1"> 4191 <para><command>unmatched</command></para> 4192 </entry> 4193 <entry colname="2"> 4194 <para> 4195 Messages that <command>named</command> was unable to determine the 4196 class of or for which there was no matching <command>view</command>. 4197 A one line summary is also logged to the <command>client</command> category. 4198 This category is best sent to a file or stderr, by 4199 default it is sent to 4200 the <command>null</command> channel. 4201 </para> 4202 </entry> 4203 </row> 4204 <row rowsep="0"> 4205 <entry colname="1"> 4206 <para><command>network</command></para> 4207 </entry> 4208 <entry colname="2"> 4209 <para> 4210 Network operations. 4211 </para> 4212 </entry> 4213 </row> 4214 <row rowsep="0"> 4215 <entry colname="1"> 4216 <para><command>update</command></para> 4217 </entry> 4218 <entry colname="2"> 4219 <para> 4220 Dynamic updates. 4221 </para> 4222 </entry> 4223 </row> 4224 <row rowsep="0"> 4225 <entry colname="1"> 4226 <para><command>update-security</command></para> 4227 </entry> 4228 <entry colname="2"> 4229 <para> 4230 Approval and denial of update requests. 4231 </para> 4232 </entry> 4233 </row> 4234 <row rowsep="0"> 4235 <entry colname="1"> 4236 <para><command>queries</command></para> 4237 </entry> 4238 <entry colname="2"> 4239 <para> 4240 Specify where queries should be logged to. 4241 </para> 4242 <para> 4243 At startup, specifying the category <command>queries</command> will also 4244 enable query logging unless <command>querylog</command> option has been 4245 specified. 4246 </para> 4247 4248 <para> 4249 The query log entry reports the client's IP 4250 address and port number, and the query name, 4251 class and type. Next it reports whether the 4252 Recursion Desired flag was set (+ if set, - 4253 if not set), if the query was signed (S), 4254 EDNS was in use (E), if TCP was used (T), if 4255 DO (DNSSEC Ok) was set (D), or if CD (Checking 4256 Disabled) was set (C). After this the 4257 destination address the query was sent to is 4258 reported. 4259 </para> 4260 4261 <para> 4262 <computeroutput>client 127.0.0.1#62536 (www.example.com): query: www.example.com IN AAAA +SE</computeroutput> 4263 </para> 4264 <para> 4265 <computeroutput>client ::1#62537 (www.example.net): query: www.example.net IN AAAA -SE</computeroutput> 4266 </para> 4267 <para> 4268 (The first part of this log message, showing the 4269 client address/port number and query name, is 4270 repeated in all subsequent log messages related 4271 to the same query.) 4272 </para> 4273 </entry> 4274 </row> 4275 <row rowsep="0"> 4276 <entry colname="1"> 4277 <para><command>query-errors</command></para> 4278 </entry> 4279 <entry colname="2"> 4280 <para> 4281 Information about queries that resulted in some 4282 failure. 4283 </para> 4284 </entry> 4285 </row> 4286 <row rowsep="0"> 4287 <entry colname="1"> 4288 <para><command>dispatch</command></para> 4289 </entry> 4290 <entry colname="2"> 4291 <para> 4292 Dispatching of incoming packets to the 4293 server modules where they are to be processed. 4294 </para> 4295 </entry> 4296 </row> 4297 <row rowsep="0"> 4298 <entry colname="1"> 4299 <para><command>dnssec</command></para> 4300 </entry> 4301 <entry colname="2"> 4302 <para> 4303 DNSSEC and TSIG protocol processing. 4304 </para> 4305 </entry> 4306 </row> 4307 <row rowsep="0"> 4308 <entry colname="1"> 4309 <para><command>lame-servers</command></para> 4310 </entry> 4311 <entry colname="2"> 4312 <para> 4313 Lame servers. These are misconfigurations 4314 in remote servers, discovered by BIND 9 when trying to 4315 query those servers during resolution. 4316 </para> 4317 </entry> 4318 </row> 4319 <row rowsep="0"> 4320 <entry colname="1"> 4321 <para><command>delegation-only</command></para> 4322 </entry> 4323 <entry colname="2"> 4324 <para> 4325 Delegation only. Logs queries that have been 4326 forced to NXDOMAIN as the result of a 4327 delegation-only zone or a 4328 <command>delegation-only</command> in a 4329 forward, hint or stub zone declaration. 4330 </para> 4331 </entry> 4332 </row> 4333 <row rowsep="0"> 4334 <entry colname="1"> 4335 <para><command>edns-disabled</command></para> 4336 </entry> 4337 <entry colname="2"> 4338 <para> 4339 Log queries that have been forced to use plain 4340 DNS due to timeouts. This is often due to 4341 the remote servers not being RFC 1034 compliant 4342 (not always returning FORMERR or similar to 4343 EDNS queries and other extensions to the DNS 4344 when they are not understood). In other words, this is 4345 targeted at servers that fail to respond to 4346 DNS queries that they don't understand. 4347 </para> 4348 <para> 4349 Note: the log message can also be due to 4350 packet loss. Before reporting servers for 4351 non-RFC 1034 compliance they should be re-tested 4352 to determine the nature of the non-compliance. 4353 This testing should prevent or reduce the 4354 number of false-positive reports. 4355 </para> 4356 <para> 4357 Note: eventually <command>named</command> will have to stop 4358 treating such timeouts as due to RFC 1034 non 4359 compliance and start treating it as plain 4360 packet loss. Falsely classifying packet 4361 loss as due to RFC 1034 non compliance impacts 4362 on DNSSEC validation which requires EDNS for 4363 the DNSSEC records to be returned. 4364 </para> 4365 </entry> 4366 </row> 4367 <row rowsep="0"> 4368 <entry colname="1"> 4369 <para><command>RPZ</command></para> 4370 </entry> 4371 <entry colname="2"> 4372 <para> 4373 Information about errors in response policy zone files, 4374 rewritten responses, and at the highest 4375 <command>debug</command> levels, mere rewriting 4376 attempts. 4377 </para> 4378 </entry> 4379 </row> 4380 <row rowsep="0"> 4381 <entry colname="1"> 4382 <para><command>rate-limit</command></para> 4383 </entry> 4384 <entry colname="2"> 4385 <para> 4386 The start, periodic, and final notices of the 4387 rate limiting of a stream of responses are logged at 4388 <command>info</command> severity in this category. 4389 These messages include a hash value of the domain name 4390 of the response and the name itself, 4391 except when there is insufficient memory to record 4392 the name for the final notice 4393 The final notice is normally delayed until about one 4394 minute after rate limit stops. 4395 A lack of memory can hurry the final notice, 4396 in which case it starts with an asterisk (*). 4397 Various internal events are logged at debug 1 level 4398 and higher. 4399 </para> 4400 <para> 4401 Rate limiting of individual requests 4402 is logged in the <command>query-errors</command> category. 4403 </para> 4404 </entry> 4405 </row> 4406 <row rowsep="0"> 4407 <entry colname="1"> 4408 <para><command>cname</command></para> 4409 </entry> 4410 <entry colname="2"> 4411 <para> 4412 Logs nameservers that are skipped due to them being 4413 a CNAME rather than A / AAAA records. 4414 </para> 4415 </entry> 4416 </row> 4417 </tbody> 4418 </tgroup> 4419 </informaltable> 4420 </sect3> 4421 <sect3> 4422 <title>The <command>query-errors</command> Category</title> 4423 <para> 4424 The <command>query-errors</command> category is 4425 specifically intended for debugging purposes: To identify 4426 why and how specific queries result in responses which 4427 indicate an error. 4428 Messages of this category are therefore only logged 4429 with <command>debug</command> levels. 4430 </para> 4431 4432 <para> 4433 At the debug levels of 1 or higher, each response with the 4434 rcode of SERVFAIL is logged as follows: 4435 </para> 4436 <para> 4437 <computeroutput>client 127.0.0.1#61502: query failed (SERVFAIL) for www.example.com/IN/AAAA at query.c:3880</computeroutput> 4438 </para> 4439 <para> 4440 This means an error resulting in SERVFAIL was 4441 detected at line 3880 of source file 4442 <filename>query.c</filename>. 4443 Log messages of this level will particularly 4444 help identify the cause of SERVFAIL for an 4445 authoritative server. 4446 </para> 4447 <para> 4448 At the debug levels of 2 or higher, detailed context 4449 information of recursive resolutions that resulted in 4450 SERVFAIL is logged. 4451 The log message will look like as follows: 4452 </para> 4453 <para> 4454<!-- NOTE: newlines and some spaces added so this would fit on page --> 4455 <programlisting> 4456fetch completed at resolver.c:2970 for www.example.com/A 4457in 30.000183: timed out/success [domain:example.com, 4458referral:2,restart:7,qrysent:8,timeout:5,lame:0,neterr:0, 4459badresp:1,adberr:0,findfail:0,valfail:0] 4460 </programlisting> 4461 </para> 4462 <para> 4463 The first part before the colon shows that a recursive 4464 resolution for AAAA records of www.example.com completed 4465 in 30.000183 seconds and the final result that led to the 4466 SERVFAIL was determined at line 2970 of source file 4467 <filename>resolver.c</filename>. 4468 </para> 4469 <para> 4470 The following part shows the detected final result and the 4471 latest result of DNSSEC validation. 4472 The latter is always success when no validation attempt 4473 is made. 4474 In this example, this query resulted in SERVFAIL probably 4475 because all name servers are down or unreachable, leading 4476 to a timeout in 30 seconds. 4477 DNSSEC validation was probably not attempted. 4478 </para> 4479 <para> 4480 The last part enclosed in square brackets shows statistics 4481 information collected for this particular resolution 4482 attempt. 4483 The <varname>domain</varname> field shows the deepest zone 4484 that the resolver reached; 4485 it is the zone where the error was finally detected. 4486 The meaning of the other fields is summarized in the 4487 following table. 4488 </para> 4489 4490 <informaltable colsep="0" rowsep="0"> 4491 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="4Level-table"> 4492 <colspec colname="1" colnum="1" colsep="0" colwidth="1.150in"/> 4493 <colspec colname="2" colnum="2" colsep="0" colwidth="3.350in"/> 4494 <tbody> 4495 <row rowsep="0"> 4496 <entry colname="1"> 4497 <para><varname>referral</varname></para> 4498 </entry> 4499 <entry colname="2"> 4500 <para> 4501 The number of referrals the resolver received 4502 throughout the resolution process. 4503 In the above example this is 2, which are most 4504 likely com and example.com. 4505 </para> 4506 </entry> 4507 </row> 4508 <row rowsep="0"> 4509 <entry colname="1"> 4510 <para><varname>restart</varname></para> 4511 </entry> 4512 <entry colname="2"> 4513 <para> 4514 The number of cycles that the resolver tried 4515 remote servers at the <varname>domain</varname> 4516 zone. 4517 In each cycle the resolver sends one query 4518 (possibly resending it, depending on the response) 4519 to each known name server of 4520 the <varname>domain</varname> zone. 4521 </para> 4522 </entry> 4523 </row> 4524 <row rowsep="0"> 4525 <entry colname="1"> 4526 <para><varname>qrysent</varname></para> 4527 </entry> 4528 <entry colname="2"> 4529 <para> 4530 The number of queries the resolver sent at the 4531 <varname>domain</varname> zone. 4532 </para> 4533 </entry> 4534 </row> 4535 <row rowsep="0"> 4536 <entry colname="1"> 4537 <para><varname>timeout</varname></para> 4538 </entry> 4539 <entry colname="2"> 4540 <para> 4541 The number of timeouts since the resolver 4542 received the last response. 4543 </para> 4544 </entry> 4545 </row> 4546 <row rowsep="0"> 4547 <entry colname="1"> 4548 <para><varname>lame</varname></para> 4549 </entry> 4550 <entry colname="2"> 4551 <para> 4552 The number of lame servers the resolver detected 4553 at the <varname>domain</varname> zone. 4554 A server is detected to be lame either by an 4555 invalid response or as a result of lookup in 4556 BIND9's address database (ADB), where lame 4557 servers are cached. 4558 </para> 4559 </entry> 4560 </row> 4561 <row rowsep="0"> 4562 <entry colname="1"> 4563 <para><varname>neterr</varname></para> 4564 </entry> 4565 <entry colname="2"> 4566 <para> 4567 The number of erroneous results that the 4568 resolver encountered in sending queries 4569 at the <varname>domain</varname> zone. 4570 One common case is the remote server is 4571 unreachable and the resolver receives an ICMP 4572 unreachable error message. 4573 </para> 4574 </entry> 4575 </row> 4576 <row rowsep="0"> 4577 <entry colname="1"> 4578 <para><varname>badresp</varname></para> 4579 </entry> 4580 <entry colname="2"> 4581 <para> 4582 The number of unexpected responses (other than 4583 <varname>lame</varname>) to queries sent by the 4584 resolver at the <varname>domain</varname> zone. 4585 </para> 4586 </entry> 4587 </row> 4588 <row rowsep="0"> 4589 <entry colname="1"> 4590 <para><varname>adberr</varname></para> 4591 </entry> 4592 <entry colname="2"> 4593 <para> 4594 Failures in finding remote server addresses 4595 of the <varname>domain</varname> zone in the ADB. 4596 One common case of this is that the remote 4597 server's name does not have any address records. 4598 </para> 4599 </entry> 4600 </row> 4601 <row rowsep="0"> 4602 <entry colname="1"> 4603 <para><varname>findfail</varname></para> 4604 </entry> 4605 <entry colname="2"> 4606 <para> 4607 Failures of resolving remote server addresses. 4608 This is a total number of failures throughout 4609 the resolution process. 4610 </para> 4611 </entry> 4612 </row> 4613 <row rowsep="0"> 4614 <entry colname="1"> 4615 <para><varname>valfail</varname></para> 4616 </entry> 4617 <entry colname="2"> 4618 <para> 4619 Failures of DNSSEC validation. 4620 Validation failures are counted throughout 4621 the resolution process (not limited to 4622 the <varname>domain</varname> zone), but should 4623 only happen in <varname>domain</varname>. 4624 </para> 4625 </entry> 4626 </row> 4627 </tbody> 4628 </tgroup> 4629 </informaltable> 4630 <para> 4631 At the debug levels of 3 or higher, the same messages 4632 as those at the debug 1 level are logged for other errors 4633 than SERVFAIL. 4634 Note that negative responses such as NXDOMAIN are not 4635 regarded as errors here. 4636 </para> 4637 <para> 4638 At the debug levels of 4 or higher, the same messages 4639 as those at the debug 2 level are logged for other errors 4640 than SERVFAIL. 4641 Unlike the above case of level 3, messages are logged for 4642 negative responses. 4643 This is because any unexpected results can be difficult to 4644 debug in the recursion case. 4645 </para> 4646 </sect3> 4647 </sect2> 4648 4649 <sect2> 4650 <title><command>lwres</command> Statement Grammar</title> 4651 4652 <para> 4653 This is the grammar of the <command>lwres</command> 4654 statement in the <filename>named.conf</filename> file: 4655 </para> 4656 4657<programlisting><command>lwres</command> { 4658 <optional> listen-on { <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; 4659 <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; ... </optional> }; </optional> 4660 <optional> view <replaceable>view_name</replaceable>; </optional> 4661 <optional> search { <replaceable>domain_name</replaceable> ; <optional> <replaceable>domain_name</replaceable> ; ... </optional> }; </optional> 4662 <optional> ndots <replaceable>number</replaceable>; </optional> 4663}; 4664</programlisting> 4665 4666 </sect2> 4667 <sect2> 4668 <title><command>lwres</command> Statement Definition and Usage</title> 4669 4670 <para> 4671 The <command>lwres</command> statement configures the 4672 name 4673 server to also act as a lightweight resolver server. (See 4674 <xref linkend="lwresd"/>.) There may be multiple 4675 <command>lwres</command> statements configuring 4676 lightweight resolver servers with different properties. 4677 </para> 4678 4679 <para> 4680 The <command>listen-on</command> statement specifies a 4681 list of 4682 IPv4 addresses (and ports) that this instance of a lightweight 4683 resolver daemon 4684 should accept requests on. If no port is specified, port 921 is 4685 used. 4686 If this statement is omitted, requests will be accepted on 4687 127.0.0.1, 4688 port 921. 4689 </para> 4690 4691 <para> 4692 The <command>view</command> statement binds this 4693 instance of a 4694 lightweight resolver daemon to a view in the DNS namespace, so that 4695 the 4696 response will be constructed in the same manner as a normal DNS 4697 query 4698 matching this view. If this statement is omitted, the default view 4699 is 4700 used, and if there is no default view, an error is triggered. 4701 </para> 4702 4703 <para> 4704 The <command>search</command> statement is equivalent to 4705 the 4706 <command>search</command> statement in 4707 <filename>/etc/resolv.conf</filename>. It provides a 4708 list of domains 4709 which are appended to relative names in queries. 4710 </para> 4711 4712 <para> 4713 The <command>ndots</command> statement is equivalent to 4714 the 4715 <command>ndots</command> statement in 4716 <filename>/etc/resolv.conf</filename>. It indicates the 4717 minimum 4718 number of dots in a relative domain name that should result in an 4719 exact match lookup before search path elements are appended. 4720 </para> 4721 </sect2> 4722 <sect2> 4723 <title><command>masters</command> Statement Grammar</title> 4724 4725<programlisting> 4726<command>masters</command> <replaceable>name</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> { ( <replaceable>masters_list</replaceable> | 4727 <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>key <replaceable>key</replaceable></optional> ) ; <optional>...</optional> }; 4728</programlisting> 4729 4730 </sect2> 4731 4732 <sect2> 4733 <title><command>masters</command> Statement Definition and 4734 Usage</title> 4735 <para><command>masters</command> 4736 lists allow for a common set of masters to be easily used by 4737 multiple stub and slave zones in their <command>masters</command> 4738 or <command>also-notify</command> lists. 4739 </para> 4740 </sect2> 4741 4742 <sect2> 4743 <title><command>options</command> Statement Grammar</title> 4744 4745 <para> 4746 This is the grammar of the <command>options</command> 4747 statement in the <filename>named.conf</filename> file: 4748 </para> 4749 4750<programlisting><command>options</command> { 4751 <optional> attach-cache <replaceable>cache_name</replaceable>; </optional> 4752 <optional> version <replaceable>version_string</replaceable>; </optional> 4753 <optional> hostname <replaceable>hostname_string</replaceable>; </optional> 4754 <optional> server-id <replaceable>server_id_string</replaceable>; </optional> 4755 <optional> directory <replaceable>path_name</replaceable>; </optional> 4756 <optional> geoip-directory <replaceable>path_name</replaceable>; </optional> 4757 <optional> key-directory <replaceable>path_name</replaceable>; </optional> 4758 <optional> managed-keys-directory <replaceable>path_name</replaceable>; </optional> 4759 <optional> named-xfer <replaceable>path_name</replaceable>; </optional> 4760 <optional> tkey-gssapi-keytab <replaceable>path_name</replaceable>; </optional> 4761 <optional> tkey-gssapi-credential <replaceable>principal</replaceable>; </optional> 4762 <optional> tkey-domain <replaceable>domainname</replaceable>; </optional> 4763 <optional> tkey-dhkey <replaceable>key_name</replaceable> <replaceable>key_tag</replaceable>; </optional> 4764 <optional> cache-file <replaceable>path_name</replaceable>; </optional> 4765 <optional> dump-file <replaceable>path_name</replaceable>; </optional> 4766 <optional> bindkeys-file <replaceable>path_name</replaceable>; </optional> 4767 <optional> secroots-file <replaceable>path_name</replaceable>; </optional> 4768 <optional> session-keyfile <replaceable>path_name</replaceable>; </optional> 4769 <optional> session-keyname <replaceable>key_name</replaceable>; </optional> 4770 <optional> session-keyalg <replaceable>algorithm_id</replaceable>; </optional> 4771 <optional> memstatistics <replaceable>yes_or_no</replaceable>; </optional> 4772 <optional> memstatistics-file <replaceable>path_name</replaceable>; </optional> 4773 <optional> pid-file <replaceable>path_name</replaceable>; </optional> 4774 <optional> recursing-file <replaceable>path_name</replaceable>; </optional> 4775 <optional> statistics-file <replaceable>path_name</replaceable>; </optional> 4776 <optional> zone-statistics <replaceable>full</replaceable> | <replaceable>terse</replaceable> | <replaceable>none</replaceable>; </optional> 4777 <optional> auth-nxdomain <replaceable>yes_or_no</replaceable>; </optional> 4778 <optional> deallocate-on-exit <replaceable>yes_or_no</replaceable>; </optional> 4779 <optional> dialup <replaceable>dialup_option</replaceable>; </optional> 4780 <optional> fake-iquery <replaceable>yes_or_no</replaceable>; </optional> 4781 <optional> fetch-glue <replaceable>yes_or_no</replaceable>; </optional> 4782 <optional> flush-zones-on-shutdown <replaceable>yes_or_no</replaceable>; </optional> 4783 <optional> has-old-clients <replaceable>yes_or_no</replaceable>; </optional> 4784 <optional> host-statistics <replaceable>yes_or_no</replaceable>; </optional> 4785 <optional> host-statistics-max <replaceable>number</replaceable>; </optional> 4786 <optional> minimal-responses <replaceable>yes_or_no</replaceable>; </optional> 4787 <optional> multiple-cnames <replaceable>yes_or_no</replaceable>; </optional> 4788 <optional> notify <replaceable>yes_or_no</replaceable> | <replaceable>explicit</replaceable> | <replaceable>master-only</replaceable>; </optional> 4789 <optional> recursion <replaceable>yes_or_no</replaceable>; </optional> 4790 <optional> request-sit <replaceable>yes_or_no</replaceable>; </optional> 4791 <optional> request-nsid <replaceable>yes_or_no</replaceable>; </optional> 4792 <optional> rfc2308-type1 <replaceable>yes_or_no</replaceable>; </optional> 4793 <optional> use-id-pool <replaceable>yes_or_no</replaceable>; </optional> 4794 <optional> maintain-ixfr-base <replaceable>yes_or_no</replaceable>; </optional> 4795 <optional> ixfr-from-differences (<replaceable>yes_or_no</replaceable> | <constant>master</constant> | <constant>slave</constant>); </optional> 4796 <optional> dnssec-enable <replaceable>yes_or_no</replaceable>; </optional> 4797 <optional> dnssec-validation (<replaceable>yes_or_no</replaceable> | <constant>auto</constant>); </optional> 4798 <optional> dnssec-lookaside ( <replaceable>auto</replaceable> | 4799 <replaceable>no</replaceable> | 4800 <replaceable>domain</replaceable> trust-anchor <replaceable>domain</replaceable> ); </optional> 4801 <optional> dnssec-must-be-secure <replaceable>domain yes_or_no</replaceable>; </optional> 4802 <optional> dnssec-accept-expired <replaceable>yes_or_no</replaceable>; </optional> 4803 <optional> forward ( <replaceable>only</replaceable> | <replaceable>first</replaceable> ); </optional> 4804 <optional> forwarders { <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; ... </optional> }; </optional> 4805 <optional> dual-stack-servers <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> { 4806 ( <replaceable>domain_name</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> | 4807 <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional>) ; 4808 ... }; </optional> 4809 <optional> check-names ( <replaceable>master</replaceable> | <replaceable>slave</replaceable> | <replaceable>response</replaceable> ) 4810 ( <replaceable>warn</replaceable> | <replaceable>fail</replaceable> | <replaceable>ignore</replaceable> ); </optional> 4811 <optional> check-dup-records ( <replaceable>warn</replaceable> | <replaceable>fail</replaceable> | <replaceable>ignore</replaceable> ); </optional> 4812 <optional> check-mx ( <replaceable>warn</replaceable> | <replaceable>fail</replaceable> | <replaceable>ignore</replaceable> ); </optional> 4813 <optional> check-wildcard <replaceable>yes_or_no</replaceable>; </optional> 4814 <optional> check-integrity <replaceable>yes_or_no</replaceable>; </optional> 4815 <optional> check-mx-cname ( <replaceable>warn</replaceable> | <replaceable>fail</replaceable> | <replaceable>ignore</replaceable> ); </optional> 4816 <optional> check-srv-cname ( <replaceable>warn</replaceable> | <replaceable>fail</replaceable> | <replaceable>ignore</replaceable> ); </optional> 4817 <optional> check-sibling <replaceable>yes_or_no</replaceable>; </optional> 4818 <optional> check-spf ( <replaceable>warn</replaceable> | <replaceable>ignore</replaceable> ); </optional> 4819 <optional> allow-new-zones { <replaceable>yes_or_no</replaceable> }; </optional> 4820 <optional> allow-notify { <replaceable>address_match_list</replaceable> }; </optional> 4821 <optional> allow-query { <replaceable>address_match_list</replaceable> }; </optional> 4822 <optional> allow-query-on { <replaceable>address_match_list</replaceable> }; </optional> 4823 <optional> allow-query-cache { <replaceable>address_match_list</replaceable> }; </optional> 4824 <optional> allow-query-cache-on { <replaceable>address_match_list</replaceable> }; </optional> 4825 <optional> allow-transfer { <replaceable>address_match_list</replaceable> }; </optional> 4826 <optional> allow-recursion { <replaceable>address_match_list</replaceable> }; </optional> 4827 <optional> allow-recursion-on { <replaceable>address_match_list</replaceable> }; </optional> 4828 <optional> allow-update { <replaceable>address_match_list</replaceable> }; </optional> 4829 <optional> allow-update-forwarding { <replaceable>address_match_list</replaceable> }; </optional> 4830 <optional> update-check-ksk <replaceable>yes_or_no</replaceable>; </optional> 4831 <optional> dnssec-update-mode ( <replaceable>maintain</replaceable> | <replaceable>no-resign</replaceable> ); </optional> 4832 <optional> dnssec-dnskey-kskonly <replaceable>yes_or_no</replaceable>; </optional> 4833 <optional> dnssec-loadkeys-interval <replaceable>number</replaceable>; </optional> 4834 <optional> dnssec-secure-to-insecure <replaceable>yes_or_no</replaceable> ;</optional> 4835 <optional> try-tcp-refresh <replaceable>yes_or_no</replaceable>; </optional> 4836 <optional> allow-v6-synthesis { <replaceable>address_match_list</replaceable> }; </optional> 4837 <optional> blackhole { <replaceable>address_match_list</replaceable> }; </optional> 4838 <optional> no-case-compress { <replaceable>address_match_list</replaceable> }; </optional> 4839 <optional> use-v4-udp-ports { <replaceable>port_list</replaceable> }; </optional> 4840 <optional> avoid-v4-udp-ports { <replaceable>port_list</replaceable> }; </optional> 4841 <optional> use-v6-udp-ports { <replaceable>port_list</replaceable> }; </optional> 4842 <optional> avoid-v6-udp-ports { <replaceable>port_list</replaceable> }; </optional> 4843 <optional> listen-on <optional> port <replaceable>ip_port</replaceable> </optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> { <replaceable>address_match_list</replaceable> }; </optional> 4844 <optional> listen-on-v6 <optional> port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> 4845{ <replaceable>address_match_list</replaceable> }; </optional> 4846 <optional> query-source ( ( <replaceable>ip4_addr</replaceable> | <replaceable>*</replaceable> ) 4847 <optional> port ( <replaceable>ip_port</replaceable> | <replaceable>*</replaceable> ) </optional> 4848 <optional> dscp <replaceable>ip_dscp</replaceable></optional> | 4849 <optional> address ( <replaceable>ip4_addr</replaceable> | <replaceable>*</replaceable> ) </optional> 4850 <optional> port ( <replaceable>ip_port</replaceable> | <replaceable>*</replaceable> ) </optional> ) 4851 <optional> dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 4852 <optional> query-source-v6 ( ( <replaceable>ip6_addr</replaceable> | <replaceable>*</replaceable> ) 4853 <optional> port ( <replaceable>ip_port</replaceable> | <replaceable>*</replaceable> ) </optional> 4854 <optional> dscp <replaceable>ip_dscp</replaceable></optional> | 4855 <optional> address ( <replaceable>ip6_addr</replaceable> | <replaceable>*</replaceable> ) </optional> 4856 <optional> port ( <replaceable>ip_port</replaceable> | <replaceable>*</replaceable> ) </optional> ) 4857 <optional> dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 4858 <optional> use-queryport-pool <replaceable>yes_or_no</replaceable>; </optional> 4859 <optional> queryport-pool-ports <replaceable>number</replaceable>; </optional> 4860 <optional> queryport-pool-updateinterval <replaceable>number</replaceable>; </optional> 4861 <optional> max-transfer-time-in <replaceable>number</replaceable>; </optional> 4862 <optional> max-transfer-time-out <replaceable>number</replaceable>; </optional> 4863 <optional> max-transfer-idle-in <replaceable>number</replaceable>; </optional> 4864 <optional> max-transfer-idle-out <replaceable>number</replaceable>; </optional> 4865 <optional> tcp-clients <replaceable>number</replaceable>; </optional> 4866 <optional> reserved-sockets <replaceable>number</replaceable>; </optional> 4867 <optional> recursive-clients <replaceable>number</replaceable>; </optional> 4868 <optional> serial-query-rate <replaceable>number</replaceable>; </optional> 4869 <optional> serial-queries <replaceable>number</replaceable>; </optional> 4870 <optional> tcp-listen-queue <replaceable>number</replaceable>; </optional> 4871 <optional> transfer-format <replaceable>( one-answer | many-answers )</replaceable>; </optional> 4872 <optional> transfers-in <replaceable>number</replaceable>; </optional> 4873 <optional> transfers-out <replaceable>number</replaceable>; </optional> 4874 <optional> transfers-per-ns <replaceable>number</replaceable>; </optional> 4875 <optional> transfer-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 4876 <optional> transfer-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 4877 <optional> alt-transfer-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 4878 <optional> alt-transfer-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 4879 <optional> use-alt-transfer-source <replaceable>yes_or_no</replaceable>; </optional> 4880 <optional> notify-delay <replaceable>seconds</replaceable> ; </optional> 4881 <optional> notify-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 4882 <optional> notify-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 4883 <optional> notify-to-soa <replaceable>yes_or_no</replaceable> ; </optional> 4884 <optional> also-notify { <replaceable>ip_addr</replaceable> 4885 <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> <optional>key <replaceable>keyname</replaceable></optional> ; 4886 <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> <optional>key <replaceable>keyname</replaceable></optional> ; ... </optional> }; </optional> 4887 <optional> max-ixfr-log-size <replaceable>number</replaceable>; </optional> 4888 <optional> max-journal-size <replaceable>size_spec</replaceable>; </optional> 4889 <optional> coresize <replaceable>size_spec</replaceable> ; </optional> 4890 <optional> datasize <replaceable>size_spec</replaceable> ; </optional> 4891 <optional> files <replaceable>size_spec</replaceable> ; </optional> 4892 <optional> stacksize <replaceable>size_spec</replaceable> ; </optional> 4893 <optional> cleaning-interval <replaceable>number</replaceable>; </optional> 4894 <optional> heartbeat-interval <replaceable>number</replaceable>; </optional> 4895 <optional> interface-interval <replaceable>number</replaceable>; </optional> 4896 <optional> statistics-interval <replaceable>number</replaceable>; </optional> 4897 <optional> topology { <replaceable>address_match_list</replaceable> }</optional>; 4898 <optional> sortlist { <replaceable>address_match_list</replaceable> }</optional>; 4899 <optional> rrset-order { <replaceable>order_spec</replaceable> ; <optional> <replaceable>order_spec</replaceable> ; ... </optional> </optional> }; 4900 <optional> lame-ttl <replaceable>number</replaceable>; </optional> 4901 <optional> max-ncache-ttl <replaceable>number</replaceable>; </optional> 4902 <optional> max-cache-ttl <replaceable>number</replaceable>; </optional> 4903 <optional> max-zone-ttl <replaceable>number</replaceable> ; </optional> 4904 <optional> sig-validity-interval <replaceable>number</replaceable> <optional><replaceable>number</replaceable></optional> ; </optional> 4905 <optional> sig-signing-nodes <replaceable>number</replaceable> ; </optional> 4906 <optional> sig-signing-signatures <replaceable>number</replaceable> ; </optional> 4907 <optional> sig-signing-type <replaceable>number</replaceable> ; </optional> 4908 <optional> min-roots <replaceable>number</replaceable>; </optional> 4909 <optional> use-ixfr <replaceable>yes_or_no</replaceable> ; </optional> 4910 <optional> provide-ixfr <replaceable>yes_or_no</replaceable>; </optional> 4911 <optional> request-ixfr <replaceable>yes_or_no</replaceable>; </optional> 4912 <optional> treat-cr-as-space <replaceable>yes_or_no</replaceable> ; </optional> 4913 <optional> min-refresh-time <replaceable>number</replaceable> ; </optional> 4914 <optional> max-refresh-time <replaceable>number</replaceable> ; </optional> 4915 <optional> min-retry-time <replaceable>number</replaceable> ; </optional> 4916 <optional> max-retry-time <replaceable>number</replaceable> ; </optional> 4917 <optional> port <replaceable>ip_port</replaceable>; </optional> 4918 <optional> dscp <replaceable>ip_dscp</replaceable></optional> ; 4919 <optional> additional-from-auth <replaceable>yes_or_no</replaceable> ; </optional> 4920 <optional> additional-from-cache <replaceable>yes_or_no</replaceable> ; </optional> 4921 <optional> random-device <replaceable>path_name</replaceable> ; </optional> 4922 <optional> max-cache-size <replaceable>size_spec</replaceable> ; </optional> 4923 <optional> match-mapped-addresses <replaceable>yes_or_no</replaceable>; </optional> 4924 <optional> filter-aaaa-on-v4 ( <replaceable>yes_or_no</replaceable> | <replaceable>break-dnssec</replaceable> ); </optional> 4925 <optional> filter-aaaa-on-v6 ( <replaceable>yes_or_no</replaceable> | <replaceable>break-dnssec</replaceable> ); </optional> 4926 <optional> filter-aaaa { <replaceable>address_match_list</replaceable> }; </optional> 4927 <optional> dns64 <replaceable>ipv6-prefix</replaceable> { 4928 <optional> clients { <replaceable>address_match_list</replaceable> }; </optional> 4929 <optional> mapped { <replaceable>address_match_list</replaceable> }; </optional> 4930 <optional> exclude { <replaceable>address_match_list</replaceable> }; </optional> 4931 <optional> suffix IPv6-address; </optional> 4932 <optional> recursive-only <replaceable>yes_or_no</replaceable>; </optional> 4933 <optional> break-dnssec <replaceable>yes_or_no</replaceable>; </optional> 4934 }; </optional>; 4935 <optional> dns64-server <replaceable>name</replaceable> </optional> 4936 <optional> dns64-contact <replaceable>name</replaceable> </optional> 4937 <optional> preferred-glue ( <replaceable>A</replaceable> | <replaceable>AAAA</replaceable> | <replaceable>NONE</replaceable> ); </optional> 4938 <optional> edns-udp-size <replaceable>number</replaceable>; </optional> 4939 <optional> max-udp-size <replaceable>number</replaceable>; </optional> 4940 <optional> max-rsa-exponent-size <replaceable>number</replaceable>; </optional> 4941 <optional> root-delegation-only <optional> exclude { <replaceable>namelist</replaceable> } </optional> ; </optional> 4942 <optional> querylog <replaceable>yes_or_no</replaceable> ; </optional> 4943 <optional> disable-algorithms <replaceable>domain</replaceable> { <replaceable>algorithm</replaceable>; 4944 <optional> <replaceable>algorithm</replaceable>; </optional> }; </optional> 4945 <optional> disable-ds-digests <replaceable>domain</replaceable> { <replaceable>digest_type</replaceable>; 4946 <optional> <replaceable>digest_type</replaceable>; </optional> }; </optional> 4947 <optional> acache-enable <replaceable>yes_or_no</replaceable> ; </optional> 4948 <optional> acache-cleaning-interval <replaceable>number</replaceable>; </optional> 4949 <optional> max-acache-size <replaceable>size_spec</replaceable> ; </optional> 4950 <optional> clients-per-query <replaceable>number</replaceable> ; </optional> 4951 <optional> max-clients-per-query <replaceable>number</replaceable> ; </optional> 4952 <optional> max-recursion-depth <replaceable>number</replaceable> ; </optional> 4953 <optional> max-recursion-queries <replaceable>number</replaceable> ; </optional> 4954 <optional> masterfile-format 4955 (<constant>text</constant>|<constant>raw</constant>|<constant>map</constant>) ; </optional> 4956 <optional> empty-server <replaceable>name</replaceable> ; </optional> 4957 <optional> empty-contact <replaceable>name</replaceable> ; </optional> 4958 <optional> empty-zones-enable <replaceable>yes_or_no</replaceable> ; </optional> 4959 <optional> disable-empty-zone <replaceable>zone_name</replaceable> ; </optional> 4960 <optional> zero-no-soa-ttl <replaceable>yes_or_no</replaceable> ; </optional> 4961 <optional> zero-no-soa-ttl-cache <replaceable>yes_or_no</replaceable> ; </optional> 4962 <optional> resolver-query-timeout <replaceable>number</replaceable> ; </optional> 4963 <optional> deny-answer-addresses { <replaceable>address_match_list</replaceable> } <optional> except-from { <replaceable>namelist</replaceable> } </optional>;</optional> 4964 <optional> deny-answer-aliases { <replaceable>namelist</replaceable> } <optional> except-from { <replaceable>namelist</replaceable> } </optional>;</optional> 4965 <optional> prefetch <replaceable>number</replaceable> <optional><replaceable>number</replaceable></optional> ; </optional> 4966 4967 <optional> rate-limit { 4968 <optional> responses-per-second <replaceable>number</replaceable> ; </optional> 4969 <optional> referrals-per-second <replaceable>number</replaceable> ; </optional> 4970 <optional> nodata-per-second <replaceable>number</replaceable> ; </optional> 4971 <optional> nxdomains-per-second <replaceable>number</replaceable> ; </optional> 4972 <optional> errors-per-second <replaceable>number</replaceable> ; </optional> 4973 <optional> all-per-second <replaceable>number</replaceable> ; </optional> 4974 <optional> window <replaceable>number</replaceable> ; </optional> 4975 <optional> log-only <replaceable>yes_or_no</replaceable> ; </optional> 4976 <optional> qps-scale <replaceable>number</replaceable> ; </optional> 4977 <optional> ipv4-prefix-length <replaceable>number</replaceable> ; </optional> 4978 <optional> ipv6-prefix-length <replaceable>number</replaceable> ; </optional> 4979 <optional> slip <replaceable>number</replaceable> ; </optional> 4980 <optional> exempt-clients { <replaceable>address_match_list</replaceable> } ; </optional> 4981 <optional> max-table-size <replaceable>number</replaceable> ; </optional> 4982 <optional> min-table-size <replaceable>number</replaceable> ; </optional> 4983 } ; </optional> 4984 <optional> response-policy { 4985 zone <replaceable>zone_name</replaceable> 4986 <optional> policy <replaceable>(given | disabled | passthru | drop | 4987 nxdomain | nodata | cname domain</replaceable>) </optional> 4988 <optional> recursive-only <replaceable>yes_or_no</replaceable> </optional> 4989 <optional> max-policy-ttl <replaceable>number</replaceable> </optional> 4990 ; <optional>...</optional> 4991 } <optional> recursive-only <replaceable>yes_or_no</replaceable> </optional> 4992 <optional> max-policy-ttl <replaceable>number</replaceable> </optional> 4993 <optional> break-dnssec <replaceable>yes_or_no</replaceable> </optional> 4994 <optional> min-ns-dots <replaceable>number</replaceable> </optional> 4995 <optional> qname-wait-recurse <replaceable>yes_or_no</replaceable> </optional> 4996 ; </optional> 4997}; 4998</programlisting> 4999 5000 </sect2> 5001 5002 <sect2 id="options"> 5003 <title><command>options</command> Statement Definition and 5004 Usage</title> 5005 5006 <para> 5007 The <command>options</command> statement sets up global 5008 options 5009 to be used by <acronym>BIND</acronym>. This statement 5010 may appear only 5011 once in a configuration file. If there is no <command>options</command> 5012 statement, an options block with each option set to its default will 5013 be used. 5014 </para> 5015 5016 <variablelist> 5017 5018 <varlistentry> 5019 <term><command>attach-cache</command></term> 5020 <listitem> 5021 <para> 5022 Allows multiple views to share a single cache 5023 database. 5024 Each view has its own cache database by default, but 5025 if multiple views have the same operational policy 5026 for name resolution and caching, those views can 5027 share a single cache to save memory and possibly 5028 improve resolution efficiency by using this option. 5029 </para> 5030 5031 <para> 5032 The <command>attach-cache</command> option 5033 may also be specified in <command>view</command> 5034 statements, in which case it overrides the 5035 global <command>attach-cache</command> option. 5036 </para> 5037 5038 <para> 5039 The <replaceable>cache_name</replaceable> specifies 5040 the cache to be shared. 5041 When the <command>named</command> server configures 5042 views which are supposed to share a cache, it 5043 creates a cache with the specified name for the 5044 first view of these sharing views. 5045 The rest of the views will simply refer to the 5046 already created cache. 5047 </para> 5048 5049 <para> 5050 One common configuration to share a cache would be to 5051 allow all views to share a single cache. 5052 This can be done by specifying 5053 the <command>attach-cache</command> as a global 5054 option with an arbitrary name. 5055 </para> 5056 5057 <para> 5058 Another possible operation is to allow a subset of 5059 all views to share a cache while the others to 5060 retain their own caches. 5061 For example, if there are three views A, B, and C, 5062 and only A and B should share a cache, specify the 5063 <command>attach-cache</command> option as a view A (or 5064 B)'s option, referring to the other view name: 5065 </para> 5066 5067<programlisting> 5068 view "A" { 5069 // this view has its own cache 5070 ... 5071 }; 5072 view "B" { 5073 // this view refers to A's cache 5074 attach-cache "A"; 5075 }; 5076 view "C" { 5077 // this view has its own cache 5078 ... 5079 }; 5080</programlisting> 5081 5082 <para> 5083 Views that share a cache must have the same policy 5084 on configurable parameters that may affect caching. 5085 The current implementation requires the following 5086 configurable options be consistent among these 5087 views: 5088 <command>check-names</command>, 5089 <command>cleaning-interval</command>, 5090 <command>dnssec-accept-expired</command>, 5091 <command>dnssec-validation</command>, 5092 <command>max-cache-ttl</command>, 5093 <command>max-ncache-ttl</command>, 5094 <command>max-cache-size</command>, and 5095 <command>zero-no-soa-ttl</command>. 5096 </para> 5097 5098 <para> 5099 Note that there may be other parameters that may 5100 cause confusion if they are inconsistent for 5101 different views that share a single cache. 5102 For example, if these views define different sets of 5103 forwarders that can return different answers for the 5104 same question, sharing the answer does not make 5105 sense or could even be harmful. 5106 It is administrator's responsibility to ensure 5107 configuration differences in different views do 5108 not cause disruption with a shared cache. 5109 </para> 5110 </listitem> 5111 5112 </varlistentry> 5113 5114 <varlistentry> 5115 <term><command>directory</command></term> 5116 <listitem> 5117 <para> 5118 The working directory of the server. 5119 Any non-absolute pathnames in the configuration file will be 5120 taken 5121 as relative to this directory. The default location for most 5122 server 5123 output files (e.g. <filename>named.run</filename>) 5124 is this directory. 5125 If a directory is not specified, the working directory 5126 defaults to `<filename>.</filename>', the directory from 5127 which the server 5128 was started. The directory specified should be an absolute 5129 path. 5130 </para> 5131 </listitem> 5132 </varlistentry> 5133 5134 <varlistentry> 5135 <term><command>geoip-directory</command></term> 5136 <listitem> 5137 <para> 5138 Specifies the directory containing GeoIP 5139 <filename>.dat</filename> database files for GeoIP 5140 initialization. By default, this option is unset 5141 and the GeoIP support will use libGeoIP's 5142 built-in directory. 5143 (For details, see <xref linkend="acl"/> about the 5144 <command>geoip</command> ACL.) 5145 </para> 5146 </listitem> 5147 </varlistentry> 5148 5149 <varlistentry> 5150 <term><command>key-directory</command></term> 5151 <listitem> 5152 <para> 5153 When performing dynamic update of secure zones, the 5154 directory where the public and private DNSSEC key files 5155 should be found, if different than the current working 5156 directory. (Note that this option has no effect on the 5157 paths for files containing non-DNSSEC keys such as 5158 <filename>bind.keys</filename>, 5159 <filename>rndc.key</filename> or 5160 <filename>session.key</filename>.) 5161 </para> 5162 </listitem> 5163 </varlistentry> 5164 5165 <varlistentry> 5166 <term><command>managed-keys-directory</command></term> 5167 <listitem> 5168 <para> 5169 Specifies the directory in which to store the files that 5170 track managed DNSSEC keys. By default, this is the working 5171 directory. 5172 </para> 5173 <para> 5174 If <command>named</command> is not configured to use views, 5175 then managed keys for the server will be tracked in a single 5176 file called <filename>managed-keys.bind</filename>. 5177 Otherwise, managed keys will be tracked in separate files, 5178 one file per view; each file name will be the SHA256 hash 5179 of the view name, followed by the extension 5180 <filename>.mkeys</filename>. 5181 </para> 5182 </listitem> 5183 </varlistentry> 5184 5185 <varlistentry> 5186 <term><command>named-xfer</command></term> 5187 <listitem> 5188 <para> 5189 <emphasis>This option is obsolete.</emphasis> It 5190 was used in <acronym>BIND</acronym> 8 to specify 5191 the pathname to the <command>named-xfer</command> 5192 program. In <acronym>BIND</acronym> 9, no separate 5193 <command>named-xfer</command> program is needed; 5194 its functionality is built into the name server. 5195 </para> 5196 </listitem> 5197 </varlistentry> 5198 5199 <varlistentry> 5200 <term><command>tkey-gssapi-keytab</command></term> 5201 <listitem> 5202 <para> 5203 The KRB5 keytab file to use for GSS-TSIG updates. If 5204 this option is set and tkey-gssapi-credential is not 5205 set, then updates will be allowed with any key 5206 matching a principal in the specified keytab. 5207 </para> 5208 </listitem> 5209 </varlistentry> 5210 5211 <varlistentry> 5212 <term><command>tkey-gssapi-credential</command></term> 5213 <listitem> 5214 <para> 5215 The security credential with which the server should 5216 authenticate keys requested by the GSS-TSIG protocol. 5217 Currently only Kerberos 5 authentication is available 5218 and the credential is a Kerberos principal which the 5219 server can acquire through the default system key 5220 file, normally <filename>/etc/krb5.keytab</filename>. 5221 The location keytab file can be overridden using the 5222 tkey-gssapi-keytab option. Normally this principal is 5223 of the form "<userinput>DNS/</userinput><varname>server.domain</varname>". 5224 To use GSS-TSIG, <command>tkey-domain</command> must 5225 also be set if a specific keytab is not set with 5226 tkey-gssapi-keytab. 5227 </para> 5228 </listitem> 5229 </varlistentry> 5230 5231 <varlistentry> 5232 <term><command>tkey-domain</command></term> 5233 <listitem> 5234 <para> 5235 The domain appended to the names of all shared keys 5236 generated with <command>TKEY</command>. When a 5237 client requests a <command>TKEY</command> exchange, 5238 it may or may not specify the desired name for the 5239 key. If present, the name of the shared key will 5240 be <varname>client specified part</varname> + 5241 <varname>tkey-domain</varname>. Otherwise, the 5242 name of the shared key will be <varname>random hex 5243 digits</varname> + <varname>tkey-domain</varname>. 5244 In most cases, the <command>domainname</command> 5245 should be the server's domain name, or an otherwise 5246 non-existent subdomain like 5247 "_tkey.<varname>domainname</varname>". If you are 5248 using GSS-TSIG, this variable must be defined, unless 5249 you specify a specific keytab using tkey-gssapi-keytab. 5250 </para> 5251 </listitem> 5252 </varlistentry> 5253 5254 <varlistentry> 5255 <term><command>tkey-dhkey</command></term> 5256 <listitem> 5257 <para> 5258 The Diffie-Hellman key used by the server 5259 to generate shared keys with clients using the Diffie-Hellman 5260 mode 5261 of <command>TKEY</command>. The server must be 5262 able to load the 5263 public and private keys from files in the working directory. 5264 In 5265 most cases, the keyname should be the server's host name. 5266 </para> 5267 </listitem> 5268 </varlistentry> 5269 5270 <varlistentry> 5271 <term><command>cache-file</command></term> 5272 <listitem> 5273 <para> 5274 This is for testing only. Do not use. 5275 </para> 5276 </listitem> 5277 </varlistentry> 5278 5279 <varlistentry> 5280 <term><command>dump-file</command></term> 5281 <listitem> 5282 <para> 5283 The pathname of the file the server dumps 5284 the database to when instructed to do so with 5285 <command>rndc dumpdb</command>. 5286 If not specified, the default is <filename>named_dump.db</filename>. 5287 </para> 5288 </listitem> 5289 </varlistentry> 5290 5291 <varlistentry> 5292 <term><command>memstatistics-file</command></term> 5293 <listitem> 5294 <para> 5295 The pathname of the file the server writes memory 5296 usage statistics to on exit. If not specified, 5297 the default is <filename>named.memstats</filename>. 5298 </para> 5299 </listitem> 5300 </varlistentry> 5301 5302 <varlistentry> 5303 <term><command>pid-file</command></term> 5304 <listitem> 5305 <para> 5306 The pathname of the file the server writes its process ID 5307 in. If not specified, the default is 5308 <filename>/var/run/named/named.pid</filename>. 5309 The PID file is used by programs that want to send signals to 5310 the running 5311 name server. Specifying <command>pid-file none</command> disables the 5312 use of a PID file — no file will be written and any 5313 existing one will be removed. Note that <command>none</command> 5314 is a keyword, not a filename, and therefore is not enclosed 5315 in 5316 double quotes. 5317 </para> 5318 </listitem> 5319 </varlistentry> 5320 5321 <varlistentry> 5322 <term><command>recursing-file</command></term> 5323 <listitem> 5324 <para> 5325 The pathname of the file the server dumps 5326 the queries that are currently recursing when instructed 5327 to do so with <command>rndc recursing</command>. 5328 If not specified, the default is <filename>named.recursing</filename>. 5329 </para> 5330 </listitem> 5331 </varlistentry> 5332 5333 <varlistentry> 5334 <term><command>statistics-file</command></term> 5335 <listitem> 5336 <para> 5337 The pathname of the file the server appends statistics 5338 to when instructed to do so using <command>rndc stats</command>. 5339 If not specified, the default is <filename>named.stats</filename> in the 5340 server's current directory. The format of the file is 5341 described 5342 in <xref linkend="statsfile"/>. 5343 </para> 5344 </listitem> 5345 </varlistentry> 5346 5347 <varlistentry> 5348 <term><command>bindkeys-file</command></term> 5349 <listitem> 5350 <para> 5351 The pathname of a file to override the built-in trusted 5352 keys provided by <command>named</command>. 5353 See the discussion of <command>dnssec-lookaside</command> 5354 and <command>dnssec-validation</command> for details. 5355 If not specified, the default is 5356 <filename>/etc/bind.keys</filename>. 5357 </para> 5358 </listitem> 5359 </varlistentry> 5360 5361 <varlistentry> 5362 <term><command>secroots-file</command></term> 5363 <listitem> 5364 <para> 5365 The pathname of the file the server dumps 5366 security roots to when instructed to do so with 5367 <command>rndc secroots</command>. 5368 If not specified, the default is 5369 <filename>named.secroots</filename>. 5370 </para> 5371 </listitem> 5372 </varlistentry> 5373 5374 <varlistentry> 5375 <term><command>session-keyfile</command></term> 5376 <listitem> 5377 <para> 5378 The pathname of the file into which to write a TSIG 5379 session key generated by <command>named</command> for use by 5380 <command>nsupdate -l</command>. If not specified, the 5381 default is <filename>/var/run/named/session.key</filename>. 5382 (See <xref linkend="dynamic_update_policies"/>, and in 5383 particular the discussion of the 5384 <command>update-policy</command> statement's 5385 <userinput>local</userinput> option for more 5386 information about this feature.) 5387 </para> 5388 </listitem> 5389 </varlistentry> 5390 5391 <varlistentry> 5392 <term><command>session-keyname</command></term> 5393 <listitem> 5394 <para> 5395 The key name to use for the TSIG session key. 5396 If not specified, the default is "local-ddns". 5397 </para> 5398 </listitem> 5399 </varlistentry> 5400 5401 <varlistentry> 5402 <term><command>session-keyalg</command></term> 5403 <listitem> 5404 <para> 5405 The algorithm to use for the TSIG session key. 5406 Valid values are hmac-sha1, hmac-sha224, hmac-sha256, 5407 hmac-sha384, hmac-sha512 and hmac-md5. If not 5408 specified, the default is hmac-sha256. 5409 </para> 5410 </listitem> 5411 </varlistentry> 5412 5413 <varlistentry> 5414 <term><command>port</command></term> 5415 <listitem> 5416 <para> 5417 The UDP/TCP port number the server uses for 5418 receiving and sending DNS protocol traffic. 5419 The default is 53. This option is mainly intended for server 5420 testing; 5421 a server using a port other than 53 will not be able to 5422 communicate with 5423 the global DNS. 5424 </para> 5425 </listitem> 5426 </varlistentry> 5427 5428 <varlistentry> 5429 <term><command>dscp</command></term> 5430 <listitem> 5431 <para> 5432 The global Differentiated Services Code Point (DSCP) 5433 value to classify outgoing DNS traffic on operating 5434 systems that support DSCP. Valid values are 0 through 63. 5435 It is not configured by default. 5436 </para> 5437 </listitem> 5438 </varlistentry> 5439 5440 <varlistentry> 5441 <term><command>random-device</command></term> 5442 <listitem> 5443 <para> 5444 The source of entropy to be used by the server. Entropy is 5445 primarily needed 5446 for DNSSEC operations, such as TKEY transactions and dynamic 5447 update of signed 5448 zones. This options specifies the device (or file) from which 5449 to read 5450 entropy. If this is a file, operations requiring entropy will 5451 fail when the 5452 file has been exhausted. If not specified, the default value 5453 is 5454 <filename>/dev/random</filename> 5455 (or equivalent) when present, and none otherwise. The 5456 <command>random-device</command> option takes 5457 effect during 5458 the initial configuration load at server startup time and 5459 is ignored on subsequent reloads. 5460 </para> 5461 </listitem> 5462 </varlistentry> 5463 5464 <varlistentry> 5465 <term><command>preferred-glue</command></term> 5466 <listitem> 5467 <para> 5468 If specified, the listed type (A or AAAA) will be emitted 5469 before other glue 5470 in the additional section of a query response. 5471 The default is not to prefer any type (NONE). 5472 </para> 5473 </listitem> 5474 </varlistentry> 5475 5476 <varlistentry id="root_delegation_only"> 5477 <term><command>root-delegation-only</command></term> 5478 <listitem> 5479 <para> 5480 Turn on enforcement of delegation-only in TLDs 5481 (top level domains) and root zones with an optional 5482 exclude list. 5483 </para> 5484 <para> 5485 DS queries are expected to be made to and be answered by 5486 delegation only zones. Such queries and responses are 5487 treated as an exception to delegation-only processing 5488 and are not converted to NXDOMAIN responses provided 5489 a CNAME is not discovered at the query name. 5490 </para> 5491 <para> 5492 If a delegation only zone server also serves a child 5493 zone it is not always possible to determine whether 5494 an answer comes from the delegation only zone or the 5495 child zone. SOA NS and DNSKEY records are apex 5496 only records and a matching response that contains 5497 these records or DS is treated as coming from a 5498 child zone. RRSIG records are also examined to see 5499 if they are signed by a child zone or not. The 5500 authority section is also examined to see if there 5501 is evidence that the answer is from the child zone. 5502 Answers that are determined to be from a child zone 5503 are not converted to NXDOMAIN responses. Despite 5504 all these checks there is still a possibility of 5505 false negatives when a child zone is being served. 5506 </para> 5507 <para> 5508 Similarly false positives can arise from empty nodes 5509 (no records at the name) in the delegation only zone 5510 when the query type is not ANY. 5511 </para> 5512 <para> 5513 Note some TLDs are not delegation only (e.g. "DE", "LV", 5514 "US" and "MUSEUM"). This list is not exhaustive. 5515 </para> 5516 5517<programlisting> 5518options { 5519 root-delegation-only exclude { "de"; "lv"; "us"; "museum"; }; 5520}; 5521</programlisting> 5522 5523 </listitem> 5524 </varlistentry> 5525 5526 <varlistentry> 5527 <term><command>disable-algorithms</command></term> 5528 <listitem> 5529 <para> 5530 Disable the specified DNSSEC algorithms at and below the 5531 specified name. 5532 Multiple <command>disable-algorithms</command> 5533 statements are allowed. 5534 Only the best match <command>disable-algorithms</command> 5535 clause will be used to determine which algorithms are used. 5536 </para> 5537 <para> 5538 If all supported algorithms are disabled, the zones covered 5539 by the <command>disable-algorithms</command> will be treated 5540 as insecure. 5541 </para> 5542 </listitem> 5543 </varlistentry> 5544 5545 <varlistentry> 5546 <term><command>disable-ds-digests</command></term> 5547 <listitem> 5548 <para> 5549 Disable the specified DS/DLV digest types at and below the 5550 specified name. 5551 Multiple <command>disable-ds-digests</command> 5552 statements are allowed. 5553 Only the best match <command>disable-ds-digests</command> 5554 clause will be used to determine which digest types are used. 5555 </para> 5556 <para> 5557 If all supported digest types are disabled, the zones covered 5558 by the <command>disable-ds-digests</command> will be treated 5559 as insecure. 5560 </para> 5561 </listitem> 5562 </varlistentry> 5563 5564 <varlistentry> 5565 <term><command>dnssec-lookaside</command></term> 5566 <listitem> 5567 <para> 5568 When set, <command>dnssec-lookaside</command> provides the 5569 validator with an alternate method to validate DNSKEY 5570 records at the top of a zone. When a DNSKEY is at or 5571 below a domain specified by the deepest 5572 <command>dnssec-lookaside</command>, and the normal DNSSEC 5573 validation has left the key untrusted, the trust-anchor 5574 will be appended to the key name and a DLV record will be 5575 looked up to see if it can validate the key. If the DLV 5576 record validates a DNSKEY (similarly to the way a DS 5577 record does) the DNSKEY RRset is deemed to be trusted. 5578 </para> 5579 <para> 5580 If <command>dnssec-lookaside</command> is set to 5581 <userinput>auto</userinput>, then built-in default 5582 values for the DLV domain and trust anchor will be 5583 used, along with a built-in key for validation. 5584 </para> 5585 <para> 5586 If <command>dnssec-lookaside</command> is set to 5587 <userinput>no</userinput>, then dnssec-lookaside 5588 is not used. 5589 </para> 5590 <para> 5591 The default DLV key is stored in the file 5592 <filename>bind.keys</filename>; 5593 <command>named</command> will load that key at 5594 startup if <command>dnssec-lookaside</command> is set to 5595 <constant>auto</constant>. A copy of the file is 5596 installed along with <acronym>BIND</acronym> 9, and is 5597 current as of the release date. If the DLV key expires, a 5598 new copy of <filename>bind.keys</filename> can be downloaded 5599 from <ulink url="https://www.isc.org/solutions/dlv/" 5600 >https://www.isc.org/solutions/dlv/</ulink>. 5601 </para> 5602 <para> 5603 (To prevent problems if <filename>bind.keys</filename> is 5604 not found, the current key is also compiled in to 5605 <command>named</command>. Relying on this is not 5606 recommended, however, as it requires <command>named</command> 5607 to be recompiled with a new key when the DLV key expires.) 5608 </para> 5609 <para> 5610 NOTE: <command>named</command> only loads certain specific 5611 keys from <filename>bind.keys</filename>: those for the 5612 DLV zone and for the DNS root zone. The file cannot be 5613 used to store keys for other zones. 5614 </para> 5615 </listitem> 5616 </varlistentry> 5617 5618 <varlistentry> 5619 <term><command>dnssec-must-be-secure</command></term> 5620 <listitem> 5621 <para> 5622 Specify hierarchies which must be or may not be secure 5623 (signed and validated). If <userinput>yes</userinput>, 5624 then <command>named</command> will only accept answers if 5625 they are secure. If <userinput>no</userinput>, then normal 5626 DNSSEC validation applies allowing for insecure answers to 5627 be accepted. The specified domain must be under a 5628 <command>trusted-keys</command> or 5629 <command>managed-keys</command> statement, or 5630 <command>dnssec-lookaside</command> must be active. 5631 </para> 5632 </listitem> 5633 </varlistentry> 5634 5635 <varlistentry> 5636 <term><command>dns64</command></term> 5637 <listitem> 5638 <para> 5639 This directive instructs <command>named</command> to 5640 return mapped IPv4 addresses to AAAA queries when 5641 there are no AAAA records. It is intended to be 5642 used in conjunction with a NAT64. Each 5643 <command>dns64</command> defines one DNS64 prefix. 5644 Multiple DNS64 prefixes can be defined. 5645 </para> 5646 <para> 5647 Compatible IPv6 prefixes have lengths of 32, 40, 48, 56, 5648 64 and 96 as per RFC 6052. 5649 </para> 5650 <para> 5651 Additionally a reverse IP6.ARPA zone will be created for 5652 the prefix to provide a mapping from the IP6.ARPA names 5653 to the corresponding IN-ADDR.ARPA names using synthesized 5654 CNAMEs. <command>dns64-server</command> and 5655 <command>dns64-contact</command> can be used to specify 5656 the name of the server and contact for the zones. These 5657 are settable at the view / options level. These are 5658 not settable on a per-prefix basis. 5659 </para> 5660 <para> 5661 Each <command>dns64</command> supports an optional 5662 <command>clients</command> ACL that determines which 5663 clients are affected by this directive. If not defined, 5664 it defaults to <userinput>any;</userinput>. 5665 </para> 5666 <para> 5667 Each <command>dns64</command> supports an optional 5668 <command>mapped</command> ACL that selects which 5669 IPv4 addresses are to be mapped in the corresponding 5670 A RRset. If not defined it defaults to 5671 <userinput>any;</userinput>. 5672 </para> 5673 <para> 5674 Normally, DNS64 won't apply to a domain name that 5675 owns one or more AAAA records; these records will 5676 simply be returned. The optional 5677 <command>exclude</command> ACL allows specification 5678 of a list of IPv6 addresses that will be ignored 5679 if they appear in a domain name's AAAA records, and 5680 DNS64 will be applied to any A records the domain 5681 name owns. If not defined, <command>exclude</command> 5682 defaults to none. 5683 </para> 5684 <para> 5685 A optional <command>suffix</command> can also 5686 be defined to set the bits trailing the mapped 5687 IPv4 address bits. By default these bits are 5688 set to <userinput>::</userinput>. The bits 5689 matching the prefix and mapped IPv4 address 5690 must be zero. 5691 </para> 5692 <para> 5693 If <command>recursive-only</command> is set to 5694 <command>yes</command> the DNS64 synthesis will 5695 only happen for recursive queries. The default 5696 is <command>no</command>. 5697 </para> 5698 <para> 5699 If <command>break-dnssec</command> is set to 5700 <command>yes</command> the DNS64 synthesis will 5701 happen even if the result, if validated, would 5702 cause a DNSSEC validation failure. If this option 5703 is set to <command>no</command> (the default), the DO 5704 is set on the incoming query, and there are RRSIGs on 5705 the applicable records, then synthesis will not happen. 5706 </para> 5707<programlisting> 5708 acl rfc1918 { 10/8; 192.168/16; 172.16/12; }; 5709 5710 dns64 64:FF9B::/96 { 5711 clients { any; }; 5712 mapped { !rfc1918; any; }; 5713 exclude { 64:FF9B::/96; ::ffff:0000:0000/96; }; 5714 suffix ::; 5715 }; 5716</programlisting> 5717 </listitem> 5718 </varlistentry> 5719 5720 <varlistentry> 5721 <term><command>dnssec-update-mode</command></term> 5722 <listitem> 5723 <para> 5724 If this option is set to its default value of 5725 <literal>maintain</literal> in a zone of type 5726 <literal>master</literal> which is DNSSEC-signed 5727 and configured to allow dynamic updates (see 5728 <xref linkend="dynamic_update_policies"/>), and 5729 if <command>named</command> has access to the 5730 private signing key(s) for the zone, then 5731 <command>named</command> will automatically sign all new 5732 or changed records and maintain signatures for the zone 5733 by regenerating RRSIG records whenever they approach 5734 their expiration date. 5735 </para> 5736 <para> 5737 If the option is changed to <literal>no-resign</literal>, 5738 then <command>named</command> will sign all new or 5739 changed records, but scheduled maintenance of 5740 signatures is disabled. 5741 </para> 5742 <para> 5743 With either of these settings, <command>named</command> 5744 will reject updates to a DNSSEC-signed zone when the 5745 signing keys are inactive or unavailable to 5746 <command>named</command>. (A planned third option, 5747 <literal>external</literal>, will disable all automatic 5748 signing and allow DNSSEC data to be submitted into a zone 5749 via dynamic update; this is not yet implemented.) 5750 </para> 5751 </listitem> 5752 </varlistentry> 5753 5754 <varlistentry> 5755 <term><command>max-zone-ttl</command></term> 5756 <listitem> 5757 <para> 5758 Specifies a maximum permissible TTL value. 5759 When loading a zone file using a 5760 <option>masterfile-format</option> of 5761 <constant>text</constant> or <constant>raw</constant>, 5762 any record encountered with a TTL higher than 5763 <option>max-zone-ttl</option> will cause the zone to 5764 be rejected. 5765 </para> 5766 <para> 5767 This is useful in DNSSEC-signed zones because when 5768 rolling to a new DNSKEY, the old key needs to remain 5769 available until RRSIG records have expired from 5770 caches. The<option>max-zone-ttl</option> option guarantees 5771 that the largest TTL in the zone will be no higher 5772 the set value. 5773 </para> 5774 <para> 5775 (NOTE: Because <constant>map</constant>-format files 5776 load directly into memory, this option cannot be 5777 used with them.) 5778 </para> 5779 </listitem> 5780 </varlistentry> 5781 5782 <varlistentry> 5783 <term><command>zone-statistics</command></term> 5784 <listitem> 5785 <para> 5786 If <userinput>full</userinput>, the server will collect 5787 statistical data on all zones (unless specifically 5788 turned off on a per-zone basis by specifying 5789 <command>zone-statistics terse</command> or 5790 <command>zone-statistics none</command> 5791 in the <command>zone</command> statement). 5792 The default is <userinput>terse</userinput>, providing 5793 minimal statistics on zones (including name and 5794 current serial number, but not query type 5795 counters). 5796 </para> 5797 <para> 5798 These statistics may be accessed via the 5799 <command>statistics-channel</command> or 5800 using <command>rndc stats</command>, which 5801 will dump them to the file listed 5802 in the <command>statistics-file</command>. See 5803 also <xref linkend="statsfile"/>. 5804 </para> 5805 <para> 5806 For backward compatibility with earlier versions 5807 of BIND 9, the <command>zone-statistics</command> 5808 option can also accept <userinput>yes</userinput> 5809 or <userinput>no</userinput>; <userinput>yes</userinput> 5810 has the same meaning as <userinput>full</userinput>. 5811 As of <acronym>BIND</acronym> 9.10, 5812 <userinput>no</userinput> has the same meaning 5813 as <userinput>none</userinput>; previously, it 5814 was the same as <userinput>terse</userinput>. 5815 </para> 5816 </listitem> 5817 </varlistentry> 5818 </variablelist> 5819 5820 <sect3 id="boolean_options"> 5821 <title>Boolean Options</title> 5822 5823 <variablelist> 5824 5825 <varlistentry> 5826 <term><command>automatic-interface-scan</command></term> 5827 <listitem> 5828 <para> 5829 If <userinput>yes</userinput> and supported by the OS, 5830 automatically rescan network interfaces when the interface 5831 addresses are added or removed. The default is 5832 <userinput>yes</userinput>. 5833 </para> 5834 <para> 5835 Currently the OS needs to support routing sockets for 5836 <command>automatic-interface-scan</command> to be 5837 supported. 5838 </para> 5839 </listitem> 5840 </varlistentry> 5841 5842 <varlistentry> 5843 <term><command>allow-new-zones</command></term> 5844 <listitem> 5845 <para> 5846 If <userinput>yes</userinput>, then zones can be 5847 added at runtime via <command>rndc addzone</command> 5848 or deleted via <command>rndc delzone</command>. 5849 The default is <userinput>no</userinput>. 5850 </para> 5851 </listitem> 5852 </varlistentry> 5853 5854 <varlistentry> 5855 <term><command>auth-nxdomain</command></term> 5856 <listitem> 5857 <para> 5858 If <userinput>yes</userinput>, then the <command>AA</command> bit 5859 is always set on NXDOMAIN responses, even if the server is 5860 not actually 5861 authoritative. The default is <userinput>no</userinput>; 5862 this is 5863 a change from <acronym>BIND</acronym> 8. If you 5864 are using very old DNS software, you 5865 may need to set it to <userinput>yes</userinput>. 5866 </para> 5867 </listitem> 5868 </varlistentry> 5869 5870 <varlistentry> 5871 <term><command>deallocate-on-exit</command></term> 5872 <listitem> 5873 <para> 5874 This option was used in <acronym>BIND</acronym> 5875 8 to enable checking 5876 for memory leaks on exit. <acronym>BIND</acronym> 9 ignores the option and always performs 5877 the checks. 5878 </para> 5879 </listitem> 5880 </varlistentry> 5881 5882 <varlistentry> 5883 <term><command>memstatistics</command></term> 5884 <listitem> 5885 <para> 5886 Write memory statistics to the file specified by 5887 <command>memstatistics-file</command> at exit. 5888 The default is <userinput>no</userinput> unless 5889 '-m record' is specified on the command line in 5890 which case it is <userinput>yes</userinput>. 5891 </para> 5892 </listitem> 5893 </varlistentry> 5894 5895 <varlistentry> 5896 <term><command>dialup</command></term> 5897 <listitem> 5898 <para> 5899 If <userinput>yes</userinput>, then the 5900 server treats all zones as if they are doing zone transfers 5901 across 5902 a dial-on-demand dialup link, which can be brought up by 5903 traffic 5904 originating from this server. This has different effects 5905 according 5906 to zone type and concentrates the zone maintenance so that 5907 it all 5908 happens in a short interval, once every <command>heartbeat-interval</command> and 5909 hopefully during the one call. It also suppresses some of 5910 the normal 5911 zone maintenance traffic. The default is <userinput>no</userinput>. 5912 </para> 5913 <para> 5914 The <command>dialup</command> option 5915 may also be specified in the <command>view</command> and 5916 <command>zone</command> statements, 5917 in which case it overrides the global <command>dialup</command> 5918 option. 5919 </para> 5920 <para> 5921 If the zone is a master zone, then the server will send out a 5922 NOTIFY 5923 request to all the slaves (default). This should trigger the 5924 zone serial 5925 number check in the slave (providing it supports NOTIFY) 5926 allowing the slave 5927 to verify the zone while the connection is active. 5928 The set of servers to which NOTIFY is sent can be controlled 5929 by 5930 <command>notify</command> and <command>also-notify</command>. 5931 </para> 5932 <para> 5933 If the 5934 zone is a slave or stub zone, then the server will suppress 5935 the regular 5936 "zone up to date" (refresh) queries and only perform them 5937 when the 5938 <command>heartbeat-interval</command> expires in 5939 addition to sending 5940 NOTIFY requests. 5941 </para> 5942 <para> 5943 Finer control can be achieved by using 5944 <userinput>notify</userinput> which only sends NOTIFY 5945 messages, 5946 <userinput>notify-passive</userinput> which sends NOTIFY 5947 messages and 5948 suppresses the normal refresh queries, <userinput>refresh</userinput> 5949 which suppresses normal refresh processing and sends refresh 5950 queries 5951 when the <command>heartbeat-interval</command> 5952 expires, and 5953 <userinput>passive</userinput> which just disables normal 5954 refresh 5955 processing. 5956 </para> 5957 5958 <informaltable colsep="0" rowsep="0"> 5959 <tgroup cols="4" colsep="0" rowsep="0" tgroupstyle="4Level-table"> 5960 <colspec colname="1" colnum="1" colsep="0" colwidth="1.150in"/> 5961 <colspec colname="2" colnum="2" colsep="0" colwidth="1.150in"/> 5962 <colspec colname="3" colnum="3" colsep="0" colwidth="1.150in"/> 5963 <colspec colname="4" colnum="4" colsep="0" colwidth="1.150in"/> 5964 <tbody> 5965 <row rowsep="0"> 5966 <entry colname="1"> 5967 <para> 5968 dialup mode 5969 </para> 5970 </entry> 5971 <entry colname="2"> 5972 <para> 5973 normal refresh 5974 </para> 5975 </entry> 5976 <entry colname="3"> 5977 <para> 5978 heart-beat refresh 5979 </para> 5980 </entry> 5981 <entry colname="4"> 5982 <para> 5983 heart-beat notify 5984 </para> 5985 </entry> 5986 </row> 5987 <row rowsep="0"> 5988 <entry colname="1"> 5989 <para><command>no</command> (default)</para> 5990 </entry> 5991 <entry colname="2"> 5992 <para> 5993 yes 5994 </para> 5995 </entry> 5996 <entry colname="3"> 5997 <para> 5998 no 5999 </para> 6000 </entry> 6001 <entry colname="4"> 6002 <para> 6003 no 6004 </para> 6005 </entry> 6006 </row> 6007 <row rowsep="0"> 6008 <entry colname="1"> 6009 <para><command>yes</command></para> 6010 </entry> 6011 <entry colname="2"> 6012 <para> 6013 no 6014 </para> 6015 </entry> 6016 <entry colname="3"> 6017 <para> 6018 yes 6019 </para> 6020 </entry> 6021 <entry colname="4"> 6022 <para> 6023 yes 6024 </para> 6025 </entry> 6026 </row> 6027 <row rowsep="0"> 6028 <entry colname="1"> 6029 <para><command>notify</command></para> 6030 </entry> 6031 <entry colname="2"> 6032 <para> 6033 yes 6034 </para> 6035 </entry> 6036 <entry colname="3"> 6037 <para> 6038 no 6039 </para> 6040 </entry> 6041 <entry colname="4"> 6042 <para> 6043 yes 6044 </para> 6045 </entry> 6046 </row> 6047 <row rowsep="0"> 6048 <entry colname="1"> 6049 <para><command>refresh</command></para> 6050 </entry> 6051 <entry colname="2"> 6052 <para> 6053 no 6054 </para> 6055 </entry> 6056 <entry colname="3"> 6057 <para> 6058 yes 6059 </para> 6060 </entry> 6061 <entry colname="4"> 6062 <para> 6063 no 6064 </para> 6065 </entry> 6066 </row> 6067 <row rowsep="0"> 6068 <entry colname="1"> 6069 <para><command>passive</command></para> 6070 </entry> 6071 <entry colname="2"> 6072 <para> 6073 no 6074 </para> 6075 </entry> 6076 <entry colname="3"> 6077 <para> 6078 no 6079 </para> 6080 </entry> 6081 <entry colname="4"> 6082 <para> 6083 no 6084 </para> 6085 </entry> 6086 </row> 6087 <row rowsep="0"> 6088 <entry colname="1"> 6089 <para><command>notify-passive</command></para> 6090 </entry> 6091 <entry colname="2"> 6092 <para> 6093 no 6094 </para> 6095 </entry> 6096 <entry colname="3"> 6097 <para> 6098 no 6099 </para> 6100 </entry> 6101 <entry colname="4"> 6102 <para> 6103 yes 6104 </para> 6105 </entry> 6106 </row> 6107 </tbody> 6108 </tgroup> 6109 </informaltable> 6110 6111 <para> 6112 Note that normal NOTIFY processing is not affected by 6113 <command>dialup</command>. 6114 </para> 6115 6116 </listitem> 6117 </varlistentry> 6118 6119 <varlistentry> 6120 <term><command>fake-iquery</command></term> 6121 <listitem> 6122 <para> 6123 In <acronym>BIND</acronym> 8, this option 6124 enabled simulating the obsolete DNS query type 6125 IQUERY. <acronym>BIND</acronym> 9 never does 6126 IQUERY simulation. 6127 </para> 6128 </listitem> 6129 </varlistentry> 6130 6131 <varlistentry> 6132 <term><command>fetch-glue</command></term> 6133 <listitem> 6134 <para> 6135 This option is obsolete. 6136 In BIND 8, <userinput>fetch-glue yes</userinput> 6137 caused the server to attempt to fetch glue resource records 6138 it 6139 didn't have when constructing the additional 6140 data section of a response. This is now considered a bad 6141 idea 6142 and BIND 9 never does it. 6143 </para> 6144 </listitem> 6145 </varlistentry> 6146 6147 <varlistentry> 6148 <term><command>flush-zones-on-shutdown</command></term> 6149 <listitem> 6150 <para> 6151 When the nameserver exits due receiving SIGTERM, 6152 flush or do not flush any pending zone writes. The default 6153 is 6154 <command>flush-zones-on-shutdown</command> <userinput>no</userinput>. 6155 </para> 6156 </listitem> 6157 </varlistentry> 6158 6159 <varlistentry> 6160 <term><command>has-old-clients</command></term> 6161 <listitem> 6162 <para> 6163 This option was incorrectly implemented 6164 in <acronym>BIND</acronym> 8, and is ignored by <acronym>BIND</acronym> 9. 6165 To achieve the intended effect 6166 of 6167 <command>has-old-clients</command> <userinput>yes</userinput>, specify 6168 the two separate options <command>auth-nxdomain</command> <userinput>yes</userinput> 6169 and <command>rfc2308-type1</command> <userinput>no</userinput> instead. 6170 </para> 6171 </listitem> 6172 </varlistentry> 6173 6174 <varlistentry> 6175 <term><command>host-statistics</command></term> 6176 <listitem> 6177 <para> 6178 In BIND 8, this enables keeping of 6179 statistics for every host that the name server interacts 6180 with. 6181 Not implemented in BIND 9. 6182 </para> 6183 </listitem> 6184 </varlistentry> 6185 6186 <varlistentry> 6187 <term><command>maintain-ixfr-base</command></term> 6188 <listitem> 6189 <para> 6190 <emphasis>This option is obsolete</emphasis>. 6191 It was used in <acronym>BIND</acronym> 8 to 6192 determine whether a transaction log was 6193 kept for Incremental Zone Transfer. <acronym>BIND</acronym> 9 maintains a transaction 6194 log whenever possible. If you need to disable outgoing 6195 incremental zone 6196 transfers, use <command>provide-ixfr</command> <userinput>no</userinput>. 6197 </para> 6198 </listitem> 6199 </varlistentry> 6200 6201 <varlistentry> 6202 <term><command>minimal-responses</command></term> 6203 <listitem> 6204 <para> 6205 If <userinput>yes</userinput>, then when generating 6206 responses the server will only add records to the authority 6207 and additional data sections when they are required (e.g. 6208 delegations, negative responses). This may improve the 6209 performance of the server. 6210 The default is <userinput>no</userinput>. 6211 </para> 6212 </listitem> 6213 </varlistentry> 6214 6215 <varlistentry> 6216 <term><command>multiple-cnames</command></term> 6217 <listitem> 6218 <para> 6219 This option was used in <acronym>BIND</acronym> 8 to allow 6220 a domain name to have multiple CNAME records in violation of 6221 the DNS standards. <acronym>BIND</acronym> 9.2 onwards 6222 always strictly enforces the CNAME rules both in master 6223 files and dynamic updates. 6224 </para> 6225 </listitem> 6226 </varlistentry> 6227 6228 <varlistentry> 6229 <term><command>notify</command></term> 6230 <listitem> 6231 <para> 6232 If <userinput>yes</userinput> (the default), 6233 DNS NOTIFY messages are sent when a zone the server is 6234 authoritative for 6235 changes, see <xref linkend="notify"/>. The messages are 6236 sent to the 6237 servers listed in the zone's NS records (except the master 6238 server identified 6239 in the SOA MNAME field), and to any servers listed in the 6240 <command>also-notify</command> option. 6241 </para> 6242 <para> 6243 If <userinput>master-only</userinput>, notifies are only 6244 sent 6245 for master zones. 6246 If <userinput>explicit</userinput>, notifies are sent only 6247 to 6248 servers explicitly listed using <command>also-notify</command>. 6249 If <userinput>no</userinput>, no notifies are sent. 6250 </para> 6251 <para> 6252 The <command>notify</command> option may also be 6253 specified in the <command>zone</command> 6254 statement, 6255 in which case it overrides the <command>options notify</command> statement. 6256 It would only be necessary to turn off this option if it 6257 caused slaves 6258 to crash. 6259 </para> 6260 </listitem> 6261 </varlistentry> 6262 6263 <varlistentry> 6264 <term><command>notify-to-soa</command></term> 6265 <listitem> 6266 <para> 6267 If <userinput>yes</userinput> do not check the nameservers 6268 in the NS RRset against the SOA MNAME. Normally a NOTIFY 6269 message is not sent to the SOA MNAME (SOA ORIGIN) as it is 6270 supposed to contain the name of the ultimate master. 6271 Sometimes, however, a slave is listed as the SOA MNAME in 6272 hidden master configurations and in that case you would 6273 want the ultimate master to still send NOTIFY messages to 6274 all the nameservers listed in the NS RRset. 6275 </para> 6276 </listitem> 6277 </varlistentry> 6278 6279 <varlistentry> 6280 <term><command>recursion</command></term> 6281 <listitem> 6282 <para> 6283 If <userinput>yes</userinput>, and a 6284 DNS query requests recursion, then the server will attempt 6285 to do 6286 all the work required to answer the query. If recursion is 6287 off 6288 and the server does not already know the answer, it will 6289 return a 6290 referral response. The default is 6291 <userinput>yes</userinput>. 6292 Note that setting <command>recursion no</command> does not prevent 6293 clients from getting data from the server's cache; it only 6294 prevents new data from being cached as an effect of client 6295 queries. 6296 Caching may still occur as an effect the server's internal 6297 operation, such as NOTIFY address lookups. 6298 See also <command>fetch-glue</command> above. 6299 </para> 6300 </listitem> 6301 </varlistentry> 6302 6303 <varlistentry> 6304 <term><command>request-nsid</command></term> 6305 <listitem> 6306 <para> 6307 If <userinput>yes</userinput>, then an empty EDNS(0) 6308 NSID (Name Server Identifier) option is sent with all 6309 queries to authoritative name servers during iterative 6310 resolution. If the authoritative server returns an NSID 6311 option in its response, then its contents are logged in 6312 the <command>resolver</command> category at level 6313 <command>info</command>. 6314 The default is <userinput>no</userinput>. 6315 </para> 6316 </listitem> 6317 </varlistentry> 6318 6319 <varlistentry> 6320 <term><command>request-sit</command></term> 6321 <listitem> 6322 <para> 6323 If <userinput>yes</userinput>, then a SIT (Source 6324 Identity Token) EDNS option is sent along with 6325 the query. If the resolver has previously talked 6326 to the server, the SIT returned in the previous 6327 transaction is sent. This is used by the server 6328 to determine whether the resolver has talked to 6329 it before. A resolver sending the correct SIT is 6330 assumed not to be an off-path attacker sending a 6331 spoofed-source query; the query is therefore 6332 unlikely to be part of a reflection/amplification 6333 attack, so resolvers sending a correct SIT option 6334 are not subject to response rate limiting (RRL). 6335 Resolvers which do not send a correct SIT option 6336 may be limited to receiving smaller responses via 6337 the <command>nosit-udp-size</command> option. 6338 </para> 6339 </listitem> 6340 </varlistentry> 6341 6342 <varlistentry> 6343 <term><command>sit-secret</command></term> 6344 <listitem> 6345 <para> 6346 If set, this is a shared secret used for generating 6347 and verifying Source Identity Token EDNS options 6348 within a anycast cluster. If not set the system 6349 will generate a random secret at startup. The 6350 shared secret is encoded as a hex string and needs 6351 to be 128 bits for AES128, 160 bits for SHA1 and 6352 256 bits for SHA256. 6353 </para> 6354 </listitem> 6355 </varlistentry> 6356 6357 <varlistentry> 6358 <term><command>rfc2308-type1</command></term> 6359 <listitem> 6360 <para> 6361 Setting this to <userinput>yes</userinput> will 6362 cause the server to send NS records along with the SOA 6363 record for negative 6364 answers. The default is <userinput>no</userinput>. 6365 </para> 6366 <note> 6367 <simpara> 6368 Not yet implemented in <acronym>BIND</acronym> 6369 9. 6370 </simpara> 6371 </note> 6372 </listitem> 6373 </varlistentry> 6374 6375 <varlistentry> 6376 <term><command>use-id-pool</command></term> 6377 <listitem> 6378 <para> 6379 <emphasis>This option is obsolete</emphasis>. 6380 <acronym>BIND</acronym> 9 always allocates query 6381 IDs from a pool. 6382 </para> 6383 </listitem> 6384 </varlistentry> 6385 6386 <varlistentry> 6387 <term><command>use-ixfr</command></term> 6388 <listitem> 6389 <para> 6390 <emphasis>This option is obsolete</emphasis>. 6391 If you need to disable IXFR to a particular server or 6392 servers, see 6393 the information on the <command>provide-ixfr</command> option 6394 in <xref linkend="server_statement_definition_and_usage"/>. 6395 See also 6396 <xref linkend="incremental_zone_transfers"/>. 6397 </para> 6398 </listitem> 6399 </varlistentry> 6400 6401 <varlistentry> 6402 <term><command>provide-ixfr</command></term> 6403 <listitem> 6404 <para> 6405 See the description of 6406 <command>provide-ixfr</command> in 6407 <xref linkend="server_statement_definition_and_usage"/>. 6408 </para> 6409 </listitem> 6410 </varlistentry> 6411 6412 <varlistentry> 6413 <term><command>request-ixfr</command></term> 6414 <listitem> 6415 <para> 6416 See the description of 6417 <command>request-ixfr</command> in 6418 <xref linkend="server_statement_definition_and_usage"/>. 6419 </para> 6420 </listitem> 6421 </varlistentry> 6422 6423 <varlistentry> 6424 <term><command>treat-cr-as-space</command></term> 6425 <listitem> 6426 <para> 6427 This option was used in <acronym>BIND</acronym> 6428 8 to make 6429 the server treat carriage return ("<command>\r</command>") characters the same way 6430 as a space or tab character, 6431 to facilitate loading of zone files on a UNIX system that 6432 were generated 6433 on an NT or DOS machine. In <acronym>BIND</acronym> 9, both UNIX "<command>\n</command>" 6434 and NT/DOS "<command>\r\n</command>" newlines 6435 are always accepted, 6436 and the option is ignored. 6437 </para> 6438 </listitem> 6439 </varlistentry> 6440 6441 <varlistentry> 6442 <term><command>additional-from-auth</command></term> 6443 <term><command>additional-from-cache</command></term> 6444 <listitem> 6445 6446 <para> 6447 These options control the behavior of an authoritative 6448 server when 6449 answering queries which have additional data, or when 6450 following CNAME 6451 and DNAME chains. 6452 </para> 6453 6454 <para> 6455 When both of these options are set to <userinput>yes</userinput> 6456 (the default) and a 6457 query is being answered from authoritative data (a zone 6458 configured into the server), the additional data section of 6459 the 6460 reply will be filled in using data from other authoritative 6461 zones 6462 and from the cache. In some situations this is undesirable, 6463 such 6464 as when there is concern over the correctness of the cache, 6465 or 6466 in servers where slave zones may be added and modified by 6467 untrusted third parties. Also, avoiding 6468 the search for this additional data will speed up server 6469 operations 6470 at the possible expense of additional queries to resolve 6471 what would 6472 otherwise be provided in the additional section. 6473 </para> 6474 6475 <para> 6476 For example, if a query asks for an MX record for host <literal>foo.example.com</literal>, 6477 and the record found is "<literal>MX 10 mail.example.net</literal>", normally the address 6478 records (A and AAAA) for <literal>mail.example.net</literal> will be provided as well, 6479 if known, even though they are not in the example.com zone. 6480 Setting these options to <command>no</command> 6481 disables this behavior and makes 6482 the server only search for additional data in the zone it 6483 answers from. 6484 </para> 6485 6486 <para> 6487 These options are intended for use in authoritative-only 6488 servers, or in authoritative-only views. Attempts to set 6489 them to <command>no</command> without also 6490 specifying 6491 <command>recursion no</command> will cause the 6492 server to 6493 ignore the options and log a warning message. 6494 </para> 6495 6496 <para> 6497 Specifying <command>additional-from-cache no</command> actually 6498 disables the use of the cache not only for additional data 6499 lookups 6500 but also when looking up the answer. This is usually the 6501 desired 6502 behavior in an authoritative-only server where the 6503 correctness of 6504 the cached data is an issue. 6505 </para> 6506 6507 <para> 6508 When a name server is non-recursively queried for a name 6509 that is not 6510 below the apex of any served zone, it normally answers with 6511 an 6512 "upwards referral" to the root servers or the servers of 6513 some other 6514 known parent of the query name. Since the data in an 6515 upwards referral 6516 comes from the cache, the server will not be able to provide 6517 upwards 6518 referrals when <command>additional-from-cache no</command> 6519 has been specified. Instead, it will respond to such 6520 queries 6521 with REFUSED. This should not cause any problems since 6522 upwards referrals are not required for the resolution 6523 process. 6524 </para> 6525 6526 </listitem> 6527 </varlistentry> 6528 6529 <varlistentry> 6530 <term><command>match-mapped-addresses</command></term> 6531 <listitem> 6532 <para> 6533 If <userinput>yes</userinput>, then an 6534 IPv4-mapped IPv6 address will match any address match 6535 list entries that match the corresponding IPv4 address. 6536 </para> 6537 <para> 6538 This option was introduced to work around a kernel quirk 6539 in some operating systems that causes IPv4 TCP 6540 connections, such as zone transfers, to be accepted on an 6541 IPv6 socket using mapped addresses. This caused address 6542 match lists designed for IPv4 to fail to match. However, 6543 <command>named</command> now solves this problem 6544 internally. The use of this option is discouraged. 6545 </para> 6546 </listitem> 6547 </varlistentry> 6548 6549 <varlistentry> 6550 <term><command>filter-aaaa-on-v4</command></term> 6551 <listitem> 6552 <para> 6553 This option is only available when 6554 <acronym>BIND</acronym> 9 is compiled with the 6555 <userinput>--enable-filter-aaaa</userinput> option on the 6556 "configure" command line. It is intended to help the 6557 transition from IPv4 to IPv6 by not giving IPv6 addresses 6558 to DNS clients unless they have connections to the IPv6 6559 Internet. This is not recommended unless absolutely 6560 necessary. The default is <userinput>no</userinput>. 6561 The <command>filter-aaaa-on-v4</command> option 6562 may also be specified in <command>view</command> statements 6563 to override the global <command>filter-aaaa-on-v4</command> 6564 option. 6565 </para> 6566 <para> 6567 If <userinput>yes</userinput>, 6568 the DNS client is at an IPv4 address, in <command>filter-aaaa</command>, 6569 and if the response does not include DNSSEC signatures, 6570 then all AAAA records are deleted from the response. 6571 This filtering applies to all responses and not only 6572 authoritative responses. 6573 </para> 6574 <para> 6575 If <userinput>break-dnssec</userinput>, 6576 then AAAA records are deleted even when DNSSEC is enabled. 6577 As suggested by the name, this makes the response not verify, 6578 because the DNSSEC protocol is designed detect deletions. 6579 </para> 6580 <para> 6581 This mechanism can erroneously cause other servers to 6582 not give AAAA records to their clients. 6583 A recursing server with both IPv6 and IPv4 network connections 6584 that queries an authoritative server using this mechanism 6585 via IPv4 will be denied AAAA records even if its client is 6586 using IPv6. 6587 </para> 6588 <para> 6589 This mechanism is applied to authoritative as well as 6590 non-authoritative records. 6591 A client using IPv4 that is not allowed recursion can 6592 erroneously be given AAAA records because the server is not 6593 allowed to check for A records. 6594 </para> 6595 <para> 6596 Some AAAA records are given to IPv4 clients in glue records. 6597 IPv4 clients that are servers can then erroneously 6598 answer requests for AAAA records received via IPv4. 6599 </para> 6600 </listitem> 6601 </varlistentry> 6602 6603 <varlistentry> 6604 <term><command>filter-aaaa-on-v6</command></term> 6605 <listitem> 6606 <para> 6607 Identical to <command>filter-aaaa-on-v4</command>, 6608 except it filters AAAA responses to queries from IPv6 6609 clients instead of IPv4 clients. To filter all 6610 responses, set both options to <userinput>yes</userinput>. 6611 </para> 6612 </listitem> 6613 </varlistentry> 6614 6615 <varlistentry> 6616 <term><command>ixfr-from-differences</command></term> 6617 <listitem> 6618 <para> 6619 When <userinput>yes</userinput> and the server loads a new 6620 version of a master zone from its zone file or receives a 6621 new version of a slave file via zone transfer, it will 6622 compare the new version to the previous one and calculate 6623 a set of differences. The differences are then logged in 6624 the zone's journal file such that the changes can be 6625 transmitted to downstream slaves as an incremental zone 6626 transfer. 6627 </para> 6628 <para> 6629 By allowing incremental zone transfers to be used for 6630 non-dynamic zones, this option saves bandwidth at the 6631 expense of increased CPU and memory consumption at the 6632 master. 6633 In particular, if the new version of a zone is completely 6634 different from the previous one, the set of differences 6635 will be of a size comparable to the combined size of the 6636 old and new zone version, and the server will need to 6637 temporarily allocate memory to hold this complete 6638 difference set. 6639 </para> 6640 <para><command>ixfr-from-differences</command> 6641 also accepts <command>master</command> and 6642 <command>slave</command> at the view and options 6643 levels which causes 6644 <command>ixfr-from-differences</command> to be enabled for 6645 all <command>master</command> or 6646 <command>slave</command> zones respectively. 6647 It is off by default. 6648 </para> 6649 </listitem> 6650 </varlistentry> 6651 6652 <varlistentry> 6653 <term><command>multi-master</command></term> 6654 <listitem> 6655 <para> 6656 This should be set when you have multiple masters for a zone 6657 and the 6658 addresses refer to different machines. If <userinput>yes</userinput>, <command>named</command> will 6659 not log 6660 when the serial number on the master is less than what <command>named</command> 6661 currently 6662 has. The default is <userinput>no</userinput>. 6663 </para> 6664 </listitem> 6665 </varlistentry> 6666 6667 <varlistentry> 6668 <term><command>dnssec-enable</command></term> 6669 <listitem> 6670 <para> 6671 Enable DNSSEC support in <command>named</command>. Unless set to <userinput>yes</userinput>, 6672 <command>named</command> behaves as if it does not support DNSSEC. 6673 The default is <userinput>yes</userinput>. 6674 </para> 6675 </listitem> 6676 </varlistentry> 6677 6678 <varlistentry> 6679 <term><command>dnssec-validation</command></term> 6680 <listitem> 6681 <para> 6682 Enable DNSSEC validation in <command>named</command>. 6683 Note <command>dnssec-enable</command> also needs to be 6684 set to <userinput>yes</userinput> to be effective. 6685 If set to <userinput>no</userinput>, DNSSEC validation 6686 is disabled. If set to <userinput>auto</userinput>, 6687 DNSSEC validation is enabled, and a default 6688 trust-anchor for the DNS root zone is used. If set to 6689 <userinput>yes</userinput>, DNSSEC validation is enabled, 6690 but a trust anchor must be manually configured using 6691 a <command>trusted-keys</command> or 6692 <command>managed-keys</command> statement. The default 6693 is <userinput>yes</userinput>. 6694 </para> 6695 </listitem> 6696 </varlistentry> 6697 6698 <varlistentry> 6699 <term><command>dnssec-accept-expired</command></term> 6700 <listitem> 6701 <para> 6702 Accept expired signatures when verifying DNSSEC signatures. 6703 The default is <userinput>no</userinput>. 6704 Setting this option to <userinput>yes</userinput> 6705 leaves <command>named</command> vulnerable to 6706 replay attacks. 6707 </para> 6708 </listitem> 6709 </varlistentry> 6710 6711 <varlistentry> 6712 <term><command>querylog</command></term> 6713 <listitem> 6714 <para> 6715 Specify whether query logging should be started when <command>named</command> 6716 starts. 6717 If <command>querylog</command> is not specified, 6718 then the query logging 6719 is determined by the presence of the logging category <command>queries</command>. 6720 </para> 6721 </listitem> 6722 </varlistentry> 6723 6724 <varlistentry> 6725 <term><command>check-names</command></term> 6726 <listitem> 6727 <para> 6728 This option is used to restrict the character set and syntax 6729 of 6730 certain domain names in master files and/or DNS responses 6731 received 6732 from the network. The default varies according to usage 6733 area. For 6734 <command>master</command> zones the default is <command>fail</command>. 6735 For <command>slave</command> zones the default 6736 is <command>warn</command>. 6737 For answers received from the network (<command>response</command>) 6738 the default is <command>ignore</command>. 6739 </para> 6740 <para> 6741 The rules for legal hostnames and mail domains are derived 6742 from RFC 952 and RFC 821 as modified by RFC 1123. 6743 </para> 6744 <para><command>check-names</command> 6745 applies to the owner names of A, AAAA and MX records. 6746 It also applies to the domain names in the RDATA of NS, SOA, 6747 MX, and SRV records. 6748 It also applies to the RDATA of PTR records where the owner 6749 name indicated that it is a reverse lookup of a hostname 6750 (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT). 6751 </para> 6752 </listitem> 6753 </varlistentry> 6754 6755 <varlistentry> 6756 <term><command>check-dup-records</command></term> 6757 <listitem> 6758 <para> 6759 Check master zones for records that are treated as different 6760 by DNSSEC but are semantically equal in plain DNS. The 6761 default is to <command>warn</command>. Other possible 6762 values are <command>fail</command> and 6763 <command>ignore</command>. 6764 </para> 6765 </listitem> 6766 </varlistentry> 6767 6768 <varlistentry> 6769 <term><command>check-mx</command></term> 6770 <listitem> 6771 <para> 6772 Check whether the MX record appears to refer to a IP address. 6773 The default is to <command>warn</command>. Other possible 6774 values are <command>fail</command> and 6775 <command>ignore</command>. 6776 </para> 6777 </listitem> 6778 </varlistentry> 6779 6780 <varlistentry> 6781 <term><command>check-wildcard</command></term> 6782 <listitem> 6783 <para> 6784 This option is used to check for non-terminal wildcards. 6785 The use of non-terminal wildcards is almost always as a 6786 result of a failure 6787 to understand the wildcard matching algorithm (RFC 1034). 6788 This option 6789 affects master zones. The default (<command>yes</command>) is to check 6790 for non-terminal wildcards and issue a warning. 6791 </para> 6792 </listitem> 6793 </varlistentry> 6794 6795 <varlistentry> 6796 <term><command>check-integrity</command></term> 6797 <listitem> 6798 <para> 6799 Perform post load zone integrity checks on master 6800 zones. This checks that MX and SRV records refer 6801 to address (A or AAAA) records and that glue 6802 address records exist for delegated zones. For 6803 MX and SRV records only in-zone hostnames are 6804 checked (for out-of-zone hostnames use 6805 <command>named-checkzone</command>). 6806 For NS records only names below top of zone are 6807 checked (for out-of-zone names and glue consistency 6808 checks use <command>named-checkzone</command>). 6809 The default is <command>yes</command>. 6810 </para> 6811 <para> 6812 The use of the SPF record for publishing Sender 6813 Policy Framework is deprecated as the migration 6814 from using TXT records to SPF records was abandoned. 6815 Enabling this option also checks that a TXT Sender 6816 Policy Framework record exists (starts with "v=spf1") 6817 if there is an SPF record. Warnings are emitted if the 6818 TXT record does not exist and can be suppressed with 6819 <command>check-spf</command>. 6820 </para> 6821 </listitem> 6822 </varlistentry> 6823 6824 <varlistentry> 6825 <term><command>check-mx-cname</command></term> 6826 <listitem> 6827 <para> 6828 If <command>check-integrity</command> is set then 6829 fail, warn or ignore MX records that refer 6830 to CNAMES. The default is to <command>warn</command>. 6831 </para> 6832 </listitem> 6833 </varlistentry> 6834 6835 <varlistentry> 6836 <term><command>check-srv-cname</command></term> 6837 <listitem> 6838 <para> 6839 If <command>check-integrity</command> is set then 6840 fail, warn or ignore SRV records that refer 6841 to CNAMES. The default is to <command>warn</command>. 6842 </para> 6843 </listitem> 6844 </varlistentry> 6845 6846 <varlistentry> 6847 <term><command>check-sibling</command></term> 6848 <listitem> 6849 <para> 6850 When performing integrity checks, also check that 6851 sibling glue exists. The default is <command>yes</command>. 6852 </para> 6853 </listitem> 6854 </varlistentry> 6855 6856 <varlistentry> 6857 <term><command>check-spf</command></term> 6858 <listitem> 6859 <para> 6860 If <command>check-integrity</command> is set then 6861 check that there is a TXT Sender Policy Framework 6862 record present (starts with "v=spf1") if there is an 6863 SPF record present. The default is 6864 <command>warn</command>. 6865 </para> 6866 </listitem> 6867 </varlistentry> 6868 6869 <varlistentry> 6870 <term><command>zero-no-soa-ttl</command></term> 6871 <listitem> 6872 <para> 6873 When returning authoritative negative responses to 6874 SOA queries set the TTL of the SOA record returned in 6875 the authority section to zero. 6876 The default is <command>yes</command>. 6877 </para> 6878 </listitem> 6879 </varlistentry> 6880 6881 <varlistentry> 6882 <term><command>zero-no-soa-ttl-cache</command></term> 6883 <listitem> 6884 <para> 6885 When caching a negative response to a SOA query 6886 set the TTL to zero. 6887 The default is <command>no</command>. 6888 </para> 6889 </listitem> 6890 </varlistentry> 6891 6892 <varlistentry> 6893 <term><command>update-check-ksk</command></term> 6894 <listitem> 6895 <para> 6896 When set to the default value of <literal>yes</literal>, 6897 check the KSK bit in each key to determine how the key 6898 should be used when generating RRSIGs for a secure zone. 6899 </para> 6900 <para> 6901 Ordinarily, zone-signing keys (that is, keys without the 6902 KSK bit set) are used to sign the entire zone, while 6903 key-signing keys (keys with the KSK bit set) are only 6904 used to sign the DNSKEY RRset at the zone apex. 6905 However, if this option is set to <literal>no</literal>, 6906 then the KSK bit is ignored; KSKs are treated as if they 6907 were ZSKs and are used to sign the entire zone. This is 6908 similar to the <command>dnssec-signzone -z</command> 6909 command line option. 6910 </para> 6911 <para> 6912 When this option is set to <literal>yes</literal>, there 6913 must be at least two active keys for every algorithm 6914 represented in the DNSKEY RRset: at least one KSK and one 6915 ZSK per algorithm. If there is any algorithm for which 6916 this requirement is not met, this option will be ignored 6917 for that algorithm. 6918 </para> 6919 </listitem> 6920 </varlistentry> 6921 6922 <varlistentry> 6923 <term><command>dnssec-dnskey-kskonly</command></term> 6924 <listitem> 6925 <para> 6926 When this option and <command>update-check-ksk</command> 6927 are both set to <literal>yes</literal>, only key-signing 6928 keys (that is, keys with the KSK bit set) will be used 6929 to sign the DNSKEY RRset at the zone apex. Zone-signing 6930 keys (keys without the KSK bit set) will be used to sign 6931 the remainder of the zone, but not the DNSKEY RRset. 6932 This is similar to the 6933 <command>dnssec-signzone -x</command> command line option. 6934 </para> 6935 <para> 6936 The default is <command>no</command>. If 6937 <command>update-check-ksk</command> is set to 6938 <literal>no</literal>, this option is ignored. 6939 </para> 6940 </listitem> 6941 </varlistentry> 6942 6943 <varlistentry> 6944 <term><command>dnssec-loadkeys-interval</command></term> 6945 <listitem> 6946 <para> 6947 When a zone is configured with <command>auto-dnssec 6948 maintain;</command> its key repository must be checked 6949 periodically to see if any new keys have been added 6950 or any existing keys' timing metadata has been updated 6951 (see <xref linkend="man.dnssec-keygen"/> and 6952 <xref linkend="man.dnssec-settime"/>). The 6953 <command>dnssec-loadkeys-interval</command> option 6954 sets the frequency of automatic repository checks, in 6955 minutes. The default is <literal>60</literal> (1 hour), 6956 the minimum is <literal>1</literal> (1 minute), and the 6957 maximum is <literal>1440</literal> (24 hours); any higher 6958 value is silently reduced. 6959 </para> 6960 </listitem> 6961 </varlistentry> 6962 6963 <varlistentry> 6964 <term><command>try-tcp-refresh</command></term> 6965 <listitem> 6966 <para> 6967 Try to refresh the zone using TCP if UDP queries fail. 6968 For BIND 8 compatibility, the default is 6969 <command>yes</command>. 6970 </para> 6971 </listitem> 6972 </varlistentry> 6973 6974 <varlistentry> 6975 <term><command>dnssec-secure-to-insecure</command></term> 6976 <listitem> 6977 <para> 6978 Allow a dynamic zone to transition from secure to 6979 insecure (i.e., signed to unsigned) by deleting all 6980 of the DNSKEY records. The default is <command>no</command>. 6981 If set to <command>yes</command>, and if the DNSKEY RRset 6982 at the zone apex is deleted, all RRSIG and NSEC records 6983 will be removed from the zone as well. 6984 </para> 6985 <para> 6986 If the zone uses NSEC3, then it is also necessary to 6987 delete the NSEC3PARAM RRset from the zone apex; this will 6988 cause the removal of all corresponding NSEC3 records. 6989 (It is expected that this requirement will be eliminated 6990 in a future release.) 6991 </para> 6992 <para> 6993 Note that if a zone has been configured with 6994 <command>auto-dnssec maintain</command> and the 6995 private keys remain accessible in the key repository, 6996 then the zone will be automatically signed again the 6997 next time <command>named</command> is started. 6998 </para> 6999 </listitem> 7000 </varlistentry> 7001 7002 </variablelist> 7003 7004 </sect3> 7005 7006 <sect3> 7007 <title>Forwarding</title> 7008 <para> 7009 The forwarding facility can be used to create a large site-wide 7010 cache on a few servers, reducing traffic over links to external 7011 name servers. It can also be used to allow queries by servers that 7012 do not have direct access to the Internet, but wish to look up 7013 exterior 7014 names anyway. Forwarding occurs only on those queries for which 7015 the server is not authoritative and does not have the answer in 7016 its cache. 7017 </para> 7018 7019 <variablelist> 7020 <varlistentry> 7021 <term><command>forward</command></term> 7022 <listitem> 7023 <para> 7024 This option is only meaningful if the 7025 forwarders list is not empty. A value of <varname>first</varname>, 7026 the default, causes the server to query the forwarders 7027 first — and 7028 if that doesn't answer the question, the server will then 7029 look for 7030 the answer itself. If <varname>only</varname> is 7031 specified, the 7032 server will only query the forwarders. 7033 </para> 7034 </listitem> 7035 </varlistentry> 7036 7037 <varlistentry> 7038 <term><command>forwarders</command></term> 7039 <listitem> 7040 <para> 7041 Specifies the IP addresses to be used 7042 for forwarding. The default is the empty list (no 7043 forwarding). 7044 </para> 7045 </listitem> 7046 </varlistentry> 7047 7048 </variablelist> 7049 7050 <para> 7051 Forwarding can also be configured on a per-domain basis, allowing 7052 for the global forwarding options to be overridden in a variety 7053 of ways. You can set particular domains to use different 7054 forwarders, 7055 or have a different <command>forward only/first</command> behavior, 7056 or not forward at all, see <xref linkend="zone_statement_grammar"/>. 7057 </para> 7058 </sect3> 7059 7060 <sect3> 7061 <title>Dual-stack Servers</title> 7062 <para> 7063 Dual-stack servers are used as servers of last resort to work 7064 around 7065 problems in reachability due the lack of support for either IPv4 7066 or IPv6 7067 on the host machine. 7068 </para> 7069 7070 <variablelist> 7071 <varlistentry> 7072 <term><command>dual-stack-servers</command></term> 7073 <listitem> 7074 <para> 7075 Specifies host names or addresses of machines with access to 7076 both IPv4 and IPv6 transports. If a hostname is used, the 7077 server must be able 7078 to resolve the name using only the transport it has. If the 7079 machine is dual 7080 stacked, then the <command>dual-stack-servers</command> have no effect unless 7081 access to a transport has been disabled on the command line 7082 (e.g. <command>named -4</command>). 7083 </para> 7084 </listitem> 7085 </varlistentry> 7086 </variablelist> 7087 </sect3> 7088 7089 <sect3 id="access_control"> 7090 <title>Access Control</title> 7091 7092 <para> 7093 Access to the server can be restricted based on the IP address 7094 of the requesting system. See <xref linkend="address_match_lists"/> for 7095 details on how to specify IP address lists. 7096 </para> 7097 7098 <variablelist> 7099 7100 <varlistentry> 7101 <term><command>allow-notify</command></term> 7102 <listitem> 7103 <para> 7104 Specifies which hosts are allowed to 7105 notify this server, a slave, of zone changes in addition 7106 to the zone masters. 7107 <command>allow-notify</command> may also be 7108 specified in the 7109 <command>zone</command> statement, in which case 7110 it overrides the 7111 <command>options allow-notify</command> 7112 statement. It is only meaningful 7113 for a slave zone. If not specified, the default is to 7114 process notify messages 7115 only from a zone's master. 7116 </para> 7117 </listitem> 7118 </varlistentry> 7119 7120 <varlistentry> 7121 <term><command>allow-query</command></term> 7122 <listitem> 7123 <para> 7124 Specifies which hosts are allowed to ask ordinary 7125 DNS questions. <command>allow-query</command> may 7126 also be specified in the <command>zone</command> 7127 statement, in which case it overrides the 7128 <command>options allow-query</command> statement. 7129 If not specified, the default is to allow queries 7130 from all hosts. 7131 </para> 7132 <note> 7133 <para> 7134 <command>allow-query-cache</command> is now 7135 used to specify access to the cache. 7136 </para> 7137 </note> 7138 </listitem> 7139 </varlistentry> 7140 7141 <varlistentry> 7142 <term><command>allow-query-on</command></term> 7143 <listitem> 7144 <para> 7145 Specifies which local addresses can accept ordinary 7146 DNS questions. This makes it possible, for instance, 7147 to allow queries on internal-facing interfaces but 7148 disallow them on external-facing ones, without 7149 necessarily knowing the internal network's addresses. 7150 </para> 7151 <para> 7152 Note that <command>allow-query-on</command> is only 7153 checked for queries that are permitted by 7154 <command>allow-query</command>. A query must be 7155 allowed by both ACLs, or it will be refused. 7156 </para> 7157 <para> 7158 <command>allow-query-on</command> may 7159 also be specified in the <command>zone</command> 7160 statement, in which case it overrides the 7161 <command>options allow-query-on</command> statement. 7162 </para> 7163 <para> 7164 If not specified, the default is to allow queries 7165 on all addresses. 7166 </para> 7167 <note> 7168 <para> 7169 <command>allow-query-cache</command> is 7170 used to specify access to the cache. 7171 </para> 7172 </note> 7173 </listitem> 7174 </varlistentry> 7175 7176 <varlistentry> 7177 <term><command>allow-query-cache</command></term> 7178 <listitem> 7179 <para> 7180 Specifies which hosts are allowed to get answers 7181 from the cache. If <command>allow-query-cache</command> 7182 is not set then <command>allow-recursion</command> 7183 is used if set, otherwise <command>allow-query</command> 7184 is used if set unless <command>recursion no;</command> is 7185 set in which case <command>none;</command> is used, 7186 otherwise the default (<command>localnets;</command> 7187 <command>localhost;</command>) is used. 7188 </para> 7189 </listitem> 7190 </varlistentry> 7191 7192 <varlistentry> 7193 <term><command>allow-query-cache-on</command></term> 7194 <listitem> 7195 <para> 7196 Specifies which local addresses can give answers 7197 from the cache. If not specified, the default is 7198 to allow cache queries on any address, 7199 <command>localnets</command> and 7200 <command>localhost</command>. 7201 </para> 7202 </listitem> 7203 </varlistentry> 7204 7205 <varlistentry> 7206 <term><command>allow-recursion</command></term> 7207 <listitem> 7208 <para> 7209 Specifies which hosts are allowed to make recursive 7210 queries through this server. If 7211 <command>allow-recursion</command> is not set 7212 then <command>allow-query-cache</command> is 7213 used if set, otherwise <command>allow-query</command> 7214 is used if set, otherwise the default 7215 (<command>localnets;</command> 7216 <command>localhost;</command>) is used. 7217 </para> 7218 </listitem> 7219 </varlistentry> 7220 7221 <varlistentry> 7222 <term><command>allow-recursion-on</command></term> 7223 <listitem> 7224 <para> 7225 Specifies which local addresses can accept recursive 7226 queries. If not specified, the default is to allow 7227 recursive queries on all addresses. 7228 </para> 7229 </listitem> 7230 </varlistentry> 7231 7232 <varlistentry> 7233 <term><command>allow-update</command></term> 7234 <listitem> 7235 <para> 7236 Specifies which hosts are allowed to 7237 submit Dynamic DNS updates for master zones. The default is 7238 to deny 7239 updates from all hosts. Note that allowing updates based 7240 on the requestor's IP address is insecure; see 7241 <xref linkend="dynamic_update_security"/> for details. 7242 </para> 7243 </listitem> 7244 </varlistentry> 7245 7246 <varlistentry> 7247 <term><command>allow-update-forwarding</command></term> 7248 <listitem> 7249 <para> 7250 Specifies which hosts are allowed to 7251 submit Dynamic DNS updates to slave zones to be forwarded to 7252 the 7253 master. The default is <userinput>{ none; }</userinput>, 7254 which 7255 means that no update forwarding will be performed. To 7256 enable 7257 update forwarding, specify 7258 <userinput>allow-update-forwarding { any; };</userinput>. 7259 Specifying values other than <userinput>{ none; }</userinput> or 7260 <userinput>{ any; }</userinput> is usually 7261 counterproductive, since 7262 the responsibility for update access control should rest 7263 with the 7264 master server, not the slaves. 7265 </para> 7266 <para> 7267 Note that enabling the update forwarding feature on a slave 7268 server 7269 may expose master servers relying on insecure IP address 7270 based 7271 access control to attacks; see <xref linkend="dynamic_update_security"/> 7272 for more details. 7273 </para> 7274 </listitem> 7275 </varlistentry> 7276 7277 <varlistentry> 7278 <term><command>allow-v6-synthesis</command></term> 7279 <listitem> 7280 <para> 7281 This option was introduced for the smooth transition from 7282 AAAA 7283 to A6 and from "nibble labels" to binary labels. 7284 However, since both A6 and binary labels were then 7285 deprecated, 7286 this option was also deprecated. 7287 It is now ignored with some warning messages. 7288 </para> 7289 </listitem> 7290 </varlistentry> 7291 7292 <varlistentry> 7293 <term><command>allow-transfer</command></term> 7294 <listitem> 7295 <para> 7296 Specifies which hosts are allowed to 7297 receive zone transfers from the server. <command>allow-transfer</command> may 7298 also be specified in the <command>zone</command> 7299 statement, in which 7300 case it overrides the <command>options allow-transfer</command> statement. 7301 If not specified, the default is to allow transfers to all 7302 hosts. 7303 </para> 7304 </listitem> 7305 </varlistentry> 7306 7307 <varlistentry> 7308 <term><command>blackhole</command></term> 7309 <listitem> 7310 <para> 7311 Specifies a list of addresses that the 7312 server will not accept queries from or use to resolve a 7313 query. Queries 7314 from these addresses will not be responded to. The default 7315 is <userinput>none</userinput>. 7316 </para> 7317 </listitem> 7318 </varlistentry> 7319 7320 <varlistentry> 7321 <term><command>filter-aaaa</command></term> 7322 <listitem> 7323 <para> 7324 Specifies a list of addresses to which 7325 <command>filter-aaaa-on-v4</command> 7326 is applies. The default is <userinput>any</userinput>. 7327 </para> 7328 </listitem> 7329 </varlistentry> 7330 7331 <varlistentry> 7332 <term><command>no-case-compress</command></term> <listitem> 7333 <para> 7334 Specifies a list of addresses which require responses 7335 to use case-insensitive compression. This ACL can be 7336 used when <command>named</command> needs to work with 7337 clients that do not comply with the requirement in RFC 7338 1034 to use case-insensitive name comparisons when 7339 checking for matching domain names. 7340 </para> 7341 <para> 7342 If left undefined, the ACL defaults to 7343 <command>none</command>: case-insensitive compression 7344 will be used for all clients. If the ACL is defined and 7345 matches a client, then case will be ignored when 7346 compressing domain names in DNS responses sent to that 7347 client. 7348 </para> 7349 <para> 7350 This can result in slightly smaller responses: if 7351 a response contains the names "example.com" and 7352 "example.COM", case-insensitive compression would treat 7353 the second one as a duplicate. It also ensures 7354 that the case of the query name exactly matches the 7355 case of the owner names of returned records, rather 7356 than matching the case of the records entered in 7357 the zone file. This allows responses to exactly 7358 match the query, which is required by some clients 7359 due to incorrect use of case-sensitive comparisons. 7360 </para> 7361 <para> 7362 Case-insensitive compression is <emphasis>always</emphasis> 7363 used in AXFR and IXFR responses, regardless of whether 7364 the client matches this ACL. 7365 </para> 7366 <para> 7367 There are circumstances in which <command>named</command> 7368 will not preserve the case of owner names of records: 7369 if a zone file defines records of different types with 7370 the same name, but the capitalization of the name is 7371 different (e.g., "www.example.com/A" and 7372 "WWW.EXAMPLE.COM/AAAA"), then all responses for that 7373 name will use the <emphasis>first</emphasis> version 7374 of the name that was used in the zone file. This 7375 limitation may be addressed in a future release. However, 7376 domain names specified in the rdata of resource records 7377 (i.e., records of type NS, MX, CNAME, etc) will always 7378 have their case preserved unless the client matches this 7379 ACL. 7380 </para> 7381 </listitem> 7382 </varlistentry> 7383 7384 <varlistentry> 7385 <term><command>resolver-query-timeout</command></term> 7386 <listitem> 7387 <para> 7388 The amount of time the resolver will spend attempting 7389 to resolve a recursive query before failing. The default 7390 and minimum is <literal>10</literal> and the maximum is 7391 <literal>30</literal>. Setting it to <literal>0</literal> 7392 will result in the default being used. 7393 </para> 7394 </listitem> 7395 </varlistentry> 7396 </variablelist> 7397 7398 </sect3> 7399 7400 <sect3> 7401 <title>Interfaces</title> 7402 <para> 7403 The interfaces and ports that the server will answer queries 7404 from may be specified using the <command>listen-on</command> option. <command>listen-on</command> takes 7405 an optional port and an <varname>address_match_list</varname> 7406 of IPv4 addresses. (IPv6 addresses are ignored, with a 7407 logged warning.) 7408 The server will listen on all interfaces allowed by the address 7409 match list. If a port is not specified, port 53 will be used. 7410 </para> 7411 <para> 7412 Multiple <command>listen-on</command> statements are 7413 allowed. 7414 For example, 7415 </para> 7416 7417<programlisting>listen-on { 5.6.7.8; }; 7418listen-on port 1234 { !1.2.3.4; 1.2/16; }; 7419</programlisting> 7420 7421 <para> 7422 will enable the name server on port 53 for the IP address 7423 5.6.7.8, and on port 1234 of an address on the machine in net 7424 1.2 that is not 1.2.3.4. 7425 </para> 7426 7427 <para> 7428 If no <command>listen-on</command> is specified, the 7429 server will listen on port 53 on all IPv4 interfaces. 7430 </para> 7431 7432 <para> 7433 The <command>listen-on-v6</command> option is used to 7434 specify the interfaces and the ports on which the server will 7435 listen for incoming queries sent using IPv6. If not specified, 7436 the server will listen on port 53 on all IPv6 interfaces. 7437 </para> 7438 7439 <para> 7440 When <programlisting>{ any; }</programlisting> is 7441 specified 7442 as the <varname>address_match_list</varname> for the 7443 <command>listen-on-v6</command> option, 7444 the server does not bind a separate socket to each IPv6 interface 7445 address as it does for IPv4 if the operating system has enough API 7446 support for IPv6 (specifically if it conforms to RFC 3493 and RFC 7447 3542). 7448 Instead, it listens on the IPv6 wildcard address. 7449 If the system only has incomplete API support for IPv6, however, 7450 the behavior is the same as that for IPv4. 7451 </para> 7452 7453 <para> 7454 A list of particular IPv6 addresses can also be specified, in 7455 which case 7456 the server listens on a separate socket for each specified 7457 address, 7458 regardless of whether the desired API is supported by the system. 7459 IPv4 addresses specified in <command>listen-on-v6</command> 7460 will be ignored, with a logged warning. 7461 </para> 7462 7463 <para> 7464 Multiple <command>listen-on-v6</command> options can 7465 be used. 7466 For example, 7467 </para> 7468 7469<programlisting>listen-on-v6 { any; }; 7470listen-on-v6 port 1234 { !2001:db8::/32; any; }; 7471</programlisting> 7472 7473 <para> 7474 will enable the name server on port 53 for any IPv6 addresses 7475 (with a single wildcard socket), 7476 and on port 1234 of IPv6 addresses that is not in the prefix 7477 2001:db8::/32 (with separate sockets for each matched address.) 7478 </para> 7479 7480 <para> 7481 To make the server not listen on any IPv6 address, use 7482 </para> 7483 7484<programlisting>listen-on-v6 { none; }; 7485</programlisting> 7486 7487 </sect3> 7488 7489 <sect3 id="query_address"> 7490 <title>Query Address</title> 7491 <para> 7492 If the server doesn't know the answer to a question, it will 7493 query other name servers. <command>query-source</command> specifies 7494 the address and port used for such queries. For queries sent over 7495 IPv6, there is a separate <command>query-source-v6</command> option. 7496 If <command>address</command> is <command>*</command> (asterisk) or is omitted, 7497 a wildcard IP address (<command>INADDR_ANY</command>) 7498 will be used. 7499 </para> 7500 7501 <para> 7502 If <command>port</command> is <command>*</command> or is omitted, 7503 a random port number from a pre-configured 7504 range is picked up and will be used for each query. 7505 The port range(s) is that specified in 7506 the <command>use-v4-udp-ports</command> (for IPv4) 7507 and <command>use-v6-udp-ports</command> (for IPv6) 7508 options, excluding the ranges specified in 7509 the <command>avoid-v4-udp-ports</command> 7510 and <command>avoid-v6-udp-ports</command> options, respectively. 7511 </para> 7512 7513 <para> 7514 The defaults of the <command>query-source</command> and 7515 <command>query-source-v6</command> options 7516 are: 7517 </para> 7518 7519<programlisting>query-source address * port *; 7520query-source-v6 address * port *; 7521</programlisting> 7522 7523 <para> 7524 If <command>use-v4-udp-ports</command> or 7525 <command>use-v6-udp-ports</command> is unspecified, 7526 <command>named</command> will check if the operating 7527 system provides a programming interface to retrieve the 7528 system's default range for ephemeral ports. 7529 If such an interface is available, 7530 <command>named</command> will use the corresponding system 7531 default range; otherwise, it will use its own defaults: 7532 </para> 7533 7534<programlisting>use-v4-udp-ports { range 1024 65535; }; 7535use-v6-udp-ports { range 1024 65535; }; 7536</programlisting> 7537 7538 <para> 7539 Note: make sure the ranges be sufficiently large for 7540 security. A desirable size depends on various parameters, 7541 but we generally recommend it contain at least 16384 ports 7542 (14 bits of entropy). 7543 Note also that the system's default range when used may be 7544 too small for this purpose, and that the range may even be 7545 changed while <command>named</command> is running; the new 7546 range will automatically be applied when <command>named</command> 7547 is reloaded. 7548 It is encouraged to 7549 configure <command>use-v4-udp-ports</command> and 7550 <command>use-v6-udp-ports</command> explicitly so that the 7551 ranges are sufficiently large and are reasonably 7552 independent from the ranges used by other applications. 7553 </para> 7554 7555 <para> 7556 Note: the operational configuration 7557 where <command>named</command> runs may prohibit the use 7558 of some ports. For example, UNIX systems will not allow 7559 <command>named</command> running without a root privilege 7560 to use ports less than 1024. 7561 If such ports are included in the specified (or detected) 7562 set of query ports, the corresponding query attempts will 7563 fail, resulting in resolution failures or delay. 7564 It is therefore important to configure the set of ports 7565 that can be safely used in the expected operational environment. 7566 </para> 7567 7568 <para> 7569 The defaults of the <command>avoid-v4-udp-ports</command> and 7570 <command>avoid-v6-udp-ports</command> options 7571 are: 7572 </para> 7573 7574<programlisting>avoid-v4-udp-ports {}; 7575avoid-v6-udp-ports {}; 7576</programlisting> 7577 7578 <para> 7579 Note: BIND 9.5.0 introduced 7580 the <command>use-queryport-pool</command> 7581 option to support a pool of such random ports, but this 7582 option is now obsolete because reusing the same ports in 7583 the pool may not be sufficiently secure. 7584 For the same reason, it is generally strongly discouraged to 7585 specify a particular port for the 7586 <command>query-source</command> or 7587 <command>query-source-v6</command> options; 7588 it implicitly disables the use of randomized port numbers. 7589 </para> 7590 7591 <variablelist> 7592 <varlistentry> 7593 <term><command>use-queryport-pool</command></term> 7594 <listitem> 7595 <para> 7596 This option is obsolete. 7597 </para> 7598 </listitem> 7599 </varlistentry> 7600 7601 <varlistentry> 7602 <term><command>queryport-pool-ports</command></term> 7603 <listitem> 7604 <para> 7605 This option is obsolete. 7606 </para> 7607 </listitem> 7608 </varlistentry> 7609 7610 <varlistentry> 7611 <term><command>queryport-pool-updateinterval</command></term> 7612 <listitem> 7613 <para> 7614 This option is obsolete. 7615 </para> 7616 </listitem> 7617 </varlistentry> 7618 7619 </variablelist> 7620 <note> 7621 <para> 7622 The address specified in the <command>query-source</command> option 7623 is used for both UDP and TCP queries, but the port applies only 7624 to UDP queries. TCP queries always use a random 7625 unprivileged port. 7626 </para> 7627 </note> 7628 <note> 7629 <para> 7630 Solaris 2.5.1 and earlier does not support setting the source 7631 address for TCP sockets. 7632 </para> 7633 </note> 7634 <note> 7635 <para> 7636 See also <command>transfer-source</command> and 7637 <command>notify-source</command>. 7638 </para> 7639 </note> 7640 </sect3> 7641 7642 <sect3 id="zone_transfers"> 7643 <title>Zone Transfers</title> 7644 <para> 7645 <acronym>BIND</acronym> has mechanisms in place to 7646 facilitate zone transfers 7647 and set limits on the amount of load that transfers place on the 7648 system. The following options apply to zone transfers. 7649 </para> 7650 7651 <variablelist> 7652 7653 <varlistentry> 7654 <term><command>also-notify</command></term> 7655 <listitem> 7656 <para> 7657 Defines a global list of IP addresses of name servers 7658 that are also sent NOTIFY messages whenever a fresh copy of 7659 the 7660 zone is loaded, in addition to the servers listed in the 7661 zone's NS records. 7662 This helps to ensure that copies of the zones will 7663 quickly converge on stealth servers. 7664 Optionally, a port may be specified with each 7665 <command>also-notify</command> address to send 7666 the notify messages to a port other than the 7667 default of 53. 7668 An optional TSIG key can also be specified with each 7669 address to cause the notify messages to be signed; this 7670 can be useful when sending notifies to multiple views. 7671 In place of explicit addresses, one or more named 7672 <command>masters</command> lists can be used. 7673 </para> 7674 <para> 7675 If an <command>also-notify</command> list 7676 is given in a <command>zone</command> statement, 7677 it will override 7678 the <command>options also-notify</command> 7679 statement. When a <command>zone notify</command> 7680 statement 7681 is set to <command>no</command>, the IP 7682 addresses in the global <command>also-notify</command> list will 7683 not be sent NOTIFY messages for that zone. The default is 7684 the empty 7685 list (no global notification list). 7686 </para> 7687 </listitem> 7688 </varlistentry> 7689 7690 <varlistentry> 7691 <term><command>max-transfer-time-in</command></term> 7692 <listitem> 7693 <para> 7694 Inbound zone transfers running longer than 7695 this many minutes will be terminated. The default is 120 7696 minutes 7697 (2 hours). The maximum value is 28 days (40320 minutes). 7698 </para> 7699 </listitem> 7700 </varlistentry> 7701 7702 <varlistentry> 7703 <term><command>max-transfer-idle-in</command></term> 7704 <listitem> 7705 <para> 7706 Inbound zone transfers making no progress 7707 in this many minutes will be terminated. The default is 60 7708 minutes 7709 (1 hour). The maximum value is 28 days (40320 minutes). 7710 </para> 7711 </listitem> 7712 </varlistentry> 7713 7714 <varlistentry> 7715 <term><command>max-transfer-time-out</command></term> 7716 <listitem> 7717 <para> 7718 Outbound zone transfers running longer than 7719 this many minutes will be terminated. The default is 120 7720 minutes 7721 (2 hours). The maximum value is 28 days (40320 minutes). 7722 </para> 7723 </listitem> 7724 </varlistentry> 7725 7726 <varlistentry> 7727 <term><command>max-transfer-idle-out</command></term> 7728 <listitem> 7729 <para> 7730 Outbound zone transfers making no progress 7731 in this many minutes will be terminated. The default is 60 7732 minutes (1 7733 hour). The maximum value is 28 days (40320 minutes). 7734 </para> 7735 </listitem> 7736 </varlistentry> 7737 7738 <varlistentry> 7739 <term><command>serial-query-rate</command></term> 7740 <listitem> 7741 <para> 7742 Slave servers will periodically query master 7743 servers to find out if zone serial numbers have 7744 changed. Each such query uses a minute amount of 7745 the slave server's network bandwidth. To limit 7746 the amount of bandwidth used, BIND 9 limits the 7747 rate at which queries are sent. The value of the 7748 <command>serial-query-rate</command> option, an 7749 integer, is the maximum number of queries sent 7750 per second. The default is 20 per second. 7751 The lowest possible rate is one per second; when set 7752 to zero, it will be silently raised to one. 7753 </para> 7754 <para> 7755 In addition to controlling the rate SOA refresh 7756 queries are issued at 7757 <command>serial-query-rate</command> also controls 7758 the rate at which NOTIFY messages are sent from 7759 both master and slave zones. 7760 </para> 7761 </listitem> 7762 </varlistentry> 7763 7764 <varlistentry> 7765 <term><command>serial-queries</command></term> 7766 <listitem> 7767 <para> 7768 In BIND 8, the <command>serial-queries</command> 7769 option 7770 set the maximum number of concurrent serial number queries 7771 allowed to be outstanding at any given time. 7772 BIND 9 does not limit the number of outstanding 7773 serial queries and ignores the <command>serial-queries</command> option. 7774 Instead, it limits the rate at which the queries are sent 7775 as defined using the <command>serial-query-rate</command> option. 7776 </para> 7777 </listitem> 7778 </varlistentry> 7779 7780 <varlistentry> 7781 <term><command>transfer-format</command></term> 7782 <listitem> 7783 7784 <para> 7785 Zone transfers can be sent using two different formats, 7786 <command>one-answer</command> and 7787 <command>many-answers</command>. 7788 The <command>transfer-format</command> option is used 7789 on the master server to determine which format it sends. 7790 <command>one-answer</command> uses one DNS message per 7791 resource record transferred. 7792 <command>many-answers</command> packs as many resource 7793 records as possible into a message. 7794 <command>many-answers</command> is more efficient, but is 7795 only supported by relatively new slave servers, 7796 such as <acronym>BIND</acronym> 9, <acronym>BIND</acronym> 7797 8.x and <acronym>BIND</acronym> 4.9.5 onwards. 7798 The <command>many-answers</command> format is also supported by 7799 recent Microsoft Windows nameservers. 7800 The default is <command>many-answers</command>. 7801 <command>transfer-format</command> may be overridden on a 7802 per-server basis by using the <command>server</command> 7803 statement. 7804 </para> 7805 7806 </listitem> 7807 </varlistentry> 7808 7809 <varlistentry> 7810 <term><command>transfers-in</command></term> 7811 <listitem> 7812 <para> 7813 The maximum number of inbound zone transfers 7814 that can be running concurrently. The default value is <literal>10</literal>. 7815 Increasing <command>transfers-in</command> may 7816 speed up the convergence 7817 of slave zones, but it also may increase the load on the 7818 local system. 7819 </para> 7820 </listitem> 7821 </varlistentry> 7822 7823 <varlistentry> 7824 <term><command>transfers-out</command></term> 7825 <listitem> 7826 <para> 7827 The maximum number of outbound zone transfers 7828 that can be running concurrently. Zone transfer requests in 7829 excess 7830 of the limit will be refused. The default value is <literal>10</literal>. 7831 </para> 7832 </listitem> 7833 </varlistentry> 7834 7835 <varlistentry> 7836 <term><command>transfers-per-ns</command></term> 7837 <listitem> 7838 <para> 7839 The maximum number of inbound zone transfers 7840 that can be concurrently transferring from a given remote 7841 name server. 7842 The default value is <literal>2</literal>. 7843 Increasing <command>transfers-per-ns</command> 7844 may 7845 speed up the convergence of slave zones, but it also may 7846 increase 7847 the load on the remote name server. <command>transfers-per-ns</command> may 7848 be overridden on a per-server basis by using the <command>transfers</command> phrase 7849 of the <command>server</command> statement. 7850 </para> 7851 </listitem> 7852 </varlistentry> 7853 7854 <varlistentry> 7855 <term><command>transfer-source</command></term> 7856 <listitem> 7857 <para><command>transfer-source</command> 7858 determines which local address will be bound to IPv4 7859 TCP connections used to fetch zones transferred 7860 inbound by the server. It also determines the 7861 source IPv4 address, and optionally the UDP port, 7862 used for the refresh queries and forwarded dynamic 7863 updates. If not set, it defaults to a system 7864 controlled value which will usually be the address 7865 of the interface "closest to" the remote end. This 7866 address must appear in the remote end's 7867 <command>allow-transfer</command> option for the 7868 zone being transferred, if one is specified. This 7869 statement sets the 7870 <command>transfer-source</command> for all zones, 7871 but can be overridden on a per-view or per-zone 7872 basis by including a 7873 <command>transfer-source</command> statement within 7874 the <command>view</command> or 7875 <command>zone</command> block in the configuration 7876 file. 7877 </para> 7878 <note> 7879 <para> 7880 Solaris 2.5.1 and earlier does not support setting the 7881 source address for TCP sockets. 7882 </para> 7883 </note> 7884 </listitem> 7885 </varlistentry> 7886 7887 <varlistentry> 7888 <term><command>transfer-source-v6</command></term> 7889 <listitem> 7890 <para> 7891 The same as <command>transfer-source</command>, 7892 except zone transfers are performed using IPv6. 7893 </para> 7894 </listitem> 7895 </varlistentry> 7896 7897 <varlistentry> 7898 <term><command>alt-transfer-source</command></term> 7899 <listitem> 7900 <para> 7901 An alternate transfer source if the one listed in 7902 <command>transfer-source</command> fails and 7903 <command>use-alt-transfer-source</command> is 7904 set. 7905 </para> 7906 <note> 7907 If you do not wish the alternate transfer source 7908 to be used, you should set 7909 <command>use-alt-transfer-source</command> 7910 appropriately and you should not depend upon 7911 getting an answer back to the first refresh 7912 query. 7913 </note> 7914 </listitem> 7915 </varlistentry> 7916 7917 <varlistentry> 7918 <term><command>alt-transfer-source-v6</command></term> 7919 <listitem> 7920 <para> 7921 An alternate transfer source if the one listed in 7922 <command>transfer-source-v6</command> fails and 7923 <command>use-alt-transfer-source</command> is 7924 set. 7925 </para> 7926 </listitem> 7927 </varlistentry> 7928 7929 <varlistentry> 7930 <term><command>use-alt-transfer-source</command></term> 7931 <listitem> 7932 <para> 7933 Use the alternate transfer sources or not. If views are 7934 specified this defaults to <command>no</command> 7935 otherwise it defaults to 7936 <command>yes</command> (for BIND 8 7937 compatibility). 7938 </para> 7939 </listitem> 7940 </varlistentry> 7941 7942 <varlistentry> 7943 <term><command>notify-source</command></term> 7944 <listitem> 7945 <para><command>notify-source</command> 7946 determines which local source address, and 7947 optionally UDP port, will be used to send NOTIFY 7948 messages. This address must appear in the slave 7949 server's <command>masters</command> zone clause or 7950 in an <command>allow-notify</command> clause. This 7951 statement sets the <command>notify-source</command> 7952 for all zones, but can be overridden on a per-zone or 7953 per-view basis by including a 7954 <command>notify-source</command> statement within 7955 the <command>zone</command> or 7956 <command>view</command> block in the configuration 7957 file. 7958 </para> 7959 <note> 7960 <para> 7961 Solaris 2.5.1 and earlier does not support setting the 7962 source address for TCP sockets. 7963 </para> 7964 </note> 7965 </listitem> 7966 </varlistentry> 7967 7968 <varlistentry> 7969 <term><command>notify-source-v6</command></term> 7970 <listitem> 7971 <para> 7972 Like <command>notify-source</command>, 7973 but applies to notify messages sent to IPv6 addresses. 7974 </para> 7975 </listitem> 7976 </varlistentry> 7977 7978 </variablelist> 7979 7980 </sect3> 7981 7982 <sect3> 7983 <title>UDP Port Lists</title> 7984 <para> 7985 <command>use-v4-udp-ports</command>, 7986 <command>avoid-v4-udp-ports</command>, 7987 <command>use-v6-udp-ports</command>, and 7988 <command>avoid-v6-udp-ports</command> 7989 specify a list of IPv4 and IPv6 UDP ports that will be 7990 used or not used as source ports for UDP messages. 7991 See <xref linkend="query_address"/> about how the 7992 available ports are determined. 7993 For example, with the following configuration 7994 </para> 7995 7996<programlisting> 7997use-v6-udp-ports { range 32768 65535; }; 7998avoid-v6-udp-ports { 40000; range 50000 60000; }; 7999</programlisting> 8000 8001 <para> 8002 UDP ports of IPv6 messages sent 8003 from <command>named</command> will be in one 8004 of the following ranges: 32768 to 39999, 40001 to 49999, 8005 and 60001 to 65535. 8006 </para> 8007 8008 <para> 8009 <command>avoid-v4-udp-ports</command> and 8010 <command>avoid-v6-udp-ports</command> can be used 8011 to prevent <command>named</command> from choosing as its random source port a 8012 port that is blocked by your firewall or a port that is 8013 used by other applications; 8014 if a query went out with a source port blocked by a 8015 firewall, the 8016 answer would not get by the firewall and the name server would 8017 have to query again. 8018 Note: the desired range can also be represented only with 8019 <command>use-v4-udp-ports</command> and 8020 <command>use-v6-udp-ports</command>, and the 8021 <command>avoid-</command> options are redundant in that 8022 sense; they are provided for backward compatibility and 8023 to possibly simplify the port specification. 8024 </para> 8025 </sect3> 8026 8027 <sect3> 8028 <title>Operating System Resource Limits</title> 8029 8030 <para> 8031 The server's usage of many system resources can be limited. 8032 Scaled values are allowed when specifying resource limits. For 8033 example, <command>1G</command> can be used instead of 8034 <command>1073741824</command> to specify a limit of 8035 one 8036 gigabyte. <command>unlimited</command> requests 8037 unlimited use, or the 8038 maximum available amount. <command>default</command> 8039 uses the limit 8040 that was in force when the server was started. See the description 8041 of <command>size_spec</command> in <xref linkend="configuration_file_elements"/>. 8042 </para> 8043 8044 <para> 8045 The following options set operating system resource limits for 8046 the name server process. Some operating systems don't support 8047 some or 8048 any of the limits. On such systems, a warning will be issued if 8049 the 8050 unsupported limit is used. 8051 </para> 8052 8053 <variablelist> 8054 8055 <varlistentry> 8056 <term><command>coresize</command></term> 8057 <listitem> 8058 <para> 8059 The maximum size of a core dump. The default 8060 is <literal>default</literal>. 8061 </para> 8062 </listitem> 8063 </varlistentry> 8064 8065 <varlistentry> 8066 <term><command>datasize</command></term> 8067 <listitem> 8068 <para> 8069 The maximum amount of data memory the server 8070 may use. The default is <literal>default</literal>. 8071 This is a hard limit on server memory usage. 8072 If the server attempts to allocate memory in excess of this 8073 limit, the allocation will fail, which may in turn leave 8074 the server unable to perform DNS service. Therefore, 8075 this option is rarely useful as a way of limiting the 8076 amount of memory used by the server, but it can be used 8077 to raise an operating system data size limit that is 8078 too small by default. If you wish to limit the amount 8079 of memory used by the server, use the 8080 <command>max-cache-size</command> and 8081 <command>recursive-clients</command> 8082 options instead. 8083 </para> 8084 </listitem> 8085 </varlistentry> 8086 8087 <varlistentry> 8088 <term><command>files</command></term> 8089 <listitem> 8090 <para> 8091 The maximum number of files the server 8092 may have open concurrently. The default is <literal>unlimited</literal>. 8093 </para> 8094 </listitem> 8095 </varlistentry> 8096 8097 <varlistentry> 8098 <term><command>stacksize</command></term> 8099 <listitem> 8100 <para> 8101 The maximum amount of stack memory the server 8102 may use. The default is <literal>default</literal>. 8103 </para> 8104 </listitem> 8105 </varlistentry> 8106 8107 </variablelist> 8108 8109 </sect3> 8110 8111 <sect3 id="server_resource_limits"> 8112 <title>Server Resource Limits</title> 8113 8114 <para> 8115 The following options set limits on the server's 8116 resource consumption that are enforced internally by the 8117 server rather than the operating system. 8118 </para> 8119 8120 <variablelist> 8121 8122 <varlistentry> 8123 <term><command>max-ixfr-log-size</command></term> 8124 <listitem> 8125 <para> 8126 This option is obsolete; it is accepted 8127 and ignored for BIND 8 compatibility. The option 8128 <command>max-journal-size</command> performs a 8129 similar function in BIND 9. 8130 </para> 8131 </listitem> 8132 </varlistentry> 8133 8134 <varlistentry> 8135 <term><command>max-journal-size</command></term> 8136 <listitem> 8137 <para> 8138 Sets a maximum size for each journal file 8139 (see <xref linkend="journal"/>). When the journal file 8140 approaches 8141 the specified size, some of the oldest transactions in the 8142 journal 8143 will be automatically removed. The largest permitted 8144 value is 2 gigabytes. The default is 8145 <literal>unlimited</literal>, which also 8146 means 2 gigabytes. 8147 This may also be set on a per-zone basis. 8148 </para> 8149 </listitem> 8150 </varlistentry> 8151 8152 <varlistentry> 8153 <term><command>host-statistics-max</command></term> 8154 <listitem> 8155 <para> 8156 In BIND 8, specifies the maximum number of host statistics 8157 entries to be kept. 8158 Not implemented in BIND 9. 8159 </para> 8160 </listitem> 8161 </varlistentry> 8162 8163 <varlistentry> 8164 <term><command>recursive-clients</command></term> 8165 <listitem> 8166 <para> 8167 The maximum number of simultaneous recursive lookups 8168 the server will perform on behalf of clients. The default 8169 is 8170 <literal>1000</literal>. Because each recursing 8171 client uses a fair 8172 bit of memory, on the order of 20 kilobytes, the value of 8173 the 8174 <command>recursive-clients</command> option may 8175 have to be decreased 8176 on hosts with limited memory. 8177 </para> 8178 </listitem> 8179 </varlistentry> 8180 8181 <varlistentry> 8182 <term><command>tcp-clients</command></term> 8183 <listitem> 8184 <para> 8185 The maximum number of simultaneous client TCP 8186 connections that the server will accept. 8187 The default is <literal>100</literal>. 8188 </para> 8189 </listitem> 8190 </varlistentry> 8191 8192 <varlistentry> 8193 <term><command>reserved-sockets</command></term> 8194 <listitem> 8195 <para> 8196 The number of file descriptors reserved for TCP, stdio, 8197 etc. This needs to be big enough to cover the number of 8198 interfaces <command>named</command> listens on, <command>tcp-clients</command> as well as 8199 to provide room for outgoing TCP queries and incoming zone 8200 transfers. The default is <literal>512</literal>. 8201 The minimum value is <literal>128</literal> and the 8202 maximum value is <literal>128</literal> less than 8203 maxsockets (-S). This option may be removed in the future. 8204 </para> 8205 <para> 8206 This option has little effect on Windows. 8207 </para> 8208 </listitem> 8209 </varlistentry> 8210 8211 <varlistentry> 8212 <term><command>max-cache-size</command></term> 8213 <listitem> 8214 <para> 8215 The maximum amount of memory to use for the 8216 server's cache, in bytes. 8217 When the amount of data in the cache 8218 reaches this limit, the server will cause records to 8219 expire prematurely based on an LRU based strategy so 8220 that the limit is not exceeded. 8221 The keyword <userinput>unlimited</userinput>, 8222 or the value 0, will place no limit on cache size; 8223 records will be purged from the cache only when their 8224 TTLs expire. 8225 Any positive values less than 2MB will be ignored 8226 and reset to 2MB. 8227 In a server with multiple views, the limit applies 8228 separately to the cache of each view. 8229 The default is <userinput>unlimited</userinput>. 8230 </para> 8231 </listitem> 8232 </varlistentry> 8233 8234 <varlistentry> 8235 <term><command>tcp-listen-queue</command></term> 8236 <listitem> 8237 <para> 8238 The listen queue depth. The default and minimum is 10. 8239 If the kernel supports the accept filter "dataready" this 8240 also controls how 8241 many TCP connections that will be queued in kernel space 8242 waiting for 8243 some data before being passed to accept. Nonzero values 8244 less than 10 will be silently raised. A value of 0 may also 8245 be used; on most platforms this sets the listen queue 8246 length to a system-defined default value. 8247 </para> 8248 </listitem> 8249 </varlistentry> 8250 8251 </variablelist> 8252 8253 </sect3> 8254 8255 <sect3> 8256 <title>Periodic Task Intervals</title> 8257 8258 <variablelist> 8259 8260 <varlistentry> 8261 <term><command>cleaning-interval</command></term> 8262 <listitem> 8263 <para> 8264 This interval is effectively obsolete. Previously, 8265 the server would remove expired resource records 8266 from the cache every <command>cleaning-interval</command> minutes. 8267 <acronym>BIND</acronym> 9 now manages cache 8268 memory in a more sophisticated manner and does not 8269 rely on the periodic cleaning any more. 8270 Specifying this option therefore has no effect on 8271 the server's behavior. 8272 </para> 8273 </listitem> 8274 </varlistentry> 8275 8276 <varlistentry> 8277 <term><command>heartbeat-interval</command></term> 8278 <listitem> 8279 <para> 8280 The server will perform zone maintenance tasks 8281 for all zones marked as <command>dialup</command> whenever this 8282 interval expires. The default is 60 minutes. Reasonable 8283 values are up 8284 to 1 day (1440 minutes). The maximum value is 28 days 8285 (40320 minutes). 8286 If set to 0, no zone maintenance for these zones will occur. 8287 </para> 8288 </listitem> 8289 </varlistentry> 8290 8291 <varlistentry> 8292 <term><command>interface-interval</command></term> 8293 <listitem> 8294 <para> 8295 The server will scan the network interface list 8296 every <command>interface-interval</command> 8297 minutes. The default 8298 is 60 minutes. The maximum value is 28 days (40320 minutes). 8299 If set to 0, interface scanning will only occur when 8300 the configuration file is loaded. After the scan, the 8301 server will 8302 begin listening for queries on any newly discovered 8303 interfaces (provided they are allowed by the 8304 <command>listen-on</command> configuration), and 8305 will 8306 stop listening on interfaces that have gone away. 8307 </para> 8308 </listitem> 8309 </varlistentry> 8310 8311 <varlistentry> 8312 <term><command>statistics-interval</command></term> 8313 <listitem> 8314 <para> 8315 Name server statistics will be logged 8316 every <command>statistics-interval</command> 8317 minutes. The default is 8318 60. The maximum value is 28 days (40320 minutes). 8319 If set to 0, no statistics will be logged. 8320 </para><note> 8321 <simpara> 8322 Not yet implemented in 8323 <acronym>BIND</acronym> 9. 8324 </simpara> 8325 </note> 8326 </listitem> 8327 </varlistentry> 8328 8329 </variablelist> 8330 8331 </sect3> 8332 8333 <sect3 id="topology"> 8334 <title>Topology</title> 8335 8336 <para> 8337 All other things being equal, when the server chooses a name 8338 server 8339 to query from a list of name servers, it prefers the one that is 8340 topologically closest to itself. The <command>topology</command> statement 8341 takes an <command>address_match_list</command> and 8342 interprets it 8343 in a special way. Each top-level list element is assigned a 8344 distance. 8345 Non-negated elements get a distance based on their position in the 8346 list, where the closer the match is to the start of the list, the 8347 shorter the distance is between it and the server. A negated match 8348 will be assigned the maximum distance from the server. If there 8349 is no match, the address will get a distance which is further than 8350 any non-negated list element, and closer than any negated element. 8351 For example, 8352 </para> 8353 8354<programlisting>topology { 8355 10/8; 8356 !1.2.3/24; 8357 { 1.2/16; 3/8; }; 8358};</programlisting> 8359 8360 <para> 8361 will prefer servers on network 10 the most, followed by hosts 8362 on network 1.2.0.0 (netmask 255.255.0.0) and network 3, with the 8363 exception of hosts on network 1.2.3 (netmask 255.255.255.0), which 8364 is preferred least of all. 8365 </para> 8366 <para> 8367 The default topology is 8368 </para> 8369 8370<programlisting> topology { localhost; localnets; }; 8371</programlisting> 8372 8373 <note> 8374 <simpara> 8375 The <command>topology</command> option 8376 is not implemented in <acronym>BIND</acronym> 9. 8377 </simpara> 8378 </note> 8379 </sect3> 8380 8381 <sect3 id="the_sortlist_statement"> 8382 8383 <title>The <command>sortlist</command> Statement</title> 8384 8385 <para> 8386 The response to a DNS query may consist of multiple resource 8387 records (RRs) forming a resource records set (RRset). 8388 The name server will normally return the 8389 RRs within the RRset in an indeterminate order 8390 (but see the <command>rrset-order</command> 8391 statement in <xref linkend="rrset_ordering"/>). 8392 The client resolver code should rearrange the RRs as appropriate, 8393 that is, using any addresses on the local net in preference to 8394 other addresses. 8395 However, not all resolvers can do this or are correctly 8396 configured. 8397 When a client is using a local server, the sorting can be performed 8398 in the server, based on the client's address. This only requires 8399 configuring the name servers, not all the clients. 8400 </para> 8401 8402 <para> 8403 The <command>sortlist</command> statement (see below) 8404 takes 8405 an <command>address_match_list</command> and 8406 interprets it even 8407 more specifically than the <command>topology</command> 8408 statement 8409 does (<xref linkend="topology"/>). 8410 Each top level statement in the <command>sortlist</command> must 8411 itself be an explicit <command>address_match_list</command> with 8412 one or two elements. The first element (which may be an IP 8413 address, 8414 an IP prefix, an ACL name or a nested <command>address_match_list</command>) 8415 of each top level list is checked against the source address of 8416 the query until a match is found. 8417 </para> 8418 <para> 8419 Once the source address of the query has been matched, if 8420 the top level statement contains only one element, the actual 8421 primitive 8422 element that matched the source address is used to select the 8423 address 8424 in the response to move to the beginning of the response. If the 8425 statement is a list of two elements, then the second element is 8426 treated the same as the <command>address_match_list</command> in 8427 a <command>topology</command> statement. Each top 8428 level element 8429 is assigned a distance and the address in the response with the 8430 minimum 8431 distance is moved to the beginning of the response. 8432 </para> 8433 <para> 8434 In the following example, any queries received from any of 8435 the addresses of the host itself will get responses preferring 8436 addresses 8437 on any of the locally connected networks. Next most preferred are 8438 addresses 8439 on the 192.168.1/24 network, and after that either the 8440 192.168.2/24 8441 or 8442 192.168.3/24 network with no preference shown between these two 8443 networks. Queries received from a host on the 192.168.1/24 network 8444 will prefer other addresses on that network to the 192.168.2/24 8445 and 8446 192.168.3/24 networks. Queries received from a host on the 8447 192.168.4/24 8448 or the 192.168.5/24 network will only prefer other addresses on 8449 their directly connected networks. 8450 </para> 8451 8452<programlisting>sortlist { 8453 // IF the local host 8454 // THEN first fit on the following nets 8455 { localhost; 8456 { localnets; 8457 192.168.1/24; 8458 { 192.168.2/24; 192.168.3/24; }; }; }; 8459 // IF on class C 192.168.1 THEN use .1, or .2 or .3 8460 { 192.168.1/24; 8461 { 192.168.1/24; 8462 { 192.168.2/24; 192.168.3/24; }; }; }; 8463 // IF on class C 192.168.2 THEN use .2, or .1 or .3 8464 { 192.168.2/24; 8465 { 192.168.2/24; 8466 { 192.168.1/24; 192.168.3/24; }; }; }; 8467 // IF on class C 192.168.3 THEN use .3, or .1 or .2 8468 { 192.168.3/24; 8469 { 192.168.3/24; 8470 { 192.168.1/24; 192.168.2/24; }; }; }; 8471 // IF .4 or .5 THEN prefer that net 8472 { { 192.168.4/24; 192.168.5/24; }; 8473 }; 8474};</programlisting> 8475 8476 <para> 8477 The following example will give reasonable behavior for the 8478 local host and hosts on directly connected networks. It is similar 8479 to the behavior of the address sort in <acronym>BIND</acronym> 4.9.x. Responses sent 8480 to queries from the local host will favor any of the directly 8481 connected 8482 networks. Responses sent to queries from any other hosts on a 8483 directly 8484 connected network will prefer addresses on that same network. 8485 Responses 8486 to other queries will not be sorted. 8487 </para> 8488 8489<programlisting>sortlist { 8490 { localhost; localnets; }; 8491 { localnets; }; 8492}; 8493</programlisting> 8494 8495 </sect3> 8496 <sect3 id="rrset_ordering"> 8497 <title id="rrset_ordering_title">RRset Ordering</title> 8498 <para> 8499 When multiple records are returned in an answer it may be 8500 useful to configure the order of the records placed into the 8501 response. 8502 The <command>rrset-order</command> statement permits 8503 configuration 8504 of the ordering of the records in a multiple record response. 8505 See also the <command>sortlist</command> statement, 8506 <xref linkend="the_sortlist_statement"/>. 8507 </para> 8508 8509 <para> 8510 An <command>order_spec</command> is defined as 8511 follows: 8512 </para> 8513 <para> 8514 <optional>class <replaceable>class_name</replaceable></optional> 8515 <optional>type <replaceable>type_name</replaceable></optional> 8516 <optional>name <replaceable>"domain_name"</replaceable></optional> 8517 order <replaceable>ordering</replaceable> 8518 </para> 8519 <para> 8520 If no class is specified, the default is <command>ANY</command>. 8521 If no type is specified, the default is <command>ANY</command>. 8522 If no name is specified, the default is "<command>*</command>" (asterisk). 8523 </para> 8524 <para> 8525 The legal values for <command>ordering</command> are: 8526 </para> 8527 <informaltable colsep="0" rowsep="0"> 8528 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="4Level-table"> 8529 <colspec colname="1" colnum="1" colsep="0" colwidth="0.750in"/> 8530 <colspec colname="2" colnum="2" colsep="0" colwidth="3.750in"/> 8531 <tbody> 8532 <row rowsep="0"> 8533 <entry colname="1"> 8534 <para><command>fixed</command></para> 8535 </entry> 8536 <entry colname="2"> 8537 <para> 8538 Records are returned in the order they 8539 are defined in the zone file. 8540 </para> 8541 </entry> 8542 </row> 8543 <row rowsep="0"> 8544 <entry colname="1"> 8545 <para><command>random</command></para> 8546 </entry> 8547 <entry colname="2"> 8548 <para> 8549 Records are returned in some random order. 8550 </para> 8551 </entry> 8552 </row> 8553 <row rowsep="0"> 8554 <entry colname="1"> 8555 <para><command>cyclic</command></para> 8556 </entry> 8557 <entry colname="2"> 8558 <para> 8559 Records are returned in a cyclic round-robin order. 8560 </para> 8561 <para> 8562 If <acronym>BIND</acronym> is configured with the 8563 "--enable-fixed-rrset" option at compile time, then 8564 the initial ordering of the RRset will match the 8565 one specified in the zone file. 8566 </para> 8567 </entry> 8568 </row> 8569 </tbody> 8570 </tgroup> 8571 </informaltable> 8572 <para> 8573 For example: 8574 </para> 8575 8576<programlisting>rrset-order { 8577 class IN type A name "host.example.com" order random; 8578 order cyclic; 8579}; 8580</programlisting> 8581 8582 <para> 8583 will cause any responses for type A records in class IN that 8584 have "<literal>host.example.com</literal>" as a 8585 suffix, to always be returned 8586 in random order. All other records are returned in cyclic order. 8587 </para> 8588 <para> 8589 If multiple <command>rrset-order</command> statements 8590 appear, they are not combined — the last one applies. 8591 </para> 8592 <para> 8593 By default, all records are returned in random order. 8594 </para> 8595 8596 <note> 8597 <simpara> 8598 In this release of <acronym>BIND</acronym> 9, the 8599 <command>rrset-order</command> statement does not support 8600 "fixed" ordering by default. Fixed ordering can be enabled 8601 at compile time by specifying "--enable-fixed-rrset" on 8602 the "configure" command line. 8603 </simpara> 8604 </note> 8605 </sect3> 8606 8607 <sect3 id="tuning"> 8608 <title>Tuning</title> 8609 8610 <variablelist> 8611 8612 <varlistentry> 8613 <term><command>lame-ttl</command></term> 8614 <listitem> 8615 <para> 8616 Sets the number of seconds to cache a 8617 lame server indication. 0 disables caching. (This is 8618 <emphasis role="bold">NOT</emphasis> recommended.) 8619 The default is <literal>600</literal> (10 minutes) and the 8620 maximum value is 8621 <literal>1800</literal> (30 minutes). 8622 </para> 8623 8624 <para> 8625 Lame-ttl also controls the amount of time DNSSEC 8626 validation failures are cached. There is a minimum 8627 of 30 seconds applied to bad cache entries if the 8628 lame-ttl is set to less than 30 seconds. 8629 </para> 8630 8631 </listitem> 8632 </varlistentry> 8633 8634 <varlistentry> 8635 <term><command>max-ncache-ttl</command></term> 8636 <listitem> 8637 <para> 8638 To reduce network traffic and increase performance, 8639 the server stores negative answers. <command>max-ncache-ttl</command> is 8640 used to set a maximum retention time for these answers in 8641 the server 8642 in seconds. The default 8643 <command>max-ncache-ttl</command> is <literal>10800</literal> seconds (3 hours). 8644 <command>max-ncache-ttl</command> cannot exceed 8645 7 days and will 8646 be silently truncated to 7 days if set to a greater value. 8647 </para> 8648 </listitem> 8649 </varlistentry> 8650 8651 <varlistentry> 8652 <term><command>max-cache-ttl</command></term> 8653 <listitem> 8654 <para> 8655 Sets the maximum time for which the server will 8656 cache ordinary (positive) answers. The default is 8657 one week (7 days). 8658 A value of zero may cause all queries to return 8659 SERVFAIL, because of lost caches of intermediate 8660 RRsets (such as NS and glue AAAA/A records) in the 8661 resolution process. 8662 </para> 8663 </listitem> 8664 </varlistentry> 8665 8666 <varlistentry> 8667 <term><command>min-roots</command></term> 8668 <listitem> 8669 <para> 8670 The minimum number of root servers that 8671 is required for a request for the root servers to be 8672 accepted. The default 8673 is <userinput>2</userinput>. 8674 </para> 8675 <note> 8676 <simpara> 8677 Not implemented in <acronym>BIND</acronym> 9. 8678 </simpara> 8679 </note> 8680 </listitem> 8681 </varlistentry> 8682 8683 <varlistentry> 8684 <term><command>sig-validity-interval</command></term> 8685 <listitem> 8686 <para> 8687 Specifies the number of days into the future when 8688 DNSSEC signatures automatically generated as a 8689 result of dynamic updates (<xref 8690 linkend="dynamic_update"/>) will expire. There 8691 is an optional second field which specifies how 8692 long before expiry that the signatures will be 8693 regenerated. If not specified, the signatures will 8694 be regenerated at 1/4 of base interval. The second 8695 field is specified in days if the base interval is 8696 greater than 7 days otherwise it is specified in hours. 8697 The default base interval is <literal>30</literal> days 8698 giving a re-signing interval of 7 1/2 days. The maximum 8699 values are 10 years (3660 days). 8700 </para> 8701 <para> 8702 The signature inception time is unconditionally 8703 set to one hour before the current time to allow 8704 for a limited amount of clock skew. 8705 </para> 8706 <para> 8707 The <command>sig-validity-interval</command> 8708 should be, at least, several multiples of the SOA 8709 expire interval to allow for reasonable interaction 8710 between the various timer and expiry dates. 8711 </para> 8712 </listitem> 8713 </varlistentry> 8714 8715 <varlistentry> 8716 <term><command>sig-signing-nodes</command></term> 8717 <listitem> 8718 <para> 8719 Specify the maximum number of nodes to be 8720 examined in each quantum when signing a zone with 8721 a new DNSKEY. The default is 8722 <literal>100</literal>. 8723 </para> 8724 </listitem> 8725 </varlistentry> 8726 8727 <varlistentry> 8728 <term><command>sig-signing-signatures</command></term> 8729 <listitem> 8730 <para> 8731 Specify a threshold number of signatures that 8732 will terminate processing a quantum when signing 8733 a zone with a new DNSKEY. The default is 8734 <literal>10</literal>. 8735 </para> 8736 </listitem> 8737 </varlistentry> 8738 8739 <varlistentry> 8740 <term><command>sig-signing-type</command></term> 8741 <listitem> 8742 <para> 8743 Specify a private RDATA type to be used when generating 8744 signing state records. The default is 8745 <literal>65534</literal>. 8746 </para> 8747 <para> 8748 It is expected that this parameter may be removed 8749 in a future version once there is a standard type. 8750 </para> 8751 <para> 8752 Signing state records are used to internally by 8753 <command>named</command> to track the current state of 8754 a zone-signing process, i.e., whether it is still active 8755 or has been completed. The records can be inspected 8756 using the command 8757 <command>rndc signing -list <replaceable>zone</replaceable></command>. 8758 Once <command>named</command> has finished signing 8759 a zone with a particular key, the signing state 8760 record associated with that key can be removed from 8761 the zone by running 8762 <command>rndc signing -clear <replaceable>keyid/algorithm</replaceable> <replaceable>zone</replaceable></command>. 8763 To clear all of the completed signing state 8764 records for a zone, use 8765 <command>rndc signing -clear all <replaceable>zone</replaceable></command>. 8766 </para> 8767 </listitem> 8768 </varlistentry> 8769 8770 <varlistentry> 8771 <term><command>min-refresh-time</command></term> 8772 <term><command>max-refresh-time</command></term> 8773 <term><command>min-retry-time</command></term> 8774 <term><command>max-retry-time</command></term> 8775 <listitem> 8776 <para> 8777 These options control the server's behavior on refreshing a 8778 zone 8779 (querying for SOA changes) or retrying failed transfers. 8780 Usually the SOA values for the zone are used, but these 8781 values 8782 are set by the master, giving slave server administrators 8783 little 8784 control over their contents. 8785 </para> 8786 <para> 8787 These options allow the administrator to set a minimum and 8788 maximum 8789 refresh and retry time either per-zone, per-view, or 8790 globally. 8791 These options are valid for slave and stub zones, 8792 and clamp the SOA refresh and retry times to the specified 8793 values. 8794 </para> 8795 <para> 8796 The following defaults apply. 8797 <command>min-refresh-time</command> 300 seconds, 8798 <command>max-refresh-time</command> 2419200 seconds 8799 (4 weeks), <command>min-retry-time</command> 500 seconds, 8800 and <command>max-retry-time</command> 1209600 seconds 8801 (2 weeks). 8802 </para> 8803 </listitem> 8804 </varlistentry> 8805 8806 <varlistentry> 8807 <term><command>edns-udp-size</command></term> 8808 <listitem> 8809 <para> 8810 Sets the maximum advertised EDNS UDP buffer size in 8811 bytes, to control the size of packets received from 8812 authoritative servers in response to recursive queries. 8813 Valid values are 512 to 4096 (values outside this range 8814 will be silently adjusted to the nearest value within 8815 it). The default value is 4096. 8816 </para> 8817 <para> 8818 The usual reason for setting 8819 <command>edns-udp-size</command> to a non-default value 8820 is to get UDP answers to pass through broken firewalls 8821 that block fragmented packets and/or block UDP DNS 8822 packets that are greater than 512 bytes. 8823 </para> 8824 <para> 8825 When <command>named</command> first queries a remote 8826 server, it will advertise a UDP buffer size of 512, as 8827 this has the greatest chance of success on the first try. 8828 </para> 8829 <para> 8830 If the initial response times out, <command>named</command> 8831 will try again with plain DNS, and if that is successful, 8832 it will be taken as evidence that the server does not 8833 support EDNS. After enough failures using EDNS and 8834 successes using plain DNS, <command>named</command> 8835 will default to plain DNS for future communications 8836 with that server. (Periodically, <command>named</command> 8837 will send an EDNS query to see if the situation has 8838 improved.) 8839 </para> 8840 <para> 8841 However, if the initial query is successful with 8842 EDNS advertising a buffer size of 512, then 8843 <command>named</command> will advertise progressively 8844 larger buffer sizes on successive queries, until 8845 responses begin timing out or 8846 <command>edns-udp-size</command> is reached. 8847 </para> 8848 <para> 8849 The default buffer sizes used by <command>named</command> 8850 are 512, 1232, 1432, and 4096, but never exceeding 8851 <command>edns-udp-size</command>. (The values 1232 and 8852 1432 are chosen to allow for an IPv4/IPv6 encapsulated 8853 UDP message to be sent without fragmentation at the 8854 minimum MTU sizes for Ethernet and IPv6 networks.) 8855 </para> 8856 </listitem> 8857 </varlistentry> 8858 8859 <varlistentry> 8860 <term><command>max-udp-size</command></term> 8861 <listitem> 8862 <para> 8863 Sets the maximum EDNS UDP message size 8864 <command>named</command> will send in bytes. 8865 Valid values are 512 to 4096 (values outside this 8866 range will be silently adjusted to the nearest 8867 value within it). The default value is 4096. 8868 </para> 8869 <para> 8870 This value applies to responses sent by a server; to 8871 set the advertised buffer size in queries, see 8872 <command>edns-udp-size</command>. 8873 </para> 8874 <para> 8875 The usual reason for setting 8876 <command>max-udp-size</command> to a non-default 8877 value is to get UDP answers to pass through broken 8878 firewalls that block fragmented packets and/or 8879 block UDP packets that are greater than 512 bytes. 8880 This is independent of the advertised receive 8881 buffer (<command>edns-udp-size</command>). 8882 </para> 8883 <para> 8884 Setting this to a low value will encourage additional 8885 TCP traffic to the nameserver. 8886 </para> 8887 </listitem> 8888 </varlistentry> 8889 8890 <varlistentry> 8891 <term><command>masterfile-format</command></term> 8892 <listitem> 8893 <para>Specifies 8894 the file format of zone files (see 8895 <xref linkend="zonefile_format"/>). 8896 The default value is <constant>text</constant>, which is the 8897 standard textual representation, except for slave zones, 8898 in which the default value is <constant>raw</constant>. 8899 Files in other formats than <constant>text</constant> are 8900 typically expected to be generated by the 8901 <command>named-compilezone</command> tool, or dumped by 8902 <command>named</command>. 8903 </para> 8904 <para> 8905 Note that when a zone file in a different format than 8906 <constant>text</constant> is loaded, <command>named</command> 8907 may omit some of the checks which would be performed for a 8908 file in the <constant>text</constant> format. In particular, 8909 <command>check-names</command> checks do not apply 8910 for the <constant>raw</constant> format. This means 8911 a zone file in the <constant>raw</constant> format 8912 must be generated with the same check level as that 8913 specified in the <command>named</command> configuration 8914 file. Also, <constant>map</constant> format files are 8915 loaded directly into memory via memory mapping, with only 8916 minimal checking. 8917 </para> 8918 <para> 8919 This statement sets the 8920 <command>masterfile-format</command> for all zones, 8921 but can be overridden on a per-zone or per-view basis 8922 by including a <command>masterfile-format</command> 8923 statement within the <command>zone</command> or 8924 <command>view</command> block in the configuration 8925 file. 8926 </para> 8927 </listitem> 8928 </varlistentry> 8929 8930 <varlistentry id="clients-per-query"> 8931 <term><command>clients-per-query</command></term> 8932 <term><command>max-clients-per-query</command></term> 8933 <listitem> 8934 <para>These set the 8935 initial value (minimum) and maximum number of recursive 8936 simultaneous clients for any given query 8937 (<qname,qtype,qclass>) that the server will accept 8938 before dropping additional clients. 8939 <command>named</command> will attempt to 8940 self tune this value and changes will be logged. The 8941 default values are 10 and 100. 8942 </para> 8943 <para> 8944 This value should reflect how many queries come in for 8945 a given name in the time it takes to resolve that name. 8946 If the number of queries exceed this value, <command>named</command> will 8947 assume that it is dealing with a non-responsive zone 8948 and will drop additional queries. If it gets a response 8949 after dropping queries, it will raise the estimate. The 8950 estimate will then be lowered in 20 minutes if it has 8951 remained unchanged. 8952 </para> 8953 <para> 8954 If <command>clients-per-query</command> is set to zero, 8955 then there is no limit on the number of clients per query 8956 and no queries will be dropped. 8957 </para> 8958 <para> 8959 If <command>max-clients-per-query</command> is set to zero, 8960 then there is no upper bound other than imposed by 8961 <command>recursive-clients</command>. 8962 </para> 8963 </listitem> 8964 </varlistentry> 8965 8966 <varlistentry id="max-recursion-depth"> 8967 <term><command>max-recursion-depth</command></term> 8968 <listitem> 8969 <para> 8970 Sets the maximum number of levels of recursion 8971 that are permitted at any one time while servicing 8972 a recursive query. Resolving a name may require 8973 looking up a name server address, which in turn 8974 requires resolving another name, etc; if the number 8975 of indirections exceeds this value, the recursive 8976 query is terminated and returns SERVFAIL. The 8977 default is 7. 8978 </para> 8979 </listitem> 8980 </varlistentry> 8981 8982 <varlistentry id="max-recursion-queries"> 8983 <term><command>max-recursion-queries</command></term> 8984 <listitem> 8985 <para> 8986 Sets the maximum number of iterative queries that 8987 may be sent while servicing a recursive query. 8988 If more queries are sent, the recursive query 8989 is terminated and returns SERVFAIL. Queries to 8990 look up top level comains such as "com" and "net" 8991 and the DNS root zone are exempt from this limitation. 8992 The default is 75. 8993 </para> 8994 </listitem> 8995 </varlistentry> 8996 8997 <varlistentry> 8998 <term><command>notify-delay</command></term> 8999 <listitem> 9000 <para> 9001 The delay, in seconds, between sending sets of notify 9002 messages for a zone. The default is five (5) seconds. 9003 </para> 9004 <para> 9005 The overall rate that NOTIFY messages are sent for all 9006 zones is controlled by <command>serial-query-rate</command>. 9007 </para> 9008 </listitem> 9009 </varlistentry> 9010 9011 <varlistentry> 9012 <term><command>max-rsa-exponent-size</command></term> 9013 <listitem> 9014 <para> 9015 The maximum RSA exponent size, in bits, that will 9016 be accepted when validating. Valid values are 35 9017 to 4096 bits. The default zero (0) is also accepted 9018 and is equivalent to 4096. 9019 </para> 9020 </listitem> 9021 </varlistentry> 9022 9023 <varlistentry> 9024 <term><command>prefetch</command></term> 9025 <listitem> 9026 <para> 9027 When a query is received for cached data which 9028 is to expire shortly, <command>named</command> can 9029 refresh the data from the authoritative server 9030 immediately, ensuring that the cache always has an 9031 answer available. 9032 </para> 9033 <para> 9034 The <option>prefetch</option> specifies the 9035 "trigger" TTL value at which prefetch of the current 9036 query will take place: when a cache record with a 9037 lower TTL value is encountered during query processing, 9038 it will be refreshed. Valid trigger TTL values are 1 to 9039 10 seconds. Values larger than 10 seconds will be silently 9040 reduced to 10. 9041 Setting a trigger TTL to zero (0) causes 9042 prefetch to be disabled. 9043 The default trigger TTL is <literal>2</literal>. 9044 </para> 9045 <para> 9046 An optional second argument specifies the "eligibility" 9047 TTL: the smallest <emphasis>original</emphasis> 9048 TTL value that will be accepted for a record to be 9049 eligible for prefetching. The eligibility TTL must 9050 be at least six seconds longer than the trigger TTL; 9051 if it isn't, <command>named</command> will silently 9052 adjust it upward. 9053 The default eligibility TTL is <literal>9</literal>. 9054 </para> 9055 </listitem> 9056 </varlistentry> 9057 </variablelist> 9058 9059 </sect3> 9060 9061 <sect3 id="builtin"> 9062 <title>Built-in server information zones</title> 9063 9064 <para> 9065 The server provides some helpful diagnostic information 9066 through a number of built-in zones under the 9067 pseudo-top-level-domain <literal>bind</literal> in the 9068 <command>CHAOS</command> class. These zones are part 9069 of a 9070 built-in view (see <xref linkend="view_statement_grammar"/>) of 9071 class 9072 <command>CHAOS</command> which is separate from the 9073 default view of class <command>IN</command>. Most global 9074 configuration options (<command>allow-query</command>, 9075 etc) will apply to this view, but some are locally 9076 overridden: <command>notify</command>, 9077 <command>recursion</command> and 9078 <command>allow-new-zones</command> are 9079 always set to <userinput>no</userinput>, and 9080 <command>rate-limit</command> is set to allow 9081 three responses per second. 9082 </para> 9083 <para> 9084 If you need to disable these zones, use the options 9085 below, or hide the built-in <command>CHAOS</command> 9086 view by 9087 defining an explicit view of class <command>CHAOS</command> 9088 that matches all clients. 9089 </para> 9090 9091 <variablelist> 9092 9093 <varlistentry> 9094 <term><command>version</command></term> 9095 <listitem> 9096 <para> 9097 The version the server should report 9098 via a query of the name <literal>version.bind</literal> 9099 with type <command>TXT</command>, class <command>CHAOS</command>. 9100 The default is the real version number of this server. 9101 Specifying <command>version none</command> 9102 disables processing of the queries. 9103 </para> 9104 </listitem> 9105 </varlistentry> 9106 9107 <varlistentry> 9108 <term><command>hostname</command></term> 9109 <listitem> 9110 <para> 9111 The hostname the server should report via a query of 9112 the name <filename>hostname.bind</filename> 9113 with type <command>TXT</command>, class <command>CHAOS</command>. 9114 This defaults to the hostname of the machine hosting the 9115 name server as 9116 found by the gethostname() function. The primary purpose of such queries 9117 is to 9118 identify which of a group of anycast servers is actually 9119 answering your queries. Specifying <command>hostname none;</command> 9120 disables processing of the queries. 9121 </para> 9122 </listitem> 9123 </varlistentry> 9124 9125 <varlistentry> 9126 <term><command>server-id</command></term> 9127 <listitem> 9128 <para> 9129 The ID the server should report when receiving a Name 9130 Server Identifier (NSID) query, or a query of the name 9131 <filename>ID.SERVER</filename> with type 9132 <command>TXT</command>, class <command>CHAOS</command>. 9133 The primary purpose of such queries is to 9134 identify which of a group of anycast servers is actually 9135 answering your queries. Specifying <command>server-id none;</command> 9136 disables processing of the queries. 9137 Specifying <command>server-id hostname;</command> will cause <command>named</command> to 9138 use the hostname as found by the gethostname() function. 9139 The default <command>server-id</command> is <command>none</command>. 9140 </para> 9141 </listitem> 9142 </varlistentry> 9143 9144 </variablelist> 9145 9146 </sect3> 9147 9148 <sect3 id="empty"> 9149 <title>Built-in Empty Zones</title> 9150 <para> 9151 Named has some built-in empty zones (SOA and NS records only). 9152 These are for zones that should normally be answered locally 9153 and which queries should not be sent to the Internet's root 9154 servers. The official servers which cover these namespaces 9155 return NXDOMAIN responses to these queries. In particular, 9156 these cover the reverse namespaces for addresses from 9157 RFC 1918, RFC 4193, RFC 5737 and RFC 6598. They also include the 9158 reverse namespace for IPv6 local address (locally assigned), 9159 IPv6 link local addresses, the IPv6 loopback address and the 9160 IPv6 unknown address. 9161 </para> 9162 <para> 9163 Named will attempt to determine if a built-in zone already exists 9164 or is active (covered by a forward-only forwarding declaration) 9165 and will not create an empty zone in that case. 9166 </para> 9167 <para> 9168 The current list of empty zones is: 9169 <itemizedlist> 9170 <listitem>10.IN-ADDR.ARPA</listitem> 9171 <listitem>16.172.IN-ADDR.ARPA</listitem> 9172 <listitem>17.172.IN-ADDR.ARPA</listitem> 9173 <listitem>18.172.IN-ADDR.ARPA</listitem> 9174 <listitem>19.172.IN-ADDR.ARPA</listitem> 9175 <listitem>20.172.IN-ADDR.ARPA</listitem> 9176 <listitem>21.172.IN-ADDR.ARPA</listitem> 9177 <listitem>22.172.IN-ADDR.ARPA</listitem> 9178 <listitem>23.172.IN-ADDR.ARPA</listitem> 9179 <listitem>24.172.IN-ADDR.ARPA</listitem> 9180 <listitem>25.172.IN-ADDR.ARPA</listitem> 9181 <listitem>26.172.IN-ADDR.ARPA</listitem> 9182 <listitem>27.172.IN-ADDR.ARPA</listitem> 9183 <listitem>28.172.IN-ADDR.ARPA</listitem> 9184 <listitem>29.172.IN-ADDR.ARPA</listitem> 9185 <listitem>30.172.IN-ADDR.ARPA</listitem> 9186 <listitem>31.172.IN-ADDR.ARPA</listitem> 9187 <listitem>168.192.IN-ADDR.ARPA</listitem> 9188 <listitem>64.100.IN-ADDR.ARPA</listitem> 9189 <listitem>65.100.IN-ADDR.ARPA</listitem> 9190 <listitem>66.100.IN-ADDR.ARPA</listitem> 9191 <listitem>67.100.IN-ADDR.ARPA</listitem> 9192 <listitem>68.100.IN-ADDR.ARPA</listitem> 9193 <listitem>69.100.IN-ADDR.ARPA</listitem> 9194 <listitem>70.100.IN-ADDR.ARPA</listitem> 9195 <listitem>71.100.IN-ADDR.ARPA</listitem> 9196 <listitem>72.100.IN-ADDR.ARPA</listitem> 9197 <listitem>73.100.IN-ADDR.ARPA</listitem> 9198 <listitem>74.100.IN-ADDR.ARPA</listitem> 9199 <listitem>75.100.IN-ADDR.ARPA</listitem> 9200 <listitem>76.100.IN-ADDR.ARPA</listitem> 9201 <listitem>77.100.IN-ADDR.ARPA</listitem> 9202 <listitem>78.100.IN-ADDR.ARPA</listitem> 9203 <listitem>79.100.IN-ADDR.ARPA</listitem> 9204 <listitem>80.100.IN-ADDR.ARPA</listitem> 9205 <listitem>81.100.IN-ADDR.ARPA</listitem> 9206 <listitem>82.100.IN-ADDR.ARPA</listitem> 9207 <listitem>83.100.IN-ADDR.ARPA</listitem> 9208 <listitem>84.100.IN-ADDR.ARPA</listitem> 9209 <listitem>85.100.IN-ADDR.ARPA</listitem> 9210 <listitem>86.100.IN-ADDR.ARPA</listitem> 9211 <listitem>87.100.IN-ADDR.ARPA</listitem> 9212 <listitem>88.100.IN-ADDR.ARPA</listitem> 9213 <listitem>89.100.IN-ADDR.ARPA</listitem> 9214 <listitem>90.100.IN-ADDR.ARPA</listitem> 9215 <listitem>91.100.IN-ADDR.ARPA</listitem> 9216 <listitem>92.100.IN-ADDR.ARPA</listitem> 9217 <listitem>93.100.IN-ADDR.ARPA</listitem> 9218 <listitem>94.100.IN-ADDR.ARPA</listitem> 9219 <listitem>95.100.IN-ADDR.ARPA</listitem> 9220 <listitem>96.100.IN-ADDR.ARPA</listitem> 9221 <listitem>97.100.IN-ADDR.ARPA</listitem> 9222 <listitem>98.100.IN-ADDR.ARPA</listitem> 9223 <listitem>99.100.IN-ADDR.ARPA</listitem> 9224 <listitem>100.100.IN-ADDR.ARPA</listitem> 9225 <listitem>101.100.IN-ADDR.ARPA</listitem> 9226 <listitem>102.100.IN-ADDR.ARPA</listitem> 9227 <listitem>103.100.IN-ADDR.ARPA</listitem> 9228 <listitem>104.100.IN-ADDR.ARPA</listitem> 9229 <listitem>105.100.IN-ADDR.ARPA</listitem> 9230 <listitem>106.100.IN-ADDR.ARPA</listitem> 9231 <listitem>107.100.IN-ADDR.ARPA</listitem> 9232 <listitem>108.100.IN-ADDR.ARPA</listitem> 9233 <listitem>109.100.IN-ADDR.ARPA</listitem> 9234 <listitem>110.100.IN-ADDR.ARPA</listitem> 9235 <listitem>111.100.IN-ADDR.ARPA</listitem> 9236 <listitem>112.100.IN-ADDR.ARPA</listitem> 9237 <listitem>113.100.IN-ADDR.ARPA</listitem> 9238 <listitem>114.100.IN-ADDR.ARPA</listitem> 9239 <listitem>115.100.IN-ADDR.ARPA</listitem> 9240 <listitem>116.100.IN-ADDR.ARPA</listitem> 9241 <listitem>117.100.IN-ADDR.ARPA</listitem> 9242 <listitem>118.100.IN-ADDR.ARPA</listitem> 9243 <listitem>119.100.IN-ADDR.ARPA</listitem> 9244 <listitem>120.100.IN-ADDR.ARPA</listitem> 9245 <listitem>121.100.IN-ADDR.ARPA</listitem> 9246 <listitem>122.100.IN-ADDR.ARPA</listitem> 9247 <listitem>123.100.IN-ADDR.ARPA</listitem> 9248 <listitem>124.100.IN-ADDR.ARPA</listitem> 9249 <listitem>125.100.IN-ADDR.ARPA</listitem> 9250 <listitem>126.100.IN-ADDR.ARPA</listitem> 9251 <listitem>127.100.IN-ADDR.ARPA</listitem> 9252 <listitem>0.IN-ADDR.ARPA</listitem> 9253 <listitem>127.IN-ADDR.ARPA</listitem> 9254 <listitem>254.169.IN-ADDR.ARPA</listitem> 9255 <listitem>2.0.192.IN-ADDR.ARPA</listitem> 9256 <listitem>100.51.198.IN-ADDR.ARPA</listitem> 9257 <listitem>113.0.203.IN-ADDR.ARPA</listitem> 9258 <listitem>255.255.255.255.IN-ADDR.ARPA</listitem> 9259 <listitem>0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA</listitem> 9260 <listitem>1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA</listitem> 9261 <listitem>8.B.D.0.1.0.0.2.IP6.ARPA</listitem> 9262 <listitem>D.F.IP6.ARPA</listitem> 9263 <listitem>8.E.F.IP6.ARPA</listitem> 9264 <listitem>9.E.F.IP6.ARPA</listitem> 9265 <listitem>A.E.F.IP6.ARPA</listitem> 9266 <listitem>B.E.F.IP6.ARPA</listitem> 9267 </itemizedlist> 9268 </para> 9269 <para> 9270 Empty zones are settable at the view level and only apply to 9271 views of class IN. Disabled empty zones are only inherited 9272 from options if there are no disabled empty zones specified 9273 at the view level. To override the options list of disabled 9274 zones, you can disable the root zone at the view level, for example: 9275<programlisting> 9276 disable-empty-zone "."; 9277</programlisting> 9278 </para> 9279 <para> 9280 If you are using the address ranges covered here, you should 9281 already have reverse zones covering the addresses you use. 9282 In practice this appears to not be the case with many queries 9283 being made to the infrastructure servers for names in these 9284 spaces. So many in fact that sacrificial servers were needed 9285 to be deployed to channel the query load away from the 9286 infrastructure servers. 9287 </para> 9288 <note> 9289 The real parent servers for these zones should disable all 9290 empty zone under the parent zone they serve. For the real 9291 root servers, this is all built-in empty zones. This will 9292 enable them to return referrals to deeper in the tree. 9293 </note> 9294 <variablelist> 9295 <varlistentry> 9296 <term><command>empty-server</command></term> 9297 <listitem> 9298 <para> 9299 Specify what server name will appear in the returned 9300 SOA record for empty zones. If none is specified, then 9301 the zone's name will be used. 9302 </para> 9303 </listitem> 9304 </varlistentry> 9305 9306 <varlistentry> 9307 <term><command>empty-contact</command></term> 9308 <listitem> 9309 <para> 9310 Specify what contact name will appear in the returned 9311 SOA record for empty zones. If none is specified, then 9312 "." will be used. 9313 </para> 9314 </listitem> 9315 </varlistentry> 9316 9317 <varlistentry> 9318 <term><command>empty-zones-enable</command></term> 9319 <listitem> 9320 <para> 9321 Enable or disable all empty zones. By default, they 9322 are enabled. 9323 </para> 9324 </listitem> 9325 </varlistentry> 9326 9327 <varlistentry> 9328 <term><command>disable-empty-zone</command></term> 9329 <listitem> 9330 <para> 9331 Disable individual empty zones. By default, none are 9332 disabled. This option can be specified multiple times. 9333 </para> 9334 </listitem> 9335 </varlistentry> 9336 </variablelist> 9337 </sect3> 9338 9339 <sect3 id="acache"> 9340 <title>Additional Section Caching</title> 9341 9342 <para> 9343 The additional section cache, also called <command>acache</command>, 9344 is an internal cache to improve the response performance of BIND 9. 9345 When additional section caching is enabled, BIND 9 will 9346 cache an internal short-cut to the additional section content for 9347 each answer RR. 9348 Note that <command>acache</command> is an internal caching 9349 mechanism of BIND 9, and is not related to the DNS caching 9350 server function. 9351 </para> 9352 9353 <para> 9354 Additional section caching does not change the 9355 response content (except the RRsets ordering of the additional 9356 section, see below), but can improve the response performance 9357 significantly. 9358 It is particularly effective when BIND 9 acts as an authoritative 9359 server for a zone that has many delegations with many glue RRs. 9360 </para> 9361 9362 <para> 9363 In order to obtain the maximum performance improvement 9364 from additional section caching, setting 9365 <command>additional-from-cache</command> 9366 to <command>no</command> is recommended, since the current 9367 implementation of <command>acache</command> 9368 does not short-cut of additional section information from the 9369 DNS cache data. 9370 </para> 9371 9372 <para> 9373 One obvious disadvantage of <command>acache</command> is 9374 that it requires much more 9375 memory for the internal cached data. 9376 Thus, if the response performance does not matter and memory 9377 consumption is much more critical, the 9378 <command>acache</command> mechanism can be 9379 disabled by setting <command>acache-enable</command> to 9380 <command>no</command>. 9381 It is also possible to specify the upper limit of memory 9382 consumption 9383 for acache by using <command>max-acache-size</command>. 9384 </para> 9385 9386 <para> 9387 Additional section caching also has a minor effect on the 9388 RRset ordering in the additional section. 9389 Without <command>acache</command>, 9390 <command>cyclic</command> order is effective for the additional 9391 section as well as the answer and authority sections. 9392 However, additional section caching fixes the ordering when it 9393 first caches an RRset for the additional section, and the same 9394 ordering will be kept in succeeding responses, regardless of the 9395 setting of <command>rrset-order</command>. 9396 The effect of this should be minor, however, since an 9397 RRset in the additional section 9398 typically only contains a small number of RRs (and in many cases 9399 it only contains a single RR), in which case the 9400 ordering does not matter much. 9401 </para> 9402 9403 <para> 9404 The following is a summary of options related to 9405 <command>acache</command>. 9406 </para> 9407 9408 <variablelist> 9409 9410 <varlistentry> 9411 <term><command>acache-enable</command></term> 9412 <listitem> 9413 <para> 9414 If <command>yes</command>, additional section caching is 9415 enabled. The default value is <command>no</command>. 9416 </para> 9417 </listitem> 9418 </varlistentry> 9419 9420 <varlistentry> 9421 <term><command>acache-cleaning-interval</command></term> 9422 <listitem> 9423 <para> 9424 The server will remove stale cache entries, based on an LRU 9425 based 9426 algorithm, every <command>acache-cleaning-interval</command> minutes. 9427 The default is 60 minutes. 9428 If set to 0, no periodic cleaning will occur. 9429 </para> 9430 </listitem> 9431 </varlistentry> 9432 9433 <varlistentry> 9434 <term><command>max-acache-size</command></term> 9435 <listitem> 9436 <para> 9437 The maximum amount of memory in bytes to use for the server's acache. 9438 When the amount of data in the acache reaches this limit, 9439 the server 9440 will clean more aggressively so that the limit is not 9441 exceeded. 9442 In a server with multiple views, the limit applies 9443 separately to the 9444 acache of each view. 9445 The default is <literal>16M</literal>. 9446 </para> 9447 </listitem> 9448 </varlistentry> 9449 9450 </variablelist> 9451 9452 </sect3> 9453 9454 <sect3> 9455 <title>Content Filtering</title> 9456 <para> 9457 <acronym>BIND</acronym> 9 provides the ability to filter 9458 out DNS responses from external DNS servers containing 9459 certain types of data in the answer section. 9460 Specifically, it can reject address (A or AAAA) records if 9461 the corresponding IPv4 or IPv6 addresses match the given 9462 <varname>address_match_list</varname> of the 9463 <command>deny-answer-addresses</command> option. 9464 It can also reject CNAME or DNAME records if the "alias" 9465 name (i.e., the CNAME alias or the substituted query name 9466 due to DNAME) matches the 9467 given <varname>namelist</varname> of the 9468 <command>deny-answer-aliases</command> option, where 9469 "match" means the alias name is a subdomain of one of 9470 the <varname>name_list</varname> elements. 9471 If the optional <varname>namelist</varname> is specified 9472 with <command>except-from</command>, records whose query name 9473 matches the list will be accepted regardless of the filter 9474 setting. 9475 Likewise, if the alias name is a subdomain of the 9476 corresponding zone, the <command>deny-answer-aliases</command> 9477 filter will not apply; 9478 for example, even if "example.com" is specified for 9479 <command>deny-answer-aliases</command>, 9480 </para> 9481<programlisting>www.example.com. CNAME xxx.example.com.</programlisting> 9482 9483 <para> 9484 returned by an "example.com" server will be accepted. 9485 </para> 9486 9487 <para> 9488 In the <varname>address_match_list</varname> of the 9489 <command>deny-answer-addresses</command> option, only 9490 <varname>ip_addr</varname> 9491 and <varname>ip_prefix</varname> 9492 are meaningful; 9493 any <varname>key_id</varname> will be silently ignored. 9494 </para> 9495 9496 <para> 9497 If a response message is rejected due to the filtering, 9498 the entire message is discarded without being cached, and 9499 a SERVFAIL error will be returned to the client. 9500 </para> 9501 9502 <para> 9503 This filtering is intended to prevent "DNS rebinding attacks," in 9504 which an attacker, in response to a query for a domain name the 9505 attacker controls, returns an IP address within your own network or 9506 an alias name within your own domain. 9507 A naive web browser or script could then serve as an 9508 unintended proxy, allowing the attacker 9509 to get access to an internal node of your local network 9510 that couldn't be externally accessed otherwise. 9511 See the paper available at 9512 <ulink url="http://portal.acm.org/citation.cfm?id=1315245.1315298"> 9513 http://portal.acm.org/citation.cfm?id=1315245.1315298 9514 </ulink> 9515 for more details about the attacks. 9516 </para> 9517 9518 <para> 9519 For example, if you own a domain named "example.net" and 9520 your internal network uses an IPv4 prefix 192.0.2.0/24, 9521 you might specify the following rules: 9522 </para> 9523 9524<programlisting>deny-answer-addresses { 192.0.2.0/24; } except-from { "example.net"; }; 9525deny-answer-aliases { "example.net"; }; 9526</programlisting> 9527 9528 <para> 9529 If an external attacker lets a web browser in your local 9530 network look up an IPv4 address of "attacker.example.com", 9531 the attacker's DNS server would return a response like this: 9532 </para> 9533 9534<programlisting>attacker.example.com. A 192.0.2.1</programlisting> 9535 9536 <para> 9537 in the answer section. 9538 Since the rdata of this record (the IPv4 address) matches 9539 the specified prefix 192.0.2.0/24, this response will be 9540 ignored. 9541 </para> 9542 9543 <para> 9544 On the other hand, if the browser looks up a legitimate 9545 internal web server "www.example.net" and the 9546 following response is returned to 9547 the <acronym>BIND</acronym> 9 server 9548 </para> 9549 9550<programlisting>www.example.net. A 192.0.2.2</programlisting> 9551 9552 <para> 9553 it will be accepted since the owner name "www.example.net" 9554 matches the <command>except-from</command> element, 9555 "example.net". 9556 </para> 9557 9558 <para> 9559 Note that this is not really an attack on the DNS per se. 9560 In fact, there is nothing wrong for an "external" name to 9561 be mapped to your "internal" IP address or domain name 9562 from the DNS point of view. 9563 It might actually be provided for a legitimate purpose, 9564 such as for debugging. 9565 As long as the mapping is provided by the correct owner, 9566 it is not possible or does not make sense to detect 9567 whether the intent of the mapping is legitimate or not 9568 within the DNS. 9569 The "rebinding" attack must primarily be protected at the 9570 application that uses the DNS. 9571 For a large site, however, it may be difficult to protect 9572 all possible applications at once. 9573 This filtering feature is provided only to help such an 9574 operational environment; 9575 it is generally discouraged to turn it on unless you are 9576 very sure you have no other choice and the attack is a 9577 real threat for your applications. 9578 </para> 9579 9580 <para> 9581 Care should be particularly taken if you want to use this 9582 option for addresses within 127.0.0.0/8. 9583 These addresses are obviously "internal", but many 9584 applications conventionally rely on a DNS mapping from 9585 some name to such an address. 9586 Filtering out DNS records containing this address 9587 spuriously can break such applications. 9588 </para> 9589 </sect3> 9590 9591 <sect3> 9592 <title>Response Policy Zone (RPZ) Rewriting</title> 9593 <para> 9594 <acronym>BIND</acronym> 9 includes a limited 9595 mechanism to modify DNS responses for requests 9596 analogous to email anti-spam DNS blacklists. 9597 Responses can be changed to deny the existence of domains (NXDOMAIN), 9598 deny the existence of IP addresses for domains (NODATA), 9599 or contain other IP addresses or data. 9600 </para> 9601 9602 <para> 9603 Response policy zones are named in the 9604 <command>response-policy</command> option for the view or among the 9605 global options if there is no response-policy option for the view. 9606 Response policy zones are ordinary DNS zones containing RRsets 9607 that can be queried normally if allowed. 9608 It is usually best to restrict those queries with something like 9609 <command>allow-query { localhost; };</command>. 9610 </para> 9611 9612 <para> 9613 A <command>response-policy</command> option can support 9614 multiple policy zones. To maximize performance, a radix 9615 tree is used to quickly identify response policy zones 9616 containing triggers that match the current query. This 9617 imposes an upper limit of 32 on the number of policy zones 9618 in a single <command>response-policy</command> option; more 9619 than that is a configuration error. 9620 </para> 9621 9622 <para> 9623 Five policy triggers can be encoded in RPZ records. 9624 <variablelist> 9625 <varlistentry> 9626 <term><command>RPZ-CLIENT-IP</command></term> 9627 <listitem> 9628 <para> 9629 IP records are triggered by the IP address of the 9630 DNS client. 9631 Client IP address triggers are encoded in records that have 9632 owner names that are subdomains of 9633 <command>rpz-client-ip</command> relativized to the 9634 policy zone origin name 9635 and encode an address or address block. 9636 IPv4 addresses are represented as 9637 <userinput>prefixlength.B4.B3.B2.B1.rpz-ip</userinput>. 9638 The IPv4 prefix length must be between 1 and 32. 9639 All four bytes, B4, B3, B2, and B1, must be present. 9640 B4 is the decimal value of the least significant byte of the 9641 IPv4 address as in IN-ADDR.ARPA. 9642 </para> 9643 9644 <para> 9645 IPv6 addresses are encoded in a format similar 9646 to the standard IPv6 text representation, 9647 <userinput>prefixlength.W8.W7.W6.W5.W4.W3.W2.W1.rpz-ip</userinput>. 9648 Each of W8,...,W1 is a one to four digit hexadecimal number 9649 representing 16 bits of the IPv6 address as in the standard 9650 text representation of IPv6 addresses, 9651 but reversed as in IN-ADDR.ARPA. 9652 All 8 words must be present except when one set of consecutive 9653 zero words is replaced with <userinput>.zz.</userinput> 9654 analogous to double colons (::) in standard IPv6 text 9655 encodings. 9656 The IPv6 prefix length must be between 64 and 128. 9657 </para> 9658 </listitem> 9659 </varlistentry> 9660 9661 <varlistentry> 9662 <term><command>QNAME</command></term> 9663 <listitem> 9664 <para> 9665 QNAME policy records are triggered by query names of 9666 requests and targets of CNAME records resolved to generate 9667 the response. 9668 The owner name of a QNAME policy record is 9669 the query name relativized to the policy zone. 9670 </para> 9671 </listitem> 9672 </varlistentry> 9673 9674 <varlistentry> 9675 <term><command>RPZ-IP</command></term> 9676 <listitem> 9677 <para> 9678 IP triggers are IP addresses in an 9679 A or AAAA record in the ANSWER section of a response. 9680 They are encoded like client-IP triggers except as 9681 subdomains of <command>rpz-ip</command>. 9682 </para> 9683 </listitem> 9684 </varlistentry> 9685 9686 <varlistentry> 9687 <term><command>RPZ-NSDNAME</command></term> 9688 <listitem> 9689 <para> 9690 NSDNAME triggers match names of authoritative servers 9691 for the query name, a parent of the query name, a CNAME for 9692 query name, or a parent of a CNAME. 9693 They are encoded as subdomains of 9694 <command>rpz-nsdname</command> relativized 9695 to the RPZ origin name. 9696 NSIP triggers match IP addresses in A and 9697 AAAA RRsets for domains that can be checked against NSDNAME 9698 policy records. 9699 </para> 9700 </listitem> 9701 </varlistentry> 9702 9703 <varlistentry> 9704 <term><command>RPZ-NSIP</command></term> 9705 <listitem> 9706 <para> 9707 NSIP triggers are encoded like IP triggers except as 9708 subdomains of <command>rpz-nsip</command>. 9709 NSDNAME and NSIP triggers are checked only for names with at 9710 least <command>min-ns-dots</command> dots. 9711 The default value of <command>min-ns-dots</command> is 1 to 9712 exclude top level domains. 9713 </para> 9714 </listitem> 9715 </varlistentry> 9716 </variablelist> 9717 </para> 9718 9719 <para> 9720 The query response is checked against all response policy zones, 9721 so two or more policy records can be triggered by a response. 9722 Because DNS responses are rewritten according to at most one 9723 policy record, a single record encoding an action (other than 9724 <command>DISABLED</command> actions) must be chosen. 9725 Triggers or the records that encode them are chosen for the 9726 rewriting in the following order: 9727 <orderedlist> 9728 <listitem>Choose the triggered record in the zone that appears 9729 first in the <command>response-policy</command> option. 9730 </listitem> 9731 <listitem>Prefer CLIENT-IP to QNAME to IP to NSDNAME to NSIP 9732 triggers in a single zone. 9733 </listitem> 9734 <listitem>Among NSDNAME triggers, prefer the 9735 trigger that matches the smallest name under the DNSSEC ordering. 9736 </listitem> 9737 <listitem>Among IP or NSIP triggers, prefer the trigger 9738 with the longest prefix. 9739 </listitem> 9740 <listitem>Among triggers with the same prefix length, 9741 prefer the IP or NSIP trigger that matches 9742 the smallest IP address. 9743 </listitem> 9744 </orderedlist> 9745 </para> 9746 9747 <para> 9748 When the processing of a response is restarted to resolve 9749 DNAME or CNAME records and a policy record set has 9750 not been triggered, 9751 all response policy zones are again consulted for the 9752 DNAME or CNAME names and addresses. 9753 </para> 9754 9755 <para> 9756 RPZ record sets are any types of DNS record except 9757 DNAME or DNSSEC that encode actions or responses to 9758 individual queries. 9759 Any of the policies can be used with any of the triggers. 9760 For example, while the <command>TCP-only</command> policy is 9761 commonly used with <command>client-IP</command> triggers, 9762 it cn be used with any type of trigger to force the use of 9763 TCP for responses with owner names in a zone. 9764 <variablelist> 9765 <varlistentry> 9766 <term><command>PASSTHRU</command></term> 9767 <listitem> 9768 <para> 9769 The whitelist policy is specified 9770 by a CNAME whose target is <command>rpz-passthru</command>. 9771 It causes the response to not be rewritten 9772 and is most often used to "poke holes" in policies for 9773 CIDR blocks. 9774 </para> 9775 </listitem> 9776 </varlistentry> 9777 9778 <varlistentry> 9779 <term><command>DROP</command></term> 9780 <listitem> 9781 <para> 9782 The blacklist policy is specified 9783 by a CNAME whose target is <command>rpz-drop</command>. 9784 It causes the response to be discarded. 9785 Nothing is sent to the DNS client. 9786 </para> 9787 </listitem> 9788 </varlistentry> 9789 9790 <varlistentry> 9791 <term><command>TCP-Only</command></term> 9792 <listitem> 9793 <para> 9794 The "slip" policy is specified 9795 by a CNAME whose target is <command>rpz-tcp-only</command>. 9796 It changes UDP responses to short, truncated DNS responses 9797 that require the DNS client to try again with TCP. 9798 It is used to mitigate distributed DNS reflection attacks. 9799 </para> 9800 </listitem> 9801 </varlistentry> 9802 9803 <varlistentry> 9804 <term><command>NXDOMAIN</command></term> 9805 <listitem> 9806 <para> 9807 The domain undefined response is encoded 9808 by a CNAME whose target is the root domain (.) 9809 </para> 9810 </listitem> 9811 </varlistentry> 9812 9813 <varlistentry> 9814 <term><command>NODATA</command></term> 9815 <listitem> 9816 <para> 9817 The empty set of resource records is specified by 9818 CNAME whose target is the wildcard top-level 9819 domain (*.). 9820 It rewrites the response to NODATA or ANCOUNT=1. 9821 </para> 9822 </listitem> 9823 </varlistentry> 9824 9825 <varlistentry> 9826 <term><command>Local Data</command></term> 9827 <listitem> 9828 <para> 9829 A set of ordinary DNS records can be used to answer queries. 9830 Queries for record types not the set are answered with 9831 NODATA. 9832 </para> 9833 9834 <para> 9835 A special form of local data is a CNAME whose target is a 9836 wildcard such as *.example.com. 9837 It is used as if were an ordinary CNAME after the astrisk (*) 9838 has been replaced with the query name. 9839 The purpose for this special form is query logging in the 9840 walled garden's authority DNS server. 9841 </para> 9842 </listitem> 9843 </varlistentry> 9844 </variablelist> 9845 </para> 9846 9847 <para> 9848 All of the actions specified in all of the individual records 9849 in a policy zone 9850 can be overridden with a <command>policy</command> clause in the 9851 <command>response-policy</command> option. 9852 An organization using a policy zone provided by another 9853 organization might use this mechanism to redirect domains 9854 to its own walled garden. 9855 <variablelist> 9856 <varlistentry> 9857 <term><command>GIVEN</command></term> 9858 <listitem> 9859 <para>The placeholder policy says "do not override but 9860 perform the action specified in the zone." 9861 </para> 9862 </listitem> 9863 </varlistentry> 9864 9865 <varlistentry> 9866 <term><command>DISABLED</command></term> 9867 <listitem> 9868 <para> 9869 The testing override policy causes policy zone records to do 9870 nothing but log what they would have done if the 9871 policy zone were not disabled. 9872 The response to the DNS query will be written (or not) 9873 according to any triggered policy records that are not 9874 disabled. 9875 Disabled policy zones should appear first, 9876 because they will often not be logged 9877 if a higher precedence trigger is found first. 9878 </para> 9879 </listitem> 9880 </varlistentry> 9881 9882 <varlistentry> 9883 <term><command>PASSTHRU</command></term>, 9884 <term><command>DROP</command></term>, 9885 <term><command>TCP-Only</command></term>, 9886 <term><command>NXDOMAIN</command></term>, 9887 and 9888 <term><command>NODATA</command></term> 9889 <listitem> 9890 <para> 9891 override with the corresponding per-record policy. 9892 </para> 9893 </listitem> 9894 </varlistentry> 9895 9896 <varlistentry> 9897 <term><command>CNAME domain</command></term> 9898 <listitem> 9899 <para> 9900 causes all RPZ policy records to act as if they were 9901 "cname domain" records. 9902 </para> 9903 </listitem> 9904 </varlistentry> 9905 </variablelist> 9906 </para> 9907 9908 <para> 9909 By default, the actions encoded in a response policy zone 9910 are applied only to queries that ask for recursion (RD=1). 9911 That default can be changed for a single policy zone or 9912 all response policy zones in a view 9913 with a <command>recursive-only no</command> clause. 9914 This feature is useful for serving the same zone files 9915 both inside and outside an RFC 1918 cloud and using RPZ to 9916 delete answers that would otherwise contain RFC 1918 values 9917 on the externally visible name server or view. 9918 </para> 9919 9920 <para> 9921 Also by default, RPZ actions are applied only to DNS requests 9922 that either do not request DNSSEC metadata (DO=0) or when no 9923 DNSSEC records are available for request name in the original 9924 zone (not the response policy zone). This default can be 9925 changed for all response policy zones in a view with a 9926 <command>break-dnssec yes</command> clause. In that case, RPZ 9927 actions are applied regardless of DNSSEC. The name of the 9928 clause option reflects the fact that results rewritten by RPZ 9929 actions cannot verify. 9930 </para> 9931 9932 <para> 9933 No DNS records are needed for a QNAME or Client-IP trigger. 9934 The name or IP address itself is sufficient, 9935 so in principle the query name need not be recursively resolved. 9936 However, not resolving the requested 9937 name can leak the fact that response policy rewriting is in use 9938 and that the name is listed in a policy zone to operators of 9939 servers for listed names. To prevent that information leak, by 9940 default any recursion needed for a request is done before any 9941 policy triggers are considered. Because listed domains often 9942 have slow authoritative servers, this default behavior can cost 9943 significant time. 9944 The <command>qname-wait-recurse no</command> option 9945 overrides that default behavior when recursion cannot 9946 change a non-error response. 9947 The option does not affect QNAME or client-IP triggers 9948 in policy zones listed 9949 after other zones containing IP, NSIP and NSDNAME triggers, because 9950 those may depend on the A, AAAA, and NS records that would be 9951 found during recursive resolution. It also does not affect 9952 DNSSEC requests (DO=1) unless <command>break-dnssec yes</command> 9953 is in use, because the response would depend on whether or not 9954 RRSIG records were found during resolution. 9955 Using this option can cause error responses such as SERVFAIL to 9956 appear to be rewritten, since no recursion is being done to 9957 discover problems at the authoritative server. 9958 </para> 9959 9960 <para> 9961 The TTL of a record modified by RPZ policies is set from the 9962 TTL of the relevant record in policy zone. It is then limited 9963 to a maximum value. 9964 The <command>max-policy-ttl</command> clause changes that 9965 maximum from its default of 5. 9966 </para> 9967 9968 <para> 9969 For example, you might use this option statement 9970 </para> 9971<programlisting> response-policy { zone "badlist"; };</programlisting> 9972 <para> 9973 and this zone statement 9974 </para> 9975<programlisting> zone "badlist" {type master; file "master/badlist"; allow-query {none;}; };</programlisting> 9976 <para> 9977 with this zone file 9978 </para> 9979<programlisting>$TTL 1H 9980@ SOA LOCALHOST. named-mgr.example.com (1 1h 15m 30d 2h) 9981 NS LOCALHOST. 9982 9983; QNAME policy records. There are no periods (.) after the owner names. 9984nxdomain.domain.com CNAME . ; NXDOMAIN policy 9985*.nxdomain.domain.com CNAME . ; NXDOMAIN policy 9986nodata.domain.com CNAME *. ; NODATA policy 9987*.nodata.domain.com CNAME *. ; NODATA policy 9988bad.domain.com A 10.0.0.1 ; redirect to a walled garden 9989 AAAA 2001:2::1 9990bzone.domain.com CNAME garden.example.com. 9991 9992; do not rewrite (PASSTHRU) OK.DOMAIN.COM 9993ok.domain.com CNAME rpz-passthru. 9994 9995; redirect x.bzone.domain.com to x.bzone.domain.com.garden.example.com 9996*.bzone.domain.com CNAME *.garden.example.com. 9997 9998 9999; IP policy records that rewrite all responses containing A records in 127/8 10000; except 127.0.0.1 100018.0.0.0.127.rpz-ip CNAME . 1000232.1.0.0.127.rpz-ip CNAME rpz-passthru. 10003 10004; NSDNAME and NSIP policy records 10005ns.domain.com.rpz-nsdname CNAME . 1000648.zz.2.2001.rpz-nsip CNAME . 10007 10008; blacklist and whitelist some DNS clients 10009112.zz.2001.rpz-client-ip CNAME rpz-drop. 100108.0.0.0.127.rpz-client-ip CNAME rpz-drop. 10011 10012; force some DNS clients and responses in the example.com zone to TCP 1001316.0.0.1.10.rpz-client-ip CNAME rpz-tcp-only. 10014example.com CNAME rpz-tcp-only. 10015*.example.com CNAME rpz-tcp-only. 10016 10017</programlisting> 10018 <para> 10019 RPZ can affect server performance. 10020 Each configured response policy zone requires the server to 10021 perform one to four additional database lookups before a 10022 query can be answered. 10023 For example, a DNS server with four policy zones, each with all 10024 four kinds of response triggers, QNAME, IP, NSIP, and 10025 NSDNAME, requires a total of 17 times as many database 10026 lookups as a similar DNS server with no response policy zones. 10027 A <acronym>BIND9</acronym> server with adequate memory and one 10028 response policy zone with QNAME and IP triggers might achieve a 10029 maximum queries-per-second rate about 20% lower. 10030 A server with four response policy zones with QNAME and IP 10031 triggers might have a maximum QPS rate about 50% lower. 10032 </para> 10033 10034 <para> 10035 Responses rewritten by RPZ are counted in the 10036 <command>RPZRewrites</command> statistics. 10037 </para> 10038 </sect3> 10039 10040 <sect3> 10041 <title>Response Rate Limiting</title> 10042 <para> 10043 Excessive almost identical UDP <emphasis>responses</emphasis> 10044 can be controlled by configuring a 10045 <command>rate-limit</command> clause in an 10046 <command>options</command> or <command>view</command> statement. 10047 This mechanism keeps authoritative BIND 9 from being used 10048 in amplifying reflection denial of service (DoS) attacks. 10049 Short truncated (TC=1) responses can be sent to provide 10050 rate-limited responses to legitimate clients within 10051 a range of forged, attacked IP addresses. 10052 Legitimate clients react to dropped or truncated response 10053 by retrying with UDP or with TCP respectively. 10054 </para> 10055 10056 <para> 10057 This mechanism is intended for authoritative DNS servers. 10058 It can be used on recursive servers but can slow 10059 applications such as SMTP servers (mail receivers) and 10060 HTTP clients (web browsers) that repeatedly request the 10061 same domains. 10062 When possible, closing "open" recursive servers is better. 10063 </para> 10064 10065 <para> 10066 Response rate limiting uses a "credit" or "token bucket" scheme. 10067 Each combination of identical response and client 10068 has a conceptual account that earns a specified number 10069 of credits every second. 10070 A prospective response debits its account by one. 10071 Responses are dropped or truncated 10072 while the account is negative. 10073 Responses are tracked within a rolling window of time 10074 which defaults to 15 seconds, but can be configured with 10075 the <command>window</command> option to any value from 10076 1 to 3600 seconds (1 hour). 10077 The account cannot become more positive than 10078 the per-second limit 10079 or more negative than <command>window</command> 10080 times the per-second limit. 10081 When the specified number of credits for a class of 10082 responses is set to 0, those responses are not rate limited. 10083 </para> 10084 10085 <para> 10086 The notions of "identical response" and "DNS client" 10087 for rate limiting are not simplistic. 10088 All responses to an address block are counted as if to a 10089 single client. 10090 The prefix lengths of addresses blocks are 10091 specified with <command>ipv4-prefix-length</command> (default 24) 10092 and <command>ipv6-prefix-length</command> (default 56). 10093 </para> 10094 10095 <para> 10096 All non-empty responses for a valid domain name (qname) 10097 and record type (qtype) are identical and have a limit specified 10098 with <command>responses-per-second</command> 10099 (default 0 or no limit). 10100 All empty (NODATA) responses for a valid domain, 10101 regardless of query type, are identical. 10102 Responses in the NODATA class are limited by 10103 <command>nodata-per-second</command> 10104 (default <command>responses-per-second</command>). 10105 Requests for any and all undefined subdomains of a given 10106 valid domain result in NXDOMAIN errors, and are identical 10107 regardless of query type. 10108 They are limited by <command>nxdomains-per-second</command> 10109 (default base <command>responses-per-second</command>). 10110 This controls some attacks using random names, but 10111 can be relaxed or turned off (set to 0) 10112 on servers that expect many legitimate 10113 NXDOMAIN responses, such as from anti-spam blacklists. 10114 Referrals or delegations to the server of a given 10115 domain are identical and are limited by 10116 <command>referrals-per-second</command> 10117 (default <command>responses-per-second</command>). 10118 </para> 10119 10120 <para> 10121 Responses generated from local wildcards are counted and limited 10122 as if they were for the parent domain name. 10123 This controls flooding using random.wild.example.com. 10124 </para> 10125 10126 <para> 10127 All requests that result in DNS errors other 10128 than NXDOMAIN, such as SERVFAIL and FORMERR, are identical 10129 regardless of requested name (qname) or record type (qtype). 10130 This controls attacks using invalid requests or distant, 10131 broken authoritative servers. 10132 By default the limit on errors is the same as the 10133 <command>responses-per-second</command> value, 10134 but it can be set separately with 10135 <command>errors-per-second</command>. 10136 </para> 10137 10138 <para> 10139 Many attacks using DNS involve UDP requests with forged source 10140 addresses. 10141 Rate limiting prevents the use of BIND 9 to flood a network 10142 with responses to requests with forged source addresses, 10143 but could let a third party block responses to legitimate requests. 10144 There is a mechanism that can answer some legitimate 10145 requests from a client whose address is being forged in a flood. 10146 Setting <command>slip</command> to 2 (its default) causes every 10147 other UDP request to be answered with a small truncated (TC=1) 10148 response. 10149 The small size and reduced frequency, and so lack of 10150 amplification, of "slipped" responses make them unattractive 10151 for reflection DoS attacks. 10152 <command>slip</command> must be between 0 and 10. 10153 A value of 0 does not "slip": 10154 no truncated responses are sent due to rate limiting, 10155 all responses are dropped. 10156 A value of 1 causes every response to slip; 10157 values between 2 and 10 cause every n'th response to slip. 10158 Some error responses including REFUSED and SERVFAIL 10159 cannot be replaced with truncated responses and are instead 10160 leaked at the <command>slip</command> rate. 10161 </para> 10162 10163 <para> 10164 (NOTE: Dropped responses from an authoritative server may 10165 reduce the difficulty of a third party successfully forging 10166 a response to a recursive resolver. The best security 10167 against forged responses is for authoritative operators 10168 to sign their zones using DNSSEC and for resolver operators 10169 to validate the responses. When this is not an option, 10170 operators who are more concerned with response integrity 10171 than with flood mitigation may consider setting 10172 <command>slip</command> to 1, causing all rate-limited 10173 responses to be truncated rather than dropped. This reduces 10174 the effectiveness of rate-limiting against reflection attacks.) 10175 </para> 10176 10177 <para> 10178 When the approximate query per second rate exceeds 10179 the <command>qps-scale</command> value, 10180 then the <command>responses-per-second</command>, 10181 <command>errors-per-second</command>, 10182 <command>nxdomains-per-second</command> and 10183 <command>all-per-second</command> values are reduced by the 10184 ratio of the current rate to the <command>qps-scale</command> value. 10185 This feature can tighten defenses during attacks. 10186 For example, with 10187 <command>qps-scale 250; responses-per-second 20;</command> and 10188 a total query rate of 1000 queries/second for all queries from 10189 all DNS clients including via TCP, 10190 then the effective responses/second limit changes to 10191 (250/1000)*20 or 5. 10192 Responses sent via TCP are not limited 10193 but are counted to compute the query per second rate. 10194 </para> 10195 10196 <para> 10197 Communities of DNS clients can be given their own parameters or no 10198 rate limiting by putting 10199 <command>rate-limit</command> statements in <command>view</command> 10200 statements instead of the global <command>option</command> 10201 statement. 10202 A <command>rate-limit</command> statement in a view replaces, 10203 rather than supplementing, a <command>rate-limit</command> 10204 statement among the main options. 10205 DNS clients within a view can be exempted from rate limits 10206 with the <command>exempt-clients</command> clause. 10207 </para> 10208 10209 <para> 10210 UDP responses of all kinds can be limited with the 10211 <command>all-per-second</command> phrase. 10212 This rate limiting is unlike the rate limiting provided by 10213 <command>responses-per-second</command>, 10214 <command>errors-per-second</command>, and 10215 <command>nxdomains-per-second</command> on a DNS server 10216 which are often invisible to the victim of a DNS reflection attack. 10217 Unless the forged requests of the attack are the same as the 10218 legitimate requests of the victim, the victim's requests are 10219 not affected. 10220 Responses affected by an <command>all-per-second</command> limit 10221 are always dropped; the <command>slip</command> value has no 10222 effect. 10223 An <command>all-per-second</command> limit should be 10224 at least 4 times as large as the other limits, 10225 because single DNS clients often send bursts of legitimate 10226 requests. 10227 For example, the receipt of a single mail message can prompt 10228 requests from an SMTP server for NS, PTR, A, and AAAA records 10229 as the incoming SMTP/TCP/IP connection is considered. 10230 The SMTP server can need additional NS, A, AAAA, MX, TXT, and SPF 10231 records as it considers the STMP <command>Mail From</command> 10232 command. 10233 Web browsers often repeatedly resolve the same names that 10234 are repeated in HTML <IMG> tags in a page. 10235 <command>All-per-second</command> is similar to the 10236 rate limiting offered by firewalls but often inferior. 10237 Attacks that justify ignoring the 10238 contents of DNS responses are likely to be attacks on the 10239 DNS server itself. 10240 They usually should be discarded before the DNS server 10241 spends resources making TCP connections or parsing DNS requests, 10242 but that rate limiting must be done before the 10243 DNS server sees the requests. 10244 </para> 10245 10246 <para> 10247 The maximum size of the table used to track requests and 10248 rate limit responses is set with <command>max-table-size</command>. 10249 Each entry in the table is between 40 and 80 bytes. 10250 The table needs approximately as many entries as the number 10251 of requests received per second. 10252 The default is 20,000. 10253 To reduce the cold start of growing the table, 10254 <command>min-table-size</command> (default 500) 10255 can set the minimum table size. 10256 Enable <command>rate-limit</command> category logging to monitor 10257 expansions of the table and inform 10258 choices for the initial and maximum table size. 10259 </para> 10260 10261 <para> 10262 Use <command>log-only yes</command> to test rate limiting parameters 10263 without actually dropping any requests. 10264 </para> 10265 10266 <para> 10267 Responses dropped by rate limits are included in the 10268 <command>RateDropped</command> and <command>QryDropped</command> 10269 statistics. 10270 Responses that truncated by rate limits are included in 10271 <command>RateSlipped</command> and <command>RespTruncated</command>. 10272 </para> 10273 </sect3> 10274 </sect2> 10275 10276 <sect2 id="server_statement_grammar"> 10277 <title><command>server</command> Statement Grammar</title> 10278 10279<programlisting><command>server</command> <replaceable>ip_addr[/prefixlen]</replaceable> { 10280 <optional> bogus <replaceable>yes_or_no</replaceable> ; </optional> 10281 <optional> provide-ixfr <replaceable>yes_or_no</replaceable> ; </optional> 10282 <optional> request-ixfr <replaceable>yes_or_no</replaceable> ; </optional> 10283 <optional> request-nsid <replaceable>yes_or_no</replaceable> ; </optional> 10284 <optional> request-sit <replaceable>yes_or_no</replaceable> ; </optional> 10285 <optional> edns <replaceable>yes_or_no</replaceable> ; </optional> 10286 <optional> edns-udp-size <replaceable>number</replaceable> ; </optional> 10287 <optional> nosit-udp-size <replaceable>number</replaceable> ; </optional> 10288 <optional> max-udp-size <replaceable>number</replaceable> ; </optional> 10289 <optional> transfers <replaceable>number</replaceable> ; </optional> 10290 <optional> transfer-format <replaceable>( one-answer | many-answers )</replaceable> ; ]</optional> 10291 <optional> keys <replaceable>{ string ; <optional> string ; <optional>...</optional></optional> }</replaceable> ; </optional> 10292 <optional> transfer-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 10293 <optional> transfer-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 10294 <optional> notify-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 10295 <optional> notify-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 10296 <optional> query-source <optional> address ( <replaceable>ip_addr</replaceable> | <replaceable>*</replaceable> ) </optional> 10297 <optional> port ( <replaceable>ip_port</replaceable> | <replaceable>*</replaceable> ) </optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 10298 <optional> query-source-v6 <optional> address ( <replaceable>ip_addr</replaceable> | <replaceable>*</replaceable> ) </optional> 10299 <optional> port ( <replaceable>ip_port</replaceable> | <replaceable>*</replaceable> ) </optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 10300 <optional> use-queryport-pool <replaceable>yes_or_no</replaceable>; </optional> 10301 <optional> queryport-pool-ports <replaceable>number</replaceable>; </optional> 10302 <optional> queryport-pool-updateinterval <replaceable>number</replaceable>; </optional> 10303}; 10304</programlisting> 10305 10306 </sect2> 10307 10308 <sect2 id="server_statement_definition_and_usage"> 10309 <title><command>server</command> Statement Definition and 10310 Usage</title> 10311 10312 <para> 10313 The <command>server</command> statement defines 10314 characteristics 10315 to be associated with a remote name server. If a prefix length is 10316 specified, then a range of servers is covered. Only the most 10317 specific 10318 server clause applies regardless of the order in 10319 <filename>named.conf</filename>. 10320 </para> 10321 10322 <para> 10323 The <command>server</command> statement can occur at 10324 the top level of the 10325 configuration file or inside a <command>view</command> 10326 statement. 10327 If a <command>view</command> statement contains 10328 one or more <command>server</command> statements, only 10329 those 10330 apply to the view and any top-level ones are ignored. 10331 If a view contains no <command>server</command> 10332 statements, 10333 any top-level <command>server</command> statements are 10334 used as 10335 defaults. 10336 </para> 10337 10338 <para> 10339 If you discover that a remote server is giving out bad data, 10340 marking it as bogus will prevent further queries to it. The 10341 default 10342 value of <command>bogus</command> is <command>no</command>. 10343 </para> 10344 <para> 10345 The <command>provide-ixfr</command> clause determines 10346 whether 10347 the local server, acting as master, will respond with an 10348 incremental 10349 zone transfer when the given remote server, a slave, requests it. 10350 If set to <command>yes</command>, incremental transfer 10351 will be provided 10352 whenever possible. If set to <command>no</command>, 10353 all transfers 10354 to the remote server will be non-incremental. If not set, the 10355 value 10356 of the <command>provide-ixfr</command> option in the 10357 view or 10358 global options block is used as a default. 10359 </para> 10360 10361 <para> 10362 The <command>request-ixfr</command> clause determines 10363 whether 10364 the local server, acting as a slave, will request incremental zone 10365 transfers from the given remote server, a master. If not set, the 10366 value of the <command>request-ixfr</command> option in 10367 the view or global options block is used as a default. It may 10368 also be set in the zone block and, if set there, it will 10369 override the global or view setting for that zone. 10370 </para> 10371 10372 <para> 10373 IXFR requests to servers that do not support IXFR will 10374 automatically 10375 fall back to AXFR. Therefore, there is no need to manually list 10376 which servers support IXFR and which ones do not; the global 10377 default 10378 of <command>yes</command> should always work. 10379 The purpose of the <command>provide-ixfr</command> and 10380 <command>request-ixfr</command> clauses is 10381 to make it possible to disable the use of IXFR even when both 10382 master 10383 and slave claim to support it, for example if one of the servers 10384 is buggy and crashes or corrupts data when IXFR is used. 10385 </para> 10386 10387 <para> 10388 The <command>edns</command> clause determines whether 10389 the local server will attempt to use EDNS when communicating 10390 with the remote server. The default is <command>yes</command>. 10391 </para> 10392 10393 <para> 10394 The <command>edns-udp-size</command> option sets the 10395 EDNS UDP size that is advertised by <command>named</command> 10396 when querying the remote server. Valid values are 512 10397 to 4096 bytes (values outside this range will be silently 10398 adjusted to the nearest value within it). This option 10399 is useful when you wish to advertise a different value 10400 to this server than the value you advertise globally, 10401 for example, when there is a firewall at the remote 10402 site that is blocking large replies. (Note: Currently, 10403 this sets a single UDP size for all packets sent to the 10404 server; <command>named</command> will not deviate from 10405 this value. This differs from the behavior of 10406 <command>edns-udp-size</command> in <command>options</command> 10407 or <command>view</command> statements, where it specifies 10408 a maximum value. The <command>server</command> statement 10409 behavior may be brought into conformance with the 10410 <command>options/view</command> behavior in future releases.) 10411 </para> 10412 10413 <para> 10414 The <command>max-udp-size</command> option sets the 10415 maximum EDNS UDP message size <command>named</command> will send. Valid 10416 values are 512 to 4096 bytes (values outside this range will 10417 be silently adjusted). This option is useful when you 10418 know that there is a firewall that is blocking large 10419 replies from <command>named</command>. 10420 </para> 10421 10422 <para> 10423 The <command>nosit-udp-size</command> option sets the 10424 maximum size of UDP responses that will be sent to 10425 queries without a valid source identity token. The command 10426 <command>max-udp-size</command> option may further limit 10427 the response size. 10428 </para> 10429 10430 <para> 10431 The server supports two zone transfer methods. The first, <command>one-answer</command>, 10432 uses one DNS message per resource record transferred. <command>many-answers</command> packs 10433 as many resource records as possible into a message. <command>many-answers</command> is 10434 more efficient, but is only known to be understood by <acronym>BIND</acronym> 9, <acronym>BIND</acronym> 10435 8.x, and patched versions of <acronym>BIND</acronym> 10436 4.9.5. You can specify which method 10437 to use for a server with the <command>transfer-format</command> option. 10438 If <command>transfer-format</command> is not 10439 specified, the <command>transfer-format</command> 10440 specified 10441 by the <command>options</command> statement will be 10442 used. 10443 </para> 10444 10445 <para><command>transfers</command> 10446 is used to limit the number of concurrent inbound zone 10447 transfers from the specified server. If no 10448 <command>transfers</command> clause is specified, the 10449 limit is set according to the 10450 <command>transfers-per-ns</command> option. 10451 </para> 10452 10453 <para> 10454 The <command>keys</command> clause identifies a 10455 <command>key_id</command> defined by the <command>key</command> statement, 10456 to be used for transaction security (TSIG, <xref linkend="tsig"/>) 10457 when talking to the remote server. 10458 When a request is sent to the remote server, a request signature 10459 will be generated using the key specified here and appended to the 10460 message. A request originating from the remote server is not 10461 required 10462 to be signed by this key. 10463 </para> 10464 10465 <para> 10466 Although the grammar of the <command>keys</command> 10467 clause 10468 allows for multiple keys, only a single key per server is 10469 currently 10470 supported. 10471 </para> 10472 10473 <para> 10474 The <command>transfer-source</command> and 10475 <command>transfer-source-v6</command> clauses specify 10476 the IPv4 and IPv6 source 10477 address to be used for zone transfer with the remote server, 10478 respectively. 10479 For an IPv4 remote server, only <command>transfer-source</command> can 10480 be specified. 10481 Similarly, for an IPv6 remote server, only 10482 <command>transfer-source-v6</command> can be 10483 specified. 10484 For more details, see the description of 10485 <command>transfer-source</command> and 10486 <command>transfer-source-v6</command> in 10487 <xref linkend="zone_transfers"/>. 10488 </para> 10489 10490 <para> 10491 The <command>notify-source</command> and 10492 <command>notify-source-v6</command> clauses specify the 10493 IPv4 and IPv6 source address to be used for notify 10494 messages sent to remote servers, respectively. For an 10495 IPv4 remote server, only <command>notify-source</command> 10496 can be specified. Similarly, for an IPv6 remote server, 10497 only <command>notify-source-v6</command> can be specified. 10498 </para> 10499 10500 <para> 10501 The <command>query-source</command> and 10502 <command>query-source-v6</command> clauses specify the 10503 IPv4 and IPv6 source address to be used for queries 10504 sent to remote servers, respectively. For an IPv4 10505 remote server, only <command>query-source</command> can 10506 be specified. Similarly, for an IPv6 remote server, 10507 only <command>query-source-v6</command> can be specified. 10508 </para> 10509 10510 <para> 10511 The <command>request-nsid</command> clause determines 10512 whether the local server will add a NSID EDNS option 10513 to requests sent to the server. This overrides 10514 <command>request-nsid</command> set at the view or 10515 option level. 10516 </para> 10517 10518 <para> 10519 The <command>request-sit</command> clause determines 10520 whether the local server will add a SIT EDNS option 10521 to requests sent to the server. This overrides 10522 <command>request-sit</command> set at the view or 10523 option level. Named may determine that SIT is not 10524 supported by the remote server and not add a SIT 10525 EDNS option to requests. 10526 </para> 10527 </sect2> 10528 10529 <sect2 id="statschannels"> 10530 <title><command>statistics-channels</command> Statement Grammar</title> 10531 10532<programlisting><command>statistics-channels</command> { 10533 [ inet ( ip_addr | * ) [ port ip_port ] 10534 [ allow { <replaceable> address_match_list </replaceable> } ]; ] 10535 [ inet ...; ] 10536}; 10537</programlisting> 10538 </sect2> 10539 10540 <sect2> 10541 <title><command>statistics-channels</command> Statement Definition and 10542 Usage</title> 10543 10544 <para> 10545 The <command>statistics-channels</command> statement 10546 declares communication channels to be used by system 10547 administrators to get access to statistics information of 10548 the name server. 10549 </para> 10550 10551 <para> 10552 This statement intends to be flexible to support multiple 10553 communication protocols in the future, but currently only 10554 HTTP access is supported. 10555 It requires that BIND 9 be compiled with libxml2 and/or 10556 json-c (also known as libjson0); the 10557 <command>statistics-channels</command> statement is 10558 still accepted even if it is built without the library, 10559 but any HTTP access will fail with an error. 10560 </para> 10561 10562 <para> 10563 An <command>inet</command> control channel is a TCP socket 10564 listening at the specified <command>ip_port</command> on the 10565 specified <command>ip_addr</command>, which can be an IPv4 or IPv6 10566 address. An <command>ip_addr</command> of <literal>*</literal> 10567 (asterisk) is 10568 interpreted as the IPv4 wildcard address; connections will be 10569 accepted on any of the system's IPv4 addresses. 10570 To listen on the IPv6 wildcard address, 10571 use an <command>ip_addr</command> of <literal>::</literal>. 10572 </para> 10573 10574 <para> 10575 If no port is specified, port 80 is used for HTTP channels. 10576 The asterisk "<literal>*</literal>" cannot be used for 10577 <command>ip_port</command>. 10578 </para> 10579 10580 <para> 10581 The attempt of opening a statistics channel is 10582 restricted by the optional <command>allow</command> clause. 10583 Connections to the statistics channel are permitted based on the 10584 <command>address_match_list</command>. 10585 If no <command>allow</command> clause is present, 10586 <command>named</command> accepts connection 10587 attempts from any address; since the statistics may 10588 contain sensitive internal information, it is highly 10589 recommended to restrict the source of connection requests 10590 appropriately. 10591 </para> 10592 10593 <para> 10594 If no <command>statistics-channels</command> statement is present, 10595 <command>named</command> will not open any communication channels. 10596 </para> 10597 10598 <para> 10599 The statistics are available in various formats and views 10600 depending on the URI used to access them. For example, if 10601 the statistics channel is configured to listen on 127.0.0.1 10602 port 8888, then the statistics are accessible in XML format at 10603 <ulink url="http://127.0.0.1:8888/" 10604 >http://127.0.0.1:8888/</ulink> or 10605 <ulink url="http://127.0.0.1:8888/xml" 10606 >http://127.0.0.1:8888/xml</ulink>. A CSS file is 10607 included which can format the XML statistics into tables 10608 when viewed with a stylesheet-capable browser, and into 10609 charts and graphs using the Google Charts API when using a 10610 javascript-capable browser. 10611 </para> 10612 10613 <para> 10614 Applications that depend on a particular XML schema 10615 can request 10616 <ulink url="http://127.0.0.1:8888/xml/v2" 10617 >http://127.0.0.1:8888/xml/v2</ulink> for version 2 10618 of the statistics XML schema or 10619 <ulink url="http://127.0.0.1:8888/xml/v3" 10620 >http://127.0.0.1:8888/xml/v3</ulink> for version 3. 10621 If the requested schema is supported by the server, then 10622 it will respond; if not, it will return a "page not found" 10623 error. 10624 </para> 10625 10626 <para> 10627 Broken-out subsets of the statistics can be viewed at 10628 <ulink url="http://127.0.0.1:8888/xml/v3/status" 10629 >http://127.0.0.1:8888/xml/v3/status</ulink> 10630 (server uptime and last reconfiguration time), 10631 <ulink url="http://127.0.0.1:8888/xml/v3/server" 10632 >http://127.0.0.1:8888/xml/v3/server</ulink> 10633 (server and resolver statistics), 10634 <ulink url="http://127.0.0.1:8888/xml/v3/zones" 10635 >http://127.0.0.1:8888/xml/v3/zones</ulink> 10636 (zone statistics), 10637 <ulink url="http://127.0.0.1:8888/xml/v3/net" 10638 >http://127.0.0.1:8888/xml/v3/net</ulink> 10639 (network status and socket statistics), 10640 <ulink url="http://127.0.0.1:8888/xml/v3/mem" 10641 >http://127.0.0.1:8888/xml/v3/mem</ulink> 10642 (memory manager statistics), 10643 <ulink url="http://127.0.0.1:8888/xml/v3/tasks" 10644 >http://127.0.0.1:8888/xml/v3/tasks</ulink> 10645 (task manager statistics). 10646 </para> 10647 10648 <para> 10649 The full set of statistics can also be read in JSON format at 10650 <ulink url="http://127.0.0.1:8888/json" 10651 >http://127.0.0.1:8888/json</ulink>, 10652 with the broken-out subsets at 10653 <ulink url="http://127.0.0.1:8888/json/v1/status" 10654 >http://127.0.0.1:8888/json/v1/status</ulink> 10655 (server uptime and last reconfiguration time), 10656 <ulink url="http://127.0.0.1:8888/json/v1/server" 10657 >http://127.0.0.1:8888/json/v1/server</ulink> 10658 (server and resolver statistics), 10659 <ulink url="http://127.0.0.1:8888/json/v1/zones" 10660 >http://127.0.0.1:8888/json/v1/zones</ulink> 10661 (zone statistics), 10662 <ulink url="http://127.0.0.1:8888/json/v1/net" 10663 >http://127.0.0.1:8888/json/v1/net</ulink> 10664 (network status and socket statistics), 10665 <ulink url="http://127.0.0.1:8888/json/v1/mem" 10666 >http://127.0.0.1:8888/json/v1/mem</ulink> 10667 (memory manager statistics), 10668 <ulink url="http://127.0.0.1:8888/json/v1/tasks" 10669 >http://127.0.0.1:8888/json/v1/tasks</ulink> 10670 (task manager statistics). 10671 </para> 10672 </sect2> 10673 10674 <sect2 id="trusted-keys"> 10675 <title><command>trusted-keys</command> Statement Grammar</title> 10676 10677<programlisting><command>trusted-keys</command> { 10678 <replaceable>string</replaceable> <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>string</replaceable> ; 10679 <optional> <replaceable>string</replaceable> <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>string</replaceable> ; <optional>...</optional></optional> 10680}; 10681</programlisting> 10682 10683 </sect2> 10684 <sect2> 10685 <title><command>trusted-keys</command> Statement Definition 10686 and Usage</title> 10687 <para> 10688 The <command>trusted-keys</command> statement defines 10689 DNSSEC security roots. DNSSEC is described in <xref 10690 linkend="DNSSEC"/>. A security root is defined when the 10691 public key for a non-authoritative zone is known, but 10692 cannot be securely obtained through DNS, either because 10693 it is the DNS root zone or because its parent zone is 10694 unsigned. Once a key has been configured as a trusted 10695 key, it is treated as if it had been validated and 10696 proven secure. The resolver attempts DNSSEC validation 10697 on all DNS data in subdomains of a security root. 10698 </para> 10699 <para> 10700 All keys (and corresponding zones) listed in 10701 <command>trusted-keys</command> are deemed to exist regardless 10702 of what parent zones say. Similarly for all keys listed in 10703 <command>trusted-keys</command> only those keys are 10704 used to validate the DNSKEY RRset. The parent's DS RRset 10705 will not be used. 10706 </para> 10707 <para> 10708 The <command>trusted-keys</command> statement can contain 10709 multiple key entries, each consisting of the key's 10710 domain name, flags, protocol, algorithm, and the Base-64 10711 representation of the key data. 10712 Spaces, tabs, newlines and carriage returns are ignored 10713 in the key data, so the configuration may be split up into 10714 multiple lines. 10715 </para> 10716 <para> 10717 <command>trusted-keys</command> may be set at the top level 10718 of <filename>named.conf</filename> or within a view. If it is 10719 set in both places, they are additive: keys defined at the top 10720 level are inherited by all views, but keys defined in a view 10721 are only used within that view. 10722 </para> 10723 </sect2> 10724 10725 <sect2> 10726 <title><command>managed-keys</command> Statement Grammar</title> 10727 10728<programlisting><command>managed-keys</command> { 10729 <replaceable>name</replaceable> initial-key <replaceable>flags</replaceable> <replaceable>protocol</replaceable> <replaceable>algorithm</replaceable> <replaceable>key-data</replaceable> ; 10730 <optional> <replaceable>name</replaceable> initial-key <replaceable>flags</replaceable> <replaceable>protocol</replaceable> <replaceable>algorithm</replaceable> <replaceable>key-data</replaceable> ; <optional>...</optional></optional> 10731}; 10732</programlisting> 10733 10734 </sect2> 10735 <sect2 id="managed-keys"> 10736 <title><command>managed-keys</command> Statement Definition 10737 and Usage</title> 10738 <para> 10739 The <command>managed-keys</command> statement, like 10740 <command>trusted-keys</command>, defines DNSSEC 10741 security roots. The difference is that 10742 <command>managed-keys</command> can be kept up to date 10743 automatically, without intervention from the resolver 10744 operator. 10745 </para> 10746 <para> 10747 Suppose, for example, that a zone's key-signing 10748 key was compromised, and the zone owner had to revoke and 10749 replace the key. A resolver which had the old key in a 10750 <command>trusted-keys</command> statement would be 10751 unable to validate this zone any longer; it would 10752 reply with a SERVFAIL response code. This would 10753 continue until the resolver operator had updated the 10754 <command>trusted-keys</command> statement with the new key. 10755 </para> 10756 <para> 10757 If, however, the zone were listed in a 10758 <command>managed-keys</command> statement instead, then the 10759 zone owner could add a "stand-by" key to the zone in advance. 10760 <command>named</command> would store the stand-by key, and 10761 when the original key was revoked, <command>named</command> 10762 would be able to transition smoothly to the new key. It would 10763 also recognize that the old key had been revoked, and cease 10764 using that key to validate answers, minimizing the damage that 10765 the compromised key could do. 10766 </para> 10767 <para> 10768 A <command>managed-keys</command> statement contains a list of 10769 the keys to be managed, along with information about how the 10770 keys are to be initialized for the first time. The only 10771 initialization method currently supported (as of 10772 <acronym>BIND</acronym> 9.7.0) is <literal>initial-key</literal>. 10773 This means the <command>managed-keys</command> statement must 10774 contain a copy of the initializing key. (Future releases may 10775 allow keys to be initialized by other methods, eliminating this 10776 requirement.) 10777 </para> 10778 <para> 10779 Consequently, a <command>managed-keys</command> statement 10780 appears similar to a <command>trusted-keys</command>, differing 10781 in the presence of the second field, containing the keyword 10782 <literal>initial-key</literal>. The difference is, whereas the 10783 keys listed in a <command>trusted-keys</command> continue to be 10784 trusted until they are removed from 10785 <filename>named.conf</filename>, an initializing key listed 10786 in a <command>managed-keys</command> statement is only trusted 10787 <emphasis>once</emphasis>: for as long as it takes to load the 10788 managed key database and start the RFC 5011 key maintenance 10789 process. 10790 </para> 10791 <para> 10792 The first time <command>named</command> runs with a managed key 10793 configured in <filename>named.conf</filename>, it fetches the 10794 DNSKEY RRset directly from the zone apex, and validates it 10795 using the key specified in the <command>managed-keys</command> 10796 statement. If the DNSKEY RRset is validly signed, then it is 10797 used as the basis for a new managed keys database. 10798 </para> 10799 <para> 10800 From that point on, whenever <command>named</command> runs, it 10801 sees the <command>managed-keys</command> statement, checks to 10802 make sure RFC 5011 key maintenance has already been initialized 10803 for the specified domain, and if so, it simply moves on. The 10804 key specified in the <command>managed-keys</command> is not 10805 used to validate answers; it has been superseded by the key or 10806 keys stored in the managed keys database. 10807 </para> 10808 <para> 10809 The next time <command>named</command> runs after a name 10810 has been <emphasis>removed</emphasis> from the 10811 <command>managed-keys</command> statement, the corresponding 10812 zone will be removed from the managed keys database, 10813 and RFC 5011 key maintenance will no longer be used for that 10814 domain. 10815 </para> 10816 <para> 10817 <command>named</command> only maintains a single managed keys 10818 database; consequently, unlike <command>trusted-keys</command>, 10819 <command>managed-keys</command> may only be set at the top 10820 level of <filename>named.conf</filename>, not within a view. 10821 </para> 10822 <para> 10823 In the current implementation, the managed keys database is 10824 stored as a master-format zone file called 10825 <filename>managed-keys.bind</filename>. When the key database 10826 is changed, the zone is updated. As with any other dynamic 10827 zone, changes will be written into a journal file, 10828 <filename>managed-keys.bind.jnl</filename>. They are committed 10829 to the master file as soon as possible afterward; in the case 10830 of the managed key database, this will usually occur within 30 10831 seconds. So, whenever <command>named</command> is using 10832 automatic key maintenance, those two files can be expected to 10833 exist in the working directory. (For this reason among others, 10834 the working directory should be always be writable by 10835 <command>named</command>.) 10836 </para> 10837 <para> 10838 If the <command>dnssec-validation</command> option is 10839 set to <userinput>auto</userinput>, <command>named</command> 10840 will automatically initialize a managed key for the 10841 root zone. Similarly, if the <command>dnssec-lookaside</command> 10842 option is set to <userinput>auto</userinput>, 10843 <command>named</command> will automatically initialize 10844 a managed key for the zone <literal>dlv.isc.org</literal>. 10845 In both cases, the key that is used to initialize the key 10846 maintenance process is built into <command>named</command>, 10847 and can be overridden from <command>bindkeys-file</command>. 10848 </para> 10849 </sect2> 10850 10851 <sect2 id="view_statement_grammar"> 10852 <title><command>view</command> Statement Grammar</title> 10853 10854<programlisting><command>view</command> <replaceable>view_name</replaceable> 10855 <optional><replaceable>class</replaceable></optional> { 10856 match-clients { <replaceable>address_match_list</replaceable> }; 10857 match-destinations { <replaceable>address_match_list</replaceable> }; 10858 match-recursive-only <replaceable>yes_or_no</replaceable> ; 10859 <optional> <replaceable>view_option</replaceable>; ...</optional> 10860 <optional> <replaceable>zone_statement</replaceable>; ...</optional> 10861}; 10862</programlisting> 10863 10864 </sect2> 10865 <sect2> 10866 <title><command>view</command> Statement Definition and Usage</title> 10867 10868 <para> 10869 The <command>view</command> statement is a powerful 10870 feature 10871 of <acronym>BIND</acronym> 9 that lets a name server 10872 answer a DNS query differently 10873 depending on who is asking. It is particularly useful for 10874 implementing 10875 split DNS setups without having to run multiple servers. 10876 </para> 10877 10878 <para> 10879 Each <command>view</command> statement defines a view 10880 of the 10881 DNS namespace that will be seen by a subset of clients. A client 10882 matches 10883 a view if its source IP address matches the 10884 <varname>address_match_list</varname> of the view's 10885 <command>match-clients</command> clause and its 10886 destination IP address matches 10887 the <varname>address_match_list</varname> of the 10888 view's 10889 <command>match-destinations</command> clause. If not 10890 specified, both 10891 <command>match-clients</command> and <command>match-destinations</command> 10892 default to matching all addresses. In addition to checking IP 10893 addresses 10894 <command>match-clients</command> and <command>match-destinations</command> 10895 can also take <command>keys</command> which provide an 10896 mechanism for the 10897 client to select the view. A view can also be specified 10898 as <command>match-recursive-only</command>, which 10899 means that only recursive 10900 requests from matching clients will match that view. 10901 The order of the <command>view</command> statements is 10902 significant — 10903 a client request will be resolved in the context of the first 10904 <command>view</command> that it matches. 10905 </para> 10906 10907 <para> 10908 Zones defined within a <command>view</command> 10909 statement will 10910 only be accessible to clients that match the <command>view</command>. 10911 By defining a zone of the same name in multiple views, different 10912 zone data can be given to different clients, for example, 10913 "internal" 10914 and "external" clients in a split DNS setup. 10915 </para> 10916 10917 <para> 10918 Many of the options given in the <command>options</command> statement 10919 can also be used within a <command>view</command> 10920 statement, and then 10921 apply only when resolving queries with that view. When no 10922 view-specific 10923 value is given, the value in the <command>options</command> statement 10924 is used as a default. Also, zone options can have default values 10925 specified 10926 in the <command>view</command> statement; these 10927 view-specific defaults 10928 take precedence over those in the <command>options</command> statement. 10929 </para> 10930 10931 <para> 10932 Views are class specific. If no class is given, class IN 10933 is assumed. Note that all non-IN views must contain a hint zone, 10934 since only the IN class has compiled-in default hints. 10935 </para> 10936 10937 <para> 10938 If there are no <command>view</command> statements in 10939 the config 10940 file, a default view that matches any client is automatically 10941 created 10942 in class IN. Any <command>zone</command> statements 10943 specified on 10944 the top level of the configuration file are considered to be part 10945 of 10946 this default view, and the <command>options</command> 10947 statement will 10948 apply to the default view. If any explicit <command>view</command> 10949 statements are present, all <command>zone</command> 10950 statements must 10951 occur inside <command>view</command> statements. 10952 </para> 10953 10954 <para> 10955 Here is an example of a typical split DNS setup implemented 10956 using <command>view</command> statements: 10957 </para> 10958 10959<programlisting>view "internal" { 10960 // This should match our internal networks. 10961 match-clients { 10.0.0.0/8; }; 10962 10963 // Provide recursive service to internal 10964 // clients only. 10965 recursion yes; 10966 10967 // Provide a complete view of the example.com 10968 // zone including addresses of internal hosts. 10969 zone "example.com" { 10970 type master; 10971 file "example-internal.db"; 10972 }; 10973}; 10974 10975view "external" { 10976 // Match all clients not matched by the 10977 // previous view. 10978 match-clients { any; }; 10979 10980 // Refuse recursive service to external clients. 10981 recursion no; 10982 10983 // Provide a restricted view of the example.com 10984 // zone containing only publicly accessible hosts. 10985 zone "example.com" { 10986 type master; 10987 file "example-external.db"; 10988 }; 10989}; 10990</programlisting> 10991 10992 </sect2> 10993 <sect2 id="zone_statement_grammar"> 10994 <title><command>zone</command> 10995 Statement Grammar</title> 10996 10997<programlisting><command>zone</command> <replaceable>zone_name</replaceable> <optional><replaceable>class</replaceable></optional> { 10998 type master; 10999 <optional> allow-query { <replaceable>address_match_list</replaceable> }; </optional> 11000 <optional> allow-query-on { <replaceable>address_match_list</replaceable> }; </optional> 11001 <optional> allow-transfer { <replaceable>address_match_list</replaceable> }; </optional> 11002 <optional> allow-update { <replaceable>address_match_list</replaceable> }; </optional> 11003 <optional> update-check-ksk <replaceable>yes_or_no</replaceable>; </optional> 11004 <optional> dnssec-dnskey-kskonly <replaceable>yes_or_no</replaceable>; </optional> 11005 <optional> dnssec-loadkeys-interval <replaceable>number</replaceable>; </optional> 11006 <optional> update-policy <replaceable>local</replaceable> | { <replaceable>update_policy_rule</replaceable> <optional>...</optional> }; </optional> 11007 <optional> also-notify { <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; 11008 <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; ... </optional> }; </optional> 11009 <optional> check-names (<constant>warn</constant>|<constant>fail</constant>|<constant>ignore</constant>) ; </optional> 11010 <optional> check-mx (<constant>warn</constant>|<constant>fail</constant>|<constant>ignore</constant>) ; </optional> 11011 <optional> check-wildcard <replaceable>yes_or_no</replaceable>; </optional> 11012 <optional> check-spf ( <replaceable>warn</replaceable> | <replaceable>ignore</replaceable> ); </optional> 11013 <optional> check-integrity <replaceable>yes_or_no</replaceable> ; </optional> 11014 <optional> dialup <replaceable>dialup_option</replaceable> ; </optional> 11015 <optional> file <replaceable>string</replaceable> ; </optional> 11016 <optional> masterfile-format (<constant>text</constant>|<constant>raw</constant>|<constant>map</constant>) ; </optional> 11017 <optional> journal <replaceable>string</replaceable> ; </optional> 11018 <optional> max-journal-size <replaceable>size_spec</replaceable>; </optional> 11019 <optional> forward (<constant>only</constant>|<constant>first</constant>) ; </optional> 11020 <optional> forwarders { <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; ... </optional> }; </optional> 11021 <optional> ixfr-base <replaceable>string</replaceable> ; </optional> 11022 <optional> ixfr-from-differences <replaceable>yes_or_no</replaceable>; </optional> 11023 <optional> ixfr-tmp-file <replaceable>string</replaceable> ; </optional> 11024 <optional> request-ixfr <replaceable>yes_or_no</replaceable> ; </optional> 11025 <optional> maintain-ixfr-base <replaceable>yes_or_no</replaceable> ; </optional> 11026 <optional> max-ixfr-log-size <replaceable>number</replaceable> ; </optional> 11027 <optional> max-transfer-idle-out <replaceable>number</replaceable> ; </optional> 11028 <optional> max-transfer-time-out <replaceable>number</replaceable> ; </optional> 11029 <optional> notify <replaceable>yes_or_no</replaceable> | <replaceable>explicit</replaceable> | <replaceable>master-only</replaceable> ; </optional> 11030 <optional> notify-delay <replaceable>seconds</replaceable> ; </optional> 11031 <optional> notify-to-soa <replaceable>yes_or_no</replaceable>; </optional> 11032 <optional> pubkey <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>string</replaceable> ; </optional> 11033 <optional> notify-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 11034 <optional> notify-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 11035 <optional> zone-statistics <replaceable>full</replaceable> | <replaceable>terse</replaceable> | <replaceable>none</replaceable>; </optional> 11036 <optional> sig-validity-interval <replaceable>number</replaceable> <optional><replaceable>number</replaceable></optional> ; </optional> 11037 <optional> sig-signing-nodes <replaceable>number</replaceable> ; </optional> 11038 <optional> sig-signing-signatures <replaceable>number</replaceable> ; </optional> 11039 <optional> sig-signing-type <replaceable>number</replaceable> ; </optional> 11040 <optional> database <replaceable>string</replaceable> ; </optional> 11041 <optional> min-refresh-time <replaceable>number</replaceable> ; </optional> 11042 <optional> max-refresh-time <replaceable>number</replaceable> ; </optional> 11043 <optional> min-retry-time <replaceable>number</replaceable> ; </optional> 11044 <optional> max-retry-time <replaceable>number</replaceable> ; </optional> 11045 <optional> key-directory <replaceable>path_name</replaceable>; </optional> 11046 <optional> auto-dnssec <constant>allow</constant>|<constant>maintain</constant>|<constant>off</constant>; </optional> 11047 <optional> inline-signing <replaceable>yes_or_no</replaceable>; </optional> 11048 <optional> zero-no-soa-ttl <replaceable>yes_or_no</replaceable> ; </optional> 11049 <optional> serial-update-method <constant>increment</constant>|<constant>unixtime</constant>; </optional> 11050 <optional> max-zone-ttl <replaceable>number</replaceable> ; </optional> 11051}; 11052 11053zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replaceable></optional> { 11054 type slave; 11055 <optional> allow-notify { <replaceable>address_match_list</replaceable> }; </optional> 11056 <optional> allow-query { <replaceable>address_match_list</replaceable> }; </optional> 11057 <optional> allow-query-on { <replaceable>address_match_list</replaceable> }; </optional> 11058 <optional> allow-transfer { <replaceable>address_match_list</replaceable> }; </optional> 11059 <optional> allow-update-forwarding { <replaceable>address_match_list</replaceable> }; </optional> 11060 <optional> dnssec-update-mode ( <replaceable>maintain</replaceable> | <replaceable>no-resign</replaceable> ); </optional> 11061 <optional> update-check-ksk <replaceable>yes_or_no</replaceable>; </optional> 11062 <optional> dnssec-dnskey-kskonly <replaceable>yes_or_no</replaceable>; </optional> 11063 <optional> dnssec-loadkeys-interval <replaceable>number</replaceable>; </optional> 11064 <optional> dnssec-secure-to-insecure <replaceable>yes_or_no</replaceable> ; </optional> 11065 <optional> try-tcp-refresh <replaceable>yes_or_no</replaceable>; </optional> 11066 <optional> also-notify <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> { ( <replaceable>masters_list</replaceable> | <replaceable>ip_addr</replaceable> 11067 <optional>port <replaceable>ip_port</replaceable></optional> 11068 <optional>dscp <replaceable>ip_dscp</replaceable></optional> 11069 <optional>key <replaceable>key</replaceable></optional> ) ; <optional>...</optional> }; </optional> 11070 <optional> check-names (<constant>warn</constant>|<constant>fail</constant>|<constant>ignore</constant>) ; </optional> 11071 <optional> dialup <replaceable>dialup_option</replaceable> ; </optional> 11072 <optional> file <replaceable>string</replaceable> ; </optional> 11073 <optional> masterfile-format (<constant>text</constant>|<constant>raw</constant>|<constant>map</constant>) ; </optional> 11074 <optional> journal <replaceable>string</replaceable> ; </optional> 11075 <optional> max-journal-size <replaceable>size_spec</replaceable>; </optional> 11076 <optional> forward (<constant>only</constant>|<constant>first</constant>) ; </optional> 11077 <optional> forwarders { <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; ... </optional> }; </optional> 11078 <optional> ixfr-base <replaceable>string</replaceable> ; </optional> 11079 <optional> ixfr-from-differences <replaceable>yes_or_no</replaceable>; </optional> 11080 <optional> ixfr-tmp-file <replaceable>string</replaceable> ; </optional> 11081 <optional> maintain-ixfr-base <replaceable>yes_or_no</replaceable> ; </optional> 11082 <optional> masters <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> { ( <replaceable>masters_list</replaceable> | <replaceable>ip_addr</replaceable> 11083 <optional>port <replaceable>ip_port</replaceable></optional> 11084 <optional>dscp <replaceable>ip_dscp</replaceable></optional> 11085 <optional>key <replaceable>key</replaceable></optional> ) ; <optional>...</optional> }; </optional> 11086 <optional> max-ixfr-log-size <replaceable>number</replaceable> ; </optional> 11087 <optional> max-transfer-idle-in <replaceable>number</replaceable> ; </optional> 11088 <optional> max-transfer-idle-out <replaceable>number</replaceable> ; </optional> 11089 <optional> max-transfer-time-in <replaceable>number</replaceable> ; </optional> 11090 <optional> max-transfer-time-out <replaceable>number</replaceable> ; </optional> 11091 <optional> notify <replaceable>yes_or_no</replaceable> | <replaceable>explicit</replaceable> | <replaceable>master-only</replaceable> ; </optional> 11092 <optional> notify-delay <replaceable>seconds</replaceable> ; </optional> 11093 <optional> notify-to-soa <replaceable>yes_or_no</replaceable>; </optional> 11094 <optional> pubkey <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>string</replaceable> ; </optional> 11095 <optional> transfer-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 11096 <optional> transfer-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 11097 <optional> alt-transfer-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 11098 <optional> alt-transfer-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) 11099 <optional>port <replaceable>ip_port</replaceable></optional> 11100 <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 11101 <optional> use-alt-transfer-source <replaceable>yes_or_no</replaceable>; </optional> 11102 <optional> notify-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 11103 <optional> notify-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 11104 <optional> zone-statistics <replaceable>full</replaceable> | <replaceable>terse</replaceable> | <replaceable>none</replaceable>; </optional> 11105 <optional> sig-validity-interval <replaceable>number</replaceable> <optional><replaceable>number</replaceable></optional> ; </optional> 11106 <optional> sig-signing-nodes <replaceable>number</replaceable> ; </optional> 11107 <optional> sig-signing-signatures <replaceable>number</replaceable> ; </optional> 11108 <optional> sig-signing-type <replaceable>number</replaceable> ; </optional> 11109 <optional> database <replaceable>string</replaceable> ; </optional> 11110 <optional> min-refresh-time <replaceable>number</replaceable> ; </optional> 11111 <optional> max-refresh-time <replaceable>number</replaceable> ; </optional> 11112 <optional> min-retry-time <replaceable>number</replaceable> ; </optional> 11113 <optional> max-retry-time <replaceable>number</replaceable> ; </optional> 11114 <optional> key-directory <replaceable>path_name</replaceable>; </optional> 11115 <optional> auto-dnssec <constant>allow</constant>|<constant>maintain</constant>|<constant>off</constant>; </optional> 11116 <optional> inline-signing <replaceable>yes_or_no</replaceable>; </optional> 11117 <optional> multi-master <replaceable>yes_or_no</replaceable> ; </optional> 11118 <optional> zero-no-soa-ttl <replaceable>yes_or_no</replaceable> ; </optional> 11119}; 11120 11121zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replaceable></optional> { 11122 type hint; 11123 file <replaceable>string</replaceable> ; 11124 <optional> delegation-only <replaceable>yes_or_no</replaceable> ; </optional> 11125 <optional> check-names (<constant>warn</constant>|<constant>fail</constant>|<constant>ignore</constant>) ; </optional> // Not Implemented. 11126}; 11127 11128zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replaceable></optional> { 11129 type stub; 11130 <optional> allow-query { <replaceable>address_match_list</replaceable> }; </optional> 11131 <optional> allow-query-on { <replaceable>address_match_list</replaceable> }; </optional> 11132 <optional> check-names (<constant>warn</constant>|<constant>fail</constant>|<constant>ignore</constant>) ; </optional> 11133 <optional> dialup <replaceable>dialup_option</replaceable> ; </optional> 11134 <optional> delegation-only <replaceable>yes_or_no</replaceable> ; </optional> 11135 <optional> file <replaceable>string</replaceable> ; </optional> 11136 <optional> masterfile-format (<constant>text</constant>|<constant>raw</constant>|<constant>map</constant>) ; </optional> 11137 <optional> forward (<constant>only</constant>|<constant>first</constant>) ; </optional> 11138 <optional> forwarders { <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; ... </optional> }; </optional> 11139 <optional> masters <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> { ( <replaceable>masters_list</replaceable> | <replaceable>ip_addr</replaceable> 11140 <optional>port <replaceable>ip_port</replaceable></optional> 11141 <optional>dscp <replaceable>ip_dscp</replaceable></optional> 11142 <optional>key <replaceable>key</replaceable></optional> ) ; <optional>...</optional> }; </optional> 11143 <optional> max-transfer-idle-in <replaceable>number</replaceable> ; </optional> 11144 <optional> max-transfer-time-in <replaceable>number</replaceable> ; </optional> 11145 <optional> pubkey <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>string</replaceable> ; </optional> 11146 <optional> transfer-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 11147 <optional> transfer-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) 11148 <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 11149 <optional> alt-transfer-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 11150 <optional> alt-transfer-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) 11151 <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; </optional> 11152 <optional> use-alt-transfer-source <replaceable>yes_or_no</replaceable>; </optional> 11153 <optional> zone-statistics <replaceable>yes_or_no</replaceable> ; </optional> 11154 <optional> database <replaceable>string</replaceable> ; </optional> 11155 <optional> min-refresh-time <replaceable>number</replaceable> ; </optional> 11156 <optional> max-refresh-time <replaceable>number</replaceable> ; </optional> 11157 <optional> min-retry-time <replaceable>number</replaceable> ; </optional> 11158 <optional> max-retry-time <replaceable>number</replaceable> ; </optional> 11159 <optional> multi-master <replaceable>yes_or_no</replaceable> ; </optional> 11160}; 11161 11162zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replaceable></optional> { 11163 type static-stub; 11164 <optional> allow-query { <replaceable>address_match_list</replaceable> }; </optional> 11165 <optional> server-addresses { <optional> <replaceable>ip_addr</replaceable> ; ... </optional> }; </optional> 11166 <optional> server-names { <optional> <replaceable>namelist</replaceable> </optional> }; </optional> 11167 <optional> zone-statistics <replaceable>yes_or_no</replaceable> ; </optional> 11168}; 11169 11170zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replaceable></optional> { 11171 type forward; 11172 <optional> forward (<constant>only</constant>|<constant>first</constant>) ; </optional> 11173 <optional> forwarders { <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> <optional>dscp <replaceable>ip_dscp</replaceable></optional> ; ... </optional> }; </optional> 11174 <optional> delegation-only <replaceable>yes_or_no</replaceable> ; </optional> 11175}; 11176 11177zone <replaceable>"."</replaceable> <optional><replaceable>class</replaceable></optional> { 11178 type redirect; 11179 file <replaceable>string</replaceable> ; 11180 <optional> masterfile-format (<constant>text</constant>|<constant>raw</constant>|<constant>map</constant>) ; </optional> 11181 <optional> allow-query { <replaceable>address_match_list</replaceable> }; </optional> 11182 <optional> max-zone-ttl <replaceable>number</replaceable> ; </optional> 11183}; 11184 11185zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replaceable></optional> { 11186 type delegation-only; 11187}; 11188 11189zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replaceable></optional> { 11190 <optional> in-view <replaceable>string</replaceable> ; </optional> 11191}; 11192 11193</programlisting> 11194 11195 </sect2> 11196 <sect2> 11197 <title><command>zone</command> Statement Definition and Usage</title> 11198 <sect3> 11199 <title>Zone Types</title> 11200 <informaltable colsep="0" rowsep="0"> 11201 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="3Level-table"> 11202 <!--colspec colname="1" colnum="1" colsep="0" colwidth="1.108in"/--> 11203 <!--colspec colname="2" colnum="2" colsep="0" colwidth="4.017in"/--> 11204 <colspec colname="1" colnum="1" colsep="0"/> 11205 <colspec colname="2" colnum="2" colsep="0" colwidth="4.017in"/> 11206 <tbody> 11207 <row rowsep="0"> 11208 <entry colname="1"> 11209 <para> 11210 <varname>master</varname> 11211 </para> 11212 </entry> 11213 <entry colname="2"> 11214 <para> 11215 The server has a master copy of the data 11216 for the zone and will be able to provide authoritative 11217 answers for 11218 it. 11219 </para> 11220 </entry> 11221 </row> 11222 <row rowsep="0"> 11223 <entry colname="1"> 11224 <para> 11225 <varname>slave</varname> 11226 </para> 11227 </entry> 11228 <entry colname="2"> 11229 <para> 11230 A slave zone is a replica of a master 11231 zone. The <command>masters</command> list 11232 specifies one or more IP addresses 11233 of master servers that the slave contacts to update 11234 its copy of the zone. 11235 Masters list elements can also be names of other 11236 masters lists. 11237 By default, transfers are made from port 53 on the 11238 servers; this can 11239 be changed for all servers by specifying a port number 11240 before the 11241 list of IP addresses, or on a per-server basis after 11242 the IP address. 11243 Authentication to the master can also be done with 11244 per-server TSIG keys. 11245 If a file is specified, then the 11246 replica will be written to this file whenever the zone 11247 is changed, 11248 and reloaded from this file on a server restart. Use 11249 of a file is 11250 recommended, since it often speeds server startup and 11251 eliminates 11252 a needless waste of bandwidth. Note that for large 11253 numbers (in the 11254 tens or hundreds of thousands) of zones per server, it 11255 is best to 11256 use a two-level naming scheme for zone filenames. For 11257 example, 11258 a slave server for the zone <literal>example.com</literal> might place 11259 the zone contents into a file called 11260 <filename>ex/example.com</filename> where <filename>ex/</filename> is 11261 just the first two letters of the zone name. (Most 11262 operating systems 11263 behave very slowly if you put 100000 files into 11264 a single directory.) 11265 </para> 11266 </entry> 11267 </row> 11268 <row rowsep="0"> 11269 <entry colname="1"> 11270 <para> 11271 <varname>stub</varname> 11272 </para> 11273 </entry> 11274 <entry colname="2"> 11275 <para> 11276 A stub zone is similar to a slave zone, 11277 except that it replicates only the NS records of a 11278 master zone instead 11279 of the entire zone. Stub zones are not a standard part 11280 of the DNS; 11281 they are a feature specific to the <acronym>BIND</acronym> implementation. 11282 </para> 11283 11284 <para> 11285 Stub zones can be used to eliminate the need for glue 11286 NS record 11287 in a parent zone at the expense of maintaining a stub 11288 zone entry and 11289 a set of name server addresses in <filename>named.conf</filename>. 11290 This usage is not recommended for new configurations, 11291 and BIND 9 11292 supports it only in a limited way. 11293 In <acronym>BIND</acronym> 4/8, zone 11294 transfers of a parent zone 11295 included the NS records from stub children of that 11296 zone. This meant 11297 that, in some cases, users could get away with 11298 configuring child stubs 11299 only in the master server for the parent zone. <acronym>BIND</acronym> 11300 9 never mixes together zone data from different zones 11301 in this 11302 way. Therefore, if a <acronym>BIND</acronym> 9 master serving a parent 11303 zone has child stub zones configured, all the slave 11304 servers for the 11305 parent zone also need to have the same child stub 11306 zones 11307 configured. 11308 </para> 11309 11310 <para> 11311 Stub zones can also be used as a way of forcing the 11312 resolution 11313 of a given domain to use a particular set of 11314 authoritative servers. 11315 For example, the caching name servers on a private 11316 network using 11317 RFC1918 addressing may be configured with stub zones 11318 for 11319 <literal>10.in-addr.arpa</literal> 11320 to use a set of internal name servers as the 11321 authoritative 11322 servers for that domain. 11323 </para> 11324 </entry> 11325 </row> 11326 <row rowsep="0"> 11327 <entry colname="1"> 11328 <para> 11329 <varname>static-stub</varname> 11330 </para> 11331 </entry> 11332 <entry colname="2"> 11333 <para> 11334 A static-stub zone is similar to a stub zone 11335 with the following exceptions: 11336 the zone data is statically configured, rather 11337 than transferred from a master server; 11338 when recursion is necessary for a query that 11339 matches a static-stub zone, the locally 11340 configured data (nameserver names and glue addresses) 11341 is always used even if different authoritative 11342 information is cached. 11343 </para> 11344 <para> 11345 Zone data is configured via the 11346 <command>server-addresses</command> and 11347 <command>server-names</command> zone options. 11348 </para> 11349 <para> 11350 The zone data is maintained in the form of NS 11351 and (if necessary) glue A or AAAA RRs 11352 internally, which can be seen by dumping zone 11353 databases by <command>rndc dumpdb -all</command>. 11354 The configured RRs are considered local configuration 11355 parameters rather than public data. 11356 Non recursive queries (i.e., those with the RD 11357 bit off) to a static-stub zone are therefore 11358 prohibited and will be responded with REFUSED. 11359 </para> 11360 <para> 11361 Since the data is statically configured, no 11362 zone maintenance action takes place for a static-stub 11363 zone. 11364 For example, there is no periodic refresh 11365 attempt, and an incoming notify message 11366 will be rejected with an rcode of NOTAUTH. 11367 </para> 11368 <para> 11369 Each static-stub zone is configured with 11370 internally generated NS and (if necessary) 11371 glue A or AAAA RRs 11372 </para> 11373 </entry> 11374 </row> 11375 <row rowsep="0"> 11376 <entry colname="1"> 11377 <para> 11378 <varname>forward</varname> 11379 </para> 11380 </entry> 11381 <entry colname="2"> 11382 <para> 11383 A "forward zone" is a way to configure 11384 forwarding on a per-domain basis. A <command>zone</command> statement 11385 of type <command>forward</command> can 11386 contain a <command>forward</command> 11387 and/or <command>forwarders</command> 11388 statement, 11389 which will apply to queries within the domain given by 11390 the zone 11391 name. If no <command>forwarders</command> 11392 statement is present or 11393 an empty list for <command>forwarders</command> is given, then no 11394 forwarding will be done for the domain, canceling the 11395 effects of 11396 any forwarders in the <command>options</command> statement. Thus 11397 if you want to use this type of zone to change the 11398 behavior of the 11399 global <command>forward</command> option 11400 (that is, "forward first" 11401 to, then "forward only", or vice versa, but want to 11402 use the same 11403 servers as set globally) you need to re-specify the 11404 global forwarders. 11405 </para> 11406 </entry> 11407 </row> 11408 <row rowsep="0"> 11409 <entry colname="1"> 11410 <para> 11411 <varname>hint</varname> 11412 </para> 11413 </entry> 11414 <entry colname="2"> 11415 <para> 11416 The initial set of root name servers is 11417 specified using a "hint zone". When the server starts 11418 up, it uses 11419 the root hints to find a root name server and get the 11420 most recent 11421 list of root name servers. If no hint zone is 11422 specified for class 11423 IN, the server uses a compiled-in default set of root 11424 servers hints. 11425 Classes other than IN have no built-in defaults hints. 11426 </para> 11427 </entry> 11428 </row> 11429 <row rowsep="0"> 11430 <entry colname="1"> 11431 <para> 11432 <varname>redirect</varname> 11433 </para> 11434 </entry> 11435 <entry colname="2"> 11436 <para> 11437 Redirect zones are used to provide answers to 11438 queries when normal resolution would result in 11439 NXDOMAIN being returned. 11440 Only one redirect zone is supported 11441 per view. <command>allow-query</command> can be 11442 used to restrict which clients see these answers. 11443 </para> 11444 <para> 11445 If the client has requested DNSSEC records (DO=1) and 11446 the NXDOMAIN response is signed then no substitution 11447 will occur. 11448 </para> 11449 <para> 11450 To redirect all NXDOMAIN responses to 11451 100.100.100.2 and 11452 2001:ffff:ffff::100.100.100.2, one would 11453 configure a type redirect zone named ".", 11454 with the zone file containing wildcard records 11455 that point to the desired addresses: 11456 <literal>"*. IN A 100.100.100.2"</literal> 11457 and 11458 <literal>"*. IN AAAA 2001:ffff:ffff::100.100.100.2"</literal>. 11459 </para> 11460 <para> 11461 To redirect all Spanish names (under .ES) one 11462 would use similar entries but with the names 11463 "*.ES." instead of "*.". To redirect all 11464 commercial Spanish names (under COM.ES) one 11465 would use wildcard entries called "*.COM.ES.". 11466 </para> 11467 <para> 11468 Note that the redirect zone supports all 11469 possible types; it is not limited to A and 11470 AAAA records. 11471 </para> 11472 <para> 11473 Because redirect zones are not referenced 11474 directly by name, they are not kept in the 11475 zone lookup table with normal master and slave 11476 zones. Consequently, it is not currently possible 11477 to use 11478 <command>rndc reload 11479 <replaceable>zonename</replaceable></command> 11480 to reload a redirect zone. However, when using 11481 <command>rndc reload</command> without specifying 11482 a zone name, redirect zones will be reloaded along 11483 with other zones. 11484 </para> 11485 </entry> 11486 </row> 11487 <row rowsep="0"> 11488 <entry colname="1"> 11489 <para> 11490 <varname>delegation-only</varname> 11491 </para> 11492 </entry> 11493 <entry colname="2"> 11494 <para> 11495 This is used to enforce the delegation-only 11496 status of infrastructure zones (e.g. COM, 11497 NET, ORG). Any answer that is received 11498 without an explicit or implicit delegation 11499 in the authority section will be treated 11500 as NXDOMAIN. This does not apply to the 11501 zone apex. This should not be applied to 11502 leaf zones. 11503 </para> 11504 <para> 11505 <varname>delegation-only</varname> has no 11506 effect on answers received from forwarders. 11507 </para> 11508 <para> 11509 See caveats in <xref linkend="root_delegation_only"/>. 11510 </para> 11511 </entry> 11512 </row> 11513 </tbody> 11514 </tgroup> 11515 </informaltable> 11516 </sect3> 11517 11518 <sect3> 11519 <title>Class</title> 11520 <para> 11521 The zone's name may optionally be followed by a class. If 11522 a class is not specified, class <literal>IN</literal> (for <varname>Internet</varname>), 11523 is assumed. This is correct for the vast majority of cases. 11524 </para> 11525 <para> 11526 The <literal>hesiod</literal> class is 11527 named for an information service from MIT's Project Athena. It 11528 is 11529 used to share information about various systems databases, such 11530 as users, groups, printers and so on. The keyword 11531 <literal>HS</literal> is 11532 a synonym for hesiod. 11533 </para> 11534 <para> 11535 Another MIT development is Chaosnet, a LAN protocol created 11536 in the mid-1970s. Zone data for it can be specified with the <literal>CHAOS</literal> class. 11537 </para> 11538 </sect3> 11539 11540 <sect3> 11541 <title>Zone Options</title> 11542 11543 <variablelist> 11544 11545 <varlistentry> 11546 <term><command>allow-notify</command></term> 11547 <listitem> 11548 <para> 11549 See the description of 11550 <command>allow-notify</command> in <xref linkend="access_control"/>. 11551 </para> 11552 </listitem> 11553 </varlistentry> 11554 11555 <varlistentry> 11556 <term><command>allow-query</command></term> 11557 <listitem> 11558 <para> 11559 See the description of 11560 <command>allow-query</command> in <xref linkend="access_control"/>. 11561 </para> 11562 </listitem> 11563 </varlistentry> 11564 11565 <varlistentry> 11566 <term><command>allow-query-on</command></term> 11567 <listitem> 11568 <para> 11569 See the description of 11570 <command>allow-query-on</command> in <xref linkend="access_control"/>. 11571 </para> 11572 </listitem> 11573 </varlistentry> 11574 11575 <varlistentry> 11576 <term><command>allow-transfer</command></term> 11577 <listitem> 11578 <para> 11579 See the description of <command>allow-transfer</command> 11580 in <xref linkend="access_control"/>. 11581 </para> 11582 </listitem> 11583 </varlistentry> 11584 11585 <varlistentry> 11586 <term><command>allow-update</command></term> 11587 <listitem> 11588 <para> 11589 See the description of <command>allow-update</command> 11590 in <xref linkend="access_control"/>. 11591 </para> 11592 </listitem> 11593 </varlistentry> 11594 11595 <varlistentry> 11596 <term><command>update-policy</command></term> 11597 <listitem> 11598 <para> 11599 Specifies a "Simple Secure Update" policy. See 11600 <xref linkend="dynamic_update_policies"/>. 11601 </para> 11602 </listitem> 11603 </varlistentry> 11604 11605 <varlistentry> 11606 <term><command>allow-update-forwarding</command></term> 11607 <listitem> 11608 <para> 11609 See the description of <command>allow-update-forwarding</command> 11610 in <xref linkend="access_control"/>. 11611 </para> 11612 </listitem> 11613 </varlistentry> 11614 11615 <varlistentry> 11616 <term><command>also-notify</command></term> 11617 <listitem> 11618 <para> 11619 Only meaningful if <command>notify</command> 11620 is 11621 active for this zone. The set of machines that will 11622 receive a 11623 <literal>DNS NOTIFY</literal> message 11624 for this zone is made up of all the listed name servers 11625 (other than 11626 the primary master) for the zone plus any IP addresses 11627 specified 11628 with <command>also-notify</command>. A port 11629 may be specified 11630 with each <command>also-notify</command> 11631 address to send the notify 11632 messages to a port other than the default of 53. 11633 A TSIG key may also be specified to cause the 11634 <literal>NOTIFY</literal> to be signed by the 11635 given key. 11636 <command>also-notify</command> is not 11637 meaningful for stub zones. 11638 The default is the empty list. 11639 </para> 11640 </listitem> 11641 </varlistentry> 11642 11643 <varlistentry> 11644 <term><command>check-names</command></term> 11645 <listitem> 11646 <para> 11647 This option is used to restrict the character set and 11648 syntax of 11649 certain domain names in master files and/or DNS responses 11650 received from the 11651 network. The default varies according to zone type. For <command>master</command> zones the default is <command>fail</command>. For <command>slave</command> 11652 zones the default is <command>warn</command>. 11653 It is not implemented for <command>hint</command> zones. 11654 </para> 11655 </listitem> 11656 </varlistentry> 11657 11658 <varlistentry> 11659 <term><command>check-mx</command></term> 11660 <listitem> 11661 <para> 11662 See the description of 11663 <command>check-mx</command> in <xref linkend="boolean_options"/>. 11664 </para> 11665 </listitem> 11666 </varlistentry> 11667 11668 <varlistentry> 11669 <term><command>check-spf</command></term> 11670 <listitem> 11671 <para> 11672 See the description of 11673 <command>check-spf</command> in <xref linkend="boolean_options"/>. 11674 </para> 11675 </listitem> 11676 </varlistentry> 11677 11678 <varlistentry> 11679 <term><command>check-wildcard</command></term> 11680 <listitem> 11681 <para> 11682 See the description of 11683 <command>check-wildcard</command> in <xref linkend="boolean_options"/>. 11684 </para> 11685 </listitem> 11686 </varlistentry> 11687 11688 <varlistentry> 11689 <term><command>check-integrity</command></term> 11690 <listitem> 11691 <para> 11692 See the description of 11693 <command>check-integrity</command> in <xref linkend="boolean_options"/>. 11694 </para> 11695 </listitem> 11696 </varlistentry> 11697 11698 <varlistentry> 11699 <term><command>check-sibling</command></term> 11700 <listitem> 11701 <para> 11702 See the description of 11703 <command>check-sibling</command> in <xref linkend="boolean_options"/>. 11704 </para> 11705 </listitem> 11706 </varlistentry> 11707 11708 <varlistentry> 11709 <term><command>zero-no-soa-ttl</command></term> 11710 <listitem> 11711 <para> 11712 See the description of 11713 <command>zero-no-soa-ttl</command> in <xref linkend="boolean_options"/>. 11714 </para> 11715 </listitem> 11716 </varlistentry> 11717 11718 <varlistentry> 11719 <term><command>update-check-ksk</command></term> 11720 <listitem> 11721 <para> 11722 See the description of 11723 <command>update-check-ksk</command> in <xref linkend="boolean_options"/>. 11724 </para> 11725 </listitem> 11726 </varlistentry> 11727 11728 <varlistentry> 11729 <term><command>dnssec-update-mode</command></term> 11730 <listitem> 11731 <para> 11732 See the description of 11733 <command>dnssec-update-mode</command> in <xref linkend="options"/>. 11734 </para> 11735 </listitem> 11736 </varlistentry> 11737 11738 <varlistentry> 11739 <term><command>dnssec-dnskey-kskonly</command></term> 11740 <listitem> 11741 <para> 11742 See the description of 11743 <command>dnssec-dnskey-kskonly</command> in <xref linkend="boolean_options"/>. 11744 </para> 11745 </listitem> 11746 </varlistentry> 11747 11748 <varlistentry> 11749 <term><command>try-tcp-refresh</command></term> 11750 <listitem> 11751 <para> 11752 See the description of 11753 <command>try-tcp-refresh</command> in <xref linkend="boolean_options"/>. 11754 </para> 11755 </listitem> 11756 </varlistentry> 11757 11758 <varlistentry> 11759 <term><command>database</command></term> 11760 <listitem> 11761 <para> 11762 Specify the type of database to be used for storing the 11763 zone data. The string following the <command>database</command> keyword 11764 is interpreted as a list of whitespace-delimited words. 11765 The first word 11766 identifies the database type, and any subsequent words are 11767 passed 11768 as arguments to the database to be interpreted in a way 11769 specific 11770 to the database type. 11771 </para> 11772 <para> 11773 The default is <userinput>"rbt"</userinput>, BIND 9's 11774 native in-memory 11775 red-black-tree database. This database does not take 11776 arguments. 11777 </para> 11778 <para> 11779 Other values are possible if additional database drivers 11780 have been linked into the server. Some sample drivers are 11781 included 11782 with the distribution but none are linked in by default. 11783 </para> 11784 </listitem> 11785 </varlistentry> 11786 11787 <varlistentry> 11788 <term><command>dialup</command></term> 11789 <listitem> 11790 <para> 11791 See the description of 11792 <command>dialup</command> in <xref linkend="boolean_options"/>. 11793 </para> 11794 </listitem> 11795 </varlistentry> 11796 11797 <varlistentry> 11798 <term><command>delegation-only</command></term> 11799 <listitem> 11800 <para> 11801 The flag only applies to forward, hint and stub 11802 zones. If set to <userinput>yes</userinput>, 11803 then the zone will also be treated as if it is 11804 also a delegation-only type zone. 11805 </para> 11806 <para> 11807 See caveats in <xref linkend="root_delegation_only"/>. 11808 </para> 11809 </listitem> 11810 </varlistentry> 11811 11812 <varlistentry> 11813 <term><command>forward</command></term> 11814 <listitem> 11815 <para> 11816 Only meaningful if the zone has a forwarders 11817 list. The <command>only</command> value causes 11818 the lookup to fail 11819 after trying the forwarders and getting no answer, while <command>first</command> would 11820 allow a normal lookup to be tried. 11821 </para> 11822 </listitem> 11823 </varlistentry> 11824 11825 <varlistentry> 11826 <term><command>forwarders</command></term> 11827 <listitem> 11828 <para> 11829 Used to override the list of global forwarders. 11830 If it is not specified in a zone of type <command>forward</command>, 11831 no forwarding is done for the zone and the global options are 11832 not used. 11833 </para> 11834 </listitem> 11835 </varlistentry> 11836 11837 <varlistentry> 11838 <term><command>ixfr-base</command></term> 11839 <listitem> 11840 <para> 11841 Was used in <acronym>BIND</acronym> 8 to 11842 specify the name 11843 of the transaction log (journal) file for dynamic update 11844 and IXFR. 11845 <acronym>BIND</acronym> 9 ignores the option 11846 and constructs the name of the journal 11847 file by appending "<filename>.jnl</filename>" 11848 to the name of the 11849 zone file. 11850 </para> 11851 </listitem> 11852 </varlistentry> 11853 11854 <varlistentry> 11855 <term><command>ixfr-tmp-file</command></term> 11856 <listitem> 11857 <para> 11858 Was an undocumented option in <acronym>BIND</acronym> 8. 11859 Ignored in <acronym>BIND</acronym> 9. 11860 </para> 11861 </listitem> 11862 </varlistentry> 11863 11864 <varlistentry> 11865 <term><command>journal</command></term> 11866 <listitem> 11867 <para> 11868 Allow the default journal's filename to be overridden. 11869 The default is the zone's filename with "<filename>.jnl</filename>" appended. 11870 This is applicable to <command>master</command> and <command>slave</command> zones. 11871 </para> 11872 </listitem> 11873 </varlistentry> 11874 11875 <varlistentry> 11876 <term><command>max-journal-size</command></term> 11877 <listitem> 11878 <para> 11879 See the description of 11880 <command>max-journal-size</command> in <xref linkend="server_resource_limits"/>. 11881 </para> 11882 </listitem> 11883 </varlistentry> 11884 11885 <varlistentry> 11886 <term><command>max-transfer-time-in</command></term> 11887 <listitem> 11888 <para> 11889 See the description of 11890 <command>max-transfer-time-in</command> in <xref linkend="zone_transfers"/>. 11891 </para> 11892 </listitem> 11893 </varlistentry> 11894 11895 <varlistentry> 11896 <term><command>max-transfer-idle-in</command></term> 11897 <listitem> 11898 <para> 11899 See the description of 11900 <command>max-transfer-idle-in</command> in <xref linkend="zone_transfers"/>. 11901 </para> 11902 </listitem> 11903 </varlistentry> 11904 11905 <varlistentry> 11906 <term><command>max-transfer-time-out</command></term> 11907 <listitem> 11908 <para> 11909 See the description of 11910 <command>max-transfer-time-out</command> in <xref linkend="zone_transfers"/>. 11911 </para> 11912 </listitem> 11913 </varlistentry> 11914 11915 <varlistentry> 11916 <term><command>max-transfer-idle-out</command></term> 11917 <listitem> 11918 <para> 11919 See the description of 11920 <command>max-transfer-idle-out</command> in <xref linkend="zone_transfers"/>. 11921 </para> 11922 </listitem> 11923 </varlistentry> 11924 11925 <varlistentry> 11926 <term><command>notify</command></term> 11927 <listitem> 11928 <para> 11929 See the description of 11930 <command>notify</command> in <xref linkend="boolean_options"/>. 11931 </para> 11932 </listitem> 11933 </varlistentry> 11934 11935 <varlistentry> 11936 <term><command>notify-delay</command></term> 11937 <listitem> 11938 <para> 11939 See the description of 11940 <command>notify-delay</command> in <xref linkend="tuning"/>. 11941 </para> 11942 </listitem> 11943 </varlistentry> 11944 11945 <varlistentry> 11946 <term><command>notify-to-soa</command></term> 11947 <listitem> 11948 <para> 11949 See the description of 11950 <command>notify-to-soa</command> in 11951 <xref linkend="boolean_options"/>. 11952 </para> 11953 </listitem> 11954 </varlistentry> 11955 11956 <varlistentry> 11957 <term><command>pubkey</command></term> 11958 <listitem> 11959 <para> 11960 In <acronym>BIND</acronym> 8, this option was 11961 intended for specifying 11962 a public zone key for verification of signatures in DNSSEC 11963 signed 11964 zones when they are loaded from disk. <acronym>BIND</acronym> 9 does not verify signatures 11965 on load and ignores the option. 11966 </para> 11967 </listitem> 11968 </varlistentry> 11969 11970 <varlistentry> 11971 <term><command>zone-statistics</command></term> 11972 <listitem> 11973 <para> 11974 If <userinput>yes</userinput>, the server will keep 11975 statistical 11976 information for this zone, which can be dumped to the 11977 <command>statistics-file</command> defined in 11978 the server options. 11979 </para> 11980 </listitem> 11981 </varlistentry> 11982 11983 <varlistentry> 11984 <term><command>server-addresses</command></term> 11985 <listitem> 11986 <para> 11987 Only meaningful for static-stub zones. 11988 This is a list of IP addresses to which queries 11989 should be sent in recursive resolution for the 11990 zone. 11991 A non empty list for this option will internally 11992 configure the apex NS RR with associated glue A or 11993 AAAA RRs. 11994 </para> 11995 <para> 11996 For example, if "example.com" is configured as a 11997 static-stub zone with 192.0.2.1 and 2001:db8::1234 11998 in a <command>server-addresses</command> option, 11999 the following RRs will be internally configured. 12000 </para> 12001<programlisting>example.com. NS example.com. 12002example.com. A 192.0.2.1 12003example.com. AAAA 2001:db8::1234</programlisting> 12004 <para> 12005 These records are internally used to resolve 12006 names under the static-stub zone. 12007 For instance, if the server receives a query for 12008 "www.example.com" with the RD bit on, the server 12009 will initiate recursive resolution and send 12010 queries to 192.0.2.1 and/or 2001:db8::1234. 12011 </para> 12012 </listitem> 12013 </varlistentry> 12014 12015 <varlistentry> 12016 <term><command>server-names</command></term> 12017 <listitem> 12018 <para> 12019 Only meaningful for static-stub zones. 12020 This is a list of domain names of nameservers that 12021 act as authoritative servers of the static-stub 12022 zone. 12023 These names will be resolved to IP addresses when 12024 <command>named</command> needs to send queries to 12025 these servers. 12026 To make this supplemental resolution successful, 12027 these names must not be a subdomain of the origin 12028 name of static-stub zone. 12029 That is, when "example.net" is the origin of a 12030 static-stub zone, "ns.example" and 12031 "master.example.com" can be specified in the 12032 <command>server-names</command> option, but 12033 "ns.example.net" cannot, and will be rejected by 12034 the configuration parser. 12035 </para> 12036 <para> 12037 A non empty list for this option will internally 12038 configure the apex NS RR with the specified names. 12039 For example, if "example.com" is configured as a 12040 static-stub zone with "ns1.example.net" and 12041 "ns2.example.net" 12042 in a <command>server-names</command> option, 12043 the following RRs will be internally configured. 12044 </para> 12045<programlisting>example.com. NS ns1.example.net. 12046example.com. NS ns2.example.net. 12047</programlisting> 12048 <para> 12049 These records are internally used to resolve 12050 names under the static-stub zone. 12051 For instance, if the server receives a query for 12052 "www.example.com" with the RD bit on, the server 12053 initiate recursive resolution, 12054 resolve "ns1.example.net" and/or 12055 "ns2.example.net" to IP addresses, and then send 12056 queries to (one or more of) these addresses. 12057 </para> 12058 </listitem> 12059 </varlistentry> 12060 12061 <varlistentry> 12062 <term><command>sig-validity-interval</command></term> 12063 <listitem> 12064 <para> 12065 See the description of 12066 <command>sig-validity-interval</command> in <xref linkend="tuning"/>. 12067 </para> 12068 </listitem> 12069 </varlistentry> 12070 12071 <varlistentry> 12072 <term><command>sig-signing-nodes</command></term> 12073 <listitem> 12074 <para> 12075 See the description of 12076 <command>sig-signing-nodes</command> in <xref linkend="tuning"/>. 12077 </para> 12078 </listitem> 12079 </varlistentry> 12080 12081 <varlistentry> 12082 <term><command>sig-signing-signatures</command></term> 12083 <listitem> 12084 <para> 12085 See the description of 12086 <command>sig-signing-signatures</command> in <xref linkend="tuning"/>. 12087 </para> 12088 </listitem> 12089 </varlistentry> 12090 12091 <varlistentry> 12092 <term><command>sig-signing-type</command></term> 12093 <listitem> 12094 <para> 12095 See the description of 12096 <command>sig-signing-type</command> in <xref linkend="tuning"/>. 12097 </para> 12098 </listitem> 12099 </varlistentry> 12100 12101 <varlistentry> 12102 <term><command>transfer-source</command></term> 12103 <listitem> 12104 <para> 12105 See the description of 12106 <command>transfer-source</command> in <xref linkend="zone_transfers"/>. 12107 </para> 12108 </listitem> 12109 </varlistentry> 12110 12111 <varlistentry> 12112 <term><command>transfer-source-v6</command></term> 12113 <listitem> 12114 <para> 12115 See the description of 12116 <command>transfer-source-v6</command> in <xref linkend="zone_transfers"/>. 12117 </para> 12118 </listitem> 12119 </varlistentry> 12120 12121 <varlistentry> 12122 <term><command>alt-transfer-source</command></term> 12123 <listitem> 12124 <para> 12125 See the description of 12126 <command>alt-transfer-source</command> in <xref linkend="zone_transfers"/>. 12127 </para> 12128 </listitem> 12129 </varlistentry> 12130 12131 <varlistentry> 12132 <term><command>alt-transfer-source-v6</command></term> 12133 <listitem> 12134 <para> 12135 See the description of 12136 <command>alt-transfer-source-v6</command> in <xref linkend="zone_transfers"/>. 12137 </para> 12138 </listitem> 12139 </varlistentry> 12140 12141 <varlistentry> 12142 <term><command>use-alt-transfer-source</command></term> 12143 <listitem> 12144 <para> 12145 See the description of 12146 <command>use-alt-transfer-source</command> in <xref linkend="zone_transfers"/>. 12147 </para> 12148 </listitem> 12149 </varlistentry> 12150 12151 12152 <varlistentry> 12153 <term><command>notify-source</command></term> 12154 <listitem> 12155 <para> 12156 See the description of 12157 <command>notify-source</command> in <xref linkend="zone_transfers"/>. 12158 </para> 12159 </listitem> 12160 </varlistentry> 12161 12162 <varlistentry> 12163 <term><command>notify-source-v6</command></term> 12164 <listitem> 12165 <para> 12166 See the description of 12167 <command>notify-source-v6</command> in <xref linkend="zone_transfers"/>. 12168 </para> 12169 </listitem> 12170 </varlistentry> 12171 12172 <varlistentry> 12173 <term><command>min-refresh-time</command></term> 12174 <term><command>max-refresh-time</command></term> 12175 <term><command>min-retry-time</command></term> 12176 <term><command>max-retry-time</command></term> 12177 <listitem> 12178 <para> 12179 See the description in <xref linkend="tuning"/>. 12180 </para> 12181 </listitem> 12182 </varlistentry> 12183 12184 <varlistentry> 12185 <term><command>ixfr-from-differences</command></term> 12186 <listitem> 12187 <para> 12188 See the description of 12189 <command>ixfr-from-differences</command> in <xref linkend="boolean_options"/>. 12190 (Note that the <command>ixfr-from-differences</command> 12191 <userinput>master</userinput> and 12192 <userinput>slave</userinput> choices are not 12193 available at the zone level.) 12194 </para> 12195 </listitem> 12196 </varlistentry> 12197 12198 <varlistentry> 12199 <term><command>key-directory</command></term> 12200 <listitem> 12201 <para> 12202 See the description of 12203 <command>key-directory</command> in <xref linkend="options"/>. 12204 </para> 12205 </listitem> 12206 </varlistentry> 12207 12208 <varlistentry> 12209 <term><command>auto-dnssec</command></term> 12210 <listitem> 12211 <para> 12212 Zones configured for dynamic DNS may also use this 12213 option to allow varying levels of automatic DNSSEC key 12214 management. There are three possible settings: 12215 </para> 12216 <para> 12217 <command>auto-dnssec allow;</command> permits 12218 keys to be updated and the zone fully re-signed 12219 whenever the user issues the command <command>rndc sign 12220 <replaceable>zonename</replaceable></command>. 12221 </para> 12222 <para> 12223 <command>auto-dnssec maintain;</command> includes the 12224 above, but also automatically adjusts the zone's DNSSEC 12225 keys on schedule, according to the keys' timing metadata 12226 (see <xref linkend="man.dnssec-keygen"/> and 12227 <xref linkend="man.dnssec-settime"/>). The command 12228 <command>rndc sign 12229 <replaceable>zonename</replaceable></command> causes 12230 <command>named</command> to load keys from the key 12231 repository and sign the zone with all keys that are 12232 active. 12233 <command>rndc loadkeys 12234 <replaceable>zonename</replaceable></command> causes 12235 <command>named</command> to load keys from the key 12236 repository and schedule key maintenance events to occur 12237 in the future, but it does not sign the full zone 12238 immediately. Note: once keys have been loaded for a 12239 zone the first time, the repository will be searched 12240 for changes periodically, regardless of whether 12241 <command>rndc loadkeys</command> is used. The recheck 12242 interval is defined by 12243 <command>dnssec-loadkeys-interval</command>.) 12244 </para> 12245 <para> 12246 The default setting is <command>auto-dnssec off</command>. 12247 </para> 12248 </listitem> 12249 </varlistentry> 12250 12251 <varlistentry> 12252 <term><command>serial-update-method</command></term> 12253 <listitem> 12254 <para> 12255 Zones configured for dynamic DNS may use this 12256 option to set the update method that will be used for 12257 the zone serial number in the SOA record. 12258 </para> 12259 <para> 12260 With the default setting of 12261 <command>serial-update-method increment;</command>, the 12262 SOA serial number will be incremented by one each time 12263 the zone is updated. 12264 </para> 12265 <para> 12266 When set to 12267 <command>serial-update-method unixtime;</command>, the 12268 SOA serial number will be set to the number of seconds 12269 since the UNIX epoch, unless the serial number is 12270 already greater than or equal to that value, in which 12271 case it is simply incremented by one. 12272 </para> 12273 </listitem> 12274 </varlistentry> 12275 12276 <varlistentry> 12277 <term><command>inline-signing</command></term> 12278 <listitem> 12279 <para> 12280 If <literal>yes</literal>, this enables 12281 "bump in the wire" signing of a zone, where a 12282 unsigned zone is transferred in or loaded from 12283 disk and a signed version of the zone is served, 12284 with possibly, a different serial number. This 12285 behaviour is disabled by default. 12286 </para> 12287 </listitem> 12288 </varlistentry> 12289 12290 <varlistentry> 12291 <term><command>multi-master</command></term> 12292 <listitem> 12293 <para> 12294 See the description of <command>multi-master</command> in 12295 <xref linkend="boolean_options"/>. 12296 </para> 12297 </listitem> 12298 </varlistentry> 12299 12300 <varlistentry> 12301 <term><command>masterfile-format</command></term> 12302 <listitem> 12303 <para> 12304 See the description of <command>masterfile-format</command> 12305 in <xref linkend="tuning"/>. 12306 </para> 12307 </listitem> 12308 </varlistentry> 12309 12310 <varlistentry> 12311 <term><command>max-zone-ttl</command></term> 12312 <listitem> 12313 <para> 12314 See the description of <command>max-zone-ttl</command> 12315 in <xref linkend="options"/>. 12316 </para> 12317 </listitem> 12318 </varlistentry> 12319 12320 <varlistentry> 12321 <term><command>dnssec-secure-to-insecure</command></term> 12322 <listitem> 12323 <para> 12324 See the description of 12325 <command>dnssec-secure-to-insecure</command> in <xref linkend="boolean_options"/>. 12326 </para> 12327 </listitem> 12328 </varlistentry> 12329 12330 </variablelist> 12331 12332 </sect3> 12333 <sect3 id="dynamic_update_policies"> 12334 <title>Dynamic Update Policies</title> 12335 <para><acronym>BIND</acronym> 9 supports two alternative 12336 methods of granting clients the right to perform 12337 dynamic updates to a zone, configured by the 12338 <command>allow-update</command> and 12339 <command>update-policy</command> option, respectively. 12340 </para> 12341 <para> 12342 The <command>allow-update</command> clause works the 12343 same way as in previous versions of <acronym>BIND</acronym>. 12344 It grants given clients the permission to update any 12345 record of any name in the zone. 12346 </para> 12347 <para> 12348 The <command>update-policy</command> clause 12349 allows more fine-grained control over what updates are 12350 allowed. A set of rules is specified, where each rule 12351 either grants or denies permissions for one or more 12352 names to be updated by one or more identities. If 12353 the dynamic update request message is signed (that is, 12354 it includes either a TSIG or SIG(0) record), the 12355 identity of the signer can be determined. 12356 </para> 12357 <para> 12358 Rules are specified in the <command>update-policy</command> 12359 zone option, and are only meaningful for master zones. 12360 When the <command>update-policy</command> statement 12361 is present, it is a configuration error for the 12362 <command>allow-update</command> statement to be 12363 present. The <command>update-policy</command> statement 12364 only examines the signer of a message; the source 12365 address is not relevant. 12366 </para> 12367 <para> 12368 There is a pre-defined <command>update-policy</command> 12369 rule which can be switched on with the command 12370 <command>update-policy local;</command>. 12371 Switching on this rule in a zone causes 12372 <command>named</command> to generate a TSIG session 12373 key and place it in a file, and to allow that key 12374 to update the zone. (By default, the file is 12375 <filename>/var/run/named/session.key</filename>, the key 12376 name is "local-ddns" and the key algorithm is HMAC-SHA256, 12377 but these values are configurable with the 12378 <command>session-keyfile</command>, 12379 <command>session-keyname</command> and 12380 <command>session-keyalg</command> options, respectively). 12381 </para> 12382 <para> 12383 A client running on the local system, and with appropriate 12384 permissions, may read that file and use the key to sign update 12385 requests. The zone's update policy will be set to allow that 12386 key to change any record within the zone. Assuming the 12387 key name is "local-ddns", this policy is equivalent to: 12388 </para> 12389 12390 <programlisting>update-policy { grant local-ddns zonesub any; }; 12391 </programlisting> 12392 12393 <para> 12394 The command <command>nsupdate -l</command> sends update 12395 requests to localhost, and signs them using the session key. 12396 </para> 12397 12398 <para> 12399 Other rule definitions look like this: 12400 </para> 12401 12402<programlisting> 12403( <command>grant</command> | <command>deny</command> ) <replaceable>identity</replaceable> <replaceable>nametype</replaceable> <optional> <replaceable>name</replaceable> </optional> <optional> <replaceable>types</replaceable> </optional> 12404</programlisting> 12405 12406 <para> 12407 Each rule grants or denies privileges. Once a message has 12408 successfully matched a rule, the operation is immediately 12409 granted or denied and no further rules are examined. A rule 12410 is matched when the signer matches the identity field, the 12411 name matches the name field in accordance with the nametype 12412 field, and the type matches the types specified in the type 12413 field. 12414 </para> 12415 <para> 12416 No signer is required for <replaceable>tcp-self</replaceable> 12417 or <replaceable>6to4-self</replaceable> however the standard 12418 reverse mapping / prefix conversion must match the identity 12419 field. 12420 </para> 12421 <para> 12422 The identity field specifies a name or a wildcard 12423 name. Normally, this is the name of the TSIG or 12424 SIG(0) key used to sign the update request. When a 12425 TKEY exchange has been used to create a shared secret, 12426 the identity of the shared secret is the same as the 12427 identity of the key used to authenticate the TKEY 12428 exchange. TKEY is also the negotiation method used 12429 by GSS-TSIG, which establishes an identity that is 12430 the Kerberos principal of the client, such as 12431 <userinput>"user@host.domain"</userinput>. When the 12432 <replaceable>identity</replaceable> field specifies 12433 a wildcard name, it is subject to DNS wildcard 12434 expansion, so the rule will apply to multiple identities. 12435 The <replaceable>identity</replaceable> field must 12436 contain a fully-qualified domain name. 12437 </para> 12438 <para> 12439 For nametypes <varname>krb5-self</varname>, 12440 <varname>ms-self</varname>, <varname>krb5-subdomain</varname>, 12441 and <varname>ms-subdomain</varname> the 12442 <replaceable>identity</replaceable> field specifies 12443 the Windows or Kerberos realm of the machine belongs to. 12444 </para> 12445 <para> 12446 The <replaceable>nametype</replaceable> field has 13 12447 values: 12448 <varname>name</varname>, <varname>subdomain</varname>, 12449 <varname>wildcard</varname>, <varname>self</varname>, 12450 <varname>selfsub</varname>, <varname>selfwild</varname>, 12451 <varname>krb5-self</varname>, <varname>ms-self</varname>, 12452 <varname>krb5-subdomain</varname>, 12453 <varname>ms-subdomain</varname>, 12454 <varname>tcp-self</varname>, <varname>6to4-self</varname>, 12455 <varname>zonesub</varname>, and <varname>external</varname>. 12456 </para> 12457 <informaltable> 12458 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="4Level-table"> 12459 <colspec colname="1" colnum="1" colsep="0" colwidth="0.819in"/> 12460 <colspec colname="2" colnum="2" colsep="0" colwidth="3.681in"/> 12461 <tbody> 12462 <row rowsep="0"> 12463 <entry colname="1"> 12464 <para> 12465 <varname>name</varname> 12466 </para> 12467 </entry> <entry colname="2"> 12468 <para> 12469 Exact-match semantics. This rule matches 12470 when the name being updated is identical 12471 to the contents of the 12472 <replaceable>name</replaceable> field. 12473 </para> 12474 </entry> 12475 </row> 12476 <row rowsep="0"> 12477 <entry colname="1"> 12478 <para> 12479 <varname>subdomain</varname> 12480 </para> 12481 </entry> <entry colname="2"> 12482 <para> 12483 This rule matches when the name being updated 12484 is a subdomain of, or identical to, the 12485 contents of the <replaceable>name</replaceable> 12486 field. 12487 </para> 12488 </entry> 12489 </row> 12490 <row rowsep="0"> 12491 <entry colname="1"> 12492 <para> 12493 <varname>zonesub</varname> 12494 </para> 12495 </entry> <entry colname="2"> 12496 <para> 12497 This rule is similar to subdomain, except that 12498 it matches when the name being updated is a 12499 subdomain of the zone in which the 12500 <command>update-policy</command> statement 12501 appears. This obviates the need to type the zone 12502 name twice, and enables the use of a standard 12503 <command>update-policy</command> statement in 12504 multiple zones without modification. 12505 </para> 12506 <para> 12507 When this rule is used, the 12508 <replaceable>name</replaceable> field is omitted. 12509 </para> 12510 </entry> 12511 </row> 12512 <row rowsep="0"> 12513 <entry colname="1"> 12514 <para> 12515 <varname>wildcard</varname> 12516 </para> 12517 </entry> <entry colname="2"> 12518 <para> 12519 The <replaceable>name</replaceable> field 12520 is subject to DNS wildcard expansion, and 12521 this rule matches when the name being updated 12522 name is a valid expansion of the wildcard. 12523 </para> 12524 </entry> 12525 </row> 12526 <row rowsep="0"> 12527 <entry colname="1"> 12528 <para> 12529 <varname>self</varname> 12530 </para> 12531 </entry> 12532 <entry colname="2"> 12533 <para> 12534 This rule matches when the name being updated 12535 matches the contents of the 12536 <replaceable>identity</replaceable> field. 12537 The <replaceable>name</replaceable> field 12538 is ignored, but should be the same as the 12539 <replaceable>identity</replaceable> field. 12540 The <varname>self</varname> nametype is 12541 most useful when allowing using one key per 12542 name to update, where the key has the same 12543 name as the name to be updated. The 12544 <replaceable>identity</replaceable> would 12545 be specified as <constant>*</constant> (an asterisk) in 12546 this case. 12547 </para> 12548 </entry> 12549 </row> 12550 <row rowsep="0"> 12551 <entry colname="1"> 12552 <para> 12553 <varname>selfsub</varname> 12554 </para> 12555 </entry> <entry colname="2"> 12556 <para> 12557 This rule is similar to <varname>self</varname> 12558 except that subdomains of <varname>self</varname> 12559 can also be updated. 12560 </para> 12561 </entry> 12562 </row> 12563 <row rowsep="0"> 12564 <entry colname="1"> 12565 <para> 12566 <varname>selfwild</varname> 12567 </para> 12568 </entry> <entry colname="2"> 12569 <para> 12570 This rule is similar to <varname>self</varname> 12571 except that only subdomains of 12572 <varname>self</varname> can be updated. 12573 </para> 12574 </entry> 12575 </row> 12576 <row rowsep="0"> 12577 <entry colname="1"> 12578 <para> 12579 <varname>ms-self</varname> 12580 </para> 12581 </entry> <entry colname="2"> 12582 <para> 12583 This rule takes a Windows machine principal 12584 (machine$@REALM) for machine in REALM and 12585 and converts it machine.realm allowing the machine 12586 to update machine.realm. The REALM to be matched 12587 is specified in the <replaceable>identity</replaceable> 12588 field. 12589 </para> 12590 </entry> 12591 </row> 12592 <row rowsep="0"> 12593 <entry colname="1"> 12594 <para> 12595 <varname>ms-subdomain</varname> 12596 </para> 12597 </entry> <entry colname="2"> 12598 <para> 12599 This rule takes a Windows machine principal 12600 (machine$@REALM) for machine in REALM and 12601 converts it to machine.realm allowing the machine 12602 to update subdomains of machine.realm. The REALM 12603 to be matched is specified in the 12604 <replaceable>identity</replaceable> field. 12605 </para> 12606 </entry> 12607 </row> 12608 <row rowsep="0"> 12609 <entry colname="1"> 12610 <para> 12611 <varname>krb5-self</varname> 12612 </para> 12613 </entry> <entry colname="2"> 12614 <para> 12615 This rule takes a Kerberos machine principal 12616 (host/machine@REALM) for machine in REALM and 12617 and converts it machine.realm allowing the machine 12618 to update machine.realm. The REALM to be matched 12619 is specified in the <replaceable>identity</replaceable> 12620 field. 12621 </para> 12622 </entry> 12623 </row> 12624 <row rowsep="0"> 12625 <entry colname="1"> 12626 <para> 12627 <varname>krb5-subdomain</varname> 12628 </para> 12629 </entry> <entry colname="2"> 12630 <para> 12631 This rule takes a Kerberos machine principal 12632 (host/machine@REALM) for machine in REALM and 12633 converts it to machine.realm allowing the machine 12634 to update subdomains of machine.realm. The REALM 12635 to be matched is specified in the 12636 <replaceable>identity</replaceable> field. 12637 </para> 12638 </entry> 12639 </row> 12640 <row rowsep="0"> 12641 <entry colname="1"> 12642 <para> 12643 <varname>tcp-self</varname> 12644 </para> 12645 </entry> <entry colname="2"> 12646 <para> 12647 Allow updates that have been sent via TCP and 12648 for which the standard mapping from the initiating 12649 IP address into the IN-ADDR.ARPA and IP6.ARPA 12650 namespaces match the name to be updated. 12651 </para> 12652 <note> 12653 It is theoretically possible to spoof these TCP 12654 sessions. 12655 </note> 12656 </entry> 12657 </row> 12658 <row rowsep="0"> 12659 <entry colname="1"> 12660 <para> 12661 <varname>6to4-self</varname> 12662 </para> 12663 </entry> <entry colname="2"> 12664 <para> 12665 Allow the 6to4 prefix to be update by any TCP 12666 connection from the 6to4 network or from the 12667 corresponding IPv4 address. This is intended 12668 to allow NS or DNAME RRsets to be added to the 12669 reverse tree. 12670 </para> 12671 <note> 12672 It is theoretically possible to spoof these TCP 12673 sessions. 12674 </note> 12675 </entry> 12676 </row> 12677 <row rowsep="0"> 12678 <entry colname="1"> 12679 <para> 12680 <varname>external</varname> 12681 </para> 12682 </entry> <entry colname="2"> 12683 <para> 12684 This rule allows <command>named</command> 12685 to defer the decision of whether to allow a 12686 given update to an external daemon. 12687 </para> 12688 <para> 12689 The method of communicating with the daemon is 12690 specified in the <replaceable>identity</replaceable> 12691 field, the format of which is 12692 "<constant>local:</constant><replaceable>path</replaceable>", 12693 where <replaceable>path</replaceable> is the location 12694 of a UNIX-domain socket. (Currently, "local" is the 12695 only supported mechanism.) 12696 </para> 12697 <para> 12698 Requests to the external daemon are sent over the 12699 UNIX-domain socket as datagrams with the following 12700 format: 12701 </para> 12702 <programlisting> 12703 Protocol version number (4 bytes, network byte order, currently 1) 12704 Request length (4 bytes, network byte order) 12705 Signer (null-terminated string) 12706 Name (null-terminated string) 12707 TCP source address (null-terminated string) 12708 Rdata type (null-terminated string) 12709 Key (null-terminated string) 12710 TKEY token length (4 bytes, network byte order) 12711 TKEY token (remainder of packet)</programlisting> 12712 <para> 12713 The daemon replies with a four-byte value in 12714 network byte order, containing either 0 or 1; 0 12715 indicates that the specified update is not 12716 permitted, and 1 indicates that it is. 12717 </para> 12718 </entry> 12719 </row> 12720 </tbody> 12721 </tgroup> 12722 </informaltable> 12723 12724 <para> 12725 In all cases, the <replaceable>name</replaceable> 12726 field must specify a fully-qualified domain name. 12727 </para> 12728 12729 <para> 12730 If no types are explicitly specified, this rule matches 12731 all types except RRSIG, NS, SOA, NSEC and NSEC3. Types 12732 may be specified by name, including "ANY" (ANY matches 12733 all types except NSEC and NSEC3, which can never be 12734 updated). Note that when an attempt is made to delete 12735 all records associated with a name, the rules are 12736 checked for each existing record type. 12737 </para> 12738 </sect3> 12739 12740 <sect3> 12741 <title>Multiple views</title> 12742 <para> 12743 When multiple views are in use, a zone may be 12744 referenced by more than one of them. Often, the views 12745 will contain different zones with the same name, allowing 12746 different clients to receive different answers for the same 12747 queries. At times, however, it is desirable for multiple 12748 views to contain identical zones. The 12749 <command>in-view</command> zone option provides an efficient 12750 way to do this: it allows a view to reference a zone that 12751 was defined in a previously configured view. Example: 12752 </para> 12753 <programlisting> 12754view internal { 12755 match-clients { 10/8; }; 12756 12757 zone example.com { 12758 type master; 12759 file "example-external.db"; 12760 }; 12761}; 12762 12763view external { 12764 match-clients { any; }; 12765 12766 zone example.com { 12767 in-view internal; 12768 }; 12769}; 12770 </programlisting> 12771 <para> 12772 An <command>in-view</command> option cannot refer to a view 12773 that is configured later in the configuration file. 12774 </para> 12775 <para> 12776 A <command>zone</command> statement which uses the 12777 <command>in-view</command> option may not use any other 12778 options with the exception of <command>forward</command> 12779 and <command>forwarders</command>. (These options control 12780 the behavior of the containing view, rather than changing 12781 the zone object itself.) 12782 </para> 12783 <para> 12784 An <command>in-view</command> zone cannot be used as a 12785 response policy zone. 12786 </para> 12787 </sect3> 12788 12789 </sect2> 12790 </sect1> 12791 <sect1> 12792 <title>Zone File</title> 12793 <sect2 id="types_of_resource_records_and_when_to_use_them"> 12794 <title>Types of Resource Records and When to Use Them</title> 12795 <para> 12796 This section, largely borrowed from RFC 1034, describes the 12797 concept of a Resource Record (RR) and explains when each is used. 12798 Since the publication of RFC 1034, several new RRs have been 12799 identified 12800 and implemented in the DNS. These are also included. 12801 </para> 12802 <sect3> 12803 <title>Resource Records</title> 12804 12805 <para> 12806 A domain name identifies a node. Each node has a set of 12807 resource information, which may be empty. The set of resource 12808 information associated with a particular name is composed of 12809 separate RRs. The order of RRs in a set is not significant and 12810 need not be preserved by name servers, resolvers, or other 12811 parts of the DNS. However, sorting of multiple RRs is 12812 permitted for optimization purposes, for example, to specify 12813 that a particular nearby server be tried first. See <xref linkend="the_sortlist_statement"/> and <xref linkend="rrset_ordering"/>. 12814 </para> 12815 12816 <para> 12817 The components of a Resource Record are: 12818 </para> 12819 <informaltable colsep="0" rowsep="0"> 12820 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="4Level-table"> 12821 <colspec colname="1" colnum="1" colsep="0" colwidth="1.000in"/> 12822 <colspec colname="2" colnum="2" colsep="0" colwidth="3.500in"/> 12823 <tbody> 12824 <row rowsep="0"> 12825 <entry colname="1"> 12826 <para> 12827 owner name 12828 </para> 12829 </entry> 12830 <entry colname="2"> 12831 <para> 12832 The domain name where the RR is found. 12833 </para> 12834 </entry> 12835 </row> 12836 <row rowsep="0"> 12837 <entry colname="1"> 12838 <para> 12839 type 12840 </para> 12841 </entry> 12842 <entry colname="2"> 12843 <para> 12844 An encoded 16-bit value that specifies 12845 the type of the resource record. 12846 </para> 12847 </entry> 12848 </row> 12849 <row rowsep="0"> 12850 <entry colname="1"> 12851 <para> 12852 TTL 12853 </para> 12854 </entry> 12855 <entry colname="2"> 12856 <para> 12857 The time-to-live of the RR. This field 12858 is a 32-bit integer in units of seconds, and is 12859 primarily used by 12860 resolvers when they cache RRs. The TTL describes how 12861 long a RR can 12862 be cached before it should be discarded. 12863 </para> 12864 </entry> 12865 </row> 12866 <row rowsep="0"> 12867 <entry colname="1"> 12868 <para> 12869 class 12870 </para> 12871 </entry> 12872 <entry colname="2"> 12873 <para> 12874 An encoded 16-bit value that identifies 12875 a protocol family or instance of a protocol. 12876 </para> 12877 </entry> 12878 </row> 12879 <row rowsep="0"> 12880 <entry colname="1"> 12881 <para> 12882 RDATA 12883 </para> 12884 </entry> 12885 <entry colname="2"> 12886 <para> 12887 The resource data. The format of the 12888 data is type (and sometimes class) specific. 12889 </para> 12890 </entry> 12891 </row> 12892 </tbody> 12893 </tgroup> 12894 </informaltable> 12895 <para> 12896 The following are <emphasis>types</emphasis> of valid RRs: 12897 </para> 12898 <informaltable colsep="0" rowsep="0"> 12899 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="4Level-table"> 12900 <colspec colname="1" colnum="1" colsep="0" colwidth="0.875in"/> 12901 <colspec colname="2" colnum="2" colsep="0" colwidth="3.625in"/> 12902 <tbody> 12903 <row rowsep="0"> 12904 <entry colname="1"> 12905 <para> 12906 A 12907 </para> 12908 </entry> 12909 <entry colname="2"> 12910 <para> 12911 A host address. In the IN class, this is a 12912 32-bit IP address. Described in RFC 1035. 12913 </para> 12914 </entry> 12915 </row> 12916 <row rowsep="0"> 12917 <entry colname="1"> 12918 <para> 12919 AAAA 12920 </para> 12921 </entry> 12922 <entry colname="2"> 12923 <para> 12924 IPv6 address. Described in RFC 1886. 12925 </para> 12926 </entry> 12927 </row> 12928 <row rowsep="0"> 12929 <entry colname="1"> 12930 <para> 12931 A6 12932 </para> 12933 </entry> 12934 <entry colname="2"> 12935 <para> 12936 IPv6 address. This can be a partial 12937 address (a suffix) and an indirection to the name 12938 where the rest of the 12939 address (the prefix) can be found. Experimental. 12940 Described in RFC 2874. 12941 </para> 12942 </entry> 12943 </row> 12944 <row rowsep="0"> 12945 <entry colname="1"> 12946 <para> 12947 AFSDB 12948 </para> 12949 </entry> 12950 <entry colname="2"> 12951 <para> 12952 Location of AFS database servers. 12953 Experimental. Described in RFC 1183. 12954 </para> 12955 </entry> 12956 </row> 12957 <row rowsep="0"> 12958 <entry colname="1"> 12959 <para> 12960 APL 12961 </para> 12962 </entry> 12963 <entry colname="2"> 12964 <para> 12965 Address prefix list. Experimental. 12966 Described in RFC 3123. 12967 </para> 12968 </entry> 12969 </row> 12970 <row rowsep="0"> 12971 <entry colname="1"> 12972 <para> 12973 CERT 12974 </para> 12975 </entry> 12976 <entry colname="2"> 12977 <para> 12978 Holds a digital certificate. 12979 Described in RFC 2538. 12980 </para> 12981 </entry> 12982 </row> 12983 <row rowsep="0"> 12984 <entry colname="1"> 12985 <para> 12986 CNAME 12987 </para> 12988 </entry> 12989 <entry colname="2"> 12990 <para> 12991 Identifies the canonical name of an alias. 12992 Described in RFC 1035. 12993 </para> 12994 </entry> 12995 </row> 12996 <row rowsep="0"> 12997 <entry colname="1"> 12998 <para> 12999 DHCID 13000 </para> 13001 </entry> 13002 <entry colname="2"> 13003 <para> 13004 Is used for identifying which DHCP client is 13005 associated with this name. Described in RFC 4701. 13006 </para> 13007 </entry> 13008 </row> 13009 <row rowsep="0"> 13010 <entry colname="1"> 13011 <para> 13012 DNAME 13013 </para> 13014 </entry> 13015 <entry colname="2"> 13016 <para> 13017 Replaces the domain name specified with 13018 another name to be looked up, effectively aliasing an 13019 entire 13020 subtree of the domain name space rather than a single 13021 record 13022 as in the case of the CNAME RR. 13023 Described in RFC 2672. 13024 </para> 13025 </entry> 13026 </row> 13027 <row rowsep="0"> 13028 <entry colname="1"> 13029 <para> 13030 DNSKEY 13031 </para> 13032 </entry> 13033 <entry colname="2"> 13034 <para> 13035 Stores a public key associated with a signed 13036 DNS zone. Described in RFC 4034. 13037 </para> 13038 </entry> 13039 </row> 13040 <row rowsep="0"> 13041 <entry colname="1"> 13042 <para> 13043 DS 13044 </para> 13045 </entry> 13046 <entry colname="2"> 13047 <para> 13048 Stores the hash of a public key associated with a 13049 signed DNS zone. Described in RFC 4034. 13050 </para> 13051 </entry> 13052 </row> 13053 <row rowsep="0"> 13054 <entry colname="1"> 13055 <para> 13056 GPOS 13057 </para> 13058 </entry> 13059 <entry colname="2"> 13060 <para> 13061 Specifies the global position. Superseded by LOC. 13062 </para> 13063 </entry> 13064 </row> 13065 <row rowsep="0"> 13066 <entry colname="1"> 13067 <para> 13068 HINFO 13069 </para> 13070 </entry> 13071 <entry colname="2"> 13072 <para> 13073 Identifies the CPU and OS used by a host. 13074 Described in RFC 1035. 13075 </para> 13076 </entry> 13077 </row> 13078 <row rowsep="0"> 13079 <entry colname="1"> 13080 <para> 13081 IPSECKEY 13082 </para> 13083 </entry> 13084 <entry colname="2"> 13085 <para> 13086 Provides a method for storing IPsec keying material in 13087 DNS. Described in RFC 4025. 13088 </para> 13089 </entry> 13090 </row> 13091 <row rowsep="0"> 13092 <entry colname="1"> 13093 <para> 13094 ISDN 13095 </para> 13096 </entry> 13097 <entry colname="2"> 13098 <para> 13099 Representation of ISDN addresses. 13100 Experimental. Described in RFC 1183. 13101 </para> 13102 </entry> 13103 </row> 13104 <row rowsep="0"> 13105 <entry colname="1"> 13106 <para> 13107 KEY 13108 </para> 13109 </entry> 13110 <entry colname="2"> 13111 <para> 13112 Stores a public key associated with a 13113 DNS name. Used in original DNSSEC; replaced 13114 by DNSKEY in DNSSECbis, but still used with 13115 SIG(0). Described in RFCs 2535 and 2931. 13116 </para> 13117 </entry> 13118 </row> 13119 <row rowsep="0"> 13120 <entry colname="1"> 13121 <para> 13122 KX 13123 </para> 13124 </entry> 13125 <entry colname="2"> 13126 <para> 13127 Identifies a key exchanger for this 13128 DNS name. Described in RFC 2230. 13129 </para> 13130 </entry> 13131 </row> 13132 <row rowsep="0"> 13133 <entry colname="1"> 13134 <para> 13135 LOC 13136 </para> 13137 </entry> 13138 <entry colname="2"> 13139 <para> 13140 For storing GPS info. Described in RFC 1876. 13141 Experimental. 13142 </para> 13143 </entry> 13144 </row> 13145 <row rowsep="0"> 13146 <entry colname="1"> 13147 <para> 13148 MX 13149 </para> 13150 </entry> 13151 <entry colname="2"> 13152 <para> 13153 Identifies a mail exchange for the domain with 13154 a 16-bit preference value (lower is better) 13155 followed by the host name of the mail exchange. 13156 Described in RFC 974, RFC 1035. 13157 </para> 13158 </entry> 13159 </row> 13160 <row rowsep="0"> 13161 <entry colname="1"> 13162 <para> 13163 NAPTR 13164 </para> 13165 </entry> 13166 <entry colname="2"> 13167 <para> 13168 Name authority pointer. Described in RFC 2915. 13169 </para> 13170 </entry> 13171 </row> 13172 <row rowsep="0"> 13173 <entry colname="1"> 13174 <para> 13175 NSAP 13176 </para> 13177 </entry> 13178 <entry colname="2"> 13179 <para> 13180 A network service access point. 13181 Described in RFC 1706. 13182 </para> 13183 </entry> 13184 </row> 13185 <row rowsep="0"> 13186 <entry colname="1"> 13187 <para> 13188 NS 13189 </para> 13190 </entry> 13191 <entry colname="2"> 13192 <para> 13193 The authoritative name server for the 13194 domain. Described in RFC 1035. 13195 </para> 13196 </entry> 13197 </row> 13198 <row rowsep="0"> 13199 <entry colname="1"> 13200 <para> 13201 NSEC 13202 </para> 13203 </entry> 13204 <entry colname="2"> 13205 <para> 13206 Used in DNSSECbis to securely indicate that 13207 RRs with an owner name in a certain name interval do 13208 not exist in 13209 a zone and indicate what RR types are present for an 13210 existing name. 13211 Described in RFC 4034. 13212 </para> 13213 </entry> 13214 </row> 13215 <row rowsep="0"> 13216 <entry colname="1"> 13217 <para> 13218 NSEC3 13219 </para> 13220 </entry> 13221 <entry colname="2"> 13222 <para> 13223 Used in DNSSECbis to securely indicate that 13224 RRs with an owner name in a certain name 13225 interval do not exist in a zone and indicate 13226 what RR types are present for an existing 13227 name. NSEC3 differs from NSEC in that it 13228 prevents zone enumeration but is more 13229 computationally expensive on both the server 13230 and the client than NSEC. Described in RFC 13231 5155. 13232 </para> 13233 </entry> 13234 </row> 13235 <row rowsep="0"> 13236 <entry colname="1"> 13237 <para> 13238 NSEC3PARAM 13239 </para> 13240 </entry> 13241 <entry colname="2"> 13242 <para> 13243 Used in DNSSECbis to tell the authoritative 13244 server which NSEC3 chains are available to use. 13245 Described in RFC 5155. 13246 </para> 13247 </entry> 13248 </row> 13249 <row rowsep="0"> 13250 <entry colname="1"> 13251 <para> 13252 NXT 13253 </para> 13254 </entry> 13255 <entry colname="2"> 13256 <para> 13257 Used in DNSSEC to securely indicate that 13258 RRs with an owner name in a certain name interval do 13259 not exist in 13260 a zone and indicate what RR types are present for an 13261 existing name. 13262 Used in original DNSSEC; replaced by NSEC in 13263 DNSSECbis. 13264 Described in RFC 2535. 13265 </para> 13266 </entry> 13267 </row> 13268 <row rowsep="0"> 13269 <entry colname="1"> 13270 <para> 13271 PTR 13272 </para> 13273 </entry> 13274 <entry colname="2"> 13275 <para> 13276 A pointer to another part of the domain 13277 name space. Described in RFC 1035. 13278 </para> 13279 </entry> 13280 </row> 13281 <row rowsep="0"> 13282 <entry colname="1"> 13283 <para> 13284 PX 13285 </para> 13286 </entry> 13287 <entry colname="2"> 13288 <para> 13289 Provides mappings between RFC 822 and X.400 13290 addresses. Described in RFC 2163. 13291 </para> 13292 </entry> 13293 </row> 13294 <row rowsep="0"> 13295 <entry colname="1"> 13296 <para> 13297 RP 13298 </para> 13299 </entry> 13300 <entry colname="2"> 13301 <para> 13302 Information on persons responsible 13303 for the domain. Experimental. Described in RFC 1183. 13304 </para> 13305 </entry> 13306 </row> 13307 <row rowsep="0"> 13308 <entry colname="1"> 13309 <para> 13310 RRSIG 13311 </para> 13312 </entry> 13313 <entry colname="2"> 13314 <para> 13315 Contains DNSSECbis signature data. Described 13316 in RFC 4034. 13317 </para> 13318 </entry> 13319 </row> 13320 <row rowsep="0"> 13321 <entry colname="1"> 13322 <para> 13323 RT 13324 </para> 13325 </entry> 13326 <entry colname="2"> 13327 <para> 13328 Route-through binding for hosts that 13329 do not have their own direct wide area network 13330 addresses. 13331 Experimental. Described in RFC 1183. 13332 </para> 13333 </entry> 13334 </row> 13335 <row rowsep="0"> 13336 <entry colname="1"> 13337 <para> 13338 SIG 13339 </para> 13340 </entry> 13341 <entry colname="2"> 13342 <para> 13343 Contains DNSSEC signature data. Used in 13344 original DNSSEC; replaced by RRSIG in 13345 DNSSECbis, but still used for SIG(0). 13346 Described in RFCs 2535 and 2931. 13347 </para> 13348 </entry> 13349 </row> 13350 <row rowsep="0"> 13351 <entry colname="1"> 13352 <para> 13353 SOA 13354 </para> 13355 </entry> 13356 <entry colname="2"> 13357 <para> 13358 Identifies the start of a zone of authority. 13359 Described in RFC 1035. 13360 </para> 13361 </entry> 13362 </row> 13363 <row rowsep="0"> 13364 <entry colname="1"> 13365 <para> 13366 SPF 13367 </para> 13368 </entry> 13369 <entry colname="2"> 13370 <para> 13371 Contains the Sender Policy Framework information 13372 for a given email domain. Described in RFC 4408. 13373 </para> 13374 </entry> 13375 </row> 13376 <row rowsep="0"> 13377 <entry colname="1"> 13378 <para> 13379 SRV 13380 </para> 13381 </entry> 13382 <entry colname="2"> 13383 <para> 13384 Information about well known network 13385 services (replaces WKS). Described in RFC 2782. 13386 </para> 13387 </entry> 13388 </row> 13389 <row rowsep="0"> 13390 <entry colname="1"> 13391 <para> 13392 SSHFP 13393 </para> 13394 </entry> 13395 <entry colname="2"> 13396 <para> 13397 Provides a way to securely publish a secure shell key's 13398 fingerprint. Described in RFC 4255. 13399 </para> 13400 </entry> 13401 </row> 13402 <row rowsep="0"> 13403 <entry colname="1"> 13404 <para> 13405 TXT 13406 </para> 13407 </entry> 13408 <entry colname="2"> 13409 <para> 13410 Text records. Described in RFC 1035. 13411 </para> 13412 </entry> 13413 </row> 13414 <row rowsep="0"> 13415 <entry colname="1"> 13416 <para> 13417 WKS 13418 </para> 13419 </entry> 13420 <entry colname="2"> 13421 <para> 13422 Information about which well known 13423 network services, such as SMTP, that a domain 13424 supports. Historical. 13425 </para> 13426 </entry> 13427 </row> 13428 <row rowsep="0"> 13429 <entry colname="1"> 13430 <para> 13431 X25 13432 </para> 13433 </entry> 13434 <entry colname="2"> 13435 <para> 13436 Representation of X.25 network addresses. 13437 Experimental. Described in RFC 1183. 13438 </para> 13439 </entry> 13440 </row> 13441 </tbody> 13442 </tgroup> 13443 </informaltable> 13444 <para> 13445 The following <emphasis>classes</emphasis> of resource records 13446 are currently valid in the DNS: 13447 </para> 13448 <informaltable colsep="0" rowsep="0"><tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="4Level-table"> 13449 <colspec colname="1" colnum="1" colsep="0" colwidth="0.875in"/> 13450 <colspec colname="2" colnum="2" colsep="0" colwidth="3.625in"/> 13451 <tbody> 13452 13453 <row rowsep="0"> 13454 <entry colname="1"> 13455 <para> 13456 IN 13457 </para> 13458 </entry> 13459 <entry colname="2"> 13460 <para> 13461 The Internet. 13462 </para> 13463 </entry> 13464 </row> 13465 13466 <row rowsep="0"> 13467 <entry colname="1"> 13468 <para> 13469 CH 13470 </para> 13471 </entry> 13472 <entry colname="2"> 13473 <para> 13474 Chaosnet, a LAN protocol created at MIT in the 13475 mid-1970s. 13476 Rarely used for its historical purpose, but reused for 13477 BIND's 13478 built-in server information zones, e.g., 13479 <literal>version.bind</literal>. 13480 </para> 13481 </entry> 13482 </row> 13483 13484 <row rowsep="0"> 13485 <entry colname="1"> 13486 <para> 13487 HS 13488 </para> 13489 </entry> 13490 <entry colname="2"> 13491 <para> 13492 Hesiod, an information service 13493 developed by MIT's Project Athena. It is used to share 13494 information 13495 about various systems databases, such as users, 13496 groups, printers 13497 and so on. 13498 </para> 13499 </entry> 13500 </row> 13501 13502 </tbody> 13503 </tgroup> 13504 </informaltable> 13505 13506 <para> 13507 The owner name is often implicit, rather than forming an 13508 integral 13509 part of the RR. For example, many name servers internally form 13510 tree 13511 or hash structures for the name space, and chain RRs off nodes. 13512 The remaining RR parts are the fixed header (type, class, TTL) 13513 which is consistent for all RRs, and a variable part (RDATA) 13514 that 13515 fits the needs of the resource being described. 13516 </para> 13517 <para> 13518 The meaning of the TTL field is a time limit on how long an 13519 RR can be kept in a cache. This limit does not apply to 13520 authoritative 13521 data in zones; it is also timed out, but by the refreshing 13522 policies 13523 for the zone. The TTL is assigned by the administrator for the 13524 zone where the data originates. While short TTLs can be used to 13525 minimize caching, and a zero TTL prohibits caching, the 13526 realities 13527 of Internet performance suggest that these times should be on 13528 the 13529 order of days for the typical host. If a change can be 13530 anticipated, 13531 the TTL can be reduced prior to the change to minimize 13532 inconsistency 13533 during the change, and then increased back to its former value 13534 following 13535 the change. 13536 </para> 13537 <para> 13538 The data in the RDATA section of RRs is carried as a combination 13539 of binary strings and domain names. The domain names are 13540 frequently 13541 used as "pointers" to other data in the DNS. 13542 </para> 13543 </sect3> 13544 <sect3> 13545 <title>Textual expression of RRs</title> 13546 <para> 13547 RRs are represented in binary form in the packets of the DNS 13548 protocol, and are usually represented in highly encoded form 13549 when 13550 stored in a name server or resolver. In the examples provided 13551 in 13552 RFC 1034, a style similar to that used in master files was 13553 employed 13554 in order to show the contents of RRs. In this format, most RRs 13555 are shown on a single line, although continuation lines are 13556 possible 13557 using parentheses. 13558 </para> 13559 <para> 13560 The start of the line gives the owner of the RR. If a line 13561 begins with a blank, then the owner is assumed to be the same as 13562 that of the previous RR. Blank lines are often included for 13563 readability. 13564 </para> 13565 <para> 13566 Following the owner, we list the TTL, type, and class of the 13567 RR. Class and type use the mnemonics defined above, and TTL is 13568 an integer before the type field. In order to avoid ambiguity 13569 in 13570 parsing, type and class mnemonics are disjoint, TTLs are 13571 integers, 13572 and the type mnemonic is always last. The IN class and TTL 13573 values 13574 are often omitted from examples in the interests of clarity. 13575 </para> 13576 <para> 13577 The resource data or RDATA section of the RR are given using 13578 knowledge of the typical representation for the data. 13579 </para> 13580 <para> 13581 For example, we might show the RRs carried in a message as: 13582 </para> 13583 <informaltable colsep="0" rowsep="0"><tgroup cols="3" colsep="0" rowsep="0" tgroupstyle="4Level-table"> 13584 <colspec colname="1" colnum="1" colsep="0" colwidth="1.381in"/> 13585 <colspec colname="2" colnum="2" colsep="0" colwidth="1.020in"/> 13586 <colspec colname="3" colnum="3" colsep="0" colwidth="2.099in"/> 13587 <tbody> 13588 <row rowsep="0"> 13589 <entry colname="1"> 13590 <para> 13591 <literal>ISI.EDU.</literal> 13592 </para> 13593 </entry> 13594 <entry colname="2"> 13595 <para> 13596 <literal>MX</literal> 13597 </para> 13598 </entry> 13599 <entry colname="3"> 13600 <para> 13601 <literal>10 VENERA.ISI.EDU.</literal> 13602 </para> 13603 </entry> 13604 </row> 13605 <row rowsep="0"> 13606 <entry colname="1"> 13607 <para/> 13608 </entry> 13609 <entry colname="2"> 13610 <para> 13611 <literal>MX</literal> 13612 </para> 13613 </entry> 13614 <entry colname="3"> 13615 <para> 13616 <literal>10 VAXA.ISI.EDU</literal> 13617 </para> 13618 </entry> 13619 </row> 13620 <row rowsep="0"> 13621 <entry colname="1"> 13622 <para> 13623 <literal>VENERA.ISI.EDU</literal> 13624 </para> 13625 </entry> 13626 <entry colname="2"> 13627 <para> 13628 <literal>A</literal> 13629 </para> 13630 </entry> 13631 <entry colname="3"> 13632 <para> 13633 <literal>128.9.0.32</literal> 13634 </para> 13635 </entry> 13636 </row> 13637 <row rowsep="0"> 13638 <entry colname="1"> 13639 <para/> 13640 </entry> 13641 <entry colname="2"> 13642 <para> 13643 <literal>A</literal> 13644 </para> 13645 </entry> 13646 <entry colname="3"> 13647 <para> 13648 <literal>10.1.0.52</literal> 13649 </para> 13650 </entry> 13651 </row> 13652 <row rowsep="0"> 13653 <entry colname="1"> 13654 <para> 13655 <literal>VAXA.ISI.EDU</literal> 13656 </para> 13657 </entry> 13658 <entry colname="2"> 13659 <para> 13660 <literal>A</literal> 13661 </para> 13662 </entry> 13663 <entry colname="3"> 13664 <para> 13665 <literal>10.2.0.27</literal> 13666 </para> 13667 </entry> 13668 </row> 13669 <row rowsep="0"> 13670 <entry colname="1"> 13671 <para/> 13672 </entry> 13673 <entry colname="2"> 13674 <para> 13675 <literal>A</literal> 13676 </para> 13677 </entry> 13678 <entry colname="3"> 13679 <para> 13680 <literal>128.9.0.33</literal> 13681 </para> 13682 </entry> 13683 </row> 13684 </tbody> 13685 </tgroup> 13686 </informaltable> 13687 <para> 13688 The MX RRs have an RDATA section which consists of a 16-bit 13689 number followed by a domain name. The address RRs use a 13690 standard 13691 IP address format to contain a 32-bit internet address. 13692 </para> 13693 <para> 13694 The above example shows six RRs, with two RRs at each of three 13695 domain names. 13696 </para> 13697 <para> 13698 Similarly we might see: 13699 </para> 13700 <informaltable colsep="0" rowsep="0"><tgroup cols="3" colsep="0" rowsep="0" tgroupstyle="4Level-table"> 13701 <colspec colname="1" colnum="1" colsep="0" colwidth="1.491in"/> 13702 <colspec colname="2" colnum="2" colsep="0" colwidth="1.067in"/> 13703 <colspec colname="3" colnum="3" colsep="0" colwidth="2.067in"/> 13704 <tbody> 13705 <row rowsep="0"> 13706 <entry colname="1"> 13707 <para> 13708 <literal>XX.LCS.MIT.EDU.</literal> 13709 </para> 13710 </entry> 13711 <entry colname="2"> 13712 <para> 13713 <literal>IN A</literal> 13714 </para> 13715 </entry> 13716 <entry colname="3"> 13717 <para> 13718 <literal>10.0.0.44</literal> 13719 </para> 13720 </entry> 13721 </row> 13722 <row rowsep="0"> 13723 <entry colname="1"/> 13724 <entry colname="2"> 13725 <para> 13726 <literal>CH A</literal> 13727 </para> 13728 </entry> 13729 <entry colname="3"> 13730 <para> 13731 <literal>MIT.EDU. 2420</literal> 13732 </para> 13733 </entry> 13734 </row> 13735 </tbody> 13736 </tgroup> 13737 </informaltable> 13738 <para> 13739 This example shows two addresses for 13740 <literal>XX.LCS.MIT.EDU</literal>, each of a different class. 13741 </para> 13742 </sect3> 13743 </sect2> 13744 13745 <sect2> 13746 <title>Discussion of MX Records</title> 13747 13748 <para> 13749 As described above, domain servers store information as a 13750 series of resource records, each of which contains a particular 13751 piece of information about a given domain name (which is usually, 13752 but not always, a host). The simplest way to think of a RR is as 13753 a typed pair of data, a domain name matched with a relevant datum, 13754 and stored with some additional type information to help systems 13755 determine when the RR is relevant. 13756 </para> 13757 13758 <para> 13759 MX records are used to control delivery of email. The data 13760 specified in the record is a priority and a domain name. The 13761 priority 13762 controls the order in which email delivery is attempted, with the 13763 lowest number first. If two priorities are the same, a server is 13764 chosen randomly. If no servers at a given priority are responding, 13765 the mail transport agent will fall back to the next largest 13766 priority. 13767 Priority numbers do not have any absolute meaning — they are 13768 relevant 13769 only respective to other MX records for that domain name. The 13770 domain 13771 name given is the machine to which the mail will be delivered. 13772 It <emphasis>must</emphasis> have an associated address record 13773 (A or AAAA) — CNAME is not sufficient. 13774 </para> 13775 <para> 13776 For a given domain, if there is both a CNAME record and an 13777 MX record, the MX record is in error, and will be ignored. 13778 Instead, 13779 the mail will be delivered to the server specified in the MX 13780 record 13781 pointed to by the CNAME. 13782 For example: 13783 </para> 13784 <informaltable colsep="0" rowsep="0"> 13785 <tgroup cols="5" colsep="0" rowsep="0" tgroupstyle="3Level-table"> 13786 <colspec colname="1" colnum="1" colsep="0" colwidth="1.708in"/> 13787 <colspec colname="2" colnum="2" colsep="0" colwidth="0.444in"/> 13788 <colspec colname="3" colnum="3" colsep="0" colwidth="0.444in"/> 13789 <colspec colname="4" colnum="4" colsep="0" colwidth="0.976in"/> 13790 <colspec colname="5" colnum="5" colsep="0" colwidth="1.553in"/> 13791 <tbody> 13792 <row rowsep="0"> 13793 <entry colname="1"> 13794 <para> 13795 <literal>example.com.</literal> 13796 </para> 13797 </entry> 13798 <entry colname="2"> 13799 <para> 13800 <literal>IN</literal> 13801 </para> 13802 </entry> 13803 <entry colname="3"> 13804 <para> 13805 <literal>MX</literal> 13806 </para> 13807 </entry> 13808 <entry colname="4"> 13809 <para> 13810 <literal>10</literal> 13811 </para> 13812 </entry> 13813 <entry colname="5"> 13814 <para> 13815 <literal>mail.example.com.</literal> 13816 </para> 13817 </entry> 13818 </row> 13819 <row rowsep="0"> 13820 <entry colname="1"> 13821 <para/> 13822 </entry> 13823 <entry colname="2"> 13824 <para> 13825 <literal>IN</literal> 13826 </para> 13827 </entry> 13828 <entry colname="3"> 13829 <para> 13830 <literal>MX</literal> 13831 </para> 13832 </entry> 13833 <entry colname="4"> 13834 <para> 13835 <literal>10</literal> 13836 </para> 13837 </entry> 13838 <entry colname="5"> 13839 <para> 13840 <literal>mail2.example.com.</literal> 13841 </para> 13842 </entry> 13843 </row> 13844 <row rowsep="0"> 13845 <entry colname="1"> 13846 <para/> 13847 </entry> 13848 <entry colname="2"> 13849 <para> 13850 <literal>IN</literal> 13851 </para> 13852 </entry> 13853 <entry colname="3"> 13854 <para> 13855 <literal>MX</literal> 13856 </para> 13857 </entry> 13858 <entry colname="4"> 13859 <para> 13860 <literal>20</literal> 13861 </para> 13862 </entry> 13863 <entry colname="5"> 13864 <para> 13865 <literal>mail.backup.org.</literal> 13866 </para> 13867 </entry> 13868 </row> 13869 <row rowsep="0"> 13870 <entry colname="1"> 13871 <para> 13872 <literal>mail.example.com.</literal> 13873 </para> 13874 </entry> 13875 <entry colname="2"> 13876 <para> 13877 <literal>IN</literal> 13878 </para> 13879 </entry> 13880 <entry colname="3"> 13881 <para> 13882 <literal>A</literal> 13883 </para> 13884 </entry> 13885 <entry colname="4"> 13886 <para> 13887 <literal>10.0.0.1</literal> 13888 </para> 13889 </entry> 13890 <entry colname="5"> 13891 <para/> 13892 </entry> 13893 </row> 13894 <row rowsep="0"> 13895 <entry colname="1"> 13896 <para> 13897 <literal>mail2.example.com.</literal> 13898 </para> 13899 </entry> 13900 <entry colname="2"> 13901 <para> 13902 <literal>IN</literal> 13903 </para> 13904 </entry> 13905 <entry colname="3"> 13906 <para> 13907 <literal>A</literal> 13908 </para> 13909 </entry> 13910 <entry colname="4"> 13911 <para> 13912 <literal>10.0.0.2</literal> 13913 </para> 13914 </entry> 13915 <entry colname="5"> 13916 <para/> 13917 </entry> 13918 </row> 13919 </tbody> 13920 </tgroup> 13921 </informaltable><para> 13922 Mail delivery will be attempted to <literal>mail.example.com</literal> and 13923 <literal>mail2.example.com</literal> (in 13924 any order), and if neither of those succeed, delivery to <literal>mail.backup.org</literal> will 13925 be attempted. 13926 </para> 13927 </sect2> 13928 <sect2 id="Setting_TTLs"> 13929 <title>Setting TTLs</title> 13930 <para> 13931 The time-to-live of the RR field is a 32-bit integer represented 13932 in units of seconds, and is primarily used by resolvers when they 13933 cache RRs. The TTL describes how long a RR can be cached before it 13934 should be discarded. The following three types of TTL are 13935 currently 13936 used in a zone file. 13937 </para> 13938 <informaltable colsep="0" rowsep="0"> 13939 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="3Level-table"> 13940 <colspec colname="1" colnum="1" colsep="0" colwidth="0.750in"/> 13941 <colspec colname="2" colnum="2" colsep="0" colwidth="4.375in"/> 13942 <tbody> 13943 <row rowsep="0"> 13944 <entry colname="1"> 13945 <para> 13946 SOA 13947 </para> 13948 </entry> 13949 <entry colname="2"> 13950 <para> 13951 The last field in the SOA is the negative 13952 caching TTL. This controls how long other servers will 13953 cache no-such-domain 13954 (NXDOMAIN) responses from you. 13955 </para> 13956 <para> 13957 The maximum time for 13958 negative caching is 3 hours (3h). 13959 </para> 13960 </entry> 13961 </row> 13962 <row rowsep="0"> 13963 <entry colname="1"> 13964 <para> 13965 $TTL 13966 </para> 13967 </entry> 13968 <entry colname="2"> 13969 <para> 13970 The $TTL directive at the top of the 13971 zone file (before the SOA) gives a default TTL for every 13972 RR without 13973 a specific TTL set. 13974 </para> 13975 </entry> 13976 </row> 13977 <row rowsep="0"> 13978 <entry colname="1"> 13979 <para> 13980 RR TTLs 13981 </para> 13982 </entry> 13983 <entry colname="2"> 13984 <para> 13985 Each RR can have a TTL as the second 13986 field in the RR, which will control how long other 13987 servers can cache it. 13988 </para> 13989 </entry> 13990 </row> 13991 </tbody> 13992 </tgroup> 13993 </informaltable> 13994 <para> 13995 All of these TTLs default to units of seconds, though units 13996 can be explicitly specified, for example, <literal>1h30m</literal>. 13997 </para> 13998 </sect2> 13999 <sect2> 14000 <title>Inverse Mapping in IPv4</title> 14001 <para> 14002 Reverse name resolution (that is, translation from IP address 14003 to name) is achieved by means of the <emphasis>in-addr.arpa</emphasis> domain 14004 and PTR records. Entries in the in-addr.arpa domain are made in 14005 least-to-most significant order, read left to right. This is the 14006 opposite order to the way IP addresses are usually written. Thus, 14007 a machine with an IP address of 10.1.2.3 would have a 14008 corresponding 14009 in-addr.arpa name of 14010 3.2.1.10.in-addr.arpa. This name should have a PTR resource record 14011 whose data field is the name of the machine or, optionally, 14012 multiple 14013 PTR records if the machine has more than one name. For example, 14014 in the <optional>example.com</optional> domain: 14015 </para> 14016 <informaltable colsep="0" rowsep="0"> 14017 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="3Level-table"> 14018 <colspec colname="1" colnum="1" colsep="0" colwidth="1.125in"/> 14019 <colspec colname="2" colnum="2" colsep="0" colwidth="4.000in"/> 14020 <tbody> 14021 <row rowsep="0"> 14022 <entry colname="1"> 14023 <para> 14024 <literal>$ORIGIN</literal> 14025 </para> 14026 </entry> 14027 <entry colname="2"> 14028 <para> 14029 <literal>2.1.10.in-addr.arpa</literal> 14030 </para> 14031 </entry> 14032 </row> 14033 <row rowsep="0"> 14034 <entry colname="1"> 14035 <para> 14036 <literal>3</literal> 14037 </para> 14038 </entry> 14039 <entry colname="2"> 14040 <para> 14041 <literal>IN PTR foo.example.com.</literal> 14042 </para> 14043 </entry> 14044 </row> 14045 </tbody> 14046 </tgroup> 14047 </informaltable> 14048 <note> 14049 <para> 14050 The <command>$ORIGIN</command> lines in the examples 14051 are for providing context to the examples only — they do not 14052 necessarily 14053 appear in the actual usage. They are only used here to indicate 14054 that the example is relative to the listed origin. 14055 </para> 14056 </note> 14057 </sect2> 14058 <sect2> 14059 <title>Other Zone File Directives</title> 14060 <para> 14061 The Master File Format was initially defined in RFC 1035 and 14062 has subsequently been extended. While the Master File Format 14063 itself 14064 is class independent all records in a Master File must be of the 14065 same 14066 class. 14067 </para> 14068 <para> 14069 Master File Directives include <command>$ORIGIN</command>, <command>$INCLUDE</command>, 14070 and <command>$TTL.</command> 14071 </para> 14072 <sect3> 14073 <title>The <command>@</command> (at-sign)</title> 14074 <para> 14075 When used in the label (or name) field, the asperand or 14076 at-sign (@) symbol represents the current origin. 14077 At the start of the zone file, it is the 14078 <<varname>zone_name</varname>> (followed by 14079 trailing dot). 14080 </para> 14081 </sect3> 14082 <sect3> 14083 <title>The <command>$ORIGIN</command> Directive</title> 14084 <para> 14085 Syntax: <command>$ORIGIN</command> 14086 <replaceable>domain-name</replaceable> 14087 <optional><replaceable>comment</replaceable></optional> 14088 </para> 14089 <para><command>$ORIGIN</command> 14090 sets the domain name that will be appended to any 14091 unqualified records. When a zone is first read in there 14092 is an implicit <command>$ORIGIN</command> 14093 <<varname>zone_name</varname>><command>.</command> 14094 (followed by trailing dot). 14095 The current <command>$ORIGIN</command> is appended to 14096 the domain specified in the <command>$ORIGIN</command> 14097 argument if it is not absolute. 14098 </para> 14099 14100<programlisting> 14101$ORIGIN example.com. 14102WWW CNAME MAIN-SERVER 14103</programlisting> 14104 14105 <para> 14106 is equivalent to 14107 </para> 14108 14109<programlisting> 14110WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. 14111</programlisting> 14112 14113 </sect3> 14114 <sect3> 14115 <title>The <command>$INCLUDE</command> Directive</title> 14116 <para> 14117 Syntax: <command>$INCLUDE</command> 14118 <replaceable>filename</replaceable> 14119 <optional> 14120<replaceable>origin</replaceable> </optional> 14121 <optional> <replaceable>comment</replaceable> </optional> 14122 </para> 14123 <para> 14124 Read and process the file <filename>filename</filename> as 14125 if it were included into the file at this point. If <command>origin</command> is 14126 specified the file is processed with <command>$ORIGIN</command> set 14127 to that value, otherwise the current <command>$ORIGIN</command> is 14128 used. 14129 </para> 14130 <para> 14131 The origin and the current domain name 14132 revert to the values they had prior to the <command>$INCLUDE</command> once 14133 the file has been read. 14134 </para> 14135 <note> 14136 <para> 14137 RFC 1035 specifies that the current origin should be restored 14138 after 14139 an <command>$INCLUDE</command>, but it is silent 14140 on whether the current 14141 domain name should also be restored. BIND 9 restores both of 14142 them. 14143 This could be construed as a deviation from RFC 1035, a 14144 feature, or both. 14145 </para> 14146 </note> 14147 </sect3> 14148 <sect3> 14149 <title>The <command>$TTL</command> Directive</title> 14150 <para> 14151 Syntax: <command>$TTL</command> 14152 <replaceable>default-ttl</replaceable> 14153 <optional> 14154<replaceable>comment</replaceable> </optional> 14155 </para> 14156 <para> 14157 Set the default Time To Live (TTL) for subsequent records 14158 with undefined TTLs. Valid TTLs are of the range 0-2147483647 14159 seconds. 14160 </para> 14161 <para><command>$TTL</command> 14162 is defined in RFC 2308. 14163 </para> 14164 </sect3> 14165 </sect2> 14166 <sect2> 14167 <title><acronym>BIND</acronym> Master File Extension: the <command>$GENERATE</command> Directive</title> 14168 <para> 14169 Syntax: <command>$GENERATE</command> 14170 <replaceable>range</replaceable> 14171 <replaceable>lhs</replaceable> 14172 <optional><replaceable>ttl</replaceable></optional> 14173 <optional><replaceable>class</replaceable></optional> 14174 <replaceable>type</replaceable> 14175 <replaceable>rhs</replaceable> 14176 <optional><replaceable>comment</replaceable></optional> 14177 </para> 14178 <para><command>$GENERATE</command> 14179 is used to create a series of resource records that only 14180 differ from each other by an 14181 iterator. <command>$GENERATE</command> can be used to 14182 easily generate the sets of records required to support 14183 sub /24 reverse delegations described in RFC 2317: 14184 Classless IN-ADDR.ARPA delegation. 14185 </para> 14186 14187<programlisting>$ORIGIN 0.0.192.IN-ADDR.ARPA. 14188$GENERATE 1-2 @ NS SERVER$.EXAMPLE. 14189$GENERATE 1-127 $ CNAME $.0</programlisting> 14190 14191 <para> 14192 is equivalent to 14193 </para> 14194 14195<programlisting>0.0.0.192.IN-ADDR.ARPA. NS SERVER1.EXAMPLE. 141960.0.0.192.IN-ADDR.ARPA. NS SERVER2.EXAMPLE. 141971.0.0.192.IN-ADDR.ARPA. CNAME 1.0.0.0.192.IN-ADDR.ARPA. 141982.0.0.192.IN-ADDR.ARPA. CNAME 2.0.0.0.192.IN-ADDR.ARPA. 14199... 14200127.0.0.192.IN-ADDR.ARPA. CNAME 127.0.0.0.192.IN-ADDR.ARPA. 14201</programlisting> 14202 14203 <para> 14204 Generate a set of A and MX records. Note the MX's right hand 14205 side is a quoted string. The quotes will be stripped when the 14206 right hand side is processed. 14207 </para> 14208 14209<programlisting> 14210$ORIGIN EXAMPLE. 14211$GENERATE 1-127 HOST-$ A 1.2.3.$ 14212$GENERATE 1-127 HOST-$ MX "0 ."</programlisting> 14213 14214 <para> 14215 is equivalent to 14216 </para> 14217 14218<programlisting>HOST-1.EXAMPLE. A 1.2.3.1 14219HOST-1.EXAMPLE. MX 0 . 14220HOST-2.EXAMPLE. A 1.2.3.2 14221HOST-2.EXAMPLE. MX 0 . 14222HOST-3.EXAMPLE. A 1.2.3.3 14223HOST-3.EXAMPLE. MX 0 . 14224... 14225HOST-127.EXAMPLE. A 1.2.3.127 14226HOST-127.EXAMPLE. MX 0 . 14227</programlisting> 14228 14229 <informaltable colsep="0" rowsep="0"> 14230 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="3Level-table"> 14231 <colspec colname="1" colnum="1" colsep="0" colwidth="0.875in"/> 14232 <colspec colname="2" colnum="2" colsep="0" colwidth="4.250in"/> 14233 <tbody> 14234 <row rowsep="0"> 14235 <entry colname="1"> 14236 <para><command>range</command></para> 14237 </entry> 14238 <entry colname="2"> 14239 <para> 14240 This can be one of two forms: start-stop 14241 or start-stop/step. If the first form is used, then step 14242 is set to 1. start, stop and step must be positive 14243 integers between 0 and (2^31)-1. start must not be 14244 larger than stop. 14245 </para> 14246 </entry> 14247 </row> 14248 <row rowsep="0"> 14249 <entry colname="1"> 14250 <para><command>lhs</command></para> 14251 </entry> 14252 <entry colname="2"> 14253 <para>This 14254 describes the owner name of the resource records 14255 to be created. Any single <command>$</command> 14256 (dollar sign) 14257 symbols within the <command>lhs</command> string 14258 are replaced by the iterator value. 14259 14260 To get a $ in the output, you need to escape the 14261 <command>$</command> using a backslash 14262 <command>\</command>, 14263 e.g. <command>\$</command>. The 14264 <command>$</command> may optionally be followed 14265 by modifiers which change the offset from the 14266 iterator, field width and base. 14267 14268 Modifiers are introduced by a 14269 <command>{</command> (left brace) immediately following the 14270 <command>$</command> as 14271 <command>${offset[,width[,base]]}</command>. 14272 For example, <command>${-20,3,d}</command> 14273 subtracts 20 from the current value, prints the 14274 result as a decimal in a zero-padded field of 14275 width 3. 14276 14277 Available output forms are decimal 14278 (<command>d</command>), octal 14279 (<command>o</command>), hexadecimal 14280 (<command>x</command> or <command>X</command> 14281 for uppercase) and nibble 14282 (<command>n</command> or <command>N</command>\ 14283 for uppercase). The default modifier is 14284 <command>${0,0,d}</command>. If the 14285 <command>lhs</command> is not absolute, the 14286 current <command>$ORIGIN</command> is appended 14287 to the name. 14288 </para> 14289 <para> 14290 In nibble mode the value will be treated as 14291 if it was a reversed hexadecimal string 14292 with each hexadecimal digit as a separate 14293 label. The width field includes the label 14294 separator. 14295 </para> 14296 <para> 14297 For compatibility with earlier versions, 14298 <command>$$</command> is still recognized as 14299 indicating a literal $ in the output. 14300 </para> 14301 </entry> 14302 </row> 14303 <row rowsep="0"> 14304 <entry colname="1"> 14305 <para><command>ttl</command></para> 14306 </entry> 14307 <entry colname="2"> 14308 <para> 14309 Specifies the time-to-live of the generated records. If 14310 not specified this will be inherited using the 14311 normal TTL inheritance rules. 14312 </para> 14313 <para><command>class</command> 14314 and <command>ttl</command> can be 14315 entered in either order. 14316 </para> 14317 </entry> 14318 </row> 14319 <row rowsep="0"> 14320 <entry colname="1"> 14321 <para><command>class</command></para> 14322 </entry> 14323 <entry colname="2"> 14324 <para> 14325 Specifies the class of the generated records. 14326 This must match the zone class if it is 14327 specified. 14328 </para> 14329 <para><command>class</command> 14330 and <command>ttl</command> can be 14331 entered in either order. 14332 </para> 14333 </entry> 14334 </row> 14335 <row rowsep="0"> 14336 <entry colname="1"> 14337 <para><command>type</command></para> 14338 </entry> 14339 <entry colname="2"> 14340 <para> 14341 Any valid type. 14342 </para> 14343 </entry> 14344 </row> 14345 <row rowsep="0"> 14346 <entry colname="1"> 14347 <para><command>rhs</command></para> 14348 </entry> 14349 <entry colname="2"> 14350 <para> 14351 <command>rhs</command>, optionally, quoted string. 14352 </para> 14353 </entry> 14354 </row> 14355 </tbody> 14356 </tgroup> 14357 </informaltable> 14358 <para> 14359 The <command>$GENERATE</command> directive is a <acronym>BIND</acronym> extension 14360 and not part of the standard zone file format. 14361 </para> 14362 <para> 14363 BIND 8 does not support the optional TTL and CLASS fields. 14364 </para> 14365 </sect2> 14366 14367 <sect2 id="zonefile_format"> 14368 <title>Additional File Formats</title> 14369 <para> 14370 In addition to the standard textual format, BIND 9 14371 supports the ability to read or dump to zone files in 14372 other formats. 14373 </para> 14374 <para> 14375 The <constant>raw</constant> format is 14376 a binary representation of zone data in a manner similar 14377 to that used in zone transfers. Since it does not require 14378 parsing text, load time is significantly reduced. 14379 </para> 14380 <para> 14381 An even faster alternative is the <constant>map</constant> 14382 format, which is an image of a <acronym>BIND</acronym> 9 14383 in-memory zone database; it is capable of being loaded 14384 directly into memory via the <command>mmap()</command> 14385 function; the zone can begin serving queries almost 14386 immediately. 14387 </para> 14388 <para> 14389 For a primary server, a zone file in 14390 <constant>raw</constant> or <constant>map</constant> 14391 format is expected to be generated from a textual zone 14392 file by the <command>named-compilezone</command> command. 14393 For a secondary server or for a dynamic zone, it is automatically 14394 generated (if this format is specified by the 14395 <command>masterfile-format</command> option) when 14396 <command>named</command> dumps the zone contents after 14397 zone transfer or when applying prior updates. 14398 </para> 14399 <para> 14400 If a zone file in a binary format needs manual modification, 14401 it first must be converted to a textual form by the 14402 <command>named-compilezone</command> command. All 14403 necessary modification should go to the text file, which 14404 should then be converted to the binary form by the 14405 <command>named-compilezone</command> command again. 14406 </para> 14407 <para> 14408 Note that <command>map</command> format is extremely 14409 architecture-specific. A <constant>map</constant> 14410 file <emphasis>cannot</emphasis> be used on a system 14411 with different pointer size, endianness or data alignment 14412 than the system on which it was generated, and should in 14413 general be used only inside a single system. 14414 While <constant>raw</constant> format uses 14415 network byte order and avoids architecture-dependent 14416 data alignment so that it is as portable as 14417 possible, it is also primarily expected to be used 14418 inside the same single system. To export a 14419 zone file in either <constant>raw</constant> or 14420 <constant>map</constant> format, or make a 14421 portable backup of such a file, conversion to 14422 <constant>text</constant> format is recommended. 14423 </para> 14424 </sect2> 14425 </sect1> 14426 14427 <sect1 id="statistics"> 14428 <title>BIND9 Statistics</title> 14429 <para> 14430 <acronym>BIND</acronym> 9 maintains lots of statistics 14431 information and provides several interfaces for users to 14432 get access to the statistics. 14433 The available statistics include all statistics counters 14434 that were available in <acronym>BIND</acronym> 8 and 14435 are meaningful in <acronym>BIND</acronym> 9, 14436 and other information that is considered useful. 14437 </para> 14438 14439 <para> 14440 The statistics information is categorized into the following 14441 sections. 14442 </para> 14443 14444 <informaltable frame="all"> 14445 <tgroup cols="2"> 14446 <colspec colname="1" colnum="1" colsep="0" colwidth="3.300in"/> 14447 <colspec colname="2" colnum="2" colsep="0" colwidth="2.625in"/> 14448 <tbody> 14449 14450 <row rowsep="0"> 14451 <entry colname="1"> 14452 <para>Incoming Requests</para> 14453 </entry> 14454 <entry colname="2"> 14455 <para> 14456 The number of incoming DNS requests for each OPCODE. 14457 </para> 14458 </entry> 14459 </row> 14460 14461 <row rowsep="0"> 14462 <entry colname="1"> 14463 <para>Incoming Queries</para> 14464 </entry> 14465 <entry colname="2"> 14466 <para> 14467 The number of incoming queries for each RR type. 14468 </para> 14469 </entry> 14470 </row> 14471 14472 <row rowsep="0"> 14473 <entry colname="1"> 14474 <para>Outgoing Queries</para> 14475 </entry> 14476 <entry colname="2"> 14477 <para> 14478 The number of outgoing queries for each RR 14479 type sent from the internal resolver. 14480 Maintained per view. 14481 </para> 14482 </entry> 14483 </row> 14484 14485 <row rowsep="0"> 14486 <entry colname="1"> 14487 <para>Name Server Statistics</para> 14488 </entry> 14489 <entry colname="2"> 14490 <para> 14491 Statistics counters about incoming request processing. 14492 </para> 14493 </entry> 14494 </row> 14495 14496 <row rowsep="0"> 14497 <entry colname="1"> 14498 <para>Zone Maintenance Statistics</para> 14499 </entry> 14500 <entry colname="2"> 14501 <para> 14502 Statistics counters regarding zone maintenance 14503 operations such as zone transfers. 14504 </para> 14505 </entry> 14506 </row> 14507 14508 <row rowsep="0"> 14509 <entry colname="1"> 14510 <para>Resolver Statistics</para> 14511 </entry> 14512 <entry colname="2"> 14513 <para> 14514 Statistics counters about name resolution 14515 performed in the internal resolver. 14516 Maintained per view. 14517 </para> 14518 </entry> 14519 </row> 14520 14521 <row rowsep="0"> 14522 <entry colname="1"> 14523 <para>Cache DB RRsets</para> 14524 </entry> 14525 <entry colname="2"> 14526 <para> 14527 The number of RRsets per RR type and nonexistent 14528 names stored in the cache database. 14529 If the exclamation mark (!) is printed for a RR 14530 type, it means that particular type of RRset is 14531 known to be nonexistent (this is also known as 14532 "NXRRSET"). If a hash mark (#) is present then 14533 the RRset is marked for garbage collection. 14534 Maintained per view. 14535 </para> 14536 </entry> 14537 </row> 14538 14539 <row rowsep="0"> 14540 <entry colname="1"> 14541 <para>Socket I/O Statistics</para> 14542 </entry> 14543 <entry colname="2"> 14544 <para> 14545 Statistics counters about network related events. 14546 </para> 14547 </entry> 14548 </row> 14549 14550 </tbody> 14551 </tgroup> 14552 </informaltable> 14553 14554 <para> 14555 A subset of Name Server Statistics is collected and shown 14556 per zone for which the server has the authority when 14557 <command>zone-statistics</command> is set to 14558 <userinput>yes</userinput>. 14559 These statistics counters are shown with their zone and view 14560 names. 14561 In some cases the view names are omitted for the default view. 14562 </para> 14563 14564 <para> 14565 There are currently two user interfaces to get access to the 14566 statistics. 14567 One is in the plain text format dumped to the file specified 14568 by the <command>statistics-file</command> configuration option. 14569 The other is remotely accessible via a statistics channel 14570 when the <command>statistics-channels</command> statement 14571 is specified in the configuration file 14572 (see <xref linkend="statschannels"/>.) 14573 </para> 14574 14575 <sect3 id="statsfile"> 14576 <title>The Statistics File</title> 14577 <para> 14578 The text format statistics dump begins with a line, like: 14579 </para> 14580 <para> 14581 <command>+++ Statistics Dump +++ (973798949)</command> 14582 </para> 14583 <para> 14584 The number in parentheses is a standard 14585 Unix-style timestamp, measured as seconds since January 1, 1970. 14586 14587 Following 14588 that line is a set of statistics information, which is categorized 14589 as described above. 14590 Each section begins with a line, like: 14591 </para> 14592 14593 <para> 14594 <command>++ Name Server Statistics ++</command> 14595 </para> 14596 14597 <para> 14598 Each section consists of lines, each containing the statistics 14599 counter value followed by its textual description. 14600 See below for available counters. 14601 For brevity, counters that have a value of 0 are not shown 14602 in the statistics file. 14603 </para> 14604 14605 <para> 14606 The statistics dump ends with the line where the 14607 number is identical to the number in the beginning line; for example: 14608 </para> 14609 <para> 14610 <command>--- Statistics Dump --- (973798949)</command> 14611 </para> 14612 </sect3> 14613 14614 <sect2 id="statistics_counters"> 14615 <title>Statistics Counters</title> 14616 <para> 14617 The following tables summarize statistics counters that 14618 <acronym>BIND</acronym> 9 provides. 14619 For each row of the tables, the leftmost column is the 14620 abbreviated symbol name of that counter. 14621 These symbols are shown in the statistics information 14622 accessed via an HTTP statistics channel. 14623 The rightmost column gives the description of the counter, 14624 which is also shown in the statistics file 14625 (but, in this document, possibly with slight modification 14626 for better readability). 14627 Additional notes may also be provided in this column. 14628 When a middle column exists between these two columns, 14629 it gives the corresponding counter name of the 14630 <acronym>BIND</acronym> 8 statistics, if applicable. 14631 </para> 14632 14633 <sect3> 14634 <title>Name Server Statistics Counters</title> 14635 14636 <informaltable colsep="0" rowsep="0"> 14637 <tgroup cols="3" colsep="0" rowsep="0" tgroupstyle="4Level-table"> 14638 <colspec colname="1" colnum="1" colsep="0" colwidth="1.150in"/> 14639 <colspec colname="2" colnum="2" colsep="0" colwidth="1.150in"/> 14640 <colspec colname="3" colnum="3" colsep="0" colwidth="3.350in"/> 14641 <tbody> 14642 <row> 14643 <entry colname="1"> 14644 <para> 14645 <emphasis>Symbol</emphasis> 14646 </para> 14647 </entry> 14648 <entry colname="2"> 14649 <para> 14650 <emphasis>BIND8 Symbol</emphasis> 14651 </para> 14652 </entry> 14653 <entry colname="3"> 14654 <para> 14655 <emphasis>Description</emphasis> 14656 </para> 14657 </entry> 14658 </row> 14659 14660 <row rowsep="0"> 14661 <entry colname="1"> 14662 <para><command>Requestv4</command></para> 14663 </entry> 14664 <entry colname="2"> 14665 <para><command>RQ</command></para> 14666 </entry> 14667 <entry colname="3"> 14668 <para> 14669 IPv4 requests received. 14670 Note: this also counts non query requests. 14671 </para> 14672 </entry> 14673 </row> 14674 <row rowsep="0"> 14675 <entry colname="1"> 14676 <para><command>Requestv6</command></para> 14677 </entry> 14678 <entry colname="2"> 14679 <para><command>RQ</command></para> 14680 </entry> 14681 <entry colname="3"> 14682 <para> 14683 IPv6 requests received. 14684 Note: this also counts non query requests. 14685 </para> 14686 </entry> 14687 </row> 14688 <row rowsep="0"> 14689 <entry colname="1"> 14690 <para><command>ReqEdns0</command></para> 14691 </entry> 14692 <entry colname="2"> 14693 <para><command></command></para> 14694 </entry> 14695 <entry colname="3"> 14696 <para> 14697 Requests with EDNS(0) received. 14698 </para> 14699 </entry> 14700 </row> 14701 <row rowsep="0"> 14702 <entry colname="1"> 14703 <para><command>ReqBadEDNSVer</command></para> 14704 </entry> 14705 <entry colname="2"> 14706 <para><command></command></para> 14707 </entry> 14708 <entry colname="3"> 14709 <para> 14710 Requests with unsupported EDNS version received. 14711 </para> 14712 </entry> 14713 </row> 14714 <row rowsep="0"> 14715 <entry colname="1"> 14716 <para><command>ReqTSIG</command></para> 14717 </entry> 14718 <entry colname="2"> 14719 <para><command></command></para> 14720 </entry> 14721 <entry colname="3"> 14722 <para> 14723 Requests with TSIG received. 14724 </para> 14725 </entry> 14726 </row> 14727 <row rowsep="0"> 14728 <entry colname="1"> 14729 <para><command>ReqSIG0</command></para> 14730 </entry> 14731 <entry colname="2"> 14732 <para><command></command></para> 14733 </entry> 14734 <entry colname="3"> 14735 <para> 14736 Requests with SIG(0) received. 14737 </para> 14738 </entry> 14739 </row> 14740 <row rowsep="0"> 14741 <entry colname="1"> 14742 <para><command>ReqBadSIG</command></para> 14743 </entry> 14744 <entry colname="2"> 14745 <para><command></command></para> 14746 </entry> 14747 <entry colname="3"> 14748 <para> 14749 Requests with invalid (TSIG or SIG(0)) signature. 14750 </para> 14751 </entry> 14752 </row> 14753 <row rowsep="0"> 14754 <entry colname="1"> 14755 <para><command>ReqTCP</command></para> 14756 </entry> 14757 <entry colname="2"> 14758 <para><command>RTCP</command></para> 14759 </entry> 14760 <entry colname="3"> 14761 <para> 14762 TCP requests received. 14763 </para> 14764 </entry> 14765 </row> 14766 <row rowsep="0"> 14767 <entry colname="1"> 14768 <para><command>AuthQryRej</command></para> 14769 </entry> 14770 <entry colname="2"> 14771 <para><command>RUQ</command></para> 14772 </entry> 14773 <entry colname="3"> 14774 <para> 14775 Authoritative (non recursive) queries rejected. 14776 </para> 14777 </entry> 14778 </row> 14779 <row rowsep="0"> 14780 <entry colname="1"> 14781 <para><command>RecQryRej</command></para> 14782 </entry> 14783 <entry colname="2"> 14784 <para><command>RURQ</command></para> 14785 </entry> 14786 <entry colname="3"> 14787 <para> 14788 Recursive queries rejected. 14789 </para> 14790 </entry> 14791 </row> 14792 <row rowsep="0"> 14793 <entry colname="1"> 14794 <para><command>XfrRej</command></para> 14795 </entry> 14796 <entry colname="2"> 14797 <para><command>RUXFR</command></para> 14798 </entry> 14799 <entry colname="3"> 14800 <para> 14801 Zone transfer requests rejected. 14802 </para> 14803 </entry> 14804 </row> 14805 <row rowsep="0"> 14806 <entry colname="1"> 14807 <para><command>UpdateRej</command></para> 14808 </entry> 14809 <entry colname="2"> 14810 <para><command>RUUpd</command></para> 14811 </entry> 14812 <entry colname="3"> 14813 <para> 14814 Dynamic update requests rejected. 14815 </para> 14816 </entry> 14817 </row> 14818 <row rowsep="0"> 14819 <entry colname="1"> 14820 <para><command>Response</command></para> 14821 </entry> 14822 <entry colname="2"> 14823 <para><command>SAns</command></para> 14824 </entry> 14825 <entry colname="3"> 14826 <para> 14827 Responses sent. 14828 </para> 14829 </entry> 14830 </row> 14831 <row rowsep="0"> 14832 <entry colname="1"> 14833 <para><command>RespTruncated</command></para> 14834 </entry> 14835 <entry colname="2"> 14836 <para><command></command></para> 14837 </entry> 14838 <entry colname="3"> 14839 <para> 14840 Truncated responses sent. 14841 </para> 14842 </entry> 14843 </row> 14844 <row rowsep="0"> 14845 <entry colname="1"> 14846 <para><command>RespEDNS0</command></para> 14847 </entry> 14848 <entry colname="2"> 14849 <para><command></command></para> 14850 </entry> 14851 <entry colname="3"> 14852 <para> 14853 Responses with EDNS(0) sent. 14854 </para> 14855 </entry> 14856 </row> 14857 <row rowsep="0"> 14858 <entry colname="1"> 14859 <para><command>RespTSIG</command></para> 14860 </entry> 14861 <entry colname="2"> 14862 <para><command></command></para> 14863 </entry> 14864 <entry colname="3"> 14865 <para> 14866 Responses with TSIG sent. 14867 </para> 14868 </entry> 14869 </row> 14870 <row rowsep="0"> 14871 <entry colname="1"> 14872 <para><command>RespSIG0</command></para> 14873 </entry> 14874 <entry colname="2"> 14875 <para><command></command></para> 14876 </entry> 14877 <entry colname="3"> 14878 <para> 14879 Responses with SIG(0) sent. 14880 </para> 14881 </entry> 14882 </row> 14883 <row rowsep="0"> 14884 <entry colname="1"> 14885 <para><command>QrySuccess</command></para> 14886 </entry> 14887 <entry colname="2"> 14888 <para><command></command></para> 14889 </entry> 14890 <entry colname="3"> 14891 <para> 14892 Queries resulted in a successful answer. 14893 This means the query which returns a NOERROR response 14894 with at least one answer RR. 14895 This corresponds to the 14896 <command>success</command> counter 14897 of previous versions of 14898 <acronym>BIND</acronym> 9. 14899 </para> 14900 </entry> 14901 </row> 14902 <row rowsep="0"> 14903 <entry colname="1"> 14904 <para><command>QryAuthAns</command></para> 14905 </entry> 14906 <entry colname="2"> 14907 <para><command></command></para> 14908 </entry> 14909 <entry colname="3"> 14910 <para> 14911 Queries resulted in authoritative answer. 14912 </para> 14913 </entry> 14914 </row> 14915 <row rowsep="0"> 14916 <entry colname="1"> 14917 <para><command>QryNoauthAns</command></para> 14918 </entry> 14919 <entry colname="2"> 14920 <para><command>SNaAns</command></para> 14921 </entry> 14922 <entry colname="3"> 14923 <para> 14924 Queries resulted in non authoritative answer. 14925 </para> 14926 </entry> 14927 </row> 14928 <row rowsep="0"> 14929 <entry colname="1"> 14930 <para><command>QryReferral</command></para> 14931 </entry> 14932 <entry colname="2"> 14933 <para><command></command></para> 14934 </entry> 14935 <entry colname="3"> 14936 <para> 14937 Queries resulted in referral answer. 14938 This corresponds to the 14939 <command>referral</command> counter 14940 of previous versions of 14941 <acronym>BIND</acronym> 9. 14942 </para> 14943 </entry> 14944 </row> 14945 <row rowsep="0"> 14946 <entry colname="1"> 14947 <para><command>QryNxrrset</command></para> 14948 </entry> 14949 <entry colname="2"> 14950 <para><command></command></para> 14951 </entry> 14952 <entry colname="3"> 14953 <para> 14954 Queries resulted in NOERROR responses with no data. 14955 This corresponds to the 14956 <command>nxrrset</command> counter 14957 of previous versions of 14958 <acronym>BIND</acronym> 9. 14959 </para> 14960 </entry> 14961 </row> 14962 <row rowsep="0"> 14963 <entry colname="1"> 14964 <para><command>QrySERVFAIL</command></para> 14965 </entry> 14966 <entry colname="2"> 14967 <para><command>SFail</command></para> 14968 </entry> 14969 <entry colname="3"> 14970 <para> 14971 Queries resulted in SERVFAIL. 14972 </para> 14973 </entry> 14974 </row> 14975 <row rowsep="0"> 14976 <entry colname="1"> 14977 <para><command>QryFORMERR</command></para> 14978 </entry> 14979 <entry colname="2"> 14980 <para><command>SFErr</command></para> 14981 </entry> 14982 <entry colname="3"> 14983 <para> 14984 Queries resulted in FORMERR. 14985 </para> 14986 </entry> 14987 </row> 14988 <row rowsep="0"> 14989 <entry colname="1"> 14990 <para><command>QryNXDOMAIN</command></para> 14991 </entry> 14992 <entry colname="2"> 14993 <para><command>SNXD</command></para> 14994 </entry> 14995 <entry colname="3"> 14996 <para> 14997 Queries resulted in NXDOMAIN. 14998 This corresponds to the 14999 <command>nxdomain</command> counter 15000 of previous versions of 15001 <acronym>BIND</acronym> 9. 15002 </para> 15003 </entry> 15004 </row> 15005 <row rowsep="0"> 15006 <entry colname="1"> 15007 <para><command>QryRecursion</command></para> 15008 </entry> 15009 <entry colname="2"> 15010 <para><command>RFwdQ</command></para> 15011 </entry> 15012 <entry colname="3"> 15013 <para> 15014 Queries which caused the server 15015 to perform recursion in order to find the final answer. 15016 This corresponds to the 15017 <command>recursion</command> counter 15018 of previous versions of 15019 <acronym>BIND</acronym> 9. 15020 </para> 15021 </entry> 15022 </row> 15023 <row rowsep="0"> 15024 <entry colname="1"> 15025 <para><command>QryDuplicate</command></para> 15026 </entry> 15027 <entry colname="2"> 15028 <para><command>RDupQ</command></para> 15029 </entry> 15030 <entry colname="3"> 15031 <para> 15032 Queries which the server attempted to 15033 recurse but discovered an existing query with the same 15034 IP address, port, query ID, name, type and class 15035 already being processed. 15036 This corresponds to the 15037 <command>duplicate</command> counter 15038 of previous versions of 15039 <acronym>BIND</acronym> 9. 15040 </para> 15041 </entry> 15042 </row> 15043 <row rowsep="0"> 15044 <entry colname="1"> 15045 <para><command>QryDropped</command></para> 15046 </entry> 15047 <entry colname="2"> 15048 <para><command></command></para> 15049 </entry> 15050 <entry colname="3"> 15051 <para> 15052 Recursive queries for which the server 15053 discovered an excessive number of existing 15054 recursive queries for the same name, type and 15055 class and were subsequently dropped. 15056 This is the number of dropped queries due to 15057 the reason explained with the 15058 <command>clients-per-query</command> 15059 and 15060 <command>max-clients-per-query</command> 15061 options 15062 (see the description about 15063 <xref linkend="clients-per-query"/>.) 15064 This corresponds to the 15065 <command>dropped</command> counter 15066 of previous versions of 15067 <acronym>BIND</acronym> 9. 15068 </para> 15069 </entry> 15070 </row> 15071 <row rowsep="0"> 15072 <entry colname="1"> 15073 <para><command>QryFailure</command></para> 15074 </entry> 15075 <entry colname="2"> 15076 <para><command></command></para> 15077 </entry> 15078 <entry colname="3"> 15079 <para> 15080 Other query failures. 15081 This corresponds to the 15082 <command>failure</command> counter 15083 of previous versions of 15084 <acronym>BIND</acronym> 9. 15085 Note: this counter is provided mainly for 15086 backward compatibility with the previous versions. 15087 Normally a more fine-grained counters such as 15088 <command>AuthQryRej</command> and 15089 <command>RecQryRej</command> 15090 that would also fall into this counter are provided, 15091 and so this counter would not be of much 15092 interest in practice. 15093 </para> 15094 </entry> 15095 </row> 15096 <row rowsep="0"> 15097 <entry colname="1"> 15098 <para><command>XfrReqDone</command></para> 15099 </entry> 15100 <entry colname="2"> 15101 <para><command></command></para> 15102 </entry> 15103 <entry colname="3"> 15104 <para> 15105 Requested zone transfers completed. 15106 </para> 15107 </entry> 15108 </row> 15109 <row rowsep="0"> 15110 <entry colname="1"> 15111 <para><command>UpdateReqFwd</command></para> 15112 </entry> 15113 <entry colname="2"> 15114 <para><command></command></para> 15115 </entry> 15116 <entry colname="3"> 15117 <para> 15118 Update requests forwarded. 15119 </para> 15120 </entry> 15121 </row> 15122 <row rowsep="0"> 15123 <entry colname="1"> 15124 <para><command>UpdateRespFwd</command></para> 15125 </entry> 15126 <entry colname="2"> 15127 <para><command></command></para> 15128 </entry> 15129 <entry colname="3"> 15130 <para> 15131 Update responses forwarded. 15132 </para> 15133 </entry> 15134 </row> 15135 <row rowsep="0"> 15136 <entry colname="1"> 15137 <para><command>UpdateFwdFail</command></para> 15138 </entry> 15139 <entry colname="2"> 15140 <para><command></command></para> 15141 </entry> 15142 <entry colname="3"> 15143 <para> 15144 Dynamic update forward failed. 15145 </para> 15146 </entry> 15147 </row> 15148 <row rowsep="0"> 15149 <entry colname="1"> 15150 <para><command>UpdateDone</command></para> 15151 </entry> 15152 <entry colname="2"> 15153 <para><command></command></para> 15154 </entry> 15155 <entry colname="3"> 15156 <para> 15157 Dynamic updates completed. 15158 </para> 15159 </entry> 15160 </row> 15161 <row rowsep="0"> 15162 <entry colname="1"> 15163 <para><command>UpdateFail</command></para> 15164 </entry> 15165 <entry colname="2"> 15166 <para><command></command></para> 15167 </entry> 15168 <entry colname="3"> 15169 <para> 15170 Dynamic updates failed. 15171 </para> 15172 </entry> 15173 </row> 15174 <row rowsep="0"> 15175 <entry colname="1"> 15176 <para><command>UpdateBadPrereq</command></para> 15177 </entry> 15178 <entry colname="2"> 15179 <para><command></command></para> 15180 </entry> 15181 <entry colname="3"> 15182 <para> 15183 Dynamic updates rejected due to prerequisite failure. 15184 </para> 15185 </entry> 15186 </row> 15187 <row rowsep="0"> 15188 <entry colname="1"> 15189 <para><command>RateDropped</command></para> 15190 </entry> 15191 <entry colname="2"> 15192 <para><command></command></para> 15193 </entry> 15194 <entry colname="3"> 15195 <para> 15196 Responses dropped by rate limits. 15197 </para> 15198 </entry> 15199 </row> 15200 <row rowsep="0"> 15201 <entry colname="1"> 15202 <para><command>RateSlipped</command></para> 15203 </entry> 15204 <entry colname="2"> 15205 <para><command></command></para> 15206 </entry> 15207 <entry colname="3"> 15208 <para> 15209 Responses truncated by rate limits. 15210 </para> 15211 </entry> 15212 </row> 15213 <row rowsep="0"> 15214 <entry colname="1"> 15215 <para><command>RPZRewrites</command></para> 15216 </entry> 15217 <entry colname="2"> 15218 <para><command></command></para> 15219 </entry> 15220 <entry colname="3"> 15221 <para> 15222 Response policy zone rewrites. 15223 </para> 15224 </entry> 15225 </row> 15226 </tbody> 15227 </tgroup> 15228 </informaltable> 15229 </sect3> 15230 15231 <sect3> 15232 <title>Zone Maintenance Statistics Counters</title> 15233 15234 <informaltable colsep="0" rowsep="0"> 15235 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="4Level-table"> 15236 <colspec colname="1" colnum="1" colsep="0" colwidth="1.150in"/> 15237 <colspec colname="2" colnum="2" colsep="0" colwidth="3.350in"/> 15238 <tbody> 15239 <row> 15240 <entry colname="1"> 15241 <para> 15242 <emphasis>Symbol</emphasis> 15243 </para> 15244 </entry> 15245 <entry colname="2"> 15246 <para> 15247 <emphasis>Description</emphasis> 15248 </para> 15249 </entry> 15250 </row> 15251 15252 <row rowsep="0"> 15253 <entry colname="1"> 15254 <para><command>NotifyOutv4</command></para> 15255 </entry> 15256 <entry colname="2"> 15257 <para> 15258 IPv4 notifies sent. 15259 </para> 15260 </entry> 15261 </row> 15262 <row rowsep="0"> 15263 <entry colname="1"> 15264 <para><command>NotifyOutv6</command></para> 15265 </entry> 15266 <entry colname="2"> 15267 <para> 15268 IPv6 notifies sent. 15269 </para> 15270 </entry> 15271 </row> 15272 <row rowsep="0"> 15273 <entry colname="1"> 15274 <para><command>NotifyInv4</command></para> 15275 </entry> 15276 <entry colname="2"> 15277 <para> 15278 IPv4 notifies received. 15279 </para> 15280 </entry> 15281 </row> 15282 <row rowsep="0"> 15283 <entry colname="1"> 15284 <para><command>NotifyInv6</command></para> 15285 </entry> 15286 <entry colname="2"> 15287 <para> 15288 IPv6 notifies received. 15289 </para> 15290 </entry> 15291 </row> 15292 <row rowsep="0"> 15293 <entry colname="1"> 15294 <para><command>NotifyRej</command></para> 15295 </entry> 15296 <entry colname="2"> 15297 <para> 15298 Incoming notifies rejected. 15299 </para> 15300 </entry> 15301 </row> 15302 <row rowsep="0"> 15303 <entry colname="1"> 15304 <para><command>SOAOutv4</command></para> 15305 </entry> 15306 <entry colname="2"> 15307 <para> 15308 IPv4 SOA queries sent. 15309 </para> 15310 </entry> 15311 </row> 15312 <row rowsep="0"> 15313 <entry colname="1"> 15314 <para><command>SOAOutv6</command></para> 15315 </entry> 15316 <entry colname="2"> 15317 <para> 15318 IPv6 SOA queries sent. 15319 </para> 15320 </entry> 15321 </row> 15322 <row rowsep="0"> 15323 <entry colname="1"> 15324 <para><command>AXFRReqv4</command></para> 15325 </entry> 15326 <entry colname="2"> 15327 <para> 15328 IPv4 AXFR requested. 15329 </para> 15330 </entry> 15331 </row> 15332 <row rowsep="0"> 15333 <entry colname="1"> 15334 <para><command>AXFRReqv6</command></para> 15335 </entry> 15336 <entry colname="2"> 15337 <para> 15338 IPv6 AXFR requested. 15339 </para> 15340 </entry> 15341 </row> 15342 <row rowsep="0"> 15343 <entry colname="1"> 15344 <para><command>IXFRReqv4</command></para> 15345 </entry> 15346 <entry colname="2"> 15347 <para> 15348 IPv4 IXFR requested. 15349 </para> 15350 </entry> 15351 </row> 15352 <row rowsep="0"> 15353 <entry colname="1"> 15354 <para><command>IXFRReqv6</command></para> 15355 </entry> 15356 <entry colname="2"> 15357 <para> 15358 IPv6 IXFR requested. 15359 </para> 15360 </entry> 15361 </row> 15362 <row rowsep="0"> 15363 <entry colname="1"> 15364 <para><command>XfrSuccess</command></para> 15365 </entry> 15366 <entry colname="2"> 15367 <para> 15368 Zone transfer requests succeeded. 15369 </para> 15370 </entry> 15371 </row> 15372 <row rowsep="0"> 15373 <entry colname="1"> 15374 <para><command>XfrFail</command></para> 15375 </entry> 15376 <entry colname="2"> 15377 <para> 15378 Zone transfer requests failed. 15379 </para> 15380 </entry> 15381 </row> 15382 </tbody> 15383 </tgroup> 15384 </informaltable> 15385 </sect3> 15386 15387 <sect3> 15388 <title>Resolver Statistics Counters</title> 15389 15390 <informaltable colsep="0" rowsep="0"> 15391 <tgroup cols="3" colsep="0" rowsep="0" tgroupstyle="4Level-table"> 15392 <colspec colname="1" colnum="1" colsep="0" colwidth="1.150in"/> 15393 <colspec colname="2" colnum="2" colsep="0" colwidth="1.150in"/> 15394 <colspec colname="3" colnum="3" colsep="0" colwidth="3.350in"/> 15395 <tbody> 15396 <row> 15397 <entry colname="1"> 15398 <para> 15399 <emphasis>Symbol</emphasis> 15400 </para> 15401 </entry> 15402 <entry colname="2"> 15403 <para> 15404 <emphasis>BIND8 Symbol</emphasis> 15405 </para> 15406 </entry> 15407 <entry colname="3"> 15408 <para> 15409 <emphasis>Description</emphasis> 15410 </para> 15411 </entry> 15412 </row> 15413 15414 <row rowsep="0"> 15415 <entry colname="1"> 15416 <para><command>Queryv4</command></para> 15417 </entry> 15418 <entry colname="2"> 15419 <para><command>SFwdQ</command></para> 15420 </entry> 15421 <entry colname="3"> 15422 <para> 15423 IPv4 queries sent. 15424 </para> 15425 </entry> 15426 </row> 15427 <row rowsep="0"> 15428 <entry colname="1"> 15429 <para><command>Queryv6</command></para> 15430 </entry> 15431 <entry colname="2"> 15432 <para><command>SFwdQ</command></para> 15433 </entry> 15434 <entry colname="3"> 15435 <para> 15436 IPv6 queries sent. 15437 </para> 15438 </entry> 15439 </row> 15440 <row rowsep="0"> 15441 <entry colname="1"> 15442 <para><command>Responsev4</command></para> 15443 </entry> 15444 <entry colname="2"> 15445 <para><command>RR</command></para> 15446 </entry> 15447 <entry colname="3"> 15448 <para> 15449 IPv4 responses received. 15450 </para> 15451 </entry> 15452 </row> 15453 <row rowsep="0"> 15454 <entry colname="1"> 15455 <para><command>Responsev6</command></para> 15456 </entry> 15457 <entry colname="2"> 15458 <para><command>RR</command></para> 15459 </entry> 15460 <entry colname="3"> 15461 <para> 15462 IPv6 responses received. 15463 </para> 15464 </entry> 15465 </row> 15466 <row rowsep="0"> 15467 <entry colname="1"> 15468 <para><command>NXDOMAIN</command></para> 15469 </entry> 15470 <entry colname="2"> 15471 <para><command>RNXD</command></para> 15472 </entry> 15473 <entry colname="3"> 15474 <para> 15475 NXDOMAIN received. 15476 </para> 15477 </entry> 15478 </row> 15479 <row rowsep="0"> 15480 <entry colname="1"> 15481 <para><command>SERVFAIL</command></para> 15482 </entry> 15483 <entry colname="2"> 15484 <para><command>RFail</command></para> 15485 </entry> 15486 <entry colname="3"> 15487 <para> 15488 SERVFAIL received. 15489 </para> 15490 </entry> 15491 </row> 15492 <row rowsep="0"> 15493 <entry colname="1"> 15494 <para><command>FORMERR</command></para> 15495 </entry> 15496 <entry colname="2"> 15497 <para><command>RFErr</command></para> 15498 </entry> 15499 <entry colname="3"> 15500 <para> 15501 FORMERR received. 15502 </para> 15503 </entry> 15504 </row> 15505 <row rowsep="0"> 15506 <entry colname="1"> 15507 <para><command>OtherError</command></para> 15508 </entry> 15509 <entry colname="2"> 15510 <para><command>RErr</command></para> 15511 </entry> 15512 <entry colname="3"> 15513 <para> 15514 Other errors received. 15515 </para> 15516 </entry> 15517 </row> 15518 <row rowsep="0"> 15519 <entry colname="1"> 15520 <para><command>EDNS0Fail</command></para> 15521 </entry> 15522 <entry colname="2"> 15523 <para><command></command></para> 15524 </entry> 15525 <entry colname="3"> 15526 <para> 15527 EDNS(0) query failures. 15528 </para> 15529 </entry> 15530 </row> 15531 <row rowsep="0"> 15532 <entry colname="1"> 15533 <para><command>Mismatch</command></para> 15534 </entry> 15535 <entry colname="2"> 15536 <para><command>RDupR</command></para> 15537 </entry> 15538 <entry colname="3"> 15539 <para> 15540 Mismatch responses received. 15541 The DNS ID, response's source address, 15542 and/or the response's source port does not 15543 match what was expected. 15544 (The port must be 53 or as defined by 15545 the <command>port</command> option.) 15546 This may be an indication of a cache 15547 poisoning attempt. 15548 </para> 15549 </entry> 15550 </row> 15551 <row rowsep="0"> 15552 <entry colname="1"> 15553 <para><command>Truncated</command></para> 15554 </entry> 15555 <entry colname="2"> 15556 <para><command></command></para> 15557 </entry> 15558 <entry colname="3"> 15559 <para> 15560 Truncated responses received. 15561 </para> 15562 </entry> 15563 </row> 15564 <row rowsep="0"> 15565 <entry colname="1"> 15566 <para><command>Lame</command></para> 15567 </entry> 15568 <entry colname="2"> 15569 <para><command>RLame</command></para> 15570 </entry> 15571 <entry colname="3"> 15572 <para> 15573 Lame delegations received. 15574 </para> 15575 </entry> 15576 </row> 15577 <row rowsep="0"> 15578 <entry colname="1"> 15579 <para><command>Retry</command></para> 15580 </entry> 15581 <entry colname="2"> 15582 <para><command>SDupQ</command></para> 15583 </entry> 15584 <entry colname="3"> 15585 <para> 15586 Query retries performed. 15587 </para> 15588 </entry> 15589 </row> 15590 <row rowsep="0"> 15591 <entry colname="1"> 15592 <para><command>QueryAbort</command></para> 15593 </entry> 15594 <entry colname="2"> 15595 <para><command></command></para> 15596 </entry> 15597 <entry colname="3"> 15598 <para> 15599 Queries aborted due to quota control. 15600 </para> 15601 </entry> 15602 </row> 15603 <row rowsep="0"> 15604 <entry colname="1"> 15605 <para><command>QuerySockFail</command></para> 15606 </entry> 15607 <entry colname="2"> 15608 <para><command></command></para> 15609 </entry> 15610 <entry colname="3"> 15611 <para> 15612 Failures in opening query sockets. 15613 One common reason for such failures is a 15614 failure of opening a new socket due to a 15615 limitation on file descriptors. 15616 </para> 15617 </entry> 15618 </row> 15619 <row rowsep="0"> 15620 <entry colname="1"> 15621 <para><command>QueryTimeout</command></para> 15622 </entry> 15623 <entry colname="2"> 15624 <para><command></command></para> 15625 </entry> 15626 <entry colname="3"> 15627 <para> 15628 Query timeouts. 15629 </para> 15630 </entry> 15631 </row> 15632 <row rowsep="0"> 15633 <entry colname="1"> 15634 <para><command>GlueFetchv4</command></para> 15635 </entry> 15636 <entry colname="2"> 15637 <para><command>SSysQ</command></para> 15638 </entry> 15639 <entry colname="3"> 15640 <para> 15641 IPv4 NS address fetches invoked. 15642 </para> 15643 </entry> 15644 </row> 15645 <row rowsep="0"> 15646 <entry colname="1"> 15647 <para><command>GlueFetchv6</command></para> 15648 </entry> 15649 <entry colname="2"> 15650 <para><command>SSysQ</command></para> 15651 </entry> 15652 <entry colname="3"> 15653 <para> 15654 IPv6 NS address fetches invoked. 15655 </para> 15656 </entry> 15657 </row> 15658 <row rowsep="0"> 15659 <entry colname="1"> 15660 <para><command>GlueFetchv4Fail</command></para> 15661 </entry> 15662 <entry colname="2"> 15663 <para><command></command></para> 15664 </entry> 15665 <entry colname="3"> 15666 <para> 15667 IPv4 NS address fetch failed. 15668 </para> 15669 </entry> 15670 </row> 15671 <row rowsep="0"> 15672 <entry colname="1"> 15673 <para><command>GlueFetchv6Fail</command></para> 15674 </entry> 15675 <entry colname="2"> 15676 <para><command></command></para> 15677 </entry> 15678 <entry colname="3"> 15679 <para> 15680 IPv6 NS address fetch failed. 15681 </para> 15682 </entry> 15683 </row> 15684 <row rowsep="0"> 15685 <entry colname="1"> 15686 <para><command>ValAttempt</command></para> 15687 </entry> 15688 <entry colname="2"> 15689 <para><command></command></para> 15690 </entry> 15691 <entry colname="3"> 15692 <para> 15693 DNSSEC validation attempted. 15694 </para> 15695 </entry> 15696 </row> 15697 <row rowsep="0"> 15698 <entry colname="1"> 15699 <para><command>ValOk</command></para> 15700 </entry> 15701 <entry colname="2"> 15702 <para><command></command></para> 15703 </entry> 15704 <entry colname="3"> 15705 <para> 15706 DNSSEC validation succeeded. 15707 </para> 15708 </entry> 15709 </row> 15710 <row rowsep="0"> 15711 <entry colname="1"> 15712 <para><command>ValNegOk</command></para> 15713 </entry> 15714 <entry colname="2"> 15715 <para><command></command></para> 15716 </entry> 15717 <entry colname="3"> 15718 <para> 15719 DNSSEC validation on negative information succeeded. 15720 </para> 15721 </entry> 15722 </row> 15723 <row rowsep="0"> 15724 <entry colname="1"> 15725 <para><command>ValFail</command></para> 15726 </entry> 15727 <entry colname="2"> 15728 <para><command></command></para> 15729 </entry> 15730 <entry colname="3"> 15731 <para> 15732 DNSSEC validation failed. 15733 </para> 15734 </entry> 15735 </row> 15736 <row rowsep="0"> 15737 <entry colname="1"> 15738 <para><command>QryRTTnn</command></para> 15739 </entry> 15740 <entry colname="2"> 15741 <para><command></command></para> 15742 </entry> 15743 <entry colname="3"> 15744 <para> 15745 Frequency table on round trip times (RTTs) of 15746 queries. 15747 Each <command>nn</command> specifies the corresponding 15748 frequency. 15749 In the sequence of 15750 <command>nn_1</command>, 15751 <command>nn_2</command>, 15752 ..., 15753 <command>nn_m</command>, 15754 the value of <command>nn_i</command> is the 15755 number of queries whose RTTs are between 15756 <command>nn_(i-1)</command> (inclusive) and 15757 <command>nn_i</command> (exclusive) milliseconds. 15758 For the sake of convenience we define 15759 <command>nn_0</command> to be 0. 15760 The last entry should be represented as 15761 <command>nn_m+</command>, which means the 15762 number of queries whose RTTs are equal to or over 15763 <command>nn_m</command> milliseconds. 15764 </para> 15765 </entry> 15766 </row> 15767 </tbody> 15768 </tgroup> 15769 </informaltable> 15770 15771 </sect3> 15772 15773 <sect3> 15774 <title>Socket I/O Statistics Counters</title> 15775 15776 <para> 15777 Socket I/O statistics counters are defined per socket 15778 types, which are 15779 <command>UDP4</command> (UDP/IPv4), 15780 <command>UDP6</command> (UDP/IPv6), 15781 <command>TCP4</command> (TCP/IPv4), 15782 <command>TCP6</command> (TCP/IPv6), 15783 <command>Unix</command> (Unix Domain), and 15784 <command>FDwatch</command> (sockets opened outside the 15785 socket module). 15786 In the following table <command><TYPE></command> 15787 represents a socket type. 15788 Not all counters are available for all socket types; 15789 exceptions are noted in the description field. 15790 </para> 15791 15792 <informaltable colsep="0" rowsep="0"> 15793 <tgroup cols="2" colsep="0" rowsep="0" tgroupstyle="4Level-table"> 15794 <colspec colname="1" colnum="1" colsep="0" colwidth="1.150in"/> 15795 <colspec colname="2" colnum="2" colsep="0" colwidth="3.350in"/> 15796 <tbody> 15797 <row> 15798 <entry colname="1"> 15799 <para> 15800 <emphasis>Symbol</emphasis> 15801 </para> 15802 </entry> 15803 <entry colname="2"> 15804 <para> 15805 <emphasis>Description</emphasis> 15806 </para> 15807 </entry> 15808 </row> 15809 15810 <row rowsep="0"> 15811 <entry colname="1"> 15812 <para><command><TYPE>Open</command></para> 15813 </entry> 15814 <entry colname="2"> 15815 <para> 15816 Sockets opened successfully. 15817 This counter is not applicable to the 15818 <command>FDwatch</command> type. 15819 </para> 15820 </entry> 15821 </row> 15822 <row rowsep="0"> 15823 <entry colname="1"> 15824 <para><command><TYPE>OpenFail</command></para> 15825 </entry> 15826 <entry colname="2"> 15827 <para> 15828 Failures of opening sockets. 15829 This counter is not applicable to the 15830 <command>FDwatch</command> type. 15831 </para> 15832 </entry> 15833 </row> 15834 <row rowsep="0"> 15835 <entry colname="1"> 15836 <para><command><TYPE>Close</command></para> 15837 </entry> 15838 <entry colname="2"> 15839 <para> 15840 Sockets closed. 15841 </para> 15842 </entry> 15843 </row> 15844 <row rowsep="0"> 15845 <entry colname="1"> 15846 <para><command><TYPE>BindFail</command></para> 15847 </entry> 15848 <entry colname="2"> 15849 <para> 15850 Failures of binding sockets. 15851 </para> 15852 </entry> 15853 </row> 15854 <row rowsep="0"> 15855 <entry colname="1"> 15856 <para><command><TYPE>ConnFail</command></para> 15857 </entry> 15858 <entry colname="2"> 15859 <para> 15860 Failures of connecting sockets. 15861 </para> 15862 </entry> 15863 </row> 15864 <row rowsep="0"> 15865 <entry colname="1"> 15866 <para><command><TYPE>Conn</command></para> 15867 </entry> 15868 <entry colname="2"> 15869 <para> 15870 Connections established successfully. 15871 </para> 15872 </entry> 15873 </row> 15874 <row rowsep="0"> 15875 <entry colname="1"> 15876 <para><command><TYPE>AcceptFail</command></para> 15877 </entry> 15878 <entry colname="2"> 15879 <para> 15880 Failures of accepting incoming connection requests. 15881 This counter is not applicable to the 15882 <command>UDP</command> and 15883 <command>FDwatch</command> types. 15884 </para> 15885 </entry> 15886 </row> 15887 <row rowsep="0"> 15888 <entry colname="1"> 15889 <para><command><TYPE>Accept</command></para> 15890 </entry> 15891 <entry colname="2"> 15892 <para> 15893 Incoming connections successfully accepted. 15894 This counter is not applicable to the 15895 <command>UDP</command> and 15896 <command>FDwatch</command> types. 15897 </para> 15898 </entry> 15899 </row> 15900 <row rowsep="0"> 15901 <entry colname="1"> 15902 <para><command><TYPE>SendErr</command></para> 15903 </entry> 15904 <entry colname="2"> 15905 <para> 15906 Errors in socket send operations. 15907 This counter corresponds 15908 to <command>SErr</command> counter of 15909 <command>BIND</command> 8. 15910 </para> 15911 </entry> 15912 </row> 15913 <row rowsep="0"> 15914 <entry colname="1"> 15915 <para><command><TYPE>RecvErr</command></para> 15916 </entry> 15917 <entry colname="2"> 15918 <para> 15919 Errors in socket receive operations. 15920 This includes errors of send operations on a 15921 connected UDP socket notified by an ICMP error 15922 message. 15923 </para> 15924 </entry> 15925 </row> 15926 </tbody> 15927 </tgroup> 15928 </informaltable> 15929 </sect3> 15930 <sect3> 15931 <title>Compatibility with <emphasis>BIND</emphasis> 8 Counters</title> 15932 <para> 15933 Most statistics counters that were available 15934 in <command>BIND</command> 8 are also supported in 15935 <command>BIND</command> 9 as shown in the above tables. 15936 Here are notes about other counters that do not appear 15937 in these tables. 15938 </para> 15939 15940 <variablelist> 15941 <varlistentry> 15942 <term><command>RFwdR,SFwdR</command></term> 15943 <listitem> 15944 <para> 15945 These counters are not supported 15946 because <command>BIND</command> 9 does not adopt 15947 the notion of <emphasis>forwarding</emphasis> 15948 as <command>BIND</command> 8 did. 15949 </para> 15950 </listitem> 15951 </varlistentry> 15952 15953 <varlistentry> 15954 <term><command>RAXFR</command></term> 15955 <listitem> 15956 <para> 15957 This counter is accessible in the Incoming Queries section. 15958 </para> 15959 </listitem> 15960 </varlistentry> 15961 15962 <varlistentry> 15963 <term><command>RIQ</command></term> 15964 <listitem> 15965 <para> 15966 This counter is accessible in the Incoming Requests section. 15967 </para> 15968 </listitem> 15969 </varlistentry> 15970 15971 <varlistentry> 15972 <term><command>ROpts</command></term> 15973 <listitem> 15974 <para> 15975 This counter is not supported 15976 because <command>BIND</command> 9 does not care 15977 about IP options in the first place. 15978 </para> 15979 </listitem> 15980 </varlistentry> 15981 </variablelist> 15982 </sect3> 15983 </sect2> 15984 </sect1> 15985 15986 </chapter> 15987 <chapter id="Bv9ARM.ch07"> 15988 <title><acronym>BIND</acronym> 9 Security Considerations</title> 15989 <sect1 id="Access_Control_Lists"> 15990 <title>Access Control Lists</title> 15991 <para> 15992 Access Control Lists (ACLs) are address match lists that 15993 you can set up and nickname for future use in <command>allow-notify</command>, 15994 <command>allow-query</command>, <command>allow-query-on</command>, 15995 <command>allow-recursion</command>, <command>allow-recursion-on</command>, 15996 <command>blackhole</command>, <command>allow-transfer</command>, 15997 etc. 15998 </para> 15999 <para> 16000 Using ACLs allows you to have finer control over who can access 16001 your name server, without cluttering up your config files with huge 16002 lists of IP addresses. 16003 </para> 16004 <para> 16005 It is a <emphasis>good idea</emphasis> to use ACLs, and to 16006 control access to your server. Limiting access to your server by 16007 outside parties can help prevent spoofing and denial of service (DoS) attacks against 16008 your server. 16009 </para> 16010 <para> 16011 Here is an example of how to properly apply ACLs: 16012 </para> 16013 16014<programlisting> 16015// Set up an ACL named "bogusnets" that will block 16016// RFC1918 space and some reserved space, which is 16017// commonly used in spoofing attacks. 16018acl bogusnets { 16019 0.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3; 16020 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; 16021}; 16022 16023// Set up an ACL called our-nets. Replace this with the 16024// real IP numbers. 16025acl our-nets { x.x.x.x/24; x.x.x.x/21; }; 16026options { 16027 ... 16028 ... 16029 allow-query { our-nets; }; 16030 allow-recursion { our-nets; }; 16031 ... 16032 blackhole { bogusnets; }; 16033 ... 16034}; 16035 16036zone "example.com" { 16037 type master; 16038 file "m/example.com"; 16039 allow-query { any; }; 16040}; 16041</programlisting> 16042 16043 <para> 16044 This allows recursive queries of the server from the outside 16045 unless recursion has been previously disabled. 16046 </para> 16047 </sect1> 16048 <sect1> 16049 <title><command>Chroot</command> and <command>Setuid</command></title> 16050 <para> 16051 On UNIX servers, it is possible to run <acronym>BIND</acronym> 16052 in a <emphasis>chrooted</emphasis> environment (using 16053 the <command>chroot()</command> function) by specifying 16054 the "<option>-t</option>" option for <command>named</command>. 16055 This can help improve system security by placing 16056 <acronym>BIND</acronym> in a "sandbox", which will limit 16057 the damage done if a server is compromised. 16058 </para> 16059 <para> 16060 Another useful feature in the UNIX version of <acronym>BIND</acronym> is the 16061 ability to run the daemon as an unprivileged user ( <option>-u</option> <replaceable>user</replaceable> ). 16062 We suggest running as an unprivileged user when using the <command>chroot</command> feature. 16063 </para> 16064 <para> 16065 Here is an example command line to load <acronym>BIND</acronym> in a <command>chroot</command> sandbox, 16066 <command>/var/named</command>, and to run <command>named</command> <command>setuid</command> to 16067 user 202: 16068 </para> 16069 <para> 16070 <userinput>/usr/local/sbin/named -u 202 -t /var/named</userinput> 16071 </para> 16072 16073 <sect2> 16074 <title>The <command>chroot</command> Environment</title> 16075 16076 <para> 16077 In order for a <command>chroot</command> environment 16078 to 16079 work properly in a particular directory 16080 (for example, <filename>/var/named</filename>), 16081 you will need to set up an environment that includes everything 16082 <acronym>BIND</acronym> needs to run. 16083 From <acronym>BIND</acronym>'s point of view, <filename>/var/named</filename> is 16084 the root of the filesystem. You will need to adjust the values of 16085 options like 16086 like <command>directory</command> and <command>pid-file</command> to account 16087 for this. 16088 </para> 16089 <para> 16090 Unlike with earlier versions of BIND, you typically will 16091 <emphasis>not</emphasis> need to compile <command>named</command> 16092 statically nor install shared libraries under the new root. 16093 However, depending on your operating system, you may need 16094 to set up things like 16095 <filename>/dev/zero</filename>, 16096 <filename>/dev/random</filename>, 16097 <filename>/dev/log</filename>, and 16098 <filename>/etc/localtime</filename>. 16099 </para> 16100 </sect2> 16101 16102 <sect2> 16103 <title>Using the <command>setuid</command> Function</title> 16104 16105 <para> 16106 Prior to running the <command>named</command> daemon, 16107 use 16108 the <command>touch</command> utility (to change file 16109 access and 16110 modification times) or the <command>chown</command> 16111 utility (to 16112 set the user id and/or group id) on files 16113 to which you want <acronym>BIND</acronym> 16114 to write. 16115 </para> 16116 <note> 16117 Note that if the <command>named</command> daemon is running as an 16118 unprivileged user, it will not be able to bind to new restricted 16119 ports if the server is reloaded. 16120 </note> 16121 </sect2> 16122 </sect1> 16123 16124 <sect1 id="dynamic_update_security"> 16125 <title>Dynamic Update Security</title> 16126 16127 <para> 16128 Access to the dynamic 16129 update facility should be strictly limited. In earlier versions of 16130 <acronym>BIND</acronym>, the only way to do this was 16131 based on the IP 16132 address of the host requesting the update, by listing an IP address 16133 or 16134 network prefix in the <command>allow-update</command> 16135 zone option. 16136 This method is insecure since the source address of the update UDP 16137 packet 16138 is easily forged. Also note that if the IP addresses allowed by the 16139 <command>allow-update</command> option include the 16140 address of a slave 16141 server which performs forwarding of dynamic updates, the master can 16142 be 16143 trivially attacked by sending the update to the slave, which will 16144 forward it to the master with its own source IP address causing the 16145 master to approve it without question. 16146 </para> 16147 16148 <para> 16149 For these reasons, we strongly recommend that updates be 16150 cryptographically authenticated by means of transaction signatures 16151 (TSIG). That is, the <command>allow-update</command> 16152 option should 16153 list only TSIG key names, not IP addresses or network 16154 prefixes. Alternatively, the new <command>update-policy</command> 16155 option can be used. 16156 </para> 16157 16158 <para> 16159 Some sites choose to keep all dynamically-updated DNS data 16160 in a subdomain and delegate that subdomain to a separate zone. This 16161 way, the top-level zone containing critical data such as the IP 16162 addresses 16163 of public web and mail servers need not allow dynamic update at 16164 all. 16165 </para> 16166 16167 </sect1> 16168 </chapter> 16169 16170 <chapter id="Bv9ARM.ch08"> 16171 <title>Troubleshooting</title> 16172 <sect1> 16173 <title>Common Problems</title> 16174 <sect2> 16175 <title>It's not working; how can I figure out what's wrong?</title> 16176 16177 <para> 16178 The best solution to solving installation and 16179 configuration issues is to take preventative measures by setting 16180 up logging files beforehand. The log files provide a 16181 source of hints and information that can be used to figure out 16182 what went wrong and how to fix the problem. 16183 </para> 16184 16185 </sect2> 16186 </sect1> 16187 <sect1> 16188 <title>Incrementing and Changing the Serial Number</title> 16189 16190 <para> 16191 Zone serial numbers are just numbers — they aren't 16192 date related. A lot of people set them to a number that 16193 represents a date, usually of the form YYYYMMDDRR. 16194 Occasionally they will make a mistake and set them to a 16195 "date in the future" then try to correct them by setting 16196 them to the "current date". This causes problems because 16197 serial numbers are used to indicate that a zone has been 16198 updated. If the serial number on the slave server is 16199 lower than the serial number on the master, the slave 16200 server will attempt to update its copy of the zone. 16201 </para> 16202 16203 <para> 16204 Setting the serial number to a lower number on the master 16205 server than the slave server means that the slave will not perform 16206 updates to its copy of the zone. 16207 </para> 16208 16209 <para> 16210 The solution to this is to add 2147483647 (2^31-1) to the 16211 number, reload the zone and make sure all slaves have updated to 16212 the new zone serial number, then reset the number to what you want 16213 it to be, and reload the zone again. 16214 </para> 16215 16216 </sect1> 16217 <sect1> 16218 <title>Where Can I Get Help?</title> 16219 16220 <para> 16221 The Internet Systems Consortium 16222 (<acronym>ISC</acronym>) offers a wide range 16223 of support and service agreements for <acronym>BIND</acronym> and <acronym>DHCP</acronym> servers. Four 16224 levels of premium support are available and each level includes 16225 support for all <acronym>ISC</acronym> programs, 16226 significant discounts on products 16227 and training, and a recognized priority on bug fixes and 16228 non-funded feature requests. In addition, <acronym>ISC</acronym> offers a standard 16229 support agreement package which includes services ranging from bug 16230 fix announcements to remote support. It also includes training in 16231 <acronym>BIND</acronym> and <acronym>DHCP</acronym>. 16232 </para> 16233 16234 <para> 16235 To discuss arrangements for support, contact 16236 <ulink url="mailto:info@isc.org">info@isc.org</ulink> or visit the 16237 <acronym>ISC</acronym> web page at 16238 <ulink url="http://www.isc.org/services/support/" 16239 >http://www.isc.org/services/support/</ulink> 16240 to read more. 16241 </para> 16242 </sect1> 16243 </chapter> 16244 16245 <appendix id="Bv9ARM.ch09"> 16246 <title>Release Notes</title> 16247 <xi:include href="notes.xml"/> 16248 </appendix> 16249 16250 <appendix id="Bv9ARM.ch10"> 16251 <title>A Brief History of the <acronym>DNS</acronym> and <acronym>BIND</acronym></title> 16252 <sect1 id="historical_dns_information"> 16253 <para> 16254 Although the "official" beginning of the Domain Name 16255 System occurred in 1984 with the publication of RFC 920, the 16256 core of the new system was described in 1983 in RFCs 882 and 16257 883. From 1984 to 1987, the ARPAnet (the precursor to today's 16258 Internet) became a testbed of experimentation for developing the 16259 new naming/addressing scheme in a rapidly expanding, 16260 operational network environment. New RFCs were written and 16261 published in 1987 that modified the original documents to 16262 incorporate improvements based on the working model. RFC 1034, 16263 "Domain Names-Concepts and Facilities", and RFC 1035, "Domain 16264 Names-Implementation and Specification" were published and 16265 became the standards upon which all <acronym>DNS</acronym> implementations are 16266 built. 16267 </para> 16268 16269 <para> 16270 The first working domain name server, called "Jeeves", was 16271 written in 1983-84 by Paul Mockapetris for operation on DEC 16272 Tops-20 16273 machines located at the University of Southern California's 16274 Information 16275 Sciences Institute (USC-ISI) and SRI International's Network 16276 Information 16277 Center (SRI-NIC). A <acronym>DNS</acronym> server for 16278 Unix machines, the Berkeley Internet 16279 Name Domain (<acronym>BIND</acronym>) package, was 16280 written soon after by a group of 16281 graduate students at the University of California at Berkeley 16282 under 16283 a grant from the US Defense Advanced Research Projects 16284 Administration 16285 (DARPA). 16286 </para> 16287 <para> 16288 Versions of <acronym>BIND</acronym> through 16289 4.8.3 were maintained by the Computer 16290 Systems Research Group (CSRG) at UC Berkeley. Douglas Terry, Mark 16291 Painter, David Riggle and Songnian Zhou made up the initial <acronym>BIND</acronym> 16292 project team. After that, additional work on the software package 16293 was done by Ralph Campbell. Kevin Dunlap, a Digital Equipment 16294 Corporation 16295 employee on loan to the CSRG, worked on <acronym>BIND</acronym> for 2 years, from 1985 16296 to 1987. Many other people also contributed to <acronym>BIND</acronym> development 16297 during that time: Doug Kingston, Craig Partridge, Smoot 16298 Carl-Mitchell, 16299 Mike Muuss, Jim Bloom and Mike Schwartz. <acronym>BIND</acronym> maintenance was subsequently 16300 handled by Mike Karels and Øivind Kure. 16301 </para> 16302 <para> 16303 <acronym>BIND</acronym> versions 4.9 and 4.9.1 were 16304 released by Digital Equipment 16305 Corporation (now Compaq Computer Corporation). Paul Vixie, then 16306 a DEC employee, became <acronym>BIND</acronym>'s 16307 primary caretaker. He was assisted 16308 by Phil Almquist, Robert Elz, Alan Barrett, Paul Albitz, Bryan 16309 Beecher, Andrew 16310 Partan, Andy Cherenson, Tom Limoncelli, Berthold Paffrath, Fuat 16311 Baran, Anant Kumar, Art Harkin, Win Treese, Don Lewis, Christophe 16312 Wolfhugel, and others. 16313 </para> 16314 <para> 16315 In 1994, <acronym>BIND</acronym> version 4.9.2 was sponsored by 16316 Vixie Enterprises. Paul 16317 Vixie became <acronym>BIND</acronym>'s principal 16318 architect/programmer. 16319 </para> 16320 <para> 16321 <acronym>BIND</acronym> versions from 4.9.3 onward 16322 have been developed and maintained 16323 by the Internet Systems Consortium and its predecessor, 16324 the Internet Software Consortium, with support being provided 16325 by ISC's sponsors. 16326 </para> 16327 <para> 16328 As co-architects/programmers, Bob Halley and 16329 Paul Vixie released the first production-ready version of 16330 <acronym>BIND</acronym> version 8 in May 1997. 16331 </para> 16332 <para> 16333 BIND version 9 was released in September 2000 and is a 16334 major rewrite of nearly all aspects of the underlying 16335 BIND architecture. 16336 </para> 16337 <para> 16338 BIND versions 4 and 8 are officially deprecated. 16339 No additional development is done 16340 on BIND version 4 or BIND version 8. 16341 </para> 16342 <para> 16343 <acronym>BIND</acronym> development work is made 16344 possible today by the sponsorship 16345 of several corporations, and by the tireless work efforts of 16346 numerous individuals. 16347 </para> 16348 </sect1> 16349 </appendix> 16350 16351 <appendix id="Bv9ARM.ch11"> 16352 <title>General <acronym>DNS</acronym> Reference Information</title> 16353 <sect1 id="ipv6addresses"> 16354 <title>IPv6 addresses (AAAA)</title> 16355 <para> 16356 IPv6 addresses are 128-bit identifiers for interfaces and 16357 sets of interfaces which were introduced in the <acronym>DNS</acronym> to facilitate 16358 scalable Internet routing. There are three types of addresses: <emphasis>Unicast</emphasis>, 16359 an identifier for a single interface; 16360 <emphasis>Anycast</emphasis>, 16361 an identifier for a set of interfaces; and <emphasis>Multicast</emphasis>, 16362 an identifier for a set of interfaces. Here we describe the global 16363 Unicast address scheme. For more information, see RFC 3587, 16364 "Global Unicast Address Format." 16365 </para> 16366 <para> 16367 IPv6 unicast addresses consist of a 16368 <emphasis>global routing prefix</emphasis>, a 16369 <emphasis>subnet identifier</emphasis>, and an 16370 <emphasis>interface identifier</emphasis>. 16371 </para> 16372 <para> 16373 The global routing prefix is provided by the 16374 upstream provider or ISP, and (roughly) corresponds to the 16375 IPv4 <emphasis>network</emphasis> section 16376 of the address range. 16377 16378 The subnet identifier is for local subnetting, much the 16379 same as subnetting an 16380 IPv4 /16 network into /24 subnets. 16381 16382 The interface identifier is the address of an individual 16383 interface on a given network; in IPv6, addresses belong to 16384 interfaces rather than to machines. 16385 </para> 16386 <para> 16387 The subnetting capability of IPv6 is much more flexible than 16388 that of IPv4: subnetting can be carried out on bit boundaries, 16389 in much the same way as Classless InterDomain Routing 16390 (CIDR), and the DNS PTR representation ("nibble" format) 16391 makes setting up reverse zones easier. 16392 </para> 16393 <para> 16394 The Interface Identifier must be unique on the local link, 16395 and is usually generated automatically by the IPv6 16396 implementation, although it is usually possible to 16397 override the default setting if necessary. A typical IPv6 16398 address might look like: 16399 <command>2001:db8:201:9:a00:20ff:fe81:2b32</command> 16400 </para> 16401 <para> 16402 IPv6 address specifications often contain long strings 16403 of zeros, so the architects have included a shorthand for 16404 specifying 16405 them. The double colon (`::') indicates the longest possible 16406 string 16407 of zeros that can fit, and can be used only once in an address. 16408 </para> 16409 </sect1> 16410 <sect1 id="bibliography"> 16411 <title>Bibliography (and Suggested Reading)</title> 16412 <sect2 id="rfcs"> 16413 <title>Request for Comments (RFCs)</title> 16414 <para> 16415 Specification documents for the Internet protocol suite, including 16416 the <acronym>DNS</acronym>, are published as part of 16417 the Request for Comments (RFCs) 16418 series of technical notes. The standards themselves are defined 16419 by the Internet Engineering Task Force (IETF) and the Internet 16420 Engineering Steering Group (IESG). RFCs can be obtained online via FTP at: 16421 </para> 16422 <para> 16423 <ulink url="ftp://www.isi.edu/in-notes/"> 16424 ftp://www.isi.edu/in-notes/RFC<replaceable>xxxx</replaceable>.txt 16425 </ulink> 16426 </para> 16427 <para> 16428 (where <replaceable>xxxx</replaceable> is 16429 the number of the RFC). RFCs are also available via the Web at: 16430 </para> 16431 <para> 16432 <ulink url="http://www.ietf.org/rfc/" 16433 >http://www.ietf.org/rfc/</ulink>. 16434 </para> 16435 <bibliography> 16436 <bibliodiv> 16437 <!-- one of (BIBLIOENTRY BIBLIOMIXED) --> 16438 <title>Standards</title> 16439 <biblioentry> 16440 <abbrev>RFC974</abbrev> 16441 <author> 16442 <surname>Partridge</surname> 16443 <firstname>C.</firstname> 16444 </author> 16445 <title>Mail Routing and the Domain System</title> 16446 <pubdate>January 1986</pubdate> 16447 </biblioentry> 16448 <biblioentry> 16449 <abbrev>RFC1034</abbrev> 16450 <author> 16451 <surname>Mockapetris</surname> 16452 <firstname>P.V.</firstname> 16453 </author> 16454 <title>Domain Names — Concepts and Facilities</title> 16455 <pubdate>November 1987</pubdate> 16456 </biblioentry> 16457 <biblioentry> 16458 <abbrev>RFC1035</abbrev> 16459 <author> 16460 <surname>Mockapetris</surname> 16461 <firstname>P. V.</firstname> 16462 </author> <title>Domain Names — Implementation and 16463 Specification</title> 16464 <pubdate>November 1987</pubdate> 16465 </biblioentry> 16466 </bibliodiv> 16467 <bibliodiv id="proposed_standards" xreflabel="Proposed Standards"> 16468 16469 <title>Proposed Standards</title> 16470 <!-- one of (BIBLIOENTRY BIBLIOMIXED) --> 16471 <biblioentry> 16472 <abbrev>RFC2181</abbrev> 16473 <author> 16474 <surname>Elz</surname> 16475 <firstname>R., R. Bush</firstname> 16476 </author> 16477 <title>Clarifications to the <acronym>DNS</acronym> 16478 Specification</title> 16479 <pubdate>July 1997</pubdate> 16480 </biblioentry> 16481 <biblioentry> 16482 <abbrev>RFC2308</abbrev> 16483 <author> 16484 <surname>Andrews</surname> 16485 <firstname>M.</firstname> 16486 </author> 16487 <title>Negative Caching of <acronym>DNS</acronym> 16488 Queries</title> 16489 <pubdate>March 1998</pubdate> 16490 </biblioentry> 16491 <biblioentry> 16492 <abbrev>RFC1995</abbrev> 16493 <author> 16494 <surname>Ohta</surname> 16495 <firstname>M.</firstname> 16496 </author> 16497 <title>Incremental Zone Transfer in <acronym>DNS</acronym></title> 16498 <pubdate>August 1996</pubdate> 16499 </biblioentry> 16500 <biblioentry> 16501 <abbrev>RFC1996</abbrev> 16502 <author> 16503 <surname>Vixie</surname> 16504 <firstname>P.</firstname> 16505 </author> 16506 <title>A Mechanism for Prompt Notification of Zone Changes</title> 16507 <pubdate>August 1996</pubdate> 16508 </biblioentry> 16509 <biblioentry> 16510 <abbrev>RFC2136</abbrev> 16511 <authorgroup> 16512 <author> 16513 <surname>Vixie</surname> 16514 <firstname>P.</firstname> 16515 </author> 16516 <author> 16517 <firstname>S.</firstname> 16518 <surname>Thomson</surname> 16519 </author> 16520 <author> 16521 <firstname>Y.</firstname> 16522 <surname>Rekhter</surname> 16523 </author> 16524 <author> 16525 <firstname>J.</firstname> 16526 <surname>Bound</surname> 16527 </author> 16528 </authorgroup> 16529 <title>Dynamic Updates in the Domain Name System</title> 16530 <pubdate>April 1997</pubdate> 16531 </biblioentry> 16532 <biblioentry> 16533 <abbrev>RFC2671</abbrev> 16534 <authorgroup> 16535 <author> 16536 <firstname>P.</firstname> 16537 <surname>Vixie</surname> 16538 </author> 16539 </authorgroup> 16540 <title>Extension Mechanisms for DNS (EDNS0)</title> 16541 <pubdate>August 1997</pubdate> 16542 </biblioentry> 16543 <biblioentry> 16544 <abbrev>RFC2672</abbrev> 16545 <authorgroup> 16546 <author> 16547 <firstname>M.</firstname> 16548 <surname>Crawford</surname> 16549 </author> 16550 </authorgroup> 16551 <title>Non-Terminal DNS Name Redirection</title> 16552 <pubdate>August 1999</pubdate> 16553 </biblioentry> 16554 <biblioentry> 16555 <abbrev>RFC2845</abbrev> 16556 <authorgroup> 16557 <author> 16558 <surname>Vixie</surname> 16559 <firstname>P.</firstname> 16560 </author> 16561 <author> 16562 <firstname>O.</firstname> 16563 <surname>Gudmundsson</surname> 16564 </author> 16565 <author> 16566 <firstname>D.</firstname> 16567 <surname>Eastlake</surname> 16568 <lineage>3rd</lineage> 16569 </author> 16570 <author> 16571 <firstname>B.</firstname> 16572 <surname>Wellington</surname> 16573 </author> 16574 </authorgroup> 16575 <title>Secret Key Transaction Authentication for <acronym>DNS</acronym> (TSIG)</title> 16576 <pubdate>May 2000</pubdate> 16577 </biblioentry> 16578 <biblioentry> 16579 <abbrev>RFC2930</abbrev> 16580 <authorgroup> 16581 <author> 16582 <firstname>D.</firstname> 16583 <surname>Eastlake</surname> 16584 <lineage>3rd</lineage> 16585 </author> 16586 </authorgroup> 16587 <title>Secret Key Establishment for DNS (TKEY RR)</title> 16588 <pubdate>September 2000</pubdate> 16589 </biblioentry> 16590 <biblioentry> 16591 <abbrev>RFC2931</abbrev> 16592 <authorgroup> 16593 <author> 16594 <firstname>D.</firstname> 16595 <surname>Eastlake</surname> 16596 <lineage>3rd</lineage> 16597 </author> 16598 </authorgroup> 16599 <title>DNS Request and Transaction Signatures (SIG(0)s)</title> 16600 <pubdate>September 2000</pubdate> 16601 </biblioentry> 16602 <biblioentry> 16603 <abbrev>RFC3007</abbrev> 16604 <authorgroup> 16605 <author> 16606 <firstname>B.</firstname> 16607 <surname>Wellington</surname> 16608 </author> 16609 </authorgroup> 16610 <title>Secure Domain Name System (DNS) Dynamic Update</title> 16611 <pubdate>November 2000</pubdate> 16612 </biblioentry> 16613 <biblioentry> 16614 <abbrev>RFC3645</abbrev> 16615 <authorgroup> 16616 <author> 16617 <firstname>S.</firstname> 16618 <surname>Kwan</surname> 16619 </author> 16620 <author> 16621 <firstname>P.</firstname> 16622 <surname>Garg</surname> 16623 </author> 16624 <author> 16625 <firstname>J.</firstname> 16626 <surname>Gilroy</surname> 16627 </author> 16628 <author> 16629 <firstname>L.</firstname> 16630 <surname>Esibov</surname> 16631 </author> 16632 <author> 16633 <firstname>J.</firstname> 16634 <surname>Westhead</surname> 16635 </author> 16636 <author> 16637 <firstname>R.</firstname> 16638 <surname>Hall</surname> 16639 </author> 16640 </authorgroup> 16641 <title>Generic Security Service Algorithm for Secret 16642 Key Transaction Authentication for DNS 16643 (GSS-TSIG)</title> 16644 <pubdate>October 2003</pubdate> 16645 </biblioentry> 16646 </bibliodiv> 16647 <bibliodiv> 16648 <title><acronym>DNS</acronym> Security Proposed Standards</title> 16649 <biblioentry> 16650 <abbrev>RFC3225</abbrev> 16651 <authorgroup> 16652 <author> 16653 <firstname>D.</firstname> 16654 <surname>Conrad</surname> 16655 </author> 16656 </authorgroup> 16657 <title>Indicating Resolver Support of DNSSEC</title> 16658 <pubdate>December 2001</pubdate> 16659 </biblioentry> 16660 <biblioentry> 16661 <abbrev>RFC3833</abbrev> 16662 <authorgroup> 16663 <author> 16664 <firstname>D.</firstname> 16665 <surname>Atkins</surname> 16666 </author> 16667 <author> 16668 <firstname>R.</firstname> 16669 <surname>Austein</surname> 16670 </author> 16671 </authorgroup> 16672 <title>Threat Analysis of the Domain Name System (DNS)</title> 16673 <pubdate>August 2004</pubdate> 16674 </biblioentry> 16675 <biblioentry> 16676 <abbrev>RFC4033</abbrev> 16677 <authorgroup> 16678 <author> 16679 <firstname>R.</firstname> 16680 <surname>Arends</surname> 16681 </author> 16682 <author> 16683 <firstname>R.</firstname> 16684 <surname>Austein</surname> 16685 </author> 16686 <author> 16687 <firstname>M.</firstname> 16688 <surname>Larson</surname> 16689 </author> 16690 <author> 16691 <firstname>D.</firstname> 16692 <surname>Massey</surname> 16693 </author> 16694 <author> 16695 <firstname>S.</firstname> 16696 <surname>Rose</surname> 16697 </author> 16698 </authorgroup> 16699 <title>DNS Security Introduction and Requirements</title> 16700 <pubdate>March 2005</pubdate> 16701 </biblioentry> 16702 <biblioentry> 16703 <abbrev>RFC4034</abbrev> 16704 <authorgroup> 16705 <author> 16706 <firstname>R.</firstname> 16707 <surname>Arends</surname> 16708 </author> 16709 <author> 16710 <firstname>R.</firstname> 16711 <surname>Austein</surname> 16712 </author> 16713 <author> 16714 <firstname>M.</firstname> 16715 <surname>Larson</surname> 16716 </author> 16717 <author> 16718 <firstname>D.</firstname> 16719 <surname>Massey</surname> 16720 </author> 16721 <author> 16722 <firstname>S.</firstname> 16723 <surname>Rose</surname> 16724 </author> 16725 </authorgroup> 16726 <title>Resource Records for the DNS Security Extensions</title> 16727 <pubdate>March 2005</pubdate> 16728 </biblioentry> 16729 <biblioentry> 16730 <abbrev>RFC4035</abbrev> 16731 <authorgroup> 16732 <author> 16733 <firstname>R.</firstname> 16734 <surname>Arends</surname> 16735 </author> 16736 <author> 16737 <firstname>R.</firstname> 16738 <surname>Austein</surname> 16739 </author> 16740 <author> 16741 <firstname>M.</firstname> 16742 <surname>Larson</surname> 16743 </author> 16744 <author> 16745 <firstname>D.</firstname> 16746 <surname>Massey</surname> 16747 </author> 16748 <author> 16749 <firstname>S.</firstname> 16750 <surname>Rose</surname> 16751 </author> 16752 </authorgroup> 16753 <title>Protocol Modifications for the DNS 16754 Security Extensions</title> 16755 <pubdate>March 2005</pubdate> 16756 </biblioentry> 16757 </bibliodiv> 16758 <bibliodiv> 16759 <title>Other Important RFCs About <acronym>DNS</acronym> 16760 Implementation</title> 16761 <biblioentry> 16762 <abbrev>RFC1535</abbrev> 16763 <author> 16764 <surname>Gavron</surname> 16765 <firstname>E.</firstname> 16766 </author> 16767 <title>A Security Problem and Proposed Correction With Widely 16768 Deployed <acronym>DNS</acronym> Software.</title> 16769 <pubdate>October 1993</pubdate> 16770 </biblioentry> 16771 <biblioentry> 16772 <abbrev>RFC1536</abbrev> 16773 <authorgroup> 16774 <author> 16775 <surname>Kumar</surname> 16776 <firstname>A.</firstname> 16777 </author> 16778 <author> 16779 <firstname>J.</firstname> 16780 <surname>Postel</surname> 16781 </author> 16782 <author> 16783 <firstname>C.</firstname> 16784 <surname>Neuman</surname> 16785 </author> 16786 <author> 16787 <firstname>P.</firstname> 16788 <surname>Danzig</surname> 16789 </author> 16790 <author> 16791 <firstname>S.</firstname> 16792 <surname>Miller</surname> 16793 </author> 16794 </authorgroup> 16795 <title>Common <acronym>DNS</acronym> Implementation 16796 Errors and Suggested Fixes</title> 16797 <pubdate>October 1993</pubdate> 16798 </biblioentry> 16799 <biblioentry> 16800 <abbrev>RFC1982</abbrev> 16801 <authorgroup> 16802 <author> 16803 <surname>Elz</surname> 16804 <firstname>R.</firstname> 16805 </author> 16806 <author> 16807 <firstname>R.</firstname> 16808 <surname>Bush</surname> 16809 </author> 16810 </authorgroup> 16811 <title>Serial Number Arithmetic</title> 16812 <pubdate>August 1996</pubdate> 16813 </biblioentry> 16814 <biblioentry> 16815 <abbrev>RFC4074</abbrev> 16816 <authorgroup> 16817 <author> 16818 <surname>Morishita</surname> 16819 <firstname>Y.</firstname> 16820 </author> 16821 <author> 16822 <firstname>T.</firstname> 16823 <surname>Jinmei</surname> 16824 </author> 16825 </authorgroup> 16826 <title>Common Misbehaviour Against <acronym>DNS</acronym> 16827 Queries for IPv6 Addresses</title> 16828 <pubdate>May 2005</pubdate> 16829 </biblioentry> 16830 </bibliodiv> 16831 <bibliodiv> 16832 <title>Resource Record Types</title> 16833 <biblioentry> 16834 <abbrev>RFC1183</abbrev> 16835 <authorgroup> 16836 <author> 16837 <surname>Everhart</surname> 16838 <firstname>C.F.</firstname> 16839 </author> 16840 <author> 16841 <firstname>L. A.</firstname> 16842 <surname>Mamakos</surname> 16843 </author> 16844 <author> 16845 <firstname>R.</firstname> 16846 <surname>Ullmann</surname> 16847 </author> 16848 <author> 16849 <firstname>P.</firstname> 16850 <surname>Mockapetris</surname> 16851 </author> 16852 </authorgroup> 16853 <title>New <acronym>DNS</acronym> RR Definitions</title> 16854 <pubdate>October 1990</pubdate> 16855 </biblioentry> 16856 <biblioentry> 16857 <abbrev>RFC1706</abbrev> 16858 <authorgroup> 16859 <author> 16860 <surname>Manning</surname> 16861 <firstname>B.</firstname> 16862 </author> 16863 <author> 16864 <firstname>R.</firstname> 16865 <surname>Colella</surname> 16866 </author> 16867 </authorgroup> 16868 <title><acronym>DNS</acronym> NSAP Resource Records</title> 16869 <pubdate>October 1994</pubdate> 16870 </biblioentry> 16871 <biblioentry> 16872 <abbrev>RFC2168</abbrev> 16873 <authorgroup> 16874 <author> 16875 <surname>Daniel</surname> 16876 <firstname>R.</firstname> 16877 </author> 16878 <author> 16879 <firstname>M.</firstname> 16880 <surname>Mealling</surname> 16881 </author> 16882 </authorgroup> 16883 <title>Resolution of Uniform Resource Identifiers using 16884 the Domain Name System</title> 16885 <pubdate>June 1997</pubdate> 16886 </biblioentry> 16887 <biblioentry> 16888 <abbrev>RFC1876</abbrev> 16889 <authorgroup> 16890 <author> 16891 <surname>Davis</surname> 16892 <firstname>C.</firstname> 16893 </author> 16894 <author> 16895 <firstname>P.</firstname> 16896 <surname>Vixie</surname> 16897 </author> 16898 <author> 16899 <firstname>T.</firstname> 16900 <firstname>Goodwin</firstname> 16901 </author> 16902 <author> 16903 <firstname>I.</firstname> 16904 <surname>Dickinson</surname> 16905 </author> 16906 </authorgroup> 16907 <title>A Means for Expressing Location Information in the 16908 Domain 16909 Name System</title> 16910 <pubdate>January 1996</pubdate> 16911 </biblioentry> 16912 <biblioentry> 16913 <abbrev>RFC2052</abbrev> 16914 <authorgroup> 16915 <author> 16916 <surname>Gulbrandsen</surname> 16917 <firstname>A.</firstname> 16918 </author> 16919 <author> 16920 <firstname>P.</firstname> 16921 <surname>Vixie</surname> 16922 </author> 16923 </authorgroup> 16924 <title>A <acronym>DNS</acronym> RR for Specifying the 16925 Location of 16926 Services.</title> 16927 <pubdate>October 1996</pubdate> 16928 </biblioentry> 16929 <biblioentry> 16930 <abbrev>RFC2163</abbrev> 16931 <author> 16932 <surname>Allocchio</surname> 16933 <firstname>A.</firstname> 16934 </author> 16935 <title>Using the Internet <acronym>DNS</acronym> to 16936 Distribute MIXER 16937 Conformant Global Address Mapping</title> 16938 <pubdate>January 1998</pubdate> 16939 </biblioentry> 16940 <biblioentry> 16941 <abbrev>RFC2230</abbrev> 16942 <author> 16943 <surname>Atkinson</surname> 16944 <firstname>R.</firstname> 16945 </author> 16946 <title>Key Exchange Delegation Record for the <acronym>DNS</acronym></title> 16947 <pubdate>October 1997</pubdate> 16948 </biblioentry> 16949 <biblioentry> 16950 <abbrev>RFC2536</abbrev> 16951 <author> 16952 <surname>Eastlake</surname> 16953 <firstname>D.</firstname> 16954 <lineage>3rd</lineage> 16955 </author> 16956 <title>DSA KEYs and SIGs in the Domain Name System (DNS)</title> 16957 <pubdate>March 1999</pubdate> 16958 </biblioentry> 16959 <biblioentry> 16960 <abbrev>RFC2537</abbrev> 16961 <author> 16962 <surname>Eastlake</surname> 16963 <firstname>D.</firstname> 16964 <lineage>3rd</lineage> 16965 </author> 16966 <title>RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)</title> 16967 <pubdate>March 1999</pubdate> 16968 </biblioentry> 16969 <biblioentry> 16970 <abbrev>RFC2538</abbrev> 16971 <authorgroup> 16972 <author> 16973 <surname>Eastlake</surname> 16974 <firstname>D.</firstname> 16975 <lineage>3rd</lineage> 16976 </author> 16977 <author> 16978 <surname>Gudmundsson</surname> 16979 <firstname>O.</firstname> 16980 </author> 16981 </authorgroup> 16982 <title>Storing Certificates in the Domain Name System (DNS)</title> 16983 <pubdate>March 1999</pubdate> 16984 </biblioentry> 16985 <biblioentry> 16986 <abbrev>RFC2539</abbrev> 16987 <authorgroup> 16988 <author> 16989 <surname>Eastlake</surname> 16990 <firstname>D.</firstname> 16991 <lineage>3rd</lineage> 16992 </author> 16993 </authorgroup> 16994 <title>Storage of Diffie-Hellman Keys in the Domain Name System (DNS)</title> 16995 <pubdate>March 1999</pubdate> 16996 </biblioentry> 16997 <biblioentry> 16998 <abbrev>RFC2540</abbrev> 16999 <authorgroup> 17000 <author> 17001 <surname>Eastlake</surname> 17002 <firstname>D.</firstname> 17003 <lineage>3rd</lineage> 17004 </author> 17005 </authorgroup> 17006 <title>Detached Domain Name System (DNS) Information</title> 17007 <pubdate>March 1999</pubdate> 17008 </biblioentry> 17009 <biblioentry> 17010 <abbrev>RFC2782</abbrev> 17011 <author> 17012 <surname>Gulbrandsen</surname> 17013 <firstname>A.</firstname> 17014 </author> 17015 <author> 17016 <surname>Vixie</surname> 17017 <firstname>P.</firstname> 17018 </author> 17019 <author> 17020 <surname>Esibov</surname> 17021 <firstname>L.</firstname> 17022 </author> 17023 <title>A DNS RR for specifying the location of services (DNS SRV)</title> 17024 <pubdate>February 2000</pubdate> 17025 </biblioentry> 17026 <biblioentry> 17027 <abbrev>RFC2915</abbrev> 17028 <author> 17029 <surname>Mealling</surname> 17030 <firstname>M.</firstname> 17031 </author> 17032 <author> 17033 <surname>Daniel</surname> 17034 <firstname>R.</firstname> 17035 </author> 17036 <title>The Naming Authority Pointer (NAPTR) DNS Resource Record</title> 17037 <pubdate>September 2000</pubdate> 17038 </biblioentry> 17039 <biblioentry> 17040 <abbrev>RFC3110</abbrev> 17041 <author> 17042 <surname>Eastlake</surname> 17043 <firstname>D.</firstname> 17044 <lineage>3rd</lineage> 17045 </author> 17046 <title>RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)</title> 17047 <pubdate>May 2001</pubdate> 17048 </biblioentry> 17049 <biblioentry> 17050 <abbrev>RFC3123</abbrev> 17051 <author> 17052 <surname>Koch</surname> 17053 <firstname>P.</firstname> 17054 </author> 17055 <title>A DNS RR Type for Lists of Address Prefixes (APL RR)</title> 17056 <pubdate>June 2001</pubdate> 17057 </biblioentry> 17058 <biblioentry> 17059 <abbrev>RFC3596</abbrev> 17060 <authorgroup> 17061 <author> 17062 <surname>Thomson</surname> 17063 <firstname>S.</firstname> 17064 </author> 17065 <author> 17066 <firstname>C.</firstname> 17067 <surname>Huitema</surname> 17068 </author> 17069 <author> 17070 <firstname>V.</firstname> 17071 <surname>Ksinant</surname> 17072 </author> 17073 <author> 17074 <firstname>M.</firstname> 17075 <surname>Souissi</surname> 17076 </author> 17077 </authorgroup> 17078 <title><acronym>DNS</acronym> Extensions to support IP 17079 version 6</title> 17080 <pubdate>October 2003</pubdate> 17081 </biblioentry> 17082 <biblioentry> 17083 <abbrev>RFC3597</abbrev> 17084 <author> 17085 <surname>Gustafsson</surname> 17086 <firstname>A.</firstname> 17087 </author> 17088 <title>Handling of Unknown DNS Resource Record (RR) Types</title> 17089 <pubdate>September 2003</pubdate> 17090 </biblioentry> 17091 </bibliodiv> 17092 <bibliodiv> 17093 <title><acronym>DNS</acronym> and the Internet</title> 17094 <biblioentry> 17095 <abbrev>RFC1101</abbrev> 17096 <author> 17097 <surname>Mockapetris</surname> 17098 <firstname>P. V.</firstname> 17099 </author> 17100 <title><acronym>DNS</acronym> Encoding of Network Names 17101 and Other Types</title> 17102 <pubdate>April 1989</pubdate> 17103 </biblioentry> 17104 <biblioentry> 17105 <abbrev>RFC1123</abbrev> 17106 <author> 17107 <surname>Braden</surname> 17108 <surname>R.</surname> 17109 </author> 17110 <title>Requirements for Internet Hosts - Application and 17111 Support</title> 17112 <pubdate>October 1989</pubdate> 17113 </biblioentry> 17114 <biblioentry> 17115 <abbrev>RFC1591</abbrev> 17116 <author> 17117 <surname>Postel</surname> 17118 <firstname>J.</firstname> 17119 </author> 17120 <title>Domain Name System Structure and Delegation</title> 17121 <pubdate>March 1994</pubdate> 17122 </biblioentry> 17123 <biblioentry> 17124 <abbrev>RFC2317</abbrev> 17125 <authorgroup> 17126 <author> 17127 <surname>Eidnes</surname> 17128 <firstname>H.</firstname> 17129 </author> 17130 <author> 17131 <firstname>G.</firstname> 17132 <surname>de Groot</surname> 17133 </author> 17134 <author> 17135 <firstname>P.</firstname> 17136 <surname>Vixie</surname> 17137 </author> 17138 </authorgroup> 17139 <title>Classless IN-ADDR.ARPA Delegation</title> 17140 <pubdate>March 1998</pubdate> 17141 </biblioentry> 17142 <biblioentry> 17143 <abbrev>RFC2826</abbrev> 17144 <authorgroup> 17145 <author> 17146 <surname>Internet Architecture Board</surname> 17147 </author> 17148 </authorgroup> 17149 <title>IAB Technical Comment on the Unique DNS Root</title> 17150 <pubdate>May 2000</pubdate> 17151 </biblioentry> 17152 <biblioentry> 17153 <abbrev>RFC2929</abbrev> 17154 <authorgroup> 17155 <author> 17156 <surname>Eastlake</surname> 17157 <firstname>D.</firstname> 17158 <lineage>3rd</lineage> 17159 </author> 17160 <author> 17161 <surname>Brunner-Williams</surname> 17162 <firstname>E.</firstname> 17163 </author> 17164 <author> 17165 <surname>Manning</surname> 17166 <firstname>B.</firstname> 17167 </author> 17168 </authorgroup> 17169 <title>Domain Name System (DNS) IANA Considerations</title> 17170 <pubdate>September 2000</pubdate> 17171 </biblioentry> 17172 </bibliodiv> 17173 <bibliodiv> 17174 <title><acronym>DNS</acronym> Operations</title> 17175 <biblioentry> 17176 <abbrev>RFC1033</abbrev> 17177 <author> 17178 <surname>Lottor</surname> 17179 <firstname>M.</firstname> 17180 </author> 17181 <title>Domain administrators operations guide.</title> 17182 <pubdate>November 1987</pubdate> 17183 </biblioentry> 17184 <biblioentry> 17185 <abbrev>RFC1537</abbrev> 17186 <author> 17187 <surname>Beertema</surname> 17188 <firstname>P.</firstname> 17189 </author> 17190 <title>Common <acronym>DNS</acronym> Data File 17191 Configuration Errors</title> 17192 <pubdate>October 1993</pubdate> 17193 </biblioentry> 17194 <biblioentry> 17195 <abbrev>RFC1912</abbrev> 17196 <author> 17197 <surname>Barr</surname> 17198 <firstname>D.</firstname> 17199 </author> 17200 <title>Common <acronym>DNS</acronym> Operational and 17201 Configuration Errors</title> 17202 <pubdate>February 1996</pubdate> 17203 </biblioentry> 17204 <biblioentry> 17205 <abbrev>RFC2010</abbrev> 17206 <authorgroup> 17207 <author> 17208 <surname>Manning</surname> 17209 <firstname>B.</firstname> 17210 </author> 17211 <author> 17212 <firstname>P.</firstname> 17213 <surname>Vixie</surname> 17214 </author> 17215 </authorgroup> 17216 <title>Operational Criteria for Root Name Servers.</title> 17217 <pubdate>October 1996</pubdate> 17218 </biblioentry> 17219 <biblioentry> 17220 <abbrev>RFC2219</abbrev> 17221 <authorgroup> 17222 <author> 17223 <surname>Hamilton</surname> 17224 <firstname>M.</firstname> 17225 </author> 17226 <author> 17227 <firstname>R.</firstname> 17228 <surname>Wright</surname> 17229 </author> 17230 </authorgroup> 17231 <title>Use of <acronym>DNS</acronym> Aliases for 17232 Network Services.</title> 17233 <pubdate>October 1997</pubdate> 17234 </biblioentry> 17235 </bibliodiv> 17236 <bibliodiv> 17237 <title>Internationalized Domain Names</title> 17238 <biblioentry> 17239 <abbrev>RFC2825</abbrev> 17240 <authorgroup> 17241 <author> 17242 <surname>IAB</surname> 17243 </author> 17244 <author> 17245 <surname>Daigle</surname> 17246 <firstname>R.</firstname> 17247 </author> 17248 </authorgroup> 17249 <title>A Tangled Web: Issues of I18N, Domain Names, 17250 and the Other Internet protocols</title> 17251 <pubdate>May 2000</pubdate> 17252 </biblioentry> 17253 <biblioentry> 17254 <abbrev>RFC3490</abbrev> 17255 <authorgroup> 17256 <author> 17257 <surname>Faltstrom</surname> 17258 <firstname>P.</firstname> 17259 </author> 17260 <author> 17261 <surname>Hoffman</surname> 17262 <firstname>P.</firstname> 17263 </author> 17264 <author> 17265 <surname>Costello</surname> 17266 <firstname>A.</firstname> 17267 </author> 17268 </authorgroup> 17269 <title>Internationalizing Domain Names in Applications (IDNA)</title> 17270 <pubdate>March 2003</pubdate> 17271 </biblioentry> 17272 <biblioentry> 17273 <abbrev>RFC3491</abbrev> 17274 <authorgroup> 17275 <author> 17276 <surname>Hoffman</surname> 17277 <firstname>P.</firstname> 17278 </author> 17279 <author> 17280 <surname>Blanchet</surname> 17281 <firstname>M.</firstname> 17282 </author> 17283 </authorgroup> 17284 <title>Nameprep: A Stringprep Profile for Internationalized Domain Names</title> 17285 <pubdate>March 2003</pubdate> 17286 </biblioentry> 17287 <biblioentry> 17288 <abbrev>RFC3492</abbrev> 17289 <authorgroup> 17290 <author> 17291 <surname>Costello</surname> 17292 <firstname>A.</firstname> 17293 </author> 17294 </authorgroup> 17295 <title>Punycode: A Bootstring encoding of Unicode 17296 for Internationalized Domain Names in 17297 Applications (IDNA)</title> 17298 <pubdate>March 2003</pubdate> 17299 </biblioentry> 17300 </bibliodiv> 17301 <bibliodiv> 17302 <title>Other <acronym>DNS</acronym>-related RFCs</title> 17303 <note> 17304 <para> 17305 Note: the following list of RFCs, although 17306 <acronym>DNS</acronym>-related, are not 17307 concerned with implementing software. 17308 </para> 17309 </note> 17310 <biblioentry> 17311 <abbrev>RFC1464</abbrev> 17312 <author> 17313 <surname>Rosenbaum</surname> 17314 <firstname>R.</firstname> 17315 </author> 17316 <title>Using the Domain Name System To Store Arbitrary String 17317 Attributes</title> 17318 <pubdate>May 1993</pubdate> 17319 </biblioentry> 17320 <biblioentry> 17321 <abbrev>RFC1713</abbrev> 17322 <author> 17323 <surname>Romao</surname> 17324 <firstname>A.</firstname> 17325 </author> 17326 <title>Tools for <acronym>DNS</acronym> Debugging</title> 17327 <pubdate>November 1994</pubdate> 17328 </biblioentry> 17329 <biblioentry> 17330 <abbrev>RFC1794</abbrev> 17331 <author> 17332 <surname>Brisco</surname> 17333 <firstname>T.</firstname> 17334 </author> 17335 <title><acronym>DNS</acronym> Support for Load 17336 Balancing</title> 17337 <pubdate>April 1995</pubdate> 17338 </biblioentry> 17339 <biblioentry> 17340 <abbrev>RFC2240</abbrev> 17341 <author> 17342 <surname>Vaughan</surname> 17343 <firstname>O.</firstname> 17344 </author> 17345 <title>A Legal Basis for Domain Name Allocation</title> 17346 <pubdate>November 1997</pubdate> 17347 </biblioentry> 17348 <biblioentry> 17349 <abbrev>RFC2345</abbrev> 17350 <authorgroup> 17351 <author> 17352 <surname>Klensin</surname> 17353 <firstname>J.</firstname> 17354 </author> 17355 <author> 17356 <firstname>T.</firstname> 17357 <surname>Wolf</surname> 17358 </author> 17359 <author> 17360 <firstname>G.</firstname> 17361 <surname>Oglesby</surname> 17362 </author> 17363 </authorgroup> 17364 <title>Domain Names and Company Name Retrieval</title> 17365 <pubdate>May 1998</pubdate> 17366 </biblioentry> 17367 <biblioentry> 17368 <abbrev>RFC2352</abbrev> 17369 <author> 17370 <surname>Vaughan</surname> 17371 <firstname>O.</firstname> 17372 </author> 17373 <title>A Convention For Using Legal Names as Domain Names</title> 17374 <pubdate>May 1998</pubdate> 17375 </biblioentry> 17376 <biblioentry> 17377 <abbrev>RFC3071</abbrev> 17378 <authorgroup> 17379 <author> 17380 <surname>Klensin</surname> 17381 <firstname>J.</firstname> 17382 </author> 17383 </authorgroup> 17384 <title>Reflections on the DNS, RFC 1591, and Categories of Domains</title> 17385 <pubdate>February 2001</pubdate> 17386 </biblioentry> 17387 <biblioentry> 17388 <abbrev>RFC3258</abbrev> 17389 <authorgroup> 17390 <author> 17391 <surname>Hardie</surname> 17392 <firstname>T.</firstname> 17393 </author> 17394 </authorgroup> 17395 <title>Distributing Authoritative Name Servers via 17396 Shared Unicast Addresses</title> 17397 <pubdate>April 2002</pubdate> 17398 </biblioentry> 17399 <biblioentry> 17400 <abbrev>RFC3901</abbrev> 17401 <authorgroup> 17402 <author> 17403 <surname>Durand</surname> 17404 <firstname>A.</firstname> 17405 </author> 17406 <author> 17407 <firstname>J.</firstname> 17408 <surname>Ihren</surname> 17409 </author> 17410 </authorgroup> 17411 <title>DNS IPv6 Transport Operational Guidelines</title> 17412 <pubdate>September 2004</pubdate> 17413 </biblioentry> 17414 </bibliodiv> 17415 <bibliodiv> 17416 <title>Obsolete and Unimplemented Experimental RFC</title> 17417 <biblioentry> 17418 <abbrev>RFC1712</abbrev> 17419 <authorgroup> 17420 <author> 17421 <surname>Farrell</surname> 17422 <firstname>C.</firstname> 17423 </author> 17424 <author> 17425 <firstname>M.</firstname> 17426 <surname>Schulze</surname> 17427 </author> 17428 <author> 17429 <firstname>S.</firstname> 17430 <surname>Pleitner</surname> 17431 </author> 17432 <author> 17433 <firstname>D.</firstname> 17434 <surname>Baldoni</surname> 17435 </author> 17436 </authorgroup> 17437 <title><acronym>DNS</acronym> Encoding of Geographical 17438 Location</title> 17439 <pubdate>November 1994</pubdate> 17440 </biblioentry> 17441 <biblioentry> 17442 <abbrev>RFC2673</abbrev> 17443 <authorgroup> 17444 <author> 17445 <surname>Crawford</surname> 17446 <firstname>M.</firstname> 17447 </author> 17448 </authorgroup> 17449 <title>Binary Labels in the Domain Name System</title> 17450 <pubdate>August 1999</pubdate> 17451 </biblioentry> 17452 <biblioentry> 17453 <abbrev>RFC2874</abbrev> 17454 <authorgroup> 17455 <author> 17456 <surname>Crawford</surname> 17457 <firstname>M.</firstname> 17458 </author> 17459 <author> 17460 <surname>Huitema</surname> 17461 <firstname>C.</firstname> 17462 </author> 17463 </authorgroup> 17464 <title>DNS Extensions to Support IPv6 Address Aggregation 17465 and Renumbering</title> 17466 <pubdate>July 2000</pubdate> 17467 </biblioentry> 17468 </bibliodiv> 17469 <bibliodiv> 17470 <title>Obsoleted DNS Security RFCs</title> 17471 <note> 17472 <para> 17473 Most of these have been consolidated into RFC4033, 17474 RFC4034 and RFC4035 which collectively describe DNSSECbis. 17475 </para> 17476 </note> 17477 <biblioentry> 17478 <abbrev>RFC2065</abbrev> 17479 <authorgroup> 17480 <author> 17481 <surname>Eastlake</surname> 17482 <lineage>3rd</lineage> 17483 <firstname>D.</firstname> 17484 </author> 17485 <author> 17486 <firstname>C.</firstname> 17487 <surname>Kaufman</surname> 17488 </author> 17489 </authorgroup> 17490 <title>Domain Name System Security Extensions</title> 17491 <pubdate>January 1997</pubdate> 17492 </biblioentry> 17493 <biblioentry> 17494 <abbrev>RFC2137</abbrev> 17495 <author> 17496 <surname>Eastlake</surname> 17497 <lineage>3rd</lineage> 17498 <firstname>D.</firstname> 17499 </author> 17500 <title>Secure Domain Name System Dynamic Update</title> 17501 <pubdate>April 1997</pubdate> 17502 </biblioentry> 17503 <biblioentry> 17504 <abbrev>RFC2535</abbrev> 17505 <authorgroup> 17506 <author> 17507 <surname>Eastlake</surname> 17508 <lineage>3rd</lineage> 17509 <firstname>D.</firstname> 17510 </author> 17511 </authorgroup> 17512 <title>Domain Name System Security Extensions</title> 17513 <pubdate>March 1999</pubdate> 17514 </biblioentry> 17515 <biblioentry> 17516 <abbrev>RFC3008</abbrev> 17517 <authorgroup> 17518 <author> 17519 <surname>Wellington</surname> 17520 <firstname>B.</firstname> 17521 </author> 17522 </authorgroup> 17523 <title>Domain Name System Security (DNSSEC) 17524 Signing Authority</title> 17525 <pubdate>November 2000</pubdate> 17526 </biblioentry> 17527 <biblioentry> 17528 <abbrev>RFC3090</abbrev> 17529 <authorgroup> 17530 <author> 17531 <surname>Lewis</surname> 17532 <firstname>E.</firstname> 17533 </author> 17534 </authorgroup> 17535 <title>DNS Security Extension Clarification on Zone Status</title> 17536 <pubdate>March 2001</pubdate> 17537 </biblioentry> 17538 <biblioentry> 17539 <abbrev>RFC3445</abbrev> 17540 <authorgroup> 17541 <author> 17542 <surname>Massey</surname> 17543 <firstname>D.</firstname> 17544 </author> 17545 <author> 17546 <surname>Rose</surname> 17547 <firstname>S.</firstname> 17548 </author> 17549 </authorgroup> 17550 <title>Limiting the Scope of the KEY Resource Record (RR)</title> 17551 <pubdate>December 2002</pubdate> 17552 </biblioentry> 17553 <biblioentry> 17554 <abbrev>RFC3655</abbrev> 17555 <authorgroup> 17556 <author> 17557 <surname>Wellington</surname> 17558 <firstname>B.</firstname> 17559 </author> 17560 <author> 17561 <surname>Gudmundsson</surname> 17562 <firstname>O.</firstname> 17563 </author> 17564 </authorgroup> 17565 <title>Redefinition of DNS Authenticated Data (AD) bit</title> 17566 <pubdate>November 2003</pubdate> 17567 </biblioentry> 17568 <biblioentry> 17569 <abbrev>RFC3658</abbrev> 17570 <authorgroup> 17571 <author> 17572 <surname>Gudmundsson</surname> 17573 <firstname>O.</firstname> 17574 </author> 17575 </authorgroup> 17576 <title>Delegation Signer (DS) Resource Record (RR)</title> 17577 <pubdate>December 2003</pubdate> 17578 </biblioentry> 17579 <biblioentry> 17580 <abbrev>RFC3755</abbrev> 17581 <authorgroup> 17582 <author> 17583 <surname>Weiler</surname> 17584 <firstname>S.</firstname> 17585 </author> 17586 </authorgroup> 17587 <title>Legacy Resolver Compatibility for Delegation Signer (DS)</title> 17588 <pubdate>May 2004</pubdate> 17589 </biblioentry> 17590 <biblioentry> 17591 <abbrev>RFC3757</abbrev> 17592 <authorgroup> 17593 <author> 17594 <surname>Kolkman</surname> 17595 <firstname>O.</firstname> 17596 </author> 17597 <author> 17598 <surname>Schlyter</surname> 17599 <firstname>J.</firstname> 17600 </author> 17601 <author> 17602 <surname>Lewis</surname> 17603 <firstname>E.</firstname> 17604 </author> 17605 </authorgroup> 17606 <title>Domain Name System KEY (DNSKEY) Resource Record 17607 (RR) Secure Entry Point (SEP) Flag</title> 17608 <pubdate>April 2004</pubdate> 17609 </biblioentry> 17610 <biblioentry> 17611 <abbrev>RFC3845</abbrev> 17612 <authorgroup> 17613 <author> 17614 <surname>Schlyter</surname> 17615 <firstname>J.</firstname> 17616 </author> 17617 </authorgroup> 17618 <title>DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format</title> 17619 <pubdate>August 2004</pubdate> 17620 </biblioentry> 17621 </bibliodiv> 17622 </bibliography> 17623 </sect2> 17624 <sect2 id="internet_drafts"> 17625 <title>Internet Drafts</title> 17626 <para> 17627 Internet Drafts (IDs) are rough-draft working documents of 17628 the Internet Engineering Task Force. They are, in essence, RFCs 17629 in the preliminary stages of development. Implementors are 17630 cautioned not 17631 to regard IDs as archival, and they should not be quoted or cited 17632 in any formal documents unless accompanied by the disclaimer that 17633 they are "works in progress." IDs have a lifespan of six months 17634 after which they are deleted unless updated by their authors. 17635 </para> 17636 </sect2> 17637 <sect2> 17638 <title>Other Documents About <acronym>BIND</acronym></title> 17639 <para/> 17640 <bibliography> 17641 <biblioentry> 17642 <authorgroup> 17643 <author> 17644 <surname>Albitz</surname> 17645 <firstname>Paul</firstname> 17646 </author> 17647 <author> 17648 <firstname>Cricket</firstname> 17649 <surname>Liu</surname> 17650 </author> 17651 </authorgroup> 17652 <title><acronym>DNS</acronym> and <acronym>BIND</acronym></title> 17653 <copyright> 17654 <year>1998</year> 17655 <holder>Sebastopol, CA: O'Reilly and Associates</holder> 17656 </copyright> 17657 </biblioentry> 17658 </bibliography> 17659 </sect2> 17660 </sect1> 17661 </appendix> 17662 17663 <appendix id="Bv9ARM.ch12"> 17664 <title>BIND 9 DNS Library Support</title> 17665 <xi:include href="libdns.xml"/> 17666 </appendix> 17667 17668 <reference id="Bv9ARM.ch13"> 17669 <title>Manual pages</title> 17670 <xi:include href="../../bin/dig/dig.docbook"/> 17671 <xi:include href="../../bin/dig/host.docbook"/> 17672 <xi:include href="../../bin/delv/delv.docbook"/> 17673 <xi:include href="../../bin/python/dnssec-checkds.docbook"/> 17674 <xi:include href="../../bin/python/dnssec-coverage.docbook"/> 17675 <xi:include href="../../bin/dnssec/dnssec-dsfromkey.docbook"/> 17676 <xi:include href="../../bin/dnssec/dnssec-importkey.docbook"/> 17677 <xi:include href="../../bin/dnssec/dnssec-keyfromlabel.docbook"/> 17678 <xi:include href="../../bin/dnssec/dnssec-keygen.docbook"/> 17679 <xi:include href="../../bin/dnssec/dnssec-revoke.docbook"/> 17680 <xi:include href="../../bin/dnssec/dnssec-settime.docbook"/> 17681 <xi:include href="../../bin/dnssec/dnssec-signzone.docbook"/> 17682 <xi:include href="../../bin/dnssec/dnssec-verify.docbook"/> 17683 <xi:include href="../../bin/check/named-checkconf.docbook"/> 17684 <xi:include href="../../bin/check/named-checkzone.docbook"/> 17685 <xi:include href="../../bin/named/named.docbook"/> 17686 <xi:include href="../../bin/tools/named-journalprint.docbook"/> 17687 <xi:include href="../../bin/tools/named-rrchecker.docbook"/> 17688 <!-- named.conf.docbook and others? --> 17689 <xi:include href="../../bin/nsupdate/nsupdate.docbook"/> 17690 <xi:include href="../../bin/rndc/rndc.docbook"/> 17691 <xi:include href="../../bin/rndc/rndc.conf.docbook"/> 17692 <xi:include href="../../bin/confgen/rndc-confgen.docbook"/> 17693 <xi:include href="../../bin/confgen/ddns-confgen.docbook"/> 17694 <xi:include href="../../bin/tools/arpaname.docbook"/> 17695 <xi:include href="../../bin/tools/genrandom.docbook"/> 17696 <xi:include href="../../bin/tools/isc-hmac-fixup.docbook"/> 17697 <xi:include href="../../bin/tools/nsec3hash.docbook"/> 17698 </reference> 17699 17700 </book> 17701 17702<!-- 17703 - Local variables: 17704 - mode: sgml 17705 - End: 17706 --> 17707