1 2This is a summary of the named.conf options supported by 3this version of BIND 9. 4 5acl <string> { <address_match_element>; ... }; // may occur multiple times 6 7controls { 8 inet ( <ipv4_address> | <ipv6_address> | 9 * ) [ port ( <integer> | * ) ] allow 10 { <address_match_element>; ... } [ 11 keys { <string>; ... } ] [ read-only 12 <boolean> ]; // may occur multiple times 13 unix <quoted_string> perm <integer> 14 owner <integer> group <integer> [ 15 keys { <string>; ... } ] [ read-only 16 <boolean> ]; // may occur multiple times 17}; // may occur multiple times 18 19dlz <string> { 20 database <string>; 21 search <boolean>; 22}; // may occur multiple times 23 24dnssec-policy <string> { 25 dnskey-ttl <duration>; 26 keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime 27 <duration_or_unlimited> algorithm <string> [ <integer> ]; ... }; 28 max-zone-ttl <duration>; 29 nsec3param [ iterations <integer> ] [ optout <boolean> ] [ 30 salt-length <integer> ]; 31 parent-ds-ttl <duration>; 32 parent-propagation-delay <duration>; 33 parent-registration-delay <duration>; // obsolete 34 publish-safety <duration>;
| 1 2This is a summary of the named.conf options supported by 3this version of BIND 9. 4 5acl <string> { <address_match_element>; ... }; // may occur multiple times 6 7controls { 8 inet ( <ipv4_address> | <ipv6_address> | 9 * ) [ port ( <integer> | * ) ] allow 10 { <address_match_element>; ... } [ 11 keys { <string>; ... } ] [ read-only 12 <boolean> ]; // may occur multiple times 13 unix <quoted_string> perm <integer> 14 owner <integer> group <integer> [ 15 keys { <string>; ... } ] [ read-only 16 <boolean> ]; // may occur multiple times 17}; // may occur multiple times 18 19dlz <string> { 20 database <string>; 21 search <boolean>; 22}; // may occur multiple times 23 24dnssec-policy <string> { 25 dnskey-ttl <duration>; 26 keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime 27 <duration_or_unlimited> algorithm <string> [ <integer> ]; ... }; 28 max-zone-ttl <duration>; 29 nsec3param [ iterations <integer> ] [ optout <boolean> ] [ 30 salt-length <integer> ]; 31 parent-ds-ttl <duration>; 32 parent-propagation-delay <duration>; 33 parent-registration-delay <duration>; // obsolete 34 publish-safety <duration>;
|
35 retire-safety <duration>; 36 signatures-refresh <duration>; 37 signatures-validity <duration>; 38 signatures-validity-dnskey <duration>; 39 zone-propagation-delay <duration>; 40}; // may occur multiple times 41 42dyndb <string> <quoted_string> { 43 <unspecified-text> }; // may occur multiple times 44 45key <string> { 46 algorithm <string>; 47 secret <string>; 48}; // may occur multiple times 49 50logging { 51 category <string> { <string>; ... }; // may occur multiple times 52 channel <string> { 53 buffered <boolean>; 54 file <quoted_string> [ versions ( unlimited | <integer> ) ] 55 [ size <size> ] [ suffix ( increment | timestamp ) ]; 56 null; 57 print-category <boolean>; 58 print-severity <boolean>; 59 print-time ( iso8601 | iso8601-utc | local | <boolean> ); 60 severity <log_severity>; 61 stderr; 62 syslog [ <syslog_facility> ]; 63 }; // may occur multiple times 64}; 65 66lwres { <unspecified-text> }; // obsolete, may occur multiple times 67 68managed-keys { <string> ( static-key 69 | initial-key | static-ds | 70 initial-ds ) <integer> <integer> 71 <integer> <quoted_string>; ... }; // may occur multiple times, deprecated 72 73masters <string> [ port <integer> ] [ dscp 74 <integer> ] { ( <primaries> | <ipv4_address> 75 [ port <integer> ] | <ipv6_address> [ port 76 <integer> ] ) [ key <string> ]; ... }; // may occur multiple times 77 78options { 79 acache-cleaning-interval <integer>; // obsolete 80 acache-enable <boolean>; // obsolete 81 additional-from-auth <boolean>; // obsolete 82 additional-from-cache <boolean>; // obsolete 83 allow-new-zones <boolean>; 84 allow-notify { <address_match_element>; ... }; 85 allow-query { <address_match_element>; ... }; 86 allow-query-cache { <address_match_element>; ... }; 87 allow-query-cache-on { <address_match_element>; ... }; 88 allow-query-on { <address_match_element>; ... }; 89 allow-recursion { <address_match_element>; ... }; 90 allow-recursion-on { <address_match_element>; ... }; 91 allow-transfer { <address_match_element>; ... }; 92 allow-update { <address_match_element>; ... }; 93 allow-update-forwarding { <address_match_element>; ... }; 94 allow-v6-synthesis { <address_match_element>; ... }; // obsolete 95 also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> | 96 <ipv4_address> [ port <integer> ] | <ipv6_address> [ port 97 <integer> ] ) [ key <string> ]; ... }; 98 alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) 99 ] [ dscp <integer> ]; 100 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | 101 * ) ] [ dscp <integer> ]; 102 answer-cookie <boolean>; 103 attach-cache <string>; 104 auth-nxdomain <boolean>; // default changed 105 auto-dnssec ( allow | maintain | off ); 106 automatic-interface-scan <boolean>; 107 avoid-v4-udp-ports { <portrange>; ... }; 108 avoid-v6-udp-ports { <portrange>; ... }; 109 bindkeys-file <quoted_string>; 110 blackhole { <address_match_element>; ... }; 111 cache-file <quoted_string>; 112 catalog-zones { zone <string> [ default-masters [ port <integer> ] 113 [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port 114 <integer> ] | <ipv6_address> [ port <integer> ] ) [ key 115 <string> ]; ... } ] [ zone-directory <quoted_string> ] [ 116 in-memory <boolean> ] [ min-update-interval <duration> ]; ... }; 117 check-dup-records ( fail | warn | ignore ); 118 check-integrity <boolean>; 119 check-mx ( fail | warn | ignore ); 120 check-mx-cname ( fail | warn | ignore ); 121 check-names ( primary | master | 122 secondary | slave | response ) ( 123 fail | warn | ignore ); // may occur multiple times 124 check-sibling <boolean>; 125 check-spf ( warn | ignore ); 126 check-srv-cname ( fail | warn | ignore ); 127 check-wildcard <boolean>; 128 cleaning-interval <integer>; // obsolete 129 clients-per-query <integer>; 130 cookie-algorithm ( aes | siphash24 ); 131 cookie-secret <string>; // may occur multiple times 132 coresize ( default | unlimited | <sizeval> ); 133 datasize ( default | unlimited | <sizeval> ); 134 deallocate-on-exit <boolean>; // ancient 135 deny-answer-addresses { <address_match_element>; ... } [ 136 except-from { <string>; ... } ]; 137 deny-answer-aliases { <string>; ... } [ except-from { <string>; ... 138 } ]; 139 dialup ( notify | notify-passive | passive | refresh | <boolean> ); 140 directory <quoted_string>; 141 disable-algorithms <string> { <string>; 142 ... }; // may occur multiple times 143 disable-ds-digests <string> { <string>; 144 ... }; // may occur multiple times 145 disable-empty-zone <string>; // may occur multiple times 146 dns64 <netprefix> { 147 break-dnssec <boolean>; 148 clients { <address_match_element>; ... }; 149 exclude { <address_match_element>; ... }; 150 mapped { <address_match_element>; ... }; 151 recursive-only <boolean>; 152 suffix <ipv6_address>; 153 }; // may occur multiple times 154 dns64-contact <string>; 155 dns64-server <string>; 156 dnskey-sig-validity <integer>; 157 dnsrps-enable <boolean>; // not configured 158 dnsrps-options { <unspecified-text> }; // not configured 159 dnssec-accept-expired <boolean>; 160 dnssec-dnskey-kskonly <boolean>; 161 dnssec-enable <boolean>; // obsolete 162 dnssec-loadkeys-interval <integer>; 163 dnssec-lookaside ( <string> 164 trust-anchor <string> | 165 auto | no ); // obsolete, may occur multiple times 166 dnssec-must-be-secure <string> <boolean>; // may occur multiple times 167 dnssec-policy <string>; 168 dnssec-secure-to-insecure <boolean>; 169 dnssec-update-mode ( maintain | no-resign ); 170 dnssec-validation ( yes | no | auto ); 171 dnstap { ( all | auth | client | forwarder | 172 resolver | update ) [ ( query | response ) ]; 173 ... }; // not configured 174 dnstap-identity ( <quoted_string> | none | 175 hostname ); // not configured 176 dnstap-output ( file | unix ) <quoted_string> [ 177 size ( unlimited | <size> ) ] [ versions ( 178 unlimited | <integer> ) ] [ suffix ( increment 179 | timestamp ) ]; // not configured 180 dnstap-version ( <quoted_string> | none ); // not configured 181 dscp <integer>; 182 dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port 183 <integer> ] [ dscp <integer> ] | <ipv4_address> [ port 184 <integer> ] [ dscp <integer> ] | <ipv6_address> [ port 185 <integer> ] [ dscp <integer> ] ); ... }; 186 dump-file <quoted_string>; 187 edns-udp-size <integer>; 188 empty-contact <string>; 189 empty-server <string>; 190 empty-zones-enable <boolean>; 191 fake-iquery <boolean>; // ancient 192 fetch-glue <boolean>; // ancient 193 fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>; 194 fetches-per-server <integer> [ ( drop | fail ) ]; 195 fetches-per-zone <integer> [ ( drop | fail ) ]; 196 files ( default | unlimited | <sizeval> ); 197 filter-aaaa { <address_match_element>; ... }; // obsolete 198 filter-aaaa-on-v4 <boolean>; // obsolete 199 filter-aaaa-on-v6 <boolean>; // obsolete 200 flush-zones-on-shutdown <boolean>; 201 forward ( first | only ); 202 forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> 203 | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... }; 204 fstrm-set-buffer-hint <integer>; // not configured 205 fstrm-set-flush-timeout <integer>; // not configured 206 fstrm-set-input-queue-size <integer>; // not configured 207 fstrm-set-output-notify-threshold <integer>; // not configured 208 fstrm-set-output-queue-model ( mpsc | spsc ); // not configured 209 fstrm-set-output-queue-size <integer>; // not configured 210 fstrm-set-reopen-interval <duration>; // not configured 211 geoip-directory ( <quoted_string> | none ); 212 geoip-use-ecs <boolean>; // obsolete 213 glue-cache <boolean>; 214 has-old-clients <boolean>; // ancient 215 heartbeat-interval <integer>; 216 host-statistics <boolean>; // ancient 217 host-statistics-max <integer>; // ancient 218 hostname ( <quoted_string> | none ); 219 inline-signing <boolean>; 220 interface-interval <duration>; 221 ixfr-from-differences ( primary | master | secondary | slave | 222 <boolean> ); 223 keep-response-order { <address_match_element>; ... }; 224 key-directory <quoted_string>; 225 lame-ttl <duration>; 226 listen-on [ port <integer> ] [ dscp 227 <integer> ] { 228 <address_match_element>; ... }; // may occur multiple times 229 listen-on-v6 [ port <integer> ] [ dscp 230 <integer> ] { 231 <address_match_element>; ... }; // may occur multiple times 232 lmdb-mapsize <sizeval>; 233 lock-file ( <quoted_string> | none ); 234 maintain-ixfr-base <boolean>; // ancient 235 managed-keys-directory <quoted_string>; 236 masterfile-format ( map | raw | text ); 237 masterfile-style ( full | relative ); 238 match-mapped-addresses <boolean>; 239 max-acache-size ( unlimited | <sizeval> ); // obsolete 240 max-cache-size ( default | unlimited | <sizeval> | <percentage> ); 241 max-cache-ttl <duration>; 242 max-clients-per-query <integer>; 243 max-ixfr-log-size ( default | unlimited | <sizeval> ); // ancient 244 max-ixfr-ratio ( unlimited | <percentage> ); 245 max-journal-size ( default | unlimited | <sizeval> ); 246 max-ncache-ttl <duration>; 247 max-records <integer>; 248 max-recursion-depth <integer>; 249 max-recursion-queries <integer>; 250 max-refresh-time <integer>; 251 max-retry-time <integer>; 252 max-rsa-exponent-size <integer>; 253 max-stale-ttl <duration>; 254 max-transfer-idle-in <integer>; 255 max-transfer-idle-out <integer>; 256 max-transfer-time-in <integer>; 257 max-transfer-time-out <integer>; 258 max-udp-size <integer>; 259 max-zone-ttl ( unlimited | <duration> ); 260 memstatistics <boolean>; 261 memstatistics-file <quoted_string>; 262 message-compression <boolean>; 263 min-cache-ttl <duration>; 264 min-ncache-ttl <duration>; 265 min-refresh-time <integer>; 266 min-retry-time <integer>; 267 min-roots <integer>; // ancient 268 minimal-any <boolean>; 269 minimal-responses ( no-auth | no-auth-recursive | <boolean> ); 270 multi-master <boolean>; 271 multiple-cnames <boolean>; // ancient 272 named-xfer <quoted_string>; // ancient 273 new-zones-directory <quoted_string>; 274 no-case-compress { <address_match_element>; ... }; 275 nocookie-udp-size <integer>; 276 nosit-udp-size <integer>; // obsolete 277 notify ( explicit | master-only | primary-only | <boolean> ); 278 notify-delay <integer>; 279 notify-rate <integer>; 280 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 281 dscp <integer> ]; 282 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] 283 [ dscp <integer> ]; 284 notify-to-soa <boolean>; 285 nsec3-test-zone <boolean>; // test only 286 nta-lifetime <duration>; 287 nta-recheck <duration>; 288 nxdomain-redirect <string>; 289 pid-file ( <quoted_string> | none ); 290 port <integer>; 291 preferred-glue <string>; 292 prefetch <integer> [ <integer> ]; 293 provide-ixfr <boolean>; 294 qname-minimization ( strict | relaxed | disabled | off ); 295 query-source ( ( [ address ] ( <ipv4_address> | * ) [ port ( 296 <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ] 297 port ( <integer> | * ) ) ) [ dscp <integer> ]; 298 query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port ( 299 <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ] 300 port ( <integer> | * ) ) ) [ dscp <integer> ]; 301 querylog <boolean>; 302 queryport-pool-ports <integer>; // obsolete 303 queryport-pool-updateinterval <integer>; // obsolete 304 random-device ( <quoted_string> | none ); 305 rate-limit { 306 all-per-second <integer>; 307 errors-per-second <integer>; 308 exempt-clients { <address_match_element>; ... }; 309 ipv4-prefix-length <integer>; 310 ipv6-prefix-length <integer>; 311 log-only <boolean>; 312 max-table-size <integer>; 313 min-table-size <integer>; 314 nodata-per-second <integer>; 315 nxdomains-per-second <integer>; 316 qps-scale <integer>; 317 referrals-per-second <integer>; 318 responses-per-second <integer>; 319 slip <integer>; 320 window <integer>; 321 }; 322 recursing-file <quoted_string>; 323 recursion <boolean>; 324 recursive-clients <integer>; 325 request-expire <boolean>; 326 request-ixfr <boolean>; 327 request-nsid <boolean>; 328 request-sit <boolean>; // obsolete 329 require-server-cookie <boolean>; 330 reserved-sockets <integer>; 331 resolver-nonbackoff-tries <integer>; 332 resolver-query-timeout <integer>; 333 resolver-retry-interval <integer>; 334 response-padding { <address_match_element>; ... } block-size 335 <integer>; 336 response-policy { zone <string> [ add-soa <boolean> ] [ log 337 <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval 338 <duration> ] [ policy ( cname | disabled | drop | given | no-op 339 | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ 340 recursive-only <boolean> ] [ nsip-enable <boolean> ] [ 341 nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [ 342 break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ 343 min-update-interval <duration> ] [ min-ns-dots <integer> ] [ 344 nsip-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] 345 [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ 346 nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ 347 dnsrps-options { <unspecified-text> } ]; 348 rfc2308-type1 <boolean>; // ancient 349 root-delegation-only [ exclude { <string>; ... } ]; 350 root-key-sentinel <boolean>; 351 rrset-order { [ class <string> ] [ type <string> ] [ name 352 <quoted_string> ] <string> <string>; ... }; 353 secroots-file <quoted_string>; 354 send-cookie <boolean>; 355 serial-queries <integer>; // ancient 356 serial-query-rate <integer>; 357 serial-update-method ( date | increment | unixtime ); 358 server-id ( <quoted_string> | none | hostname ); 359 servfail-ttl <duration>; 360 session-keyalg <string>; 361 session-keyfile ( <quoted_string> | none ); 362 session-keyname <string>; 363 sig-signing-nodes <integer>; 364 sig-signing-signatures <integer>; 365 sig-signing-type <integer>; 366 sig-validity-interval <integer> [ <integer> ]; 367 sit-secret <string>; // obsolete 368 sortlist { <address_match_element>; ... }; 369 stacksize ( default | unlimited | <sizeval> ); 370 stale-answer-client-timeout ( disabled | off | <integer> ); 371 stale-answer-enable <boolean>; 372 stale-answer-ttl <duration>; 373 stale-cache-enable <boolean>; 374 stale-refresh-time <duration>; 375 startup-notify-rate <integer>; 376 statistics-file <quoted_string>; 377 statistics-interval <integer>; // ancient 378 suppress-initial-notify <boolean>; // not yet implemented 379 synth-from-dnssec <boolean>; 380 tcp-advertised-timeout <integer>; 381 tcp-clients <integer>; 382 tcp-idle-timeout <integer>; 383 tcp-initial-timeout <integer>; 384 tcp-keepalive-timeout <integer>; 385 tcp-listen-queue <integer>; 386 tkey-dhkey <quoted_string> <integer>; 387 tkey-domain <quoted_string>; 388 tkey-gssapi-credential <quoted_string>; 389 tkey-gssapi-keytab <quoted_string>; 390 topology { <address_match_element>; ... }; // ancient 391 transfer-format ( many-answers | one-answer ); 392 transfer-message-size <integer>; 393 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 394 dscp <integer> ]; 395 transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 396 ] [ dscp <integer> ]; 397 transfers-in <integer>; 398 transfers-out <integer>; 399 transfers-per-ns <integer>; 400 treat-cr-as-space <boolean>; // ancient 401 trust-anchor-telemetry <boolean>; // experimental 402 try-tcp-refresh <boolean>; 403 update-check-ksk <boolean>; 404 use-alt-transfer-source <boolean>; 405 use-id-pool <boolean>; // ancient 406 use-ixfr <boolean>; // obsolete 407 use-queryport-pool <boolean>; // obsolete 408 use-v4-udp-ports { <portrange>; ... }; 409 use-v6-udp-ports { <portrange>; ... }; 410 v6-bias <integer>; 411 validate-except { <string>; ... }; 412 version ( <quoted_string> | none ); 413 zero-no-soa-ttl <boolean>; 414 zero-no-soa-ttl-cache <boolean>; 415 zone-statistics ( full | terse | none | <boolean> ); 416}; 417 418plugin ( query ) <string> [ { <unspecified-text> 419 } ]; // may occur multiple times 420 421primaries <string> [ port <integer> ] [ dscp 422 <integer> ] { ( <primaries> | <ipv4_address> 423 [ port <integer> ] | <ipv6_address> [ port 424 <integer> ] ) [ key <string> ]; ... }; // may occur multiple times 425 426server <netprefix> { 427 bogus <boolean>; 428 edns <boolean>; 429 edns-udp-size <integer>; 430 edns-version <integer>; 431 keys <server_key>; 432 max-udp-size <integer>; 433 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 434 dscp <integer> ]; 435 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] 436 [ dscp <integer> ]; 437 padding <integer>; 438 provide-ixfr <boolean>; 439 query-source ( ( [ address ] ( <ipv4_address> | * ) [ port ( 440 <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ] 441 port ( <integer> | * ) ) ) [ dscp <integer> ]; 442 query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port ( 443 <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ] 444 port ( <integer> | * ) ) ) [ dscp <integer> ]; 445 request-expire <boolean>; 446 request-ixfr <boolean>; 447 request-nsid <boolean>; 448 request-sit <boolean>; // obsolete 449 send-cookie <boolean>; 450 support-ixfr <boolean>; // obsolete 451 tcp-keepalive <boolean>; 452 tcp-only <boolean>; 453 transfer-format ( many-answers | one-answer ); 454 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 455 dscp <integer> ]; 456 transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 457 ] [ dscp <integer> ]; 458 transfers <integer>; 459}; // may occur multiple times 460 461statistics-channels { 462 inet ( <ipv4_address> | <ipv6_address> | 463 * ) [ port ( <integer> | * ) ] [ 464 allow { <address_match_element>; ... 465 } ]; // may occur multiple times 466}; // may occur multiple times 467 468trust-anchors { <string> ( static-key | 469 initial-key | static-ds | initial-ds ) 470 <integer> <integer> <integer> 471 <quoted_string>; ... }; // may occur multiple times 472 473trusted-keys { <string> <integer> 474 <integer> <integer> 475 <quoted_string>; ... }; // may occur multiple times, deprecated 476 477view <string> [ <class> ] { 478 acache-cleaning-interval <integer>; // obsolete 479 acache-enable <boolean>; // obsolete 480 additional-from-auth <boolean>; // obsolete 481 additional-from-cache <boolean>; // obsolete 482 allow-new-zones <boolean>; 483 allow-notify { <address_match_element>; ... }; 484 allow-query { <address_match_element>; ... }; 485 allow-query-cache { <address_match_element>; ... }; 486 allow-query-cache-on { <address_match_element>; ... }; 487 allow-query-on { <address_match_element>; ... }; 488 allow-recursion { <address_match_element>; ... }; 489 allow-recursion-on { <address_match_element>; ... }; 490 allow-transfer { <address_match_element>; ... }; 491 allow-update { <address_match_element>; ... }; 492 allow-update-forwarding { <address_match_element>; ... }; 493 allow-v6-synthesis { <address_match_element>; ... }; // obsolete 494 also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> | 495 <ipv4_address> [ port <integer> ] | <ipv6_address> [ port 496 <integer> ] ) [ key <string> ]; ... }; 497 alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) 498 ] [ dscp <integer> ]; 499 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | 500 * ) ] [ dscp <integer> ]; 501 attach-cache <string>; 502 auth-nxdomain <boolean>; // default changed 503 auto-dnssec ( allow | maintain | off ); 504 cache-file <quoted_string>; 505 catalog-zones { zone <string> [ default-masters [ port <integer> ] 506 [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port 507 <integer> ] | <ipv6_address> [ port <integer> ] ) [ key 508 <string> ]; ... } ] [ zone-directory <quoted_string> ] [ 509 in-memory <boolean> ] [ min-update-interval <duration> ]; ... }; 510 check-dup-records ( fail | warn | ignore ); 511 check-integrity <boolean>; 512 check-mx ( fail | warn | ignore ); 513 check-mx-cname ( fail | warn | ignore ); 514 check-names ( primary | master | 515 secondary | slave | response ) ( 516 fail | warn | ignore ); // may occur multiple times 517 check-sibling <boolean>; 518 check-spf ( warn | ignore ); 519 check-srv-cname ( fail | warn | ignore ); 520 check-wildcard <boolean>; 521 cleaning-interval <integer>; // obsolete 522 clients-per-query <integer>; 523 deny-answer-addresses { <address_match_element>; ... } [ 524 except-from { <string>; ... } ]; 525 deny-answer-aliases { <string>; ... } [ except-from { <string>; ... 526 } ]; 527 dialup ( notify | notify-passive | passive | refresh | <boolean> ); 528 disable-algorithms <string> { <string>; 529 ... }; // may occur multiple times 530 disable-ds-digests <string> { <string>; 531 ... }; // may occur multiple times 532 disable-empty-zone <string>; // may occur multiple times 533 dlz <string> { 534 database <string>; 535 search <boolean>; 536 }; // may occur multiple times 537 dns64 <netprefix> { 538 break-dnssec <boolean>; 539 clients { <address_match_element>; ... }; 540 exclude { <address_match_element>; ... }; 541 mapped { <address_match_element>; ... }; 542 recursive-only <boolean>; 543 suffix <ipv6_address>; 544 }; // may occur multiple times 545 dns64-contact <string>; 546 dns64-server <string>; 547 dnskey-sig-validity <integer>; 548 dnsrps-enable <boolean>; // not configured 549 dnsrps-options { <unspecified-text> }; // not configured 550 dnssec-accept-expired <boolean>; 551 dnssec-dnskey-kskonly <boolean>; 552 dnssec-enable <boolean>; // obsolete 553 dnssec-loadkeys-interval <integer>; 554 dnssec-lookaside ( <string> 555 trust-anchor <string> | 556 auto | no ); // obsolete, may occur multiple times 557 dnssec-must-be-secure <string> <boolean>; // may occur multiple times 558 dnssec-policy <string>; 559 dnssec-secure-to-insecure <boolean>; 560 dnssec-update-mode ( maintain | no-resign ); 561 dnssec-validation ( yes | no | auto ); 562 dnstap { ( all | auth | client | forwarder | 563 resolver | update ) [ ( query | response ) ]; 564 ... }; // not configured 565 dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port 566 <integer> ] [ dscp <integer> ] | <ipv4_address> [ port 567 <integer> ] [ dscp <integer> ] | <ipv6_address> [ port 568 <integer> ] [ dscp <integer> ] ); ... }; 569 dyndb <string> <quoted_string> { 570 <unspecified-text> }; // may occur multiple times 571 edns-udp-size <integer>; 572 empty-contact <string>; 573 empty-server <string>; 574 empty-zones-enable <boolean>; 575 fetch-glue <boolean>; // ancient 576 fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>; 577 fetches-per-server <integer> [ ( drop | fail ) ]; 578 fetches-per-zone <integer> [ ( drop | fail ) ]; 579 filter-aaaa { <address_match_element>; ... }; // obsolete 580 filter-aaaa-on-v4 <boolean>; // obsolete 581 filter-aaaa-on-v6 <boolean>; // obsolete 582 forward ( first | only ); 583 forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> 584 | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... }; 585 glue-cache <boolean>; 586 inline-signing <boolean>; 587 ixfr-from-differences ( primary | master | secondary | slave | 588 <boolean> ); 589 key <string> { 590 algorithm <string>; 591 secret <string>; 592 }; // may occur multiple times 593 key-directory <quoted_string>; 594 lame-ttl <duration>; 595 lmdb-mapsize <sizeval>; 596 maintain-ixfr-base <boolean>; // ancient 597 managed-keys { <string> ( 598 static-key | initial-key 599 | static-ds | initial-ds 600 ) <integer> <integer> 601 <integer> 602 <quoted_string>; ... }; // may occur multiple times, deprecated 603 masterfile-format ( map | raw | text ); 604 masterfile-style ( full | relative ); 605 match-clients { <address_match_element>; ... }; 606 match-destinations { <address_match_element>; ... }; 607 match-recursive-only <boolean>; 608 max-acache-size ( unlimited | <sizeval> ); // obsolete 609 max-cache-size ( default | unlimited | <sizeval> | <percentage> ); 610 max-cache-ttl <duration>; 611 max-clients-per-query <integer>; 612 max-ixfr-log-size ( default | unlimited | <sizeval> ); // ancient 613 max-ixfr-ratio ( unlimited | <percentage> ); 614 max-journal-size ( default | unlimited | <sizeval> ); 615 max-ncache-ttl <duration>; 616 max-records <integer>; 617 max-recursion-depth <integer>; 618 max-recursion-queries <integer>; 619 max-refresh-time <integer>; 620 max-retry-time <integer>; 621 max-stale-ttl <duration>; 622 max-transfer-idle-in <integer>; 623 max-transfer-idle-out <integer>; 624 max-transfer-time-in <integer>; 625 max-transfer-time-out <integer>; 626 max-udp-size <integer>; 627 max-zone-ttl ( unlimited | <duration> ); 628 message-compression <boolean>; 629 min-cache-ttl <duration>; 630 min-ncache-ttl <duration>; 631 min-refresh-time <integer>; 632 min-retry-time <integer>; 633 min-roots <integer>; // ancient 634 minimal-any <boolean>; 635 minimal-responses ( no-auth | no-auth-recursive | <boolean> ); 636 multi-master <boolean>; 637 new-zones-directory <quoted_string>; 638 no-case-compress { <address_match_element>; ... }; 639 nocookie-udp-size <integer>; 640 nosit-udp-size <integer>; // obsolete 641 notify ( explicit | master-only | primary-only | <boolean> ); 642 notify-delay <integer>; 643 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 644 dscp <integer> ]; 645 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] 646 [ dscp <integer> ]; 647 notify-to-soa <boolean>; 648 nsec3-test-zone <boolean>; // test only 649 nta-lifetime <duration>; 650 nta-recheck <duration>; 651 nxdomain-redirect <string>; 652 plugin ( query ) <string> [ { 653 <unspecified-text> } ]; // may occur multiple times 654 preferred-glue <string>; 655 prefetch <integer> [ <integer> ]; 656 provide-ixfr <boolean>; 657 qname-minimization ( strict | relaxed | disabled | off ); 658 query-source ( ( [ address ] ( <ipv4_address> | * ) [ port ( 659 <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ] 660 port ( <integer> | * ) ) ) [ dscp <integer> ]; 661 query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port ( 662 <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ] 663 port ( <integer> | * ) ) ) [ dscp <integer> ]; 664 queryport-pool-ports <integer>; // obsolete 665 queryport-pool-updateinterval <integer>; // obsolete 666 rate-limit { 667 all-per-second <integer>; 668 errors-per-second <integer>; 669 exempt-clients { <address_match_element>; ... }; 670 ipv4-prefix-length <integer>; 671 ipv6-prefix-length <integer>; 672 log-only <boolean>; 673 max-table-size <integer>; 674 min-table-size <integer>; 675 nodata-per-second <integer>; 676 nxdomains-per-second <integer>; 677 qps-scale <integer>; 678 referrals-per-second <integer>; 679 responses-per-second <integer>; 680 slip <integer>; 681 window <integer>; 682 }; 683 recursion <boolean>; 684 request-expire <boolean>; 685 request-ixfr <boolean>; 686 request-nsid <boolean>; 687 request-sit <boolean>; // obsolete 688 require-server-cookie <boolean>; 689 resolver-nonbackoff-tries <integer>; 690 resolver-query-timeout <integer>; 691 resolver-retry-interval <integer>; 692 response-padding { <address_match_element>; ... } block-size 693 <integer>; 694 response-policy { zone <string> [ add-soa <boolean> ] [ log 695 <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval 696 <duration> ] [ policy ( cname | disabled | drop | given | no-op 697 | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ 698 recursive-only <boolean> ] [ nsip-enable <boolean> ] [ 699 nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [ 700 break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ 701 min-update-interval <duration> ] [ min-ns-dots <integer> ] [ 702 nsip-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] 703 [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ 704 nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ 705 dnsrps-options { <unspecified-text> } ]; 706 rfc2308-type1 <boolean>; // ancient 707 root-delegation-only [ exclude { <string>; ... } ]; 708 root-key-sentinel <boolean>; 709 rrset-order { [ class <string> ] [ type <string> ] [ name 710 <quoted_string> ] <string> <string>; ... }; 711 send-cookie <boolean>; 712 serial-update-method ( date | increment | unixtime ); 713 server <netprefix> { 714 bogus <boolean>; 715 edns <boolean>; 716 edns-udp-size <integer>; 717 edns-version <integer>; 718 keys <server_key>; 719 max-udp-size <integer>; 720 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * 721 ) ] [ dscp <integer> ]; 722 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> 723 | * ) ] [ dscp <integer> ]; 724 padding <integer>; 725 provide-ixfr <boolean>; 726 query-source ( ( [ address ] ( <ipv4_address> | * ) [ port 727 ( <integer> | * ) ] ) | ( [ [ address ] ( 728 <ipv4_address> | * ) ] port ( <integer> | * ) ) ) [ 729 dscp <integer> ]; 730 query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ 731 port ( <integer> | * ) ] ) | ( [ [ address ] ( 732 <ipv6_address> | * ) ] port ( <integer> | * ) ) ) [ 733 dscp <integer> ]; 734 request-expire <boolean>; 735 request-ixfr <boolean>; 736 request-nsid <boolean>; 737 request-sit <boolean>; // obsolete 738 send-cookie <boolean>; 739 support-ixfr <boolean>; // obsolete 740 tcp-keepalive <boolean>; 741 tcp-only <boolean>; 742 transfer-format ( many-answers | one-answer ); 743 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | 744 * ) ] [ dscp <integer> ]; 745 transfer-source-v6 ( <ipv6_address> | * ) [ port ( 746 <integer> | * ) ] [ dscp <integer> ]; 747 transfers <integer>; 748 }; // may occur multiple times 749 servfail-ttl <duration>; 750 sig-signing-nodes <integer>; 751 sig-signing-signatures <integer>; 752 sig-signing-type <integer>; 753 sig-validity-interval <integer> [ <integer> ]; 754 sortlist { <address_match_element>; ... }; 755 stale-answer-client-timeout ( disabled | off | <integer> ); 756 stale-answer-enable <boolean>; 757 stale-answer-ttl <duration>; 758 stale-cache-enable <boolean>; 759 stale-refresh-time <duration>; 760 suppress-initial-notify <boolean>; // not yet implemented 761 synth-from-dnssec <boolean>; 762 topology { <address_match_element>; ... }; // ancient 763 transfer-format ( many-answers | one-answer ); 764 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 765 dscp <integer> ]; 766 transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 767 ] [ dscp <integer> ]; 768 trust-anchor-telemetry <boolean>; // experimental 769 trust-anchors { <string> ( static-key | 770 initial-key | static-ds | initial-ds 771 ) <integer> <integer> <integer> 772 <quoted_string>; ... }; // may occur multiple times 773 trusted-keys { <string> 774 <integer> <integer> 775 <integer> 776 <quoted_string>; ... }; // may occur multiple times, deprecated 777 try-tcp-refresh <boolean>; 778 update-check-ksk <boolean>; 779 use-alt-transfer-source <boolean>; 780 use-queryport-pool <boolean>; // obsolete 781 v6-bias <integer>; 782 validate-except { <string>; ... }; 783 zero-no-soa-ttl <boolean>; 784 zero-no-soa-ttl-cache <boolean>; 785 zone <string> [ <class> ] { 786 allow-notify { <address_match_element>; ... }; 787 allow-query { <address_match_element>; ... }; 788 allow-query-on { <address_match_element>; ... }; 789 allow-transfer { <address_match_element>; ... }; 790 allow-update { <address_match_element>; ... }; 791 allow-update-forwarding { <address_match_element>; ... }; 792 also-notify [ port <integer> ] [ dscp <integer> ] { ( 793 <primaries> | <ipv4_address> [ port <integer> ] | 794 <ipv6_address> [ port <integer> ] ) [ key <string> ]; 795 ... }; 796 alt-transfer-source ( <ipv4_address> | * ) [ port ( 797 <integer> | * ) ] [ dscp <integer> ]; 798 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( 799 <integer> | * ) ] [ dscp <integer> ]; 800 auto-dnssec ( allow | maintain | off ); 801 check-dup-records ( fail | warn | ignore ); 802 check-integrity <boolean>; 803 check-mx ( fail | warn | ignore ); 804 check-mx-cname ( fail | warn | ignore ); 805 check-names ( fail | warn | ignore ); 806 check-sibling <boolean>; 807 check-spf ( warn | ignore ); 808 check-srv-cname ( fail | warn | ignore ); 809 check-wildcard <boolean>; 810 database <string>; 811 delegation-only <boolean>; 812 dialup ( notify | notify-passive | passive | refresh | 813 <boolean> ); 814 dlz <string>; 815 dnskey-sig-validity <integer>; 816 dnssec-dnskey-kskonly <boolean>; 817 dnssec-loadkeys-interval <integer>; 818 dnssec-policy <string>; 819 dnssec-secure-to-insecure <boolean>; 820 dnssec-update-mode ( maintain | no-resign ); 821 file <quoted_string>; 822 forward ( first | only ); 823 forwarders [ port <integer> ] [ dscp <integer> ] { ( 824 <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ 825 dscp <integer> ]; ... }; 826 in-view <string>; 827 inline-signing <boolean>; 828 ixfr-base <quoted_string>; // ancient 829 ixfr-from-differences <boolean>; 830 ixfr-tmp-file <quoted_string>; // ancient 831 journal <quoted_string>; 832 key-directory <quoted_string>; 833 maintain-ixfr-base <boolean>; // ancient 834 masterfile-format ( map | raw | text ); 835 masterfile-style ( full | relative ); 836 masters [ port <integer> ] [ dscp <integer> ] { ( 837 <primaries> | <ipv4_address> [ port <integer> ] | 838 <ipv6_address> [ port <integer> ] ) [ key <string> ]; 839 ... }; 840 max-ixfr-log-size ( default | unlimited | 841 <sizeval> ); // ancient 842 max-ixfr-ratio ( unlimited | <percentage> ); 843 max-journal-size ( default | unlimited | <sizeval> ); 844 max-records <integer>; 845 max-refresh-time <integer>; 846 max-retry-time <integer>; 847 max-transfer-idle-in <integer>; 848 max-transfer-idle-out <integer>; 849 max-transfer-time-in <integer>; 850 max-transfer-time-out <integer>; 851 max-zone-ttl ( unlimited | <duration> ); 852 min-refresh-time <integer>; 853 min-retry-time <integer>; 854 multi-master <boolean>; 855 notify ( explicit | master-only | primary-only | <boolean> ); 856 notify-delay <integer>; 857 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * 858 ) ] [ dscp <integer> ]; 859 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> 860 | * ) ] [ dscp <integer> ]; 861 notify-to-soa <boolean>; 862 nsec3-test-zone <boolean>; // test only 863 primaries [ port <integer> ] [ dscp <integer> ] { ( 864 <primaries> | <ipv4_address> [ port <integer> ] | 865 <ipv6_address> [ port <integer> ] ) [ key <string> ]; 866 ... }; 867 pubkey <integer> <integer> <integer> 868 <quoted_string>; // ancient 869 request-expire <boolean>; 870 request-ixfr <boolean>; 871 serial-update-method ( date | increment | unixtime ); 872 server-addresses { ( <ipv4_address> | <ipv6_address> ); ... }; 873 server-names { <string>; ... }; 874 sig-signing-nodes <integer>; 875 sig-signing-signatures <integer>; 876 sig-signing-type <integer>; 877 sig-validity-interval <integer> [ <integer> ]; 878 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | 879 * ) ] [ dscp <integer> ]; 880 transfer-source-v6 ( <ipv6_address> | * ) [ port ( 881 <integer> | * ) ] [ dscp <integer> ]; 882 try-tcp-refresh <boolean>; 883 type ( primary | master | secondary | slave | mirror | 884 delegation-only | forward | hint | redirect | 885 static-stub | stub ); 886 update-check-ksk <boolean>; 887 update-policy ( local | { ( deny | grant ) <string> ( 888 6to4-self | external | krb5-self | krb5-selfsub | 889 krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | 890 name | self | selfsub | selfwild | subdomain | tcp-self 891 | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... }; 892 use-alt-transfer-source <boolean>; 893 zero-no-soa-ttl <boolean>; 894 zone-statistics ( full | terse | none | <boolean> ); 895 }; // may occur multiple times 896 zone-statistics ( full | terse | none | <boolean> ); 897}; // may occur multiple times 898 899zone <string> [ <class> ] { 900 allow-notify { <address_match_element>; ... }; 901 allow-query { <address_match_element>; ... }; 902 allow-query-on { <address_match_element>; ... }; 903 allow-transfer { <address_match_element>; ... }; 904 allow-update { <address_match_element>; ... }; 905 allow-update-forwarding { <address_match_element>; ... }; 906 also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> | 907 <ipv4_address> [ port <integer> ] | <ipv6_address> [ port 908 <integer> ] ) [ key <string> ]; ... }; 909 alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) 910 ] [ dscp <integer> ]; 911 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | 912 * ) ] [ dscp <integer> ]; 913 auto-dnssec ( allow | maintain | off ); 914 check-dup-records ( fail | warn | ignore ); 915 check-integrity <boolean>; 916 check-mx ( fail | warn | ignore ); 917 check-mx-cname ( fail | warn | ignore ); 918 check-names ( fail | warn | ignore ); 919 check-sibling <boolean>; 920 check-spf ( warn | ignore ); 921 check-srv-cname ( fail | warn | ignore ); 922 check-wildcard <boolean>; 923 database <string>; 924 delegation-only <boolean>; 925 dialup ( notify | notify-passive | passive | refresh | <boolean> ); 926 dlz <string>; 927 dnskey-sig-validity <integer>; 928 dnssec-dnskey-kskonly <boolean>; 929 dnssec-loadkeys-interval <integer>; 930 dnssec-policy <string>; 931 dnssec-secure-to-insecure <boolean>; 932 dnssec-update-mode ( maintain | no-resign ); 933 file <quoted_string>; 934 forward ( first | only ); 935 forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> 936 | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... }; 937 in-view <string>; 938 inline-signing <boolean>; 939 ixfr-base <quoted_string>; // ancient 940 ixfr-from-differences <boolean>; 941 ixfr-tmp-file <quoted_string>; // ancient 942 journal <quoted_string>; 943 key-directory <quoted_string>; 944 maintain-ixfr-base <boolean>; // ancient 945 masterfile-format ( map | raw | text ); 946 masterfile-style ( full | relative ); 947 masters [ port <integer> ] [ dscp <integer> ] { ( <primaries> | 948 <ipv4_address> [ port <integer> ] | <ipv6_address> [ port 949 <integer> ] ) [ key <string> ]; ... }; 950 max-ixfr-log-size ( default | unlimited | <sizeval> ); // ancient 951 max-ixfr-ratio ( unlimited | <percentage> ); 952 max-journal-size ( default | unlimited | <sizeval> ); 953 max-records <integer>; 954 max-refresh-time <integer>; 955 max-retry-time <integer>; 956 max-transfer-idle-in <integer>; 957 max-transfer-idle-out <integer>; 958 max-transfer-time-in <integer>; 959 max-transfer-time-out <integer>; 960 max-zone-ttl ( unlimited | <duration> ); 961 min-refresh-time <integer>; 962 min-retry-time <integer>; 963 multi-master <boolean>; 964 notify ( explicit | master-only | primary-only | <boolean> ); 965 notify-delay <integer>; 966 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 967 dscp <integer> ]; 968 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] 969 [ dscp <integer> ]; 970 notify-to-soa <boolean>; 971 nsec3-test-zone <boolean>; // test only 972 primaries [ port <integer> ] [ dscp <integer> ] { ( <primaries> | 973 <ipv4_address> [ port <integer> ] | <ipv6_address> [ port 974 <integer> ] ) [ key <string> ]; ... }; 975 pubkey <integer> <integer> <integer> <quoted_string>; // ancient 976 request-expire <boolean>; 977 request-ixfr <boolean>; 978 serial-update-method ( date | increment | unixtime ); 979 server-addresses { ( <ipv4_address> | <ipv6_address> ); ... }; 980 server-names { <string>; ... }; 981 sig-signing-nodes <integer>; 982 sig-signing-signatures <integer>; 983 sig-signing-type <integer>; 984 sig-validity-interval <integer> [ <integer> ]; 985 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 986 dscp <integer> ]; 987 transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 988 ] [ dscp <integer> ]; 989 try-tcp-refresh <boolean>; 990 type ( primary | master | secondary | slave | mirror | 991 delegation-only | forward | hint | redirect | static-stub | 992 stub ); 993 update-check-ksk <boolean>; 994 update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | 995 external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self 996 | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild 997 | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] 998 <rrtypelist>; ... }; 999 use-alt-transfer-source <boolean>; 1000 zero-no-soa-ttl <boolean>; 1001 zone-statistics ( full | terse | none | <boolean> ); 1002}; // may occur multiple times 1003
| 36 retire-safety <duration>; 37 signatures-refresh <duration>; 38 signatures-validity <duration>; 39 signatures-validity-dnskey <duration>; 40 zone-propagation-delay <duration>; 41}; // may occur multiple times 42 43dyndb <string> <quoted_string> { 44 <unspecified-text> }; // may occur multiple times 45 46key <string> { 47 algorithm <string>; 48 secret <string>; 49}; // may occur multiple times 50 51logging { 52 category <string> { <string>; ... }; // may occur multiple times 53 channel <string> { 54 buffered <boolean>; 55 file <quoted_string> [ versions ( unlimited | <integer> ) ] 56 [ size <size> ] [ suffix ( increment | timestamp ) ]; 57 null; 58 print-category <boolean>; 59 print-severity <boolean>; 60 print-time ( iso8601 | iso8601-utc | local | <boolean> ); 61 severity <log_severity>; 62 stderr; 63 syslog [ <syslog_facility> ]; 64 }; // may occur multiple times 65}; 66 67lwres { <unspecified-text> }; // obsolete, may occur multiple times 68 69managed-keys { <string> ( static-key 70 | initial-key | static-ds | 71 initial-ds ) <integer> <integer> 72 <integer> <quoted_string>; ... }; // may occur multiple times, deprecated 73 74masters <string> [ port <integer> ] [ dscp 75 <integer> ] { ( <primaries> | <ipv4_address> 76 [ port <integer> ] | <ipv6_address> [ port 77 <integer> ] ) [ key <string> ]; ... }; // may occur multiple times 78 79options { 80 acache-cleaning-interval <integer>; // obsolete 81 acache-enable <boolean>; // obsolete 82 additional-from-auth <boolean>; // obsolete 83 additional-from-cache <boolean>; // obsolete 84 allow-new-zones <boolean>; 85 allow-notify { <address_match_element>; ... }; 86 allow-query { <address_match_element>; ... }; 87 allow-query-cache { <address_match_element>; ... }; 88 allow-query-cache-on { <address_match_element>; ... }; 89 allow-query-on { <address_match_element>; ... }; 90 allow-recursion { <address_match_element>; ... }; 91 allow-recursion-on { <address_match_element>; ... }; 92 allow-transfer { <address_match_element>; ... }; 93 allow-update { <address_match_element>; ... }; 94 allow-update-forwarding { <address_match_element>; ... }; 95 allow-v6-synthesis { <address_match_element>; ... }; // obsolete 96 also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> | 97 <ipv4_address> [ port <integer> ] | <ipv6_address> [ port 98 <integer> ] ) [ key <string> ]; ... }; 99 alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) 100 ] [ dscp <integer> ]; 101 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | 102 * ) ] [ dscp <integer> ]; 103 answer-cookie <boolean>; 104 attach-cache <string>; 105 auth-nxdomain <boolean>; // default changed 106 auto-dnssec ( allow | maintain | off ); 107 automatic-interface-scan <boolean>; 108 avoid-v4-udp-ports { <portrange>; ... }; 109 avoid-v6-udp-ports { <portrange>; ... }; 110 bindkeys-file <quoted_string>; 111 blackhole { <address_match_element>; ... }; 112 cache-file <quoted_string>; 113 catalog-zones { zone <string> [ default-masters [ port <integer> ] 114 [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port 115 <integer> ] | <ipv6_address> [ port <integer> ] ) [ key 116 <string> ]; ... } ] [ zone-directory <quoted_string> ] [ 117 in-memory <boolean> ] [ min-update-interval <duration> ]; ... }; 118 check-dup-records ( fail | warn | ignore ); 119 check-integrity <boolean>; 120 check-mx ( fail | warn | ignore ); 121 check-mx-cname ( fail | warn | ignore ); 122 check-names ( primary | master | 123 secondary | slave | response ) ( 124 fail | warn | ignore ); // may occur multiple times 125 check-sibling <boolean>; 126 check-spf ( warn | ignore ); 127 check-srv-cname ( fail | warn | ignore ); 128 check-wildcard <boolean>; 129 cleaning-interval <integer>; // obsolete 130 clients-per-query <integer>; 131 cookie-algorithm ( aes | siphash24 ); 132 cookie-secret <string>; // may occur multiple times 133 coresize ( default | unlimited | <sizeval> ); 134 datasize ( default | unlimited | <sizeval> ); 135 deallocate-on-exit <boolean>; // ancient 136 deny-answer-addresses { <address_match_element>; ... } [ 137 except-from { <string>; ... } ]; 138 deny-answer-aliases { <string>; ... } [ except-from { <string>; ... 139 } ]; 140 dialup ( notify | notify-passive | passive | refresh | <boolean> ); 141 directory <quoted_string>; 142 disable-algorithms <string> { <string>; 143 ... }; // may occur multiple times 144 disable-ds-digests <string> { <string>; 145 ... }; // may occur multiple times 146 disable-empty-zone <string>; // may occur multiple times 147 dns64 <netprefix> { 148 break-dnssec <boolean>; 149 clients { <address_match_element>; ... }; 150 exclude { <address_match_element>; ... }; 151 mapped { <address_match_element>; ... }; 152 recursive-only <boolean>; 153 suffix <ipv6_address>; 154 }; // may occur multiple times 155 dns64-contact <string>; 156 dns64-server <string>; 157 dnskey-sig-validity <integer>; 158 dnsrps-enable <boolean>; // not configured 159 dnsrps-options { <unspecified-text> }; // not configured 160 dnssec-accept-expired <boolean>; 161 dnssec-dnskey-kskonly <boolean>; 162 dnssec-enable <boolean>; // obsolete 163 dnssec-loadkeys-interval <integer>; 164 dnssec-lookaside ( <string> 165 trust-anchor <string> | 166 auto | no ); // obsolete, may occur multiple times 167 dnssec-must-be-secure <string> <boolean>; // may occur multiple times 168 dnssec-policy <string>; 169 dnssec-secure-to-insecure <boolean>; 170 dnssec-update-mode ( maintain | no-resign ); 171 dnssec-validation ( yes | no | auto ); 172 dnstap { ( all | auth | client | forwarder | 173 resolver | update ) [ ( query | response ) ]; 174 ... }; // not configured 175 dnstap-identity ( <quoted_string> | none | 176 hostname ); // not configured 177 dnstap-output ( file | unix ) <quoted_string> [ 178 size ( unlimited | <size> ) ] [ versions ( 179 unlimited | <integer> ) ] [ suffix ( increment 180 | timestamp ) ]; // not configured 181 dnstap-version ( <quoted_string> | none ); // not configured 182 dscp <integer>; 183 dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port 184 <integer> ] [ dscp <integer> ] | <ipv4_address> [ port 185 <integer> ] [ dscp <integer> ] | <ipv6_address> [ port 186 <integer> ] [ dscp <integer> ] ); ... }; 187 dump-file <quoted_string>; 188 edns-udp-size <integer>; 189 empty-contact <string>; 190 empty-server <string>; 191 empty-zones-enable <boolean>; 192 fake-iquery <boolean>; // ancient 193 fetch-glue <boolean>; // ancient 194 fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>; 195 fetches-per-server <integer> [ ( drop | fail ) ]; 196 fetches-per-zone <integer> [ ( drop | fail ) ]; 197 files ( default | unlimited | <sizeval> ); 198 filter-aaaa { <address_match_element>; ... }; // obsolete 199 filter-aaaa-on-v4 <boolean>; // obsolete 200 filter-aaaa-on-v6 <boolean>; // obsolete 201 flush-zones-on-shutdown <boolean>; 202 forward ( first | only ); 203 forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> 204 | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... }; 205 fstrm-set-buffer-hint <integer>; // not configured 206 fstrm-set-flush-timeout <integer>; // not configured 207 fstrm-set-input-queue-size <integer>; // not configured 208 fstrm-set-output-notify-threshold <integer>; // not configured 209 fstrm-set-output-queue-model ( mpsc | spsc ); // not configured 210 fstrm-set-output-queue-size <integer>; // not configured 211 fstrm-set-reopen-interval <duration>; // not configured 212 geoip-directory ( <quoted_string> | none ); 213 geoip-use-ecs <boolean>; // obsolete 214 glue-cache <boolean>; 215 has-old-clients <boolean>; // ancient 216 heartbeat-interval <integer>; 217 host-statistics <boolean>; // ancient 218 host-statistics-max <integer>; // ancient 219 hostname ( <quoted_string> | none ); 220 inline-signing <boolean>; 221 interface-interval <duration>; 222 ixfr-from-differences ( primary | master | secondary | slave | 223 <boolean> ); 224 keep-response-order { <address_match_element>; ... }; 225 key-directory <quoted_string>; 226 lame-ttl <duration>; 227 listen-on [ port <integer> ] [ dscp 228 <integer> ] { 229 <address_match_element>; ... }; // may occur multiple times 230 listen-on-v6 [ port <integer> ] [ dscp 231 <integer> ] { 232 <address_match_element>; ... }; // may occur multiple times 233 lmdb-mapsize <sizeval>; 234 lock-file ( <quoted_string> | none ); 235 maintain-ixfr-base <boolean>; // ancient 236 managed-keys-directory <quoted_string>; 237 masterfile-format ( map | raw | text ); 238 masterfile-style ( full | relative ); 239 match-mapped-addresses <boolean>; 240 max-acache-size ( unlimited | <sizeval> ); // obsolete 241 max-cache-size ( default | unlimited | <sizeval> | <percentage> ); 242 max-cache-ttl <duration>; 243 max-clients-per-query <integer>; 244 max-ixfr-log-size ( default | unlimited | <sizeval> ); // ancient 245 max-ixfr-ratio ( unlimited | <percentage> ); 246 max-journal-size ( default | unlimited | <sizeval> ); 247 max-ncache-ttl <duration>; 248 max-records <integer>; 249 max-recursion-depth <integer>; 250 max-recursion-queries <integer>; 251 max-refresh-time <integer>; 252 max-retry-time <integer>; 253 max-rsa-exponent-size <integer>; 254 max-stale-ttl <duration>; 255 max-transfer-idle-in <integer>; 256 max-transfer-idle-out <integer>; 257 max-transfer-time-in <integer>; 258 max-transfer-time-out <integer>; 259 max-udp-size <integer>; 260 max-zone-ttl ( unlimited | <duration> ); 261 memstatistics <boolean>; 262 memstatistics-file <quoted_string>; 263 message-compression <boolean>; 264 min-cache-ttl <duration>; 265 min-ncache-ttl <duration>; 266 min-refresh-time <integer>; 267 min-retry-time <integer>; 268 min-roots <integer>; // ancient 269 minimal-any <boolean>; 270 minimal-responses ( no-auth | no-auth-recursive | <boolean> ); 271 multi-master <boolean>; 272 multiple-cnames <boolean>; // ancient 273 named-xfer <quoted_string>; // ancient 274 new-zones-directory <quoted_string>; 275 no-case-compress { <address_match_element>; ... }; 276 nocookie-udp-size <integer>; 277 nosit-udp-size <integer>; // obsolete 278 notify ( explicit | master-only | primary-only | <boolean> ); 279 notify-delay <integer>; 280 notify-rate <integer>; 281 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 282 dscp <integer> ]; 283 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] 284 [ dscp <integer> ]; 285 notify-to-soa <boolean>; 286 nsec3-test-zone <boolean>; // test only 287 nta-lifetime <duration>; 288 nta-recheck <duration>; 289 nxdomain-redirect <string>; 290 pid-file ( <quoted_string> | none ); 291 port <integer>; 292 preferred-glue <string>; 293 prefetch <integer> [ <integer> ]; 294 provide-ixfr <boolean>; 295 qname-minimization ( strict | relaxed | disabled | off ); 296 query-source ( ( [ address ] ( <ipv4_address> | * ) [ port ( 297 <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ] 298 port ( <integer> | * ) ) ) [ dscp <integer> ]; 299 query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port ( 300 <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ] 301 port ( <integer> | * ) ) ) [ dscp <integer> ]; 302 querylog <boolean>; 303 queryport-pool-ports <integer>; // obsolete 304 queryport-pool-updateinterval <integer>; // obsolete 305 random-device ( <quoted_string> | none ); 306 rate-limit { 307 all-per-second <integer>; 308 errors-per-second <integer>; 309 exempt-clients { <address_match_element>; ... }; 310 ipv4-prefix-length <integer>; 311 ipv6-prefix-length <integer>; 312 log-only <boolean>; 313 max-table-size <integer>; 314 min-table-size <integer>; 315 nodata-per-second <integer>; 316 nxdomains-per-second <integer>; 317 qps-scale <integer>; 318 referrals-per-second <integer>; 319 responses-per-second <integer>; 320 slip <integer>; 321 window <integer>; 322 }; 323 recursing-file <quoted_string>; 324 recursion <boolean>; 325 recursive-clients <integer>; 326 request-expire <boolean>; 327 request-ixfr <boolean>; 328 request-nsid <boolean>; 329 request-sit <boolean>; // obsolete 330 require-server-cookie <boolean>; 331 reserved-sockets <integer>; 332 resolver-nonbackoff-tries <integer>; 333 resolver-query-timeout <integer>; 334 resolver-retry-interval <integer>; 335 response-padding { <address_match_element>; ... } block-size 336 <integer>; 337 response-policy { zone <string> [ add-soa <boolean> ] [ log 338 <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval 339 <duration> ] [ policy ( cname | disabled | drop | given | no-op 340 | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ 341 recursive-only <boolean> ] [ nsip-enable <boolean> ] [ 342 nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [ 343 break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ 344 min-update-interval <duration> ] [ min-ns-dots <integer> ] [ 345 nsip-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] 346 [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ 347 nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ 348 dnsrps-options { <unspecified-text> } ]; 349 rfc2308-type1 <boolean>; // ancient 350 root-delegation-only [ exclude { <string>; ... } ]; 351 root-key-sentinel <boolean>; 352 rrset-order { [ class <string> ] [ type <string> ] [ name 353 <quoted_string> ] <string> <string>; ... }; 354 secroots-file <quoted_string>; 355 send-cookie <boolean>; 356 serial-queries <integer>; // ancient 357 serial-query-rate <integer>; 358 serial-update-method ( date | increment | unixtime ); 359 server-id ( <quoted_string> | none | hostname ); 360 servfail-ttl <duration>; 361 session-keyalg <string>; 362 session-keyfile ( <quoted_string> | none ); 363 session-keyname <string>; 364 sig-signing-nodes <integer>; 365 sig-signing-signatures <integer>; 366 sig-signing-type <integer>; 367 sig-validity-interval <integer> [ <integer> ]; 368 sit-secret <string>; // obsolete 369 sortlist { <address_match_element>; ... }; 370 stacksize ( default | unlimited | <sizeval> ); 371 stale-answer-client-timeout ( disabled | off | <integer> ); 372 stale-answer-enable <boolean>; 373 stale-answer-ttl <duration>; 374 stale-cache-enable <boolean>; 375 stale-refresh-time <duration>; 376 startup-notify-rate <integer>; 377 statistics-file <quoted_string>; 378 statistics-interval <integer>; // ancient 379 suppress-initial-notify <boolean>; // not yet implemented 380 synth-from-dnssec <boolean>; 381 tcp-advertised-timeout <integer>; 382 tcp-clients <integer>; 383 tcp-idle-timeout <integer>; 384 tcp-initial-timeout <integer>; 385 tcp-keepalive-timeout <integer>; 386 tcp-listen-queue <integer>; 387 tkey-dhkey <quoted_string> <integer>; 388 tkey-domain <quoted_string>; 389 tkey-gssapi-credential <quoted_string>; 390 tkey-gssapi-keytab <quoted_string>; 391 topology { <address_match_element>; ... }; // ancient 392 transfer-format ( many-answers | one-answer ); 393 transfer-message-size <integer>; 394 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 395 dscp <integer> ]; 396 transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 397 ] [ dscp <integer> ]; 398 transfers-in <integer>; 399 transfers-out <integer>; 400 transfers-per-ns <integer>; 401 treat-cr-as-space <boolean>; // ancient 402 trust-anchor-telemetry <boolean>; // experimental 403 try-tcp-refresh <boolean>; 404 update-check-ksk <boolean>; 405 use-alt-transfer-source <boolean>; 406 use-id-pool <boolean>; // ancient 407 use-ixfr <boolean>; // obsolete 408 use-queryport-pool <boolean>; // obsolete 409 use-v4-udp-ports { <portrange>; ... }; 410 use-v6-udp-ports { <portrange>; ... }; 411 v6-bias <integer>; 412 validate-except { <string>; ... }; 413 version ( <quoted_string> | none ); 414 zero-no-soa-ttl <boolean>; 415 zero-no-soa-ttl-cache <boolean>; 416 zone-statistics ( full | terse | none | <boolean> ); 417}; 418 419plugin ( query ) <string> [ { <unspecified-text> 420 } ]; // may occur multiple times 421 422primaries <string> [ port <integer> ] [ dscp 423 <integer> ] { ( <primaries> | <ipv4_address> 424 [ port <integer> ] | <ipv6_address> [ port 425 <integer> ] ) [ key <string> ]; ... }; // may occur multiple times 426 427server <netprefix> { 428 bogus <boolean>; 429 edns <boolean>; 430 edns-udp-size <integer>; 431 edns-version <integer>; 432 keys <server_key>; 433 max-udp-size <integer>; 434 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 435 dscp <integer> ]; 436 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] 437 [ dscp <integer> ]; 438 padding <integer>; 439 provide-ixfr <boolean>; 440 query-source ( ( [ address ] ( <ipv4_address> | * ) [ port ( 441 <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ] 442 port ( <integer> | * ) ) ) [ dscp <integer> ]; 443 query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port ( 444 <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ] 445 port ( <integer> | * ) ) ) [ dscp <integer> ]; 446 request-expire <boolean>; 447 request-ixfr <boolean>; 448 request-nsid <boolean>; 449 request-sit <boolean>; // obsolete 450 send-cookie <boolean>; 451 support-ixfr <boolean>; // obsolete 452 tcp-keepalive <boolean>; 453 tcp-only <boolean>; 454 transfer-format ( many-answers | one-answer ); 455 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 456 dscp <integer> ]; 457 transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 458 ] [ dscp <integer> ]; 459 transfers <integer>; 460}; // may occur multiple times 461 462statistics-channels { 463 inet ( <ipv4_address> | <ipv6_address> | 464 * ) [ port ( <integer> | * ) ] [ 465 allow { <address_match_element>; ... 466 } ]; // may occur multiple times 467}; // may occur multiple times 468 469trust-anchors { <string> ( static-key | 470 initial-key | static-ds | initial-ds ) 471 <integer> <integer> <integer> 472 <quoted_string>; ... }; // may occur multiple times 473 474trusted-keys { <string> <integer> 475 <integer> <integer> 476 <quoted_string>; ... }; // may occur multiple times, deprecated 477 478view <string> [ <class> ] { 479 acache-cleaning-interval <integer>; // obsolete 480 acache-enable <boolean>; // obsolete 481 additional-from-auth <boolean>; // obsolete 482 additional-from-cache <boolean>; // obsolete 483 allow-new-zones <boolean>; 484 allow-notify { <address_match_element>; ... }; 485 allow-query { <address_match_element>; ... }; 486 allow-query-cache { <address_match_element>; ... }; 487 allow-query-cache-on { <address_match_element>; ... }; 488 allow-query-on { <address_match_element>; ... }; 489 allow-recursion { <address_match_element>; ... }; 490 allow-recursion-on { <address_match_element>; ... }; 491 allow-transfer { <address_match_element>; ... }; 492 allow-update { <address_match_element>; ... }; 493 allow-update-forwarding { <address_match_element>; ... }; 494 allow-v6-synthesis { <address_match_element>; ... }; // obsolete 495 also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> | 496 <ipv4_address> [ port <integer> ] | <ipv6_address> [ port 497 <integer> ] ) [ key <string> ]; ... }; 498 alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) 499 ] [ dscp <integer> ]; 500 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | 501 * ) ] [ dscp <integer> ]; 502 attach-cache <string>; 503 auth-nxdomain <boolean>; // default changed 504 auto-dnssec ( allow | maintain | off ); 505 cache-file <quoted_string>; 506 catalog-zones { zone <string> [ default-masters [ port <integer> ] 507 [ dscp <integer> ] { ( <primaries> | <ipv4_address> [ port 508 <integer> ] | <ipv6_address> [ port <integer> ] ) [ key 509 <string> ]; ... } ] [ zone-directory <quoted_string> ] [ 510 in-memory <boolean> ] [ min-update-interval <duration> ]; ... }; 511 check-dup-records ( fail | warn | ignore ); 512 check-integrity <boolean>; 513 check-mx ( fail | warn | ignore ); 514 check-mx-cname ( fail | warn | ignore ); 515 check-names ( primary | master | 516 secondary | slave | response ) ( 517 fail | warn | ignore ); // may occur multiple times 518 check-sibling <boolean>; 519 check-spf ( warn | ignore ); 520 check-srv-cname ( fail | warn | ignore ); 521 check-wildcard <boolean>; 522 cleaning-interval <integer>; // obsolete 523 clients-per-query <integer>; 524 deny-answer-addresses { <address_match_element>; ... } [ 525 except-from { <string>; ... } ]; 526 deny-answer-aliases { <string>; ... } [ except-from { <string>; ... 527 } ]; 528 dialup ( notify | notify-passive | passive | refresh | <boolean> ); 529 disable-algorithms <string> { <string>; 530 ... }; // may occur multiple times 531 disable-ds-digests <string> { <string>; 532 ... }; // may occur multiple times 533 disable-empty-zone <string>; // may occur multiple times 534 dlz <string> { 535 database <string>; 536 search <boolean>; 537 }; // may occur multiple times 538 dns64 <netprefix> { 539 break-dnssec <boolean>; 540 clients { <address_match_element>; ... }; 541 exclude { <address_match_element>; ... }; 542 mapped { <address_match_element>; ... }; 543 recursive-only <boolean>; 544 suffix <ipv6_address>; 545 }; // may occur multiple times 546 dns64-contact <string>; 547 dns64-server <string>; 548 dnskey-sig-validity <integer>; 549 dnsrps-enable <boolean>; // not configured 550 dnsrps-options { <unspecified-text> }; // not configured 551 dnssec-accept-expired <boolean>; 552 dnssec-dnskey-kskonly <boolean>; 553 dnssec-enable <boolean>; // obsolete 554 dnssec-loadkeys-interval <integer>; 555 dnssec-lookaside ( <string> 556 trust-anchor <string> | 557 auto | no ); // obsolete, may occur multiple times 558 dnssec-must-be-secure <string> <boolean>; // may occur multiple times 559 dnssec-policy <string>; 560 dnssec-secure-to-insecure <boolean>; 561 dnssec-update-mode ( maintain | no-resign ); 562 dnssec-validation ( yes | no | auto ); 563 dnstap { ( all | auth | client | forwarder | 564 resolver | update ) [ ( query | response ) ]; 565 ... }; // not configured 566 dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port 567 <integer> ] [ dscp <integer> ] | <ipv4_address> [ port 568 <integer> ] [ dscp <integer> ] | <ipv6_address> [ port 569 <integer> ] [ dscp <integer> ] ); ... }; 570 dyndb <string> <quoted_string> { 571 <unspecified-text> }; // may occur multiple times 572 edns-udp-size <integer>; 573 empty-contact <string>; 574 empty-server <string>; 575 empty-zones-enable <boolean>; 576 fetch-glue <boolean>; // ancient 577 fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>; 578 fetches-per-server <integer> [ ( drop | fail ) ]; 579 fetches-per-zone <integer> [ ( drop | fail ) ]; 580 filter-aaaa { <address_match_element>; ... }; // obsolete 581 filter-aaaa-on-v4 <boolean>; // obsolete 582 filter-aaaa-on-v6 <boolean>; // obsolete 583 forward ( first | only ); 584 forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> 585 | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... }; 586 glue-cache <boolean>; 587 inline-signing <boolean>; 588 ixfr-from-differences ( primary | master | secondary | slave | 589 <boolean> ); 590 key <string> { 591 algorithm <string>; 592 secret <string>; 593 }; // may occur multiple times 594 key-directory <quoted_string>; 595 lame-ttl <duration>; 596 lmdb-mapsize <sizeval>; 597 maintain-ixfr-base <boolean>; // ancient 598 managed-keys { <string> ( 599 static-key | initial-key 600 | static-ds | initial-ds 601 ) <integer> <integer> 602 <integer> 603 <quoted_string>; ... }; // may occur multiple times, deprecated 604 masterfile-format ( map | raw | text ); 605 masterfile-style ( full | relative ); 606 match-clients { <address_match_element>; ... }; 607 match-destinations { <address_match_element>; ... }; 608 match-recursive-only <boolean>; 609 max-acache-size ( unlimited | <sizeval> ); // obsolete 610 max-cache-size ( default | unlimited | <sizeval> | <percentage> ); 611 max-cache-ttl <duration>; 612 max-clients-per-query <integer>; 613 max-ixfr-log-size ( default | unlimited | <sizeval> ); // ancient 614 max-ixfr-ratio ( unlimited | <percentage> ); 615 max-journal-size ( default | unlimited | <sizeval> ); 616 max-ncache-ttl <duration>; 617 max-records <integer>; 618 max-recursion-depth <integer>; 619 max-recursion-queries <integer>; 620 max-refresh-time <integer>; 621 max-retry-time <integer>; 622 max-stale-ttl <duration>; 623 max-transfer-idle-in <integer>; 624 max-transfer-idle-out <integer>; 625 max-transfer-time-in <integer>; 626 max-transfer-time-out <integer>; 627 max-udp-size <integer>; 628 max-zone-ttl ( unlimited | <duration> ); 629 message-compression <boolean>; 630 min-cache-ttl <duration>; 631 min-ncache-ttl <duration>; 632 min-refresh-time <integer>; 633 min-retry-time <integer>; 634 min-roots <integer>; // ancient 635 minimal-any <boolean>; 636 minimal-responses ( no-auth | no-auth-recursive | <boolean> ); 637 multi-master <boolean>; 638 new-zones-directory <quoted_string>; 639 no-case-compress { <address_match_element>; ... }; 640 nocookie-udp-size <integer>; 641 nosit-udp-size <integer>; // obsolete 642 notify ( explicit | master-only | primary-only | <boolean> ); 643 notify-delay <integer>; 644 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 645 dscp <integer> ]; 646 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] 647 [ dscp <integer> ]; 648 notify-to-soa <boolean>; 649 nsec3-test-zone <boolean>; // test only 650 nta-lifetime <duration>; 651 nta-recheck <duration>; 652 nxdomain-redirect <string>; 653 plugin ( query ) <string> [ { 654 <unspecified-text> } ]; // may occur multiple times 655 preferred-glue <string>; 656 prefetch <integer> [ <integer> ]; 657 provide-ixfr <boolean>; 658 qname-minimization ( strict | relaxed | disabled | off ); 659 query-source ( ( [ address ] ( <ipv4_address> | * ) [ port ( 660 <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ] 661 port ( <integer> | * ) ) ) [ dscp <integer> ]; 662 query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port ( 663 <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ] 664 port ( <integer> | * ) ) ) [ dscp <integer> ]; 665 queryport-pool-ports <integer>; // obsolete 666 queryport-pool-updateinterval <integer>; // obsolete 667 rate-limit { 668 all-per-second <integer>; 669 errors-per-second <integer>; 670 exempt-clients { <address_match_element>; ... }; 671 ipv4-prefix-length <integer>; 672 ipv6-prefix-length <integer>; 673 log-only <boolean>; 674 max-table-size <integer>; 675 min-table-size <integer>; 676 nodata-per-second <integer>; 677 nxdomains-per-second <integer>; 678 qps-scale <integer>; 679 referrals-per-second <integer>; 680 responses-per-second <integer>; 681 slip <integer>; 682 window <integer>; 683 }; 684 recursion <boolean>; 685 request-expire <boolean>; 686 request-ixfr <boolean>; 687 request-nsid <boolean>; 688 request-sit <boolean>; // obsolete 689 require-server-cookie <boolean>; 690 resolver-nonbackoff-tries <integer>; 691 resolver-query-timeout <integer>; 692 resolver-retry-interval <integer>; 693 response-padding { <address_match_element>; ... } block-size 694 <integer>; 695 response-policy { zone <string> [ add-soa <boolean> ] [ log 696 <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval 697 <duration> ] [ policy ( cname | disabled | drop | given | no-op 698 | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ 699 recursive-only <boolean> ] [ nsip-enable <boolean> ] [ 700 nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [ 701 break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ 702 min-update-interval <duration> ] [ min-ns-dots <integer> ] [ 703 nsip-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] 704 [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ 705 nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ 706 dnsrps-options { <unspecified-text> } ]; 707 rfc2308-type1 <boolean>; // ancient 708 root-delegation-only [ exclude { <string>; ... } ]; 709 root-key-sentinel <boolean>; 710 rrset-order { [ class <string> ] [ type <string> ] [ name 711 <quoted_string> ] <string> <string>; ... }; 712 send-cookie <boolean>; 713 serial-update-method ( date | increment | unixtime ); 714 server <netprefix> { 715 bogus <boolean>; 716 edns <boolean>; 717 edns-udp-size <integer>; 718 edns-version <integer>; 719 keys <server_key>; 720 max-udp-size <integer>; 721 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * 722 ) ] [ dscp <integer> ]; 723 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> 724 | * ) ] [ dscp <integer> ]; 725 padding <integer>; 726 provide-ixfr <boolean>; 727 query-source ( ( [ address ] ( <ipv4_address> | * ) [ port 728 ( <integer> | * ) ] ) | ( [ [ address ] ( 729 <ipv4_address> | * ) ] port ( <integer> | * ) ) ) [ 730 dscp <integer> ]; 731 query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ 732 port ( <integer> | * ) ] ) | ( [ [ address ] ( 733 <ipv6_address> | * ) ] port ( <integer> | * ) ) ) [ 734 dscp <integer> ]; 735 request-expire <boolean>; 736 request-ixfr <boolean>; 737 request-nsid <boolean>; 738 request-sit <boolean>; // obsolete 739 send-cookie <boolean>; 740 support-ixfr <boolean>; // obsolete 741 tcp-keepalive <boolean>; 742 tcp-only <boolean>; 743 transfer-format ( many-answers | one-answer ); 744 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | 745 * ) ] [ dscp <integer> ]; 746 transfer-source-v6 ( <ipv6_address> | * ) [ port ( 747 <integer> | * ) ] [ dscp <integer> ]; 748 transfers <integer>; 749 }; // may occur multiple times 750 servfail-ttl <duration>; 751 sig-signing-nodes <integer>; 752 sig-signing-signatures <integer>; 753 sig-signing-type <integer>; 754 sig-validity-interval <integer> [ <integer> ]; 755 sortlist { <address_match_element>; ... }; 756 stale-answer-client-timeout ( disabled | off | <integer> ); 757 stale-answer-enable <boolean>; 758 stale-answer-ttl <duration>; 759 stale-cache-enable <boolean>; 760 stale-refresh-time <duration>; 761 suppress-initial-notify <boolean>; // not yet implemented 762 synth-from-dnssec <boolean>; 763 topology { <address_match_element>; ... }; // ancient 764 transfer-format ( many-answers | one-answer ); 765 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 766 dscp <integer> ]; 767 transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 768 ] [ dscp <integer> ]; 769 trust-anchor-telemetry <boolean>; // experimental 770 trust-anchors { <string> ( static-key | 771 initial-key | static-ds | initial-ds 772 ) <integer> <integer> <integer> 773 <quoted_string>; ... }; // may occur multiple times 774 trusted-keys { <string> 775 <integer> <integer> 776 <integer> 777 <quoted_string>; ... }; // may occur multiple times, deprecated 778 try-tcp-refresh <boolean>; 779 update-check-ksk <boolean>; 780 use-alt-transfer-source <boolean>; 781 use-queryport-pool <boolean>; // obsolete 782 v6-bias <integer>; 783 validate-except { <string>; ... }; 784 zero-no-soa-ttl <boolean>; 785 zero-no-soa-ttl-cache <boolean>; 786 zone <string> [ <class> ] { 787 allow-notify { <address_match_element>; ... }; 788 allow-query { <address_match_element>; ... }; 789 allow-query-on { <address_match_element>; ... }; 790 allow-transfer { <address_match_element>; ... }; 791 allow-update { <address_match_element>; ... }; 792 allow-update-forwarding { <address_match_element>; ... }; 793 also-notify [ port <integer> ] [ dscp <integer> ] { ( 794 <primaries> | <ipv4_address> [ port <integer> ] | 795 <ipv6_address> [ port <integer> ] ) [ key <string> ]; 796 ... }; 797 alt-transfer-source ( <ipv4_address> | * ) [ port ( 798 <integer> | * ) ] [ dscp <integer> ]; 799 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( 800 <integer> | * ) ] [ dscp <integer> ]; 801 auto-dnssec ( allow | maintain | off ); 802 check-dup-records ( fail | warn | ignore ); 803 check-integrity <boolean>; 804 check-mx ( fail | warn | ignore ); 805 check-mx-cname ( fail | warn | ignore ); 806 check-names ( fail | warn | ignore ); 807 check-sibling <boolean>; 808 check-spf ( warn | ignore ); 809 check-srv-cname ( fail | warn | ignore ); 810 check-wildcard <boolean>; 811 database <string>; 812 delegation-only <boolean>; 813 dialup ( notify | notify-passive | passive | refresh | 814 <boolean> ); 815 dlz <string>; 816 dnskey-sig-validity <integer>; 817 dnssec-dnskey-kskonly <boolean>; 818 dnssec-loadkeys-interval <integer>; 819 dnssec-policy <string>; 820 dnssec-secure-to-insecure <boolean>; 821 dnssec-update-mode ( maintain | no-resign ); 822 file <quoted_string>; 823 forward ( first | only ); 824 forwarders [ port <integer> ] [ dscp <integer> ] { ( 825 <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ 826 dscp <integer> ]; ... }; 827 in-view <string>; 828 inline-signing <boolean>; 829 ixfr-base <quoted_string>; // ancient 830 ixfr-from-differences <boolean>; 831 ixfr-tmp-file <quoted_string>; // ancient 832 journal <quoted_string>; 833 key-directory <quoted_string>; 834 maintain-ixfr-base <boolean>; // ancient 835 masterfile-format ( map | raw | text ); 836 masterfile-style ( full | relative ); 837 masters [ port <integer> ] [ dscp <integer> ] { ( 838 <primaries> | <ipv4_address> [ port <integer> ] | 839 <ipv6_address> [ port <integer> ] ) [ key <string> ]; 840 ... }; 841 max-ixfr-log-size ( default | unlimited | 842 <sizeval> ); // ancient 843 max-ixfr-ratio ( unlimited | <percentage> ); 844 max-journal-size ( default | unlimited | <sizeval> ); 845 max-records <integer>; 846 max-refresh-time <integer>; 847 max-retry-time <integer>; 848 max-transfer-idle-in <integer>; 849 max-transfer-idle-out <integer>; 850 max-transfer-time-in <integer>; 851 max-transfer-time-out <integer>; 852 max-zone-ttl ( unlimited | <duration> ); 853 min-refresh-time <integer>; 854 min-retry-time <integer>; 855 multi-master <boolean>; 856 notify ( explicit | master-only | primary-only | <boolean> ); 857 notify-delay <integer>; 858 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * 859 ) ] [ dscp <integer> ]; 860 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> 861 | * ) ] [ dscp <integer> ]; 862 notify-to-soa <boolean>; 863 nsec3-test-zone <boolean>; // test only 864 primaries [ port <integer> ] [ dscp <integer> ] { ( 865 <primaries> | <ipv4_address> [ port <integer> ] | 866 <ipv6_address> [ port <integer> ] ) [ key <string> ]; 867 ... }; 868 pubkey <integer> <integer> <integer> 869 <quoted_string>; // ancient 870 request-expire <boolean>; 871 request-ixfr <boolean>; 872 serial-update-method ( date | increment | unixtime ); 873 server-addresses { ( <ipv4_address> | <ipv6_address> ); ... }; 874 server-names { <string>; ... }; 875 sig-signing-nodes <integer>; 876 sig-signing-signatures <integer>; 877 sig-signing-type <integer>; 878 sig-validity-interval <integer> [ <integer> ]; 879 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | 880 * ) ] [ dscp <integer> ]; 881 transfer-source-v6 ( <ipv6_address> | * ) [ port ( 882 <integer> | * ) ] [ dscp <integer> ]; 883 try-tcp-refresh <boolean>; 884 type ( primary | master | secondary | slave | mirror | 885 delegation-only | forward | hint | redirect | 886 static-stub | stub ); 887 update-check-ksk <boolean>; 888 update-policy ( local | { ( deny | grant ) <string> ( 889 6to4-self | external | krb5-self | krb5-selfsub | 890 krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | 891 name | self | selfsub | selfwild | subdomain | tcp-self 892 | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... }; 893 use-alt-transfer-source <boolean>; 894 zero-no-soa-ttl <boolean>; 895 zone-statistics ( full | terse | none | <boolean> ); 896 }; // may occur multiple times 897 zone-statistics ( full | terse | none | <boolean> ); 898}; // may occur multiple times 899 900zone <string> [ <class> ] { 901 allow-notify { <address_match_element>; ... }; 902 allow-query { <address_match_element>; ... }; 903 allow-query-on { <address_match_element>; ... }; 904 allow-transfer { <address_match_element>; ... }; 905 allow-update { <address_match_element>; ... }; 906 allow-update-forwarding { <address_match_element>; ... }; 907 also-notify [ port <integer> ] [ dscp <integer> ] { ( <primaries> | 908 <ipv4_address> [ port <integer> ] | <ipv6_address> [ port 909 <integer> ] ) [ key <string> ]; ... }; 910 alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) 911 ] [ dscp <integer> ]; 912 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | 913 * ) ] [ dscp <integer> ]; 914 auto-dnssec ( allow | maintain | off ); 915 check-dup-records ( fail | warn | ignore ); 916 check-integrity <boolean>; 917 check-mx ( fail | warn | ignore ); 918 check-mx-cname ( fail | warn | ignore ); 919 check-names ( fail | warn | ignore ); 920 check-sibling <boolean>; 921 check-spf ( warn | ignore ); 922 check-srv-cname ( fail | warn | ignore ); 923 check-wildcard <boolean>; 924 database <string>; 925 delegation-only <boolean>; 926 dialup ( notify | notify-passive | passive | refresh | <boolean> ); 927 dlz <string>; 928 dnskey-sig-validity <integer>; 929 dnssec-dnskey-kskonly <boolean>; 930 dnssec-loadkeys-interval <integer>; 931 dnssec-policy <string>; 932 dnssec-secure-to-insecure <boolean>; 933 dnssec-update-mode ( maintain | no-resign ); 934 file <quoted_string>; 935 forward ( first | only ); 936 forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> 937 | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... }; 938 in-view <string>; 939 inline-signing <boolean>; 940 ixfr-base <quoted_string>; // ancient 941 ixfr-from-differences <boolean>; 942 ixfr-tmp-file <quoted_string>; // ancient 943 journal <quoted_string>; 944 key-directory <quoted_string>; 945 maintain-ixfr-base <boolean>; // ancient 946 masterfile-format ( map | raw | text ); 947 masterfile-style ( full | relative ); 948 masters [ port <integer> ] [ dscp <integer> ] { ( <primaries> | 949 <ipv4_address> [ port <integer> ] | <ipv6_address> [ port 950 <integer> ] ) [ key <string> ]; ... }; 951 max-ixfr-log-size ( default | unlimited | <sizeval> ); // ancient 952 max-ixfr-ratio ( unlimited | <percentage> ); 953 max-journal-size ( default | unlimited | <sizeval> ); 954 max-records <integer>; 955 max-refresh-time <integer>; 956 max-retry-time <integer>; 957 max-transfer-idle-in <integer>; 958 max-transfer-idle-out <integer>; 959 max-transfer-time-in <integer>; 960 max-transfer-time-out <integer>; 961 max-zone-ttl ( unlimited | <duration> ); 962 min-refresh-time <integer>; 963 min-retry-time <integer>; 964 multi-master <boolean>; 965 notify ( explicit | master-only | primary-only | <boolean> ); 966 notify-delay <integer>; 967 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 968 dscp <integer> ]; 969 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] 970 [ dscp <integer> ]; 971 notify-to-soa <boolean>; 972 nsec3-test-zone <boolean>; // test only 973 primaries [ port <integer> ] [ dscp <integer> ] { ( <primaries> | 974 <ipv4_address> [ port <integer> ] | <ipv6_address> [ port 975 <integer> ] ) [ key <string> ]; ... }; 976 pubkey <integer> <integer> <integer> <quoted_string>; // ancient 977 request-expire <boolean>; 978 request-ixfr <boolean>; 979 serial-update-method ( date | increment | unixtime ); 980 server-addresses { ( <ipv4_address> | <ipv6_address> ); ... }; 981 server-names { <string>; ... }; 982 sig-signing-nodes <integer>; 983 sig-signing-signatures <integer>; 984 sig-signing-type <integer>; 985 sig-validity-interval <integer> [ <integer> ]; 986 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 987 dscp <integer> ]; 988 transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 989 ] [ dscp <integer> ]; 990 try-tcp-refresh <boolean>; 991 type ( primary | master | secondary | slave | mirror | 992 delegation-only | forward | hint | redirect | static-stub | 993 stub ); 994 update-check-ksk <boolean>; 995 update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | 996 external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self 997 | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild 998 | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] 999 <rrtypelist>; ... }; 1000 use-alt-transfer-source <boolean>; 1001 zero-no-soa-ttl <boolean>; 1002 zone-statistics ( full | terse | none | <boolean> ); 1003}; // may occur multiple times 1004
|