named.conf revision 200563
1// $FreeBSD: head/etc/namedb/named.conf 200563 2009-12-15 05:14:39Z dougb $ 2// 3// Refer to the named.conf(5) and named(8) man pages, and the documentation 4// in /usr/share/doc/bind9 for more details. 5// 6// If you are going to set up an authoritative server, make sure you 7// understand the hairy details of how DNS works. Even with 8// simple mistakes, you can break connectivity for affected parties, 9// or cause huge amounts of useless Internet traffic. 10 11options { 12 // All file and path names are relative to the chroot directory, 13 // if any, and should be fully qualified. 14 directory "/etc/namedb/working"; 15 pid-file "/var/run/named/pid"; 16 dump-file "/var/dump/named_dump.db"; 17 statistics-file "/var/stats/named.stats"; 18 19// If named is being used only as a local resolver, this is a safe default. 20// For named to be accessible to the network, comment this option, specify 21// the proper IP address, or delete this option. 22 listen-on { 127.0.0.1; }; 23 24// If you have IPv6 enabled on this system, uncomment this option for 25// use as a local resolver. To give access to the network, specify 26// an IPv6 address, or the keyword "any". 27// listen-on-v6 { ::1; }; 28 29// These zones are already covered by the empty zones listed below. 30// If you remove the related empty zones below, comment these lines out. 31 disable-empty-zone "255.255.255.255.IN-ADDR.ARPA"; 32 disable-empty-zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA"; 33 disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA"; 34 35// If you've got a DNS server around at your upstream provider, enter 36// its IP address here, and enable the line below. This will make you 37// benefit from its cache, thus reduce overall DNS traffic in the Internet. 38/* 39 forwarders { 40 127.0.0.1; 41 }; 42*/ 43 44// If the 'forwarders' clause is not empty the default is to 'forward first' 45// which will fall back to sending a query from your local server if the name 46// servers in 'forwarders' do not have the answer. Alternatively you can 47// force your name server to never initiate queries of its own by enabling the 48// following line: 49// forward only; 50 51// If you wish to have forwarding configured automatically based on 52// the entries in /etc/resolv.conf, uncomment the following line and 53// set named_auto_forward=yes in /etc/rc.conf. You can also enable 54// named_auto_forward_only (the effect of which is described above). 55// include "/etc/namedb/auto_forward.conf"; 56 57 /* 58 Modern versions of BIND use a random UDP port for each outgoing 59 query by default in order to dramatically reduce the possibility 60 of cache poisoning. All users are strongly encouraged to utilize 61 this feature, and to configure their firewalls to accommodate it. 62 63 AS A LAST RESORT in order to get around a restrictive firewall 64 policy you can try enabling the option below. Use of this option 65 will significantly reduce your ability to withstand cache poisoning 66 attacks, and should be avoided if at all possible. 67 68 Replace NNNNN in the example with a number between 49160 and 65530. 69 */ 70 // query-source address * port NNNNN; 71}; 72 73// If you enable a local name server, don't forget to enter 127.0.0.1 74// first in your /etc/resolv.conf so this server will be queried. 75// Also, make sure to enable it in /etc/rc.conf. 76 77// The traditional root hints mechanism. Use this, OR the slave zones below. 78zone "." { type hint; file "/etc/namedb/named.root"; }; 79 80/* Slaving the following zones from the root name servers has some 81 significant advantages: 82 1. Faster local resolution for your users 83 2. No spurious traffic will be sent from your network to the roots 84 3. Greater resilience to any potential root server failure/DDoS 85 86 On the other hand, this method requires more monitoring than the 87 hints file to be sure that an unexpected failure mode has not 88 incapacitated your server. Name servers that are serving a lot 89 of clients will benefit more from this approach than individual 90 hosts. Use with caution. 91 92 To use this mechanism, uncomment the entries below, and comment 93 the hint zone above. 94*/ 95/* 96zone "." { 97 type slave; 98 file "/etc/namedb/slave/root.slave"; 99 masters { 100 192.5.5.241; // F.ROOT-SERVERS.NET. 101 }; 102 notify no; 103}; 104zone "arpa" { 105 type slave; 106 file "/etc/namedb/slave/arpa.slave"; 107 masters { 108 192.5.5.241; // F.ROOT-SERVERS.NET. 109 }; 110 notify no; 111}; 112zone "in-addr.arpa" { 113 type slave; 114 file "/etc/namedb/slave/in-addr.arpa.slave"; 115 masters { 116 192.5.5.241; // F.ROOT-SERVERS.NET. 117 }; 118 notify no; 119}; 120*/ 121 122/* Serving the following zones locally will prevent any queries 123 for these zones leaving your network and going to the root 124 name servers. This has two significant advantages: 125 1. Faster local resolution for your users 126 2. No spurious traffic will be sent from your network to the roots 127*/ 128// RFC 1912 129zone "localhost" { type master; file "/etc/namedb/master/localhost-forward.db"; }; 130zone "127.in-addr.arpa" { type master; file "/etc/namedb/master/localhost-reverse.db"; }; 131zone "255.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 132 133// RFC 1912-style zone for IPv6 localhost address 134zone "0.ip6.arpa" { type master; file "/etc/namedb/master/localhost-reverse.db"; }; 135 136// "This" Network (RFCs 1912 and 3330) 137zone "0.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 138 139// Private Use Networks (RFC 1918) 140zone "10.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 141zone "16.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 142zone "17.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 143zone "18.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 144zone "19.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 145zone "20.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 146zone "21.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 147zone "22.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 148zone "23.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 149zone "24.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 150zone "25.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 151zone "26.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 152zone "27.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 153zone "28.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 154zone "29.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 155zone "30.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 156zone "31.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 157zone "168.192.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 158 159// Link-local/APIPA (RFCs 3330 and 3927) 160zone "254.169.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 161 162// TEST-NET for Documentation (RFC 3330) 163zone "2.0.192.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 164 165// Router Benchmark Testing (RFC 3330) 166zone "18.198.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 167zone "19.198.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 168 169// IANA Reserved - Old Class E Space 170zone "240.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 171zone "241.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 172zone "242.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 173zone "243.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 174zone "244.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 175zone "245.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 176zone "246.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 177zone "247.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 178zone "248.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 179zone "249.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 180zone "250.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 181zone "251.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 182zone "252.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 183zone "253.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 184zone "254.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 185 186// IPv6 Unassigned Addresses (RFC 4291) 187zone "1.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 188zone "3.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 189zone "4.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 190zone "5.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 191zone "6.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 192zone "7.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 193zone "8.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 194zone "9.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 195zone "a.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 196zone "b.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 197zone "c.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 198zone "d.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 199zone "e.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 200zone "0.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 201zone "1.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 202zone "2.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 203zone "3.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 204zone "4.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 205zone "5.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 206zone "6.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 207zone "7.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 208zone "8.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 209zone "9.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 210zone "a.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 211zone "b.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 212zone "0.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 213zone "1.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 214zone "2.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 215zone "3.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 216zone "4.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 217zone "5.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 218zone "6.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 219zone "7.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 220 221// IPv6 ULA (RFC 4193) 222zone "c.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 223zone "d.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 224 225// IPv6 Link Local (RFC 4291) 226zone "8.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 227zone "9.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 228zone "a.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 229zone "b.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 230 231// IPv6 Deprecated Site-Local Addresses (RFC 3879) 232zone "c.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 233zone "d.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 234zone "e.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 235zone "f.e.f.ip6.arpa" { type master; file "/etc/namedb/master/empty.db"; }; 236 237// IP6.INT is Deprecated (RFC 4159) 238zone "ip6.int" { type master; file "/etc/namedb/master/empty.db"; }; 239 240// NB: Do not use the IP addresses below, they are faked, and only 241// serve demonstration/documentation purposes! 242// 243// Example slave zone config entries. It can be convenient to become 244// a slave at least for the zone your own domain is in. Ask 245// your network administrator for the IP address of the responsible 246// master name server. 247// 248// Do not forget to include the reverse lookup zone! 249// This is named after the first bytes of the IP address, in reverse 250// order, with ".IN-ADDR.ARPA" appended, or ".IP6.ARPA" for IPv6. 251// 252// Before starting to set up a master zone, make sure you fully 253// understand how DNS and BIND work. There are sometimes 254// non-obvious pitfalls. Setting up a slave zone is usually simpler. 255// 256// NB: Don't blindly enable the examples below. :-) Use actual names 257// and addresses instead. 258 259/* An example dynamic zone 260key "exampleorgkey" { 261 algorithm hmac-md5; 262 secret "sf87HJqjkqh8ac87a02lla=="; 263}; 264zone "example.org" { 265 type master; 266 allow-update { 267 key "exampleorgkey"; 268 }; 269 file "/etc/namedb/dynamic/example.org"; 270}; 271*/ 272 273/* Example of a slave reverse zone 274zone "1.168.192.in-addr.arpa" { 275 type slave; 276 file "/etc/namedb/slave/1.168.192.in-addr.arpa"; 277 masters { 278 192.168.1.1; 279 }; 280}; 281*/ 282