named.conf revision 200563
1// $FreeBSD: head/etc/namedb/named.conf 200563 2009-12-15 05:14:39Z dougb $
2//
3// Refer to the named.conf(5) and named(8) man pages, and the documentation
4// in /usr/share/doc/bind9 for more details.
5//
6// If you are going to set up an authoritative server, make sure you
7// understand the hairy details of how DNS works.  Even with
8// simple mistakes, you can break connectivity for affected parties,
9// or cause huge amounts of useless Internet traffic.
10
11options {
12	// All file and path names are relative to the chroot directory,
13	// if any, and should be fully qualified.
14	directory	"/etc/namedb/working";
15	pid-file	"/var/run/named/pid";
16	dump-file	"/var/dump/named_dump.db";
17	statistics-file	"/var/stats/named.stats";
18
19// If named is being used only as a local resolver, this is a safe default.
20// For named to be accessible to the network, comment this option, specify
21// the proper IP address, or delete this option.
22	listen-on	{ 127.0.0.1; };
23
24// If you have IPv6 enabled on this system, uncomment this option for
25// use as a local resolver.  To give access to the network, specify
26// an IPv6 address, or the keyword "any".
27//	listen-on-v6	{ ::1; };
28
29// These zones are already covered by the empty zones listed below.
30// If you remove the related empty zones below, comment these lines out.
31	disable-empty-zone "255.255.255.255.IN-ADDR.ARPA";
32	disable-empty-zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";
33	disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";
34
35// If you've got a DNS server around at your upstream provider, enter
36// its IP address here, and enable the line below.  This will make you
37// benefit from its cache, thus reduce overall DNS traffic in the Internet.
38/*
39	forwarders {
40		127.0.0.1;
41	};
42*/
43
44// If the 'forwarders' clause is not empty the default is to 'forward first'
45// which will fall back to sending a query from your local server if the name
46// servers in 'forwarders' do not have the answer.  Alternatively you can
47// force your name server to never initiate queries of its own by enabling the
48// following line:
49//	forward only;
50
51// If you wish to have forwarding configured automatically based on
52// the entries in /etc/resolv.conf, uncomment the following line and
53// set named_auto_forward=yes in /etc/rc.conf.  You can also enable
54// named_auto_forward_only (the effect of which is described above).
55//	include "/etc/namedb/auto_forward.conf";
56
57	/*
58	   Modern versions of BIND use a random UDP port for each outgoing
59	   query by default in order to dramatically reduce the possibility
60	   of cache poisoning.  All users are strongly encouraged to utilize
61	   this feature, and to configure their firewalls to accommodate it.
62
63	   AS A LAST RESORT in order to get around a restrictive firewall
64	   policy you can try enabling the option below.  Use of this option
65	   will significantly reduce your ability to withstand cache poisoning
66	   attacks, and should be avoided if at all possible.
67
68	   Replace NNNNN in the example with a number between 49160 and 65530.
69	*/
70	// query-source address * port NNNNN;
71};
72
73// If you enable a local name server, don't forget to enter 127.0.0.1
74// first in your /etc/resolv.conf so this server will be queried.
75// Also, make sure to enable it in /etc/rc.conf.
76
77// The traditional root hints mechanism. Use this, OR the slave zones below.
78zone "." { type hint; file "/etc/namedb/named.root"; };
79
80/*	Slaving the following zones from the root name servers has some
81	significant advantages:
82	1. Faster local resolution for your users
83	2. No spurious traffic will be sent from your network to the roots
84	3. Greater resilience to any potential root server failure/DDoS
85
86	On the other hand, this method requires more monitoring than the
87	hints file to be sure that an unexpected failure mode has not
88	incapacitated your server.  Name servers that are serving a lot
89	of clients will benefit more from this approach than individual
90	hosts.  Use with caution.
91
92	To use this mechanism, uncomment the entries below, and comment
93	the hint zone above.
94*/
95/*
96zone "." {
97	type slave;
98	file "/etc/namedb/slave/root.slave";
99	masters {
100		192.5.5.241;	// F.ROOT-SERVERS.NET.
101	};
102	notify no;
103};
104zone "arpa" {
105	type slave;
106	file "/etc/namedb/slave/arpa.slave";
107	masters {
108		192.5.5.241;	// F.ROOT-SERVERS.NET.
109	};
110	notify no;
111};
112zone "in-addr.arpa" {
113	type slave;
114	file "/etc/namedb/slave/in-addr.arpa.slave";
115	masters {
116		192.5.5.241;	// F.ROOT-SERVERS.NET.
117	};
118	notify no;
119};
120*/
121
122/*	Serving the following zones locally will prevent any queries
123	for these zones leaving your network and going to the root
124	name servers.  This has two significant advantages:
125	1. Faster local resolution for your users
126	2. No spurious traffic will be sent from your network to the roots
127*/
128// RFC 1912
129zone "localhost"	{ type master; file "/etc/namedb/master/localhost-forward.db"; };
130zone "127.in-addr.arpa"	{ type master; file "/etc/namedb/master/localhost-reverse.db"; };
131zone "255.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
132
133// RFC 1912-style zone for IPv6 localhost address
134zone "0.ip6.arpa"	{ type master; file "/etc/namedb/master/localhost-reverse.db"; };
135
136// "This" Network (RFCs 1912 and 3330)
137zone "0.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
138
139// Private Use Networks (RFC 1918)
140zone "10.in-addr.arpa"	   { type master; file "/etc/namedb/master/empty.db"; };
141zone "16.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
142zone "17.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
143zone "18.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
144zone "19.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
145zone "20.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
146zone "21.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
147zone "22.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
148zone "23.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
149zone "24.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
150zone "25.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
151zone "26.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
152zone "27.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
153zone "28.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
154zone "29.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
155zone "30.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
156zone "31.172.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
157zone "168.192.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
158
159// Link-local/APIPA (RFCs 3330 and 3927)
160zone "254.169.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
161
162// TEST-NET for Documentation (RFC 3330)
163zone "2.0.192.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
164
165// Router Benchmark Testing (RFC 3330)
166zone "18.198.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
167zone "19.198.in-addr.arpa" { type master; file "/etc/namedb/master/empty.db"; };
168
169// IANA Reserved - Old Class E Space
170zone "240.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
171zone "241.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
172zone "242.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
173zone "243.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
174zone "244.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
175zone "245.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
176zone "246.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
177zone "247.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
178zone "248.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
179zone "249.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
180zone "250.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
181zone "251.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
182zone "252.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
183zone "253.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
184zone "254.in-addr.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
185
186// IPv6 Unassigned Addresses (RFC 4291)
187zone "1.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
188zone "3.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
189zone "4.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
190zone "5.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
191zone "6.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
192zone "7.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
193zone "8.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
194zone "9.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
195zone "a.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
196zone "b.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
197zone "c.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
198zone "d.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
199zone "e.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
200zone "0.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
201zone "1.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
202zone "2.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
203zone "3.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
204zone "4.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
205zone "5.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
206zone "6.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
207zone "7.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
208zone "8.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
209zone "9.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
210zone "a.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
211zone "b.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
212zone "0.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
213zone "1.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
214zone "2.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
215zone "3.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
216zone "4.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
217zone "5.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
218zone "6.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
219zone "7.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
220
221// IPv6 ULA (RFC 4193)
222zone "c.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
223zone "d.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
224
225// IPv6 Link Local (RFC 4291)
226zone "8.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
227zone "9.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
228zone "a.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
229zone "b.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
230
231// IPv6 Deprecated Site-Local Addresses (RFC 3879)
232zone "c.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
233zone "d.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
234zone "e.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
235zone "f.e.f.ip6.arpa"	{ type master; file "/etc/namedb/master/empty.db"; };
236
237// IP6.INT is Deprecated (RFC 4159)
238zone "ip6.int"		{ type master; file "/etc/namedb/master/empty.db"; };
239
240// NB: Do not use the IP addresses below, they are faked, and only
241// serve demonstration/documentation purposes!
242//
243// Example slave zone config entries.  It can be convenient to become
244// a slave at least for the zone your own domain is in.  Ask
245// your network administrator for the IP address of the responsible
246// master name server.
247//
248// Do not forget to include the reverse lookup zone!
249// This is named after the first bytes of the IP address, in reverse
250// order, with ".IN-ADDR.ARPA" appended, or ".IP6.ARPA" for IPv6.
251//
252// Before starting to set up a master zone, make sure you fully
253// understand how DNS and BIND work.  There are sometimes
254// non-obvious pitfalls.  Setting up a slave zone is usually simpler.
255//
256// NB: Don't blindly enable the examples below. :-)  Use actual names
257// and addresses instead.
258
259/* An example dynamic zone
260key "exampleorgkey" {
261	algorithm hmac-md5;
262	secret "sf87HJqjkqh8ac87a02lla==";
263};
264zone "example.org" {
265	type master;
266	allow-update {
267		key "exampleorgkey";
268	};
269	file "/etc/namedb/dynamic/example.org";
270};
271*/
272
273/* Example of a slave reverse zone
274zone "1.168.192.in-addr.arpa" {
275	type slave;
276	file "/etc/namedb/slave/1.168.192.in-addr.arpa";
277	masters {
278		192.168.1.1;
279	};
280};
281*/
282