options revision 1.1.1.11
1 2This is a summary of the named.conf options supported by 3this version of BIND 9. 4 5acl <string> { <address_match_element>; ... }; // may occur multiple times 6 7controls { 8 inet ( <ipv4_address> | <ipv6_address> | 9 * ) [ port ( <integer> | * ) ] allow 10 { <address_match_element>; ... } [ 11 keys { <string>; ... } ] [ read-only 12 <boolean> ]; // may occur multiple times 13 unix <quoted_string> perm <integer> 14 owner <integer> group <integer> [ 15 keys { <string>; ... } ] [ read-only 16 <boolean> ]; // may occur multiple times 17}; // may occur multiple times 18 19dlz <string> { 20 database <string>; 21 search <boolean>; 22}; // may occur multiple times 23 24dnssec-policy <string> { 25 dnskey-ttl <duration>; 26 keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime 27 <duration_or_unlimited> algorithm <string> [ <integer> ]; ... }; 28 max-zone-ttl <duration>; 29 nsec3param [ iterations <integer> ] [ optout <boolean> ] [ 30 salt-length <integer> ]; 31 parent-ds-ttl <duration>; 32 parent-propagation-delay <duration>; 33 parent-registration-delay <duration>; // obsolete 34 publish-safety <duration>; 35 purge-keys <duration>; 36 retire-safety <duration>; 37 signatures-refresh <duration>; 38 signatures-validity <duration>; 39 signatures-validity-dnskey <duration>; 40 zone-propagation-delay <duration>; 41}; // may occur multiple times 42 43dyndb <string> <quoted_string> { 44 <unspecified-text> }; // may occur multiple times 45 46key <string> { 47 algorithm <string>; 48 secret <string>; 49}; // may occur multiple times 50 51logging { 52 category <string> { <string>; ... }; // may occur multiple times 53 channel <string> { 54 buffered <boolean>; 55 file <quoted_string> [ versions ( unlimited | <integer> ) ] 56 [ size <size> ] [ suffix ( increment | timestamp ) ]; 57 null; 58 print-category <boolean>; 59 print-severity <boolean>; 60 print-time ( iso8601 | iso8601-utc | local | <boolean> ); 61 severity <log_severity>; 62 stderr; 63 syslog [ <syslog_facility> ]; 64 }; // may occur multiple times 65}; 66 67lwres { <unspecified-text> }; // obsolete, may occur multiple times 68 69managed-keys { <string> ( static-key 70 | initial-key | static-ds | 71 initial-ds ) <integer> <integer> 72 <integer> <quoted_string>; ... }; // may occur multiple times, deprecated 73 74masters <string> [ port <integer> ] [ dscp 75 <integer> ] { ( <remote-servers> | 76 <ipv4_address> [ port <integer> ] | 77 <ipv6_address> [ port <integer> ] ) [ key 78 <string> ]; ... }; // may occur multiple times 79 80options { 81 acache-cleaning-interval <integer>; // obsolete 82 acache-enable <boolean>; // obsolete 83 additional-from-auth <boolean>; // obsolete 84 additional-from-cache <boolean>; // obsolete 85 allow-new-zones <boolean>; 86 allow-notify { <address_match_element>; ... }; 87 allow-query { <address_match_element>; ... }; 88 allow-query-cache { <address_match_element>; ... }; 89 allow-query-cache-on { <address_match_element>; ... }; 90 allow-query-on { <address_match_element>; ... }; 91 allow-recursion { <address_match_element>; ... }; 92 allow-recursion-on { <address_match_element>; ... }; 93 allow-transfer { <address_match_element>; ... }; 94 allow-update { <address_match_element>; ... }; 95 allow-update-forwarding { <address_match_element>; ... }; 96 allow-v6-synthesis { <address_match_element>; ... }; // obsolete 97 also-notify [ port <integer> ] [ dscp <integer> ] { ( 98 <remote-servers> | <ipv4_address> [ port <integer> ] | 99 <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... }; 100 alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) 101 ] [ dscp <integer> ]; 102 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | 103 * ) ] [ dscp <integer> ]; 104 answer-cookie <boolean>; 105 attach-cache <string>; 106 auth-nxdomain <boolean>; // default changed 107 auto-dnssec ( allow | maintain | off ); 108 automatic-interface-scan <boolean>; 109 avoid-v4-udp-ports { <portrange>; ... }; 110 avoid-v6-udp-ports { <portrange>; ... }; 111 bindkeys-file <quoted_string>; 112 blackhole { <address_match_element>; ... }; 113 cache-file <quoted_string>; // deprecated 114 catalog-zones { zone <string> [ default-masters [ port <integer> ] 115 [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port 116 <integer> ] | <ipv6_address> [ port <integer> ] ) [ key 117 <string> ]; ... } ] [ zone-directory <quoted_string> ] [ 118 in-memory <boolean> ] [ min-update-interval <duration> ]; ... }; 119 check-dup-records ( fail | warn | ignore ); 120 check-integrity <boolean>; 121 check-mx ( fail | warn | ignore ); 122 check-mx-cname ( fail | warn | ignore ); 123 check-names ( primary | master | 124 secondary | slave | response ) ( 125 fail | warn | ignore ); // may occur multiple times 126 check-sibling <boolean>; 127 check-spf ( warn | ignore ); 128 check-srv-cname ( fail | warn | ignore ); 129 check-wildcard <boolean>; 130 cleaning-interval <integer>; // obsolete 131 clients-per-query <integer>; 132 cookie-algorithm ( aes | siphash24 ); 133 cookie-secret <string>; // may occur multiple times 134 coresize ( default | unlimited | <sizeval> ); 135 datasize ( default | unlimited | <sizeval> ); 136 deallocate-on-exit <boolean>; // ancient 137 deny-answer-addresses { <address_match_element>; ... } [ 138 except-from { <string>; ... } ]; 139 deny-answer-aliases { <string>; ... } [ except-from { <string>; ... 140 } ]; 141 dialup ( notify | notify-passive | passive | refresh | <boolean> ); 142 directory <quoted_string>; 143 disable-algorithms <string> { <string>; 144 ... }; // may occur multiple times 145 disable-ds-digests <string> { <string>; 146 ... }; // may occur multiple times 147 disable-empty-zone <string>; // may occur multiple times 148 dns64 <netprefix> { 149 break-dnssec <boolean>; 150 clients { <address_match_element>; ... }; 151 exclude { <address_match_element>; ... }; 152 mapped { <address_match_element>; ... }; 153 recursive-only <boolean>; 154 suffix <ipv6_address>; 155 }; // may occur multiple times 156 dns64-contact <string>; 157 dns64-server <string>; 158 dnskey-sig-validity <integer>; 159 dnsrps-enable <boolean>; // not configured 160 dnsrps-options { <unspecified-text> }; // not configured 161 dnssec-accept-expired <boolean>; 162 dnssec-dnskey-kskonly <boolean>; 163 dnssec-enable <boolean>; // obsolete 164 dnssec-loadkeys-interval <integer>; 165 dnssec-lookaside ( <string> 166 trust-anchor <string> | 167 auto | no ); // obsolete, may occur multiple times 168 dnssec-must-be-secure <string> <boolean>; // may occur multiple times 169 dnssec-policy <string>; 170 dnssec-secure-to-insecure <boolean>; 171 dnssec-update-mode ( maintain | no-resign ); 172 dnssec-validation ( yes | no | auto ); 173 dnstap { ( all | auth | client | forwarder | resolver | update ) [ 174 ( query | response ) ]; ... }; 175 dnstap-identity ( <quoted_string> | none | hostname ); 176 dnstap-output ( file | unix ) <quoted_string> [ size ( unlimited | 177 <size> ) ] [ versions ( unlimited | <integer> ) ] [ suffix ( 178 increment | timestamp ) ]; 179 dnstap-version ( <quoted_string> | none ); 180 dscp <integer>; 181 dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port 182 <integer> ] [ dscp <integer> ] | <ipv4_address> [ port 183 <integer> ] [ dscp <integer> ] | <ipv6_address> [ port 184 <integer> ] [ dscp <integer> ] ); ... }; 185 dump-file <quoted_string>; 186 edns-udp-size <integer>; 187 empty-contact <string>; 188 empty-server <string>; 189 empty-zones-enable <boolean>; 190 fake-iquery <boolean>; // ancient 191 fetch-glue <boolean>; // ancient 192 fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>; 193 fetches-per-server <integer> [ ( drop | fail ) ]; 194 fetches-per-zone <integer> [ ( drop | fail ) ]; 195 files ( default | unlimited | <sizeval> ); 196 filter-aaaa { <address_match_element>; ... }; // obsolete 197 filter-aaaa-on-v4 <boolean>; // obsolete 198 filter-aaaa-on-v6 <boolean>; // obsolete 199 flush-zones-on-shutdown <boolean>; 200 forward ( first | only ); 201 forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> 202 | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... }; 203 fstrm-set-buffer-hint <integer>; 204 fstrm-set-flush-timeout <integer>; 205 fstrm-set-input-queue-size <integer>; 206 fstrm-set-output-notify-threshold <integer>; 207 fstrm-set-output-queue-model ( mpsc | spsc ); 208 fstrm-set-output-queue-size <integer>; 209 fstrm-set-reopen-interval <duration>; 210 geoip-directory ( <quoted_string> | none ); 211 geoip-use-ecs <boolean>; // obsolete 212 glue-cache <boolean>; 213 has-old-clients <boolean>; // ancient 214 heartbeat-interval <integer>; 215 host-statistics <boolean>; // ancient 216 host-statistics-max <integer>; // ancient 217 hostname ( <quoted_string> | none ); 218 interface-interval <duration>; 219 ixfr-from-differences ( primary | master | secondary | slave | 220 <boolean> ); 221 keep-response-order { <address_match_element>; ... }; 222 key-directory <quoted_string>; 223 lame-ttl <duration>; 224 listen-on [ port <integer> ] [ dscp 225 <integer> ] { 226 <address_match_element>; ... }; // may occur multiple times 227 listen-on-v6 [ port <integer> ] [ dscp 228 <integer> ] { 229 <address_match_element>; ... }; // may occur multiple times 230 lmdb-mapsize <sizeval>; 231 lock-file ( <quoted_string> | none ); 232 maintain-ixfr-base <boolean>; // ancient 233 managed-keys-directory <quoted_string>; 234 masterfile-format ( map | raw | text ); 235 masterfile-style ( full | relative ); 236 match-mapped-addresses <boolean>; 237 max-acache-size ( unlimited | <sizeval> ); // obsolete 238 max-cache-size ( default | unlimited | <sizeval> | <percentage> ); 239 max-cache-ttl <duration>; 240 max-clients-per-query <integer>; 241 max-ixfr-log-size ( default | unlimited | <sizeval> ); // ancient 242 max-ixfr-ratio ( unlimited | <percentage> ); 243 max-journal-size ( default | unlimited | <sizeval> ); 244 max-ncache-ttl <duration>; 245 max-records <integer>; 246 max-recursion-depth <integer>; 247 max-recursion-queries <integer>; 248 max-refresh-time <integer>; 249 max-retry-time <integer>; 250 max-rsa-exponent-size <integer>; 251 max-stale-ttl <duration>; 252 max-transfer-idle-in <integer>; 253 max-transfer-idle-out <integer>; 254 max-transfer-time-in <integer>; 255 max-transfer-time-out <integer>; 256 max-udp-size <integer>; 257 max-zone-ttl ( unlimited | <duration> ); 258 memstatistics <boolean>; 259 memstatistics-file <quoted_string>; 260 message-compression <boolean>; 261 min-cache-ttl <duration>; 262 min-ncache-ttl <duration>; 263 min-refresh-time <integer>; 264 min-retry-time <integer>; 265 min-roots <integer>; // ancient 266 minimal-any <boolean>; 267 minimal-responses ( no-auth | no-auth-recursive | <boolean> ); 268 multi-master <boolean>; 269 multiple-cnames <boolean>; // ancient 270 named-xfer <quoted_string>; // ancient 271 new-zones-directory <quoted_string>; 272 no-case-compress { <address_match_element>; ... }; 273 nocookie-udp-size <integer>; 274 nosit-udp-size <integer>; // obsolete 275 notify ( explicit | master-only | primary-only | <boolean> ); 276 notify-delay <integer>; 277 notify-rate <integer>; 278 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 279 dscp <integer> ]; 280 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] 281 [ dscp <integer> ]; 282 notify-to-soa <boolean>; 283 nsec3-test-zone <boolean>; // test only 284 nta-lifetime <duration>; 285 nta-recheck <duration>; 286 nxdomain-redirect <string>; 287 parental-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 288 dscp <integer> ]; 289 parental-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 290 ] [ dscp <integer> ]; 291 pid-file ( <quoted_string> | none ); 292 port <integer>; 293 preferred-glue <string>; 294 prefetch <integer> [ <integer> ]; 295 provide-ixfr <boolean>; 296 qname-minimization ( strict | relaxed | disabled | off ); 297 query-source ( ( [ address ] ( <ipv4_address> | * ) [ port ( 298 <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ] 299 port ( <integer> | * ) ) ) [ dscp <integer> ]; 300 query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port ( 301 <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ] 302 port ( <integer> | * ) ) ) [ dscp <integer> ]; 303 querylog <boolean>; 304 queryport-pool-ports <integer>; // obsolete 305 queryport-pool-updateinterval <integer>; // obsolete 306 random-device ( <quoted_string> | none ); 307 rate-limit { 308 all-per-second <integer>; 309 errors-per-second <integer>; 310 exempt-clients { <address_match_element>; ... }; 311 ipv4-prefix-length <integer>; 312 ipv6-prefix-length <integer>; 313 log-only <boolean>; 314 max-table-size <integer>; 315 min-table-size <integer>; 316 nodata-per-second <integer>; 317 nxdomains-per-second <integer>; 318 qps-scale <integer>; 319 referrals-per-second <integer>; 320 responses-per-second <integer>; 321 slip <integer>; 322 window <integer>; 323 }; 324 recursing-file <quoted_string>; 325 recursion <boolean>; 326 recursive-clients <integer>; 327 request-expire <boolean>; 328 request-ixfr <boolean>; 329 request-nsid <boolean>; 330 request-sit <boolean>; // obsolete 331 require-server-cookie <boolean>; 332 reserved-sockets <integer>; 333 resolver-nonbackoff-tries <integer>; 334 resolver-query-timeout <integer>; 335 resolver-retry-interval <integer>; 336 response-padding { <address_match_element>; ... } block-size 337 <integer>; 338 response-policy { zone <string> [ add-soa <boolean> ] [ log 339 <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval 340 <duration> ] [ policy ( cname | disabled | drop | given | no-op 341 | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ 342 recursive-only <boolean> ] [ nsip-enable <boolean> ] [ 343 nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [ 344 break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ 345 min-update-interval <duration> ] [ min-ns-dots <integer> ] [ 346 nsip-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] 347 [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ 348 nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ 349 dnsrps-options { <unspecified-text> } ]; 350 reuseport <boolean>; 351 rfc2308-type1 <boolean>; // ancient 352 root-delegation-only [ exclude { <string>; ... } ]; 353 root-key-sentinel <boolean>; 354 rrset-order { [ class <string> ] [ type <string> ] [ name 355 <quoted_string> ] <string> <string>; ... }; 356 secroots-file <quoted_string>; 357 send-cookie <boolean>; 358 serial-queries <integer>; // ancient 359 serial-query-rate <integer>; 360 serial-update-method ( date | increment | unixtime ); 361 server-id ( <quoted_string> | none | hostname ); 362 servfail-ttl <duration>; 363 session-keyalg <string>; 364 session-keyfile ( <quoted_string> | none ); 365 session-keyname <string>; 366 sig-signing-nodes <integer>; 367 sig-signing-signatures <integer>; 368 sig-signing-type <integer>; 369 sig-validity-interval <integer> [ <integer> ]; 370 sit-secret <string>; // obsolete 371 sortlist { <address_match_element>; ... }; 372 stacksize ( default | unlimited | <sizeval> ); 373 stale-answer-client-timeout ( disabled | off | <integer> ); 374 stale-answer-enable <boolean>; 375 stale-answer-ttl <duration>; 376 stale-cache-enable <boolean>; 377 stale-refresh-time <duration>; 378 startup-notify-rate <integer>; 379 statistics-file <quoted_string>; 380 statistics-interval <integer>; // ancient 381 suppress-initial-notify <boolean>; // not yet implemented 382 synth-from-dnssec <boolean>; 383 tcp-advertised-timeout <integer>; 384 tcp-clients <integer>; 385 tcp-idle-timeout <integer>; 386 tcp-initial-timeout <integer>; 387 tcp-keepalive-timeout <integer>; 388 tcp-listen-queue <integer>; 389 tkey-dhkey <quoted_string> <integer>; 390 tkey-domain <quoted_string>; 391 tkey-gssapi-credential <quoted_string>; 392 tkey-gssapi-keytab <quoted_string>; 393 topology { <address_match_element>; ... }; // ancient 394 transfer-format ( many-answers | one-answer ); 395 transfer-message-size <integer>; 396 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 397 dscp <integer> ]; 398 transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 399 ] [ dscp <integer> ]; 400 transfers-in <integer>; 401 transfers-out <integer>; 402 transfers-per-ns <integer>; 403 treat-cr-as-space <boolean>; // ancient 404 trust-anchor-telemetry <boolean>; // experimental 405 try-tcp-refresh <boolean>; 406 update-check-ksk <boolean>; 407 use-alt-transfer-source <boolean>; 408 use-id-pool <boolean>; // ancient 409 use-ixfr <boolean>; // obsolete 410 use-queryport-pool <boolean>; // obsolete 411 use-v4-udp-ports { <portrange>; ... }; 412 use-v6-udp-ports { <portrange>; ... }; 413 v6-bias <integer>; 414 validate-except { <string>; ... }; 415 version ( <quoted_string> | none ); 416 zero-no-soa-ttl <boolean>; 417 zero-no-soa-ttl-cache <boolean>; 418 zone-statistics ( full | terse | none | <boolean> ); 419}; 420 421parental-agents <string> [ port <integer> ] [ 422 dscp <integer> ] { ( <remote-servers> | 423 <ipv4_address> [ port <integer> ] | 424 <ipv6_address> [ port <integer> ] ) [ key 425 <string> ]; ... }; // may occur multiple times 426 427plugin ( query ) <string> [ { <unspecified-text> 428 } ]; // may occur multiple times 429 430primaries <string> [ port <integer> ] [ dscp 431 <integer> ] { ( <remote-servers> | 432 <ipv4_address> [ port <integer> ] | 433 <ipv6_address> [ port <integer> ] ) [ key 434 <string> ]; ... }; // may occur multiple times 435 436server <netprefix> { 437 bogus <boolean>; 438 edns <boolean>; 439 edns-udp-size <integer>; 440 edns-version <integer>; 441 keys <server_key>; 442 max-udp-size <integer>; 443 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 444 dscp <integer> ]; 445 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] 446 [ dscp <integer> ]; 447 padding <integer>; 448 provide-ixfr <boolean>; 449 query-source ( ( [ address ] ( <ipv4_address> | * ) [ port ( 450 <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ] 451 port ( <integer> | * ) ) ) [ dscp <integer> ]; 452 query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port ( 453 <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ] 454 port ( <integer> | * ) ) ) [ dscp <integer> ]; 455 request-expire <boolean>; 456 request-ixfr <boolean>; 457 request-nsid <boolean>; 458 request-sit <boolean>; // obsolete 459 send-cookie <boolean>; 460 support-ixfr <boolean>; // obsolete 461 tcp-keepalive <boolean>; 462 tcp-only <boolean>; 463 transfer-format ( many-answers | one-answer ); 464 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 465 dscp <integer> ]; 466 transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 467 ] [ dscp <integer> ]; 468 transfers <integer>; 469}; // may occur multiple times 470 471statistics-channels { 472 inet ( <ipv4_address> | <ipv6_address> | 473 * ) [ port ( <integer> | * ) ] [ 474 allow { <address_match_element>; ... 475 } ]; // may occur multiple times 476}; // may occur multiple times 477 478trust-anchors { <string> ( static-key | 479 initial-key | static-ds | initial-ds ) 480 <integer> <integer> <integer> 481 <quoted_string>; ... }; // may occur multiple times 482 483trusted-keys { <string> <integer> 484 <integer> <integer> 485 <quoted_string>; ... }; // may occur multiple times, deprecated 486 487view <string> [ <class> ] { 488 acache-cleaning-interval <integer>; // obsolete 489 acache-enable <boolean>; // obsolete 490 additional-from-auth <boolean>; // obsolete 491 additional-from-cache <boolean>; // obsolete 492 allow-new-zones <boolean>; 493 allow-notify { <address_match_element>; ... }; 494 allow-query { <address_match_element>; ... }; 495 allow-query-cache { <address_match_element>; ... }; 496 allow-query-cache-on { <address_match_element>; ... }; 497 allow-query-on { <address_match_element>; ... }; 498 allow-recursion { <address_match_element>; ... }; 499 allow-recursion-on { <address_match_element>; ... }; 500 allow-transfer { <address_match_element>; ... }; 501 allow-update { <address_match_element>; ... }; 502 allow-update-forwarding { <address_match_element>; ... }; 503 allow-v6-synthesis { <address_match_element>; ... }; // obsolete 504 also-notify [ port <integer> ] [ dscp <integer> ] { ( 505 <remote-servers> | <ipv4_address> [ port <integer> ] | 506 <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... }; 507 alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) 508 ] [ dscp <integer> ]; 509 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | 510 * ) ] [ dscp <integer> ]; 511 attach-cache <string>; 512 auth-nxdomain <boolean>; // default changed 513 auto-dnssec ( allow | maintain | off ); 514 cache-file <quoted_string>; // deprecated 515 catalog-zones { zone <string> [ default-masters [ port <integer> ] 516 [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port 517 <integer> ] | <ipv6_address> [ port <integer> ] ) [ key 518 <string> ]; ... } ] [ zone-directory <quoted_string> ] [ 519 in-memory <boolean> ] [ min-update-interval <duration> ]; ... }; 520 check-dup-records ( fail | warn | ignore ); 521 check-integrity <boolean>; 522 check-mx ( fail | warn | ignore ); 523 check-mx-cname ( fail | warn | ignore ); 524 check-names ( primary | master | 525 secondary | slave | response ) ( 526 fail | warn | ignore ); // may occur multiple times 527 check-sibling <boolean>; 528 check-spf ( warn | ignore ); 529 check-srv-cname ( fail | warn | ignore ); 530 check-wildcard <boolean>; 531 cleaning-interval <integer>; // obsolete 532 clients-per-query <integer>; 533 deny-answer-addresses { <address_match_element>; ... } [ 534 except-from { <string>; ... } ]; 535 deny-answer-aliases { <string>; ... } [ except-from { <string>; ... 536 } ]; 537 dialup ( notify | notify-passive | passive | refresh | <boolean> ); 538 disable-algorithms <string> { <string>; 539 ... }; // may occur multiple times 540 disable-ds-digests <string> { <string>; 541 ... }; // may occur multiple times 542 disable-empty-zone <string>; // may occur multiple times 543 dlz <string> { 544 database <string>; 545 search <boolean>; 546 }; // may occur multiple times 547 dns64 <netprefix> { 548 break-dnssec <boolean>; 549 clients { <address_match_element>; ... }; 550 exclude { <address_match_element>; ... }; 551 mapped { <address_match_element>; ... }; 552 recursive-only <boolean>; 553 suffix <ipv6_address>; 554 }; // may occur multiple times 555 dns64-contact <string>; 556 dns64-server <string>; 557 dnskey-sig-validity <integer>; 558 dnsrps-enable <boolean>; // not configured 559 dnsrps-options { <unspecified-text> }; // not configured 560 dnssec-accept-expired <boolean>; 561 dnssec-dnskey-kskonly <boolean>; 562 dnssec-enable <boolean>; // obsolete 563 dnssec-loadkeys-interval <integer>; 564 dnssec-lookaside ( <string> 565 trust-anchor <string> | 566 auto | no ); // obsolete, may occur multiple times 567 dnssec-must-be-secure <string> <boolean>; // may occur multiple times 568 dnssec-policy <string>; 569 dnssec-secure-to-insecure <boolean>; 570 dnssec-update-mode ( maintain | no-resign ); 571 dnssec-validation ( yes | no | auto ); 572 dnstap { ( all | auth | client | forwarder | resolver | update ) [ 573 ( query | response ) ]; ... }; 574 dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port 575 <integer> ] [ dscp <integer> ] | <ipv4_address> [ port 576 <integer> ] [ dscp <integer> ] | <ipv6_address> [ port 577 <integer> ] [ dscp <integer> ] ); ... }; 578 dyndb <string> <quoted_string> { 579 <unspecified-text> }; // may occur multiple times 580 edns-udp-size <integer>; 581 empty-contact <string>; 582 empty-server <string>; 583 empty-zones-enable <boolean>; 584 fetch-glue <boolean>; // ancient 585 fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>; 586 fetches-per-server <integer> [ ( drop | fail ) ]; 587 fetches-per-zone <integer> [ ( drop | fail ) ]; 588 filter-aaaa { <address_match_element>; ... }; // obsolete 589 filter-aaaa-on-v4 <boolean>; // obsolete 590 filter-aaaa-on-v6 <boolean>; // obsolete 591 forward ( first | only ); 592 forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> 593 | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... }; 594 glue-cache <boolean>; 595 ixfr-from-differences ( primary | master | secondary | slave | 596 <boolean> ); 597 key <string> { 598 algorithm <string>; 599 secret <string>; 600 }; // may occur multiple times 601 key-directory <quoted_string>; 602 lame-ttl <duration>; 603 lmdb-mapsize <sizeval>; 604 maintain-ixfr-base <boolean>; // ancient 605 managed-keys { <string> ( 606 static-key | initial-key 607 | static-ds | initial-ds 608 ) <integer> <integer> 609 <integer> 610 <quoted_string>; ... }; // may occur multiple times, deprecated 611 masterfile-format ( map | raw | text ); 612 masterfile-style ( full | relative ); 613 match-clients { <address_match_element>; ... }; 614 match-destinations { <address_match_element>; ... }; 615 match-recursive-only <boolean>; 616 max-acache-size ( unlimited | <sizeval> ); // obsolete 617 max-cache-size ( default | unlimited | <sizeval> | <percentage> ); 618 max-cache-ttl <duration>; 619 max-clients-per-query <integer>; 620 max-ixfr-log-size ( default | unlimited | <sizeval> ); // ancient 621 max-ixfr-ratio ( unlimited | <percentage> ); 622 max-journal-size ( default | unlimited | <sizeval> ); 623 max-ncache-ttl <duration>; 624 max-records <integer>; 625 max-recursion-depth <integer>; 626 max-recursion-queries <integer>; 627 max-refresh-time <integer>; 628 max-retry-time <integer>; 629 max-stale-ttl <duration>; 630 max-transfer-idle-in <integer>; 631 max-transfer-idle-out <integer>; 632 max-transfer-time-in <integer>; 633 max-transfer-time-out <integer>; 634 max-udp-size <integer>; 635 max-zone-ttl ( unlimited | <duration> ); 636 message-compression <boolean>; 637 min-cache-ttl <duration>; 638 min-ncache-ttl <duration>; 639 min-refresh-time <integer>; 640 min-retry-time <integer>; 641 min-roots <integer>; // ancient 642 minimal-any <boolean>; 643 minimal-responses ( no-auth | no-auth-recursive | <boolean> ); 644 multi-master <boolean>; 645 new-zones-directory <quoted_string>; 646 no-case-compress { <address_match_element>; ... }; 647 nocookie-udp-size <integer>; 648 nosit-udp-size <integer>; // obsolete 649 notify ( explicit | master-only | primary-only | <boolean> ); 650 notify-delay <integer>; 651 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 652 dscp <integer> ]; 653 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] 654 [ dscp <integer> ]; 655 notify-to-soa <boolean>; 656 nsec3-test-zone <boolean>; // test only 657 nta-lifetime <duration>; 658 nta-recheck <duration>; 659 nxdomain-redirect <string>; 660 parental-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 661 dscp <integer> ]; 662 parental-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 663 ] [ dscp <integer> ]; 664 plugin ( query ) <string> [ { 665 <unspecified-text> } ]; // may occur multiple times 666 preferred-glue <string>; 667 prefetch <integer> [ <integer> ]; 668 provide-ixfr <boolean>; 669 qname-minimization ( strict | relaxed | disabled | off ); 670 query-source ( ( [ address ] ( <ipv4_address> | * ) [ port ( 671 <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ] 672 port ( <integer> | * ) ) ) [ dscp <integer> ]; 673 query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port ( 674 <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ] 675 port ( <integer> | * ) ) ) [ dscp <integer> ]; 676 queryport-pool-ports <integer>; // obsolete 677 queryport-pool-updateinterval <integer>; // obsolete 678 rate-limit { 679 all-per-second <integer>; 680 errors-per-second <integer>; 681 exempt-clients { <address_match_element>; ... }; 682 ipv4-prefix-length <integer>; 683 ipv6-prefix-length <integer>; 684 log-only <boolean>; 685 max-table-size <integer>; 686 min-table-size <integer>; 687 nodata-per-second <integer>; 688 nxdomains-per-second <integer>; 689 qps-scale <integer>; 690 referrals-per-second <integer>; 691 responses-per-second <integer>; 692 slip <integer>; 693 window <integer>; 694 }; 695 recursion <boolean>; 696 request-expire <boolean>; 697 request-ixfr <boolean>; 698 request-nsid <boolean>; 699 request-sit <boolean>; // obsolete 700 require-server-cookie <boolean>; 701 resolver-nonbackoff-tries <integer>; 702 resolver-query-timeout <integer>; 703 resolver-retry-interval <integer>; 704 response-padding { <address_match_element>; ... } block-size 705 <integer>; 706 response-policy { zone <string> [ add-soa <boolean> ] [ log 707 <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval 708 <duration> ] [ policy ( cname | disabled | drop | given | no-op 709 | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ 710 recursive-only <boolean> ] [ nsip-enable <boolean> ] [ 711 nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [ 712 break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ 713 min-update-interval <duration> ] [ min-ns-dots <integer> ] [ 714 nsip-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] 715 [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ 716 nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ 717 dnsrps-options { <unspecified-text> } ]; 718 rfc2308-type1 <boolean>; // ancient 719 root-delegation-only [ exclude { <string>; ... } ]; 720 root-key-sentinel <boolean>; 721 rrset-order { [ class <string> ] [ type <string> ] [ name 722 <quoted_string> ] <string> <string>; ... }; 723 send-cookie <boolean>; 724 serial-update-method ( date | increment | unixtime ); 725 server <netprefix> { 726 bogus <boolean>; 727 edns <boolean>; 728 edns-udp-size <integer>; 729 edns-version <integer>; 730 keys <server_key>; 731 max-udp-size <integer>; 732 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * 733 ) ] [ dscp <integer> ]; 734 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> 735 | * ) ] [ dscp <integer> ]; 736 padding <integer>; 737 provide-ixfr <boolean>; 738 query-source ( ( [ address ] ( <ipv4_address> | * ) [ port 739 ( <integer> | * ) ] ) | ( [ [ address ] ( 740 <ipv4_address> | * ) ] port ( <integer> | * ) ) ) [ 741 dscp <integer> ]; 742 query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ 743 port ( <integer> | * ) ] ) | ( [ [ address ] ( 744 <ipv6_address> | * ) ] port ( <integer> | * ) ) ) [ 745 dscp <integer> ]; 746 request-expire <boolean>; 747 request-ixfr <boolean>; 748 request-nsid <boolean>; 749 request-sit <boolean>; // obsolete 750 send-cookie <boolean>; 751 support-ixfr <boolean>; // obsolete 752 tcp-keepalive <boolean>; 753 tcp-only <boolean>; 754 transfer-format ( many-answers | one-answer ); 755 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | 756 * ) ] [ dscp <integer> ]; 757 transfer-source-v6 ( <ipv6_address> | * ) [ port ( 758 <integer> | * ) ] [ dscp <integer> ]; 759 transfers <integer>; 760 }; // may occur multiple times 761 servfail-ttl <duration>; 762 sig-signing-nodes <integer>; 763 sig-signing-signatures <integer>; 764 sig-signing-type <integer>; 765 sig-validity-interval <integer> [ <integer> ]; 766 sortlist { <address_match_element>; ... }; 767 stale-answer-client-timeout ( disabled | off | <integer> ); 768 stale-answer-enable <boolean>; 769 stale-answer-ttl <duration>; 770 stale-cache-enable <boolean>; 771 stale-refresh-time <duration>; 772 suppress-initial-notify <boolean>; // not yet implemented 773 synth-from-dnssec <boolean>; 774 topology { <address_match_element>; ... }; // ancient 775 transfer-format ( many-answers | one-answer ); 776 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 777 dscp <integer> ]; 778 transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 779 ] [ dscp <integer> ]; 780 trust-anchor-telemetry <boolean>; // experimental 781 trust-anchors { <string> ( static-key | 782 initial-key | static-ds | initial-ds 783 ) <integer> <integer> <integer> 784 <quoted_string>; ... }; // may occur multiple times 785 trusted-keys { <string> 786 <integer> <integer> 787 <integer> 788 <quoted_string>; ... }; // may occur multiple times, deprecated 789 try-tcp-refresh <boolean>; 790 update-check-ksk <boolean>; 791 use-alt-transfer-source <boolean>; 792 use-queryport-pool <boolean>; // obsolete 793 v6-bias <integer>; 794 validate-except { <string>; ... }; 795 zero-no-soa-ttl <boolean>; 796 zero-no-soa-ttl-cache <boolean>; 797 zone <string> [ <class> ] { 798 allow-notify { <address_match_element>; ... }; 799 allow-query { <address_match_element>; ... }; 800 allow-query-on { <address_match_element>; ... }; 801 allow-transfer { <address_match_element>; ... }; 802 allow-update { <address_match_element>; ... }; 803 allow-update-forwarding { <address_match_element>; ... }; 804 also-notify [ port <integer> ] [ dscp <integer> ] { ( 805 <remote-servers> | <ipv4_address> [ port <integer> ] | 806 <ipv6_address> [ port <integer> ] ) [ key <string> ]; 807 ... }; 808 alt-transfer-source ( <ipv4_address> | * ) [ port ( 809 <integer> | * ) ] [ dscp <integer> ]; 810 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( 811 <integer> | * ) ] [ dscp <integer> ]; 812 auto-dnssec ( allow | maintain | off ); 813 check-dup-records ( fail | warn | ignore ); 814 check-integrity <boolean>; 815 check-mx ( fail | warn | ignore ); 816 check-mx-cname ( fail | warn | ignore ); 817 check-names ( fail | warn | ignore ); 818 check-sibling <boolean>; 819 check-spf ( warn | ignore ); 820 check-srv-cname ( fail | warn | ignore ); 821 check-wildcard <boolean>; 822 database <string>; 823 delegation-only <boolean>; 824 dialup ( notify | notify-passive | passive | refresh | 825 <boolean> ); 826 dlz <string>; 827 dnskey-sig-validity <integer>; 828 dnssec-dnskey-kskonly <boolean>; 829 dnssec-loadkeys-interval <integer>; 830 dnssec-policy <string>; 831 dnssec-secure-to-insecure <boolean>; 832 dnssec-update-mode ( maintain | no-resign ); 833 file <quoted_string>; 834 forward ( first | only ); 835 forwarders [ port <integer> ] [ dscp <integer> ] { ( 836 <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ 837 dscp <integer> ]; ... }; 838 in-view <string>; 839 inline-signing <boolean>; 840 ixfr-base <quoted_string>; // ancient 841 ixfr-from-differences <boolean>; 842 ixfr-tmp-file <quoted_string>; // ancient 843 journal <quoted_string>; 844 key-directory <quoted_string>; 845 maintain-ixfr-base <boolean>; // ancient 846 masterfile-format ( map | raw | text ); 847 masterfile-style ( full | relative ); 848 masters [ port <integer> ] [ dscp <integer> ] { ( 849 <remote-servers> | <ipv4_address> [ port <integer> ] | 850 <ipv6_address> [ port <integer> ] ) [ key <string> ]; 851 ... }; 852 max-ixfr-log-size ( default | unlimited | 853 <sizeval> ); // ancient 854 max-ixfr-ratio ( unlimited | <percentage> ); 855 max-journal-size ( default | unlimited | <sizeval> ); 856 max-records <integer>; 857 max-refresh-time <integer>; 858 max-retry-time <integer>; 859 max-transfer-idle-in <integer>; 860 max-transfer-idle-out <integer>; 861 max-transfer-time-in <integer>; 862 max-transfer-time-out <integer>; 863 max-zone-ttl ( unlimited | <duration> ); 864 min-refresh-time <integer>; 865 min-retry-time <integer>; 866 multi-master <boolean>; 867 notify ( explicit | master-only | primary-only | <boolean> ); 868 notify-delay <integer>; 869 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * 870 ) ] [ dscp <integer> ]; 871 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> 872 | * ) ] [ dscp <integer> ]; 873 notify-to-soa <boolean>; 874 nsec3-test-zone <boolean>; // test only 875 parental-agents [ port <integer> ] [ dscp <integer> ] { ( 876 <remote-servers> | <ipv4_address> [ port <integer> ] | 877 <ipv6_address> [ port <integer> ] ) [ key <string> ]; 878 ... }; 879 parental-source ( <ipv4_address> | * ) [ port ( <integer> | 880 * ) ] [ dscp <integer> ]; 881 parental-source-v6 ( <ipv6_address> | * ) [ port ( 882 <integer> | * ) ] [ dscp <integer> ]; 883 primaries [ port <integer> ] [ dscp <integer> ] { ( 884 <remote-servers> | <ipv4_address> [ port <integer> ] | 885 <ipv6_address> [ port <integer> ] ) [ key <string> ]; 886 ... }; 887 pubkey <integer> <integer> <integer> 888 <quoted_string>; // ancient 889 request-expire <boolean>; 890 request-ixfr <boolean>; 891 serial-update-method ( date | increment | unixtime ); 892 server-addresses { ( <ipv4_address> | <ipv6_address> ); ... }; 893 server-names { <string>; ... }; 894 sig-signing-nodes <integer>; 895 sig-signing-signatures <integer>; 896 sig-signing-type <integer>; 897 sig-validity-interval <integer> [ <integer> ]; 898 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | 899 * ) ] [ dscp <integer> ]; 900 transfer-source-v6 ( <ipv6_address> | * ) [ port ( 901 <integer> | * ) ] [ dscp <integer> ]; 902 try-tcp-refresh <boolean>; 903 type ( primary | master | secondary | slave | mirror | 904 delegation-only | forward | hint | redirect | 905 static-stub | stub ); 906 update-check-ksk <boolean>; 907 update-policy ( local | { ( deny | grant ) <string> ( 908 6to4-self | external | krb5-self | krb5-selfsub | 909 krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | 910 name | self | selfsub | selfwild | subdomain | tcp-self 911 | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... }; 912 use-alt-transfer-source <boolean>; 913 zero-no-soa-ttl <boolean>; 914 zone-statistics ( full | terse | none | <boolean> ); 915 }; // may occur multiple times 916 zone-statistics ( full | terse | none | <boolean> ); 917}; // may occur multiple times 918 919zone <string> [ <class> ] { 920 allow-notify { <address_match_element>; ... }; 921 allow-query { <address_match_element>; ... }; 922 allow-query-on { <address_match_element>; ... }; 923 allow-transfer { <address_match_element>; ... }; 924 allow-update { <address_match_element>; ... }; 925 allow-update-forwarding { <address_match_element>; ... }; 926 also-notify [ port <integer> ] [ dscp <integer> ] { ( 927 <remote-servers> | <ipv4_address> [ port <integer> ] | 928 <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... }; 929 alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) 930 ] [ dscp <integer> ]; 931 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | 932 * ) ] [ dscp <integer> ]; 933 auto-dnssec ( allow | maintain | off ); 934 check-dup-records ( fail | warn | ignore ); 935 check-integrity <boolean>; 936 check-mx ( fail | warn | ignore ); 937 check-mx-cname ( fail | warn | ignore ); 938 check-names ( fail | warn | ignore ); 939 check-sibling <boolean>; 940 check-spf ( warn | ignore ); 941 check-srv-cname ( fail | warn | ignore ); 942 check-wildcard <boolean>; 943 database <string>; 944 delegation-only <boolean>; 945 dialup ( notify | notify-passive | passive | refresh | <boolean> ); 946 dlz <string>; 947 dnskey-sig-validity <integer>; 948 dnssec-dnskey-kskonly <boolean>; 949 dnssec-loadkeys-interval <integer>; 950 dnssec-policy <string>; 951 dnssec-secure-to-insecure <boolean>; 952 dnssec-update-mode ( maintain | no-resign ); 953 file <quoted_string>; 954 forward ( first | only ); 955 forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> 956 | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... }; 957 in-view <string>; 958 inline-signing <boolean>; 959 ixfr-base <quoted_string>; // ancient 960 ixfr-from-differences <boolean>; 961 ixfr-tmp-file <quoted_string>; // ancient 962 journal <quoted_string>; 963 key-directory <quoted_string>; 964 maintain-ixfr-base <boolean>; // ancient 965 masterfile-format ( map | raw | text ); 966 masterfile-style ( full | relative ); 967 masters [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> 968 | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port 969 <integer> ] ) [ key <string> ]; ... }; 970 max-ixfr-log-size ( default | unlimited | <sizeval> ); // ancient 971 max-ixfr-ratio ( unlimited | <percentage> ); 972 max-journal-size ( default | unlimited | <sizeval> ); 973 max-records <integer>; 974 max-refresh-time <integer>; 975 max-retry-time <integer>; 976 max-transfer-idle-in <integer>; 977 max-transfer-idle-out <integer>; 978 max-transfer-time-in <integer>; 979 max-transfer-time-out <integer>; 980 max-zone-ttl ( unlimited | <duration> ); 981 min-refresh-time <integer>; 982 min-retry-time <integer>; 983 multi-master <boolean>; 984 notify ( explicit | master-only | primary-only | <boolean> ); 985 notify-delay <integer>; 986 notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 987 dscp <integer> ]; 988 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] 989 [ dscp <integer> ]; 990 notify-to-soa <boolean>; 991 nsec3-test-zone <boolean>; // test only 992 parental-agents [ port <integer> ] [ dscp <integer> ] { ( 993 <remote-servers> | <ipv4_address> [ port <integer> ] | 994 <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... }; 995 parental-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 996 dscp <integer> ]; 997 parental-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 998 ] [ dscp <integer> ]; 999 primaries [ port <integer> ] [ dscp <integer> ] { ( 1000 <remote-servers> | <ipv4_address> [ port <integer> ] | 1001 <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... }; 1002 pubkey <integer> <integer> <integer> <quoted_string>; // ancient 1003 request-expire <boolean>; 1004 request-ixfr <boolean>; 1005 serial-update-method ( date | increment | unixtime ); 1006 server-addresses { ( <ipv4_address> | <ipv6_address> ); ... }; 1007 server-names { <string>; ... }; 1008 sig-signing-nodes <integer>; 1009 sig-signing-signatures <integer>; 1010 sig-signing-type <integer>; 1011 sig-validity-interval <integer> [ <integer> ]; 1012 transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ 1013 dscp <integer> ]; 1014 transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) 1015 ] [ dscp <integer> ]; 1016 try-tcp-refresh <boolean>; 1017 type ( primary | master | secondary | slave | mirror | 1018 delegation-only | forward | hint | redirect | static-stub | 1019 stub ); 1020 update-check-ksk <boolean>; 1021 update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | 1022 external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self 1023 | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild 1024 | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] 1025 <rrtypelist>; ... }; 1026 use-alt-transfer-source <boolean>; 1027 zero-no-soa-ttl <boolean>; 1028 zone-statistics ( full | terse | none | <boolean> ); 1029}; // may occur multiple times 1030 1031