NAMED.CONF(5)

NAME
named.conf - configuration file for **named**

SYNOPSIS

named.conf

DESCRIPTION

named.conf is the configuration file for named. Statements are enclosed in braces and terminated with a semi-colon. Clauses in the statements are also semi-colon terminated. The usual comment styles are supported:

C style: /* */ C++ style: // to end of line

Unix style: # to end of line

  ACL

acl string { address_match_element; ... };

  CONTROLS

controls {
      inet ( ipv4_address | ipv6_address |
          * ) [ port ( integer | * ) ] allow
          { address_match_element; ... } [
          keys { string; ... } ] [ read-only
          boolean ];
      unix quoted_string perm integer
          owner integer group integer [
          keys { string; ... } ] [ read-only
          boolean ];
};

  DLZ

dlz string {
      database string;
      search boolean;
};

  DNSSEC-POLICY

dnssec-policy string {
      dnskey-ttl duration;
      keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
          duration_or_unlimited algorithm string [ integer ]; ... };
      max-zone-ttl duration;
      nsec3param [ iterations integer ] [ optout boolean ] [
          salt-length integer ];
      parent-ds-ttl duration;
      parent-propagation-delay duration;
      publish-safety duration;
      purge-keys duration;
      retire-safety duration;
      signatures-refresh duration;
      signatures-validity duration;
      signatures-validity-dnskey duration;
      zone-propagation-delay duration;
};

  DYNDB

dyndb string quoted_string {
    unspecified-text };

  HTTP

http string {
      endpoints { quoted_string; ... };
      listener-clients integer;
      streams-per-connection integer;
};

  KEY

key string {
      algorithm string;
      secret string;
};

  LOGGING

logging {
      category string { string; ... };
      channel string {
              buffered boolean;
              file quoted_string [ versions ( unlimited | integer ) ]
                  [ size size ] [ suffix ( increment | timestamp ) ];
              null;
              print-category boolean;
              print-severity boolean;
              print-time ( iso8601 | iso8601-utc | local | boolean );
              severity log_severity;
              stderr;
              syslog [ syslog_facility ];
      };
};

  MANAGED-KEYS

See DNSSEC-KEYS.

managed-keys { string ( static-key
    | initial-key | static-ds |
    initial-ds ) integer integer
    integer quoted_string; ... };, deprecated

  OPTIONS

options {
      allow-new-zones boolean;
      allow-notify { address_match_element; ... };
      allow-query { address_match_element; ... };
      allow-query-cache { address_match_element; ... };
      allow-query-cache-on { address_match_element; ... };
      allow-query-on { address_match_element; ... };
      allow-recursion { address_match_element; ... };
      allow-recursion-on { address_match_element; ... };
      allow-transfer [ port integer ] [ transport string ] {
          address_match_element; ... };
      allow-update { address_match_element; ... };
      allow-update-forwarding { address_match_element; ... };
      also-notify [ port integer ] [ dscp integer ] { (
          remote-servers | ipv4_address [ port integer ] |
          ipv6_address [ port integer ] ) [ key string ] [ tls
          string ]; ... };
      alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
          ] [ dscp integer ];
      alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
          * ) ] [ dscp integer ];
      answer-cookie boolean;
      attach-cache string;
      auth-nxdomain boolean;
      auto-dnssec ( allow | maintain | off );
      automatic-interface-scan boolean;
      avoid-v4-udp-ports { portrange; ... };
      avoid-v6-udp-ports { portrange; ... };
      bindkeys-file quoted_string;
      blackhole { address_match_element; ... };
      catalog-zones { zone string [ default-primaries [ port integer
          ] [ dscp integer ] { ( remote-servers | ipv4_address [
          port integer ] | ipv6_address [ port integer ] ) [ key
          string ] [ tls string ]; ... } ] [ zone-directory
          quoted_string ] [ in-memory boolean ] [ min-update-interval
          duration ]; ... };
      check-dup-records ( fail | warn | ignore );
      check-integrity boolean;
      check-mx ( fail | warn | ignore );
      check-mx-cname ( fail | warn | ignore );
      check-names ( primary | master |
          secondary | slave | response ) (
          fail | warn | ignore );
      check-sibling boolean;
      check-spf ( warn | ignore );
      check-srv-cname ( fail | warn | ignore );
      check-wildcard boolean;
      clients-per-query integer;
      cookie-algorithm ( aes | siphash24 );
      cookie-secret string;
      coresize ( default | unlimited | sizeval );
      datasize ( default | unlimited | sizeval );
      deny-answer-addresses { address_match_element; ... } [
          except-from { string; ... } ];
      deny-answer-aliases { string; ... } [ except-from { string; ...
          } ];
      dialup ( notify | notify-passive | passive | refresh | boolean );
      directory quoted_string;
      disable-algorithms string { string;
          ... };
      disable-ds-digests string { string;
          ... };
      disable-empty-zone string;
      dns64 netprefix {
              break-dnssec boolean;
              clients { address_match_element; ... };
              exclude { address_match_element; ... };
              mapped { address_match_element; ... };
              recursive-only boolean;
              suffix ipv6_address;
      };
      dns64-contact string;
      dns64-server string;
      dnskey-sig-validity integer;
      dnsrps-enable boolean;
      dnsrps-options { unspecified-text };
      dnssec-accept-expired boolean;
      dnssec-dnskey-kskonly boolean;
      dnssec-loadkeys-interval integer;
      dnssec-must-be-secure string boolean;
      dnssec-policy string;
      dnssec-secure-to-insecure boolean;
      dnssec-update-mode ( maintain | no-resign );
      dnssec-validation ( yes | no | auto );
      dnstap { ( all | auth | client | forwarder | resolver | update ) [
          ( query | response ) ]; ... };
      dnstap-identity ( quoted_string | none | hostname );
      dnstap-output ( file | unix ) quoted_string [ size ( unlimited |
          size ) ] [ versions ( unlimited | integer ) ] [ suffix (
          increment | timestamp ) ];
      dnstap-version ( quoted_string | none );
      dscp integer;
      dual-stack-servers [ port integer ] { ( quoted_string [ port
          integer ] [ dscp integer ] | ipv4_address [ port
          integer ] [ dscp integer ] | ipv6_address [ port
          integer ] [ dscp integer ] ); ... };
      dump-file quoted_string;
      edns-udp-size integer;
      empty-contact string;
      empty-server string;
      empty-zones-enable boolean;
      fetch-quota-params integer fixedpoint fixedpoint fixedpoint;
      fetches-per-server integer [ ( drop | fail ) ];
      fetches-per-zone integer [ ( drop | fail ) ];
      files ( default | unlimited | sizeval );
      flush-zones-on-shutdown boolean;
      forward ( first | only );
      forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
          | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
      fstrm-set-buffer-hint integer;
      fstrm-set-flush-timeout integer;
      fstrm-set-input-queue-size integer;
      fstrm-set-output-notify-threshold integer;
      fstrm-set-output-queue-model ( mpsc | spsc );
      fstrm-set-output-queue-size integer;
      fstrm-set-reopen-interval duration;
      geoip-directory ( quoted_string | none );
      glue-cache boolean;// deprecated
      heartbeat-interval integer;
      hostname ( quoted_string | none );
      http-listener-clients integer;
      http-port integer;
      http-streams-per-connection integer;
      https-port integer;
      interface-interval duration;
      ipv4only-contact string;
      ipv4only-enable boolean;
      ipv4only-server string;
      ixfr-from-differences ( primary | master | secondary | slave |
          boolean );
      key-directory quoted_string;
      lame-ttl duration;
      listen-on [ port integer ] [ dscp
          integer ] [ tls string ] [ http
          string ] {
          address_match_element; ... };
      listen-on-v6 [ port integer ] [ dscp
          integer ] [ tls string ] [ http
          string ] {
          address_match_element; ... };
      lmdb-mapsize sizeval;
      lock-file ( quoted_string | none );
      managed-keys-directory quoted_string;
      masterfile-format ( raw | text );
      masterfile-style ( full | relative );
      match-mapped-addresses boolean;
      max-cache-size ( default | unlimited | sizeval | percentage );
      max-cache-ttl duration;
      max-clients-per-query integer;
      max-ixfr-ratio ( unlimited | percentage );
      max-journal-size ( default | unlimited | sizeval );
      max-ncache-ttl duration;
      max-records integer;
      max-recursion-depth integer;
      max-recursion-queries integer;
      max-refresh-time integer;
      max-retry-time integer;
      max-rsa-exponent-size integer;
      max-stale-ttl duration;
      max-transfer-idle-in integer;
      max-transfer-idle-out integer;
      max-transfer-time-in integer;
      max-transfer-time-out integer;
      max-udp-size integer;
      max-zone-ttl ( unlimited | duration );
      memstatistics boolean;
      memstatistics-file quoted_string;
      message-compression boolean;
      min-cache-ttl duration;
      min-ncache-ttl duration;
      min-refresh-time integer;
      min-retry-time integer;
      minimal-any boolean;
      minimal-responses ( no-auth | no-auth-recursive | boolean );
      multi-master boolean;
      new-zones-directory quoted_string;
      no-case-compress { address_match_element; ... };
      nocookie-udp-size integer;
      notify ( explicit | master-only | primary-only | boolean );
      notify-delay integer;
      notify-rate integer;
      notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
          [ dscp integer ];
      notify-to-soa boolean;
      nta-lifetime duration;
      nta-recheck duration;
      nxdomain-redirect string;
      parental-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      parental-source-v6 ( ipv6_address | * ) [ port ( integer | * )
          ] [ dscp integer ];
      pid-file ( quoted_string | none );
      port integer;
      preferred-glue string;
      prefetch integer [ integer ];
      provide-ixfr boolean;
      qname-minimization ( strict | relaxed | disabled | off );
      query-source ( ( [ address ] ( ipv4_address | * ) [ port (
          integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
          port ( integer | * ) ) ) [ dscp integer ];
      query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
          integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
          port ( integer | * ) ) ) [ dscp integer ];
      querylog boolean;
      random-device ( quoted_string | none );
      rate-limit {
              all-per-second integer;
              errors-per-second integer;
              exempt-clients { address_match_element; ... };
              ipv4-prefix-length integer;
              ipv6-prefix-length integer;
              log-only boolean;
              max-table-size integer;
              min-table-size integer;
              nodata-per-second integer;
              nxdomains-per-second integer;
              qps-scale integer;
              referrals-per-second integer;
              responses-per-second integer;
              slip integer;
              window integer;
      };
      recursing-file quoted_string;
      recursion boolean;
      recursive-clients integer;
      request-expire boolean;
      request-ixfr boolean;
      request-nsid boolean;
      require-server-cookie boolean;
      reserved-sockets integer;// deprecated
      resolver-nonbackoff-tries integer;
      resolver-query-timeout integer;
      resolver-retry-interval integer;
      response-padding { address_match_element; ... } block-size
          integer;
      response-policy { zone string [ add-soa boolean ] [ log
          boolean ] [ max-policy-ttl duration ] [ min-update-interval
          duration ] [ policy ( cname | disabled | drop | given | no-op
          | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
          recursive-only boolean ] [ nsip-enable boolean ] [
          nsdname-enable boolean ]; ... } [ add-soa boolean ] [
          break-dnssec boolean ] [ max-policy-ttl duration ] [
          min-update-interval duration ] [ min-ns-dots integer ] [
          nsip-wait-recurse boolean ] [ nsdname-wait-recurse boolean
          ] [ qname-wait-recurse boolean ] [ recursive-only boolean ]
          [ nsip-enable boolean ] [ nsdname-enable boolean ] [
          dnsrps-enable boolean ] [ dnsrps-options { unspecified-text
          } ];
      root-delegation-only [ exclude { string; ... } ];
      root-key-sentinel boolean;
      rrset-order { [ class string ] [ type string ] [ name
          quoted_string ] string string; ... };
      secroots-file quoted_string;
      send-cookie boolean;
      serial-query-rate integer;
      serial-update-method ( date | increment | unixtime );
      server-id ( quoted_string | none | hostname );
      servfail-ttl duration;
      session-keyalg string;
      session-keyfile ( quoted_string | none );
      session-keyname string;
      sig-signing-nodes integer;
      sig-signing-signatures integer;
      sig-signing-type integer;
      sig-validity-interval integer [ integer ];
      sortlist { address_match_element; ... };
      stacksize ( default | unlimited | sizeval );
      stale-answer-client-timeout ( disabled | off | integer );
      stale-answer-enable boolean;
      stale-answer-ttl duration;
      stale-cache-enable boolean;
      stale-refresh-time duration;
      startup-notify-rate integer;
      statistics-file quoted_string;
      synth-from-dnssec boolean;
      tcp-advertised-timeout integer;
      tcp-clients integer;
      tcp-idle-timeout integer;
      tcp-initial-timeout integer;
      tcp-keepalive-timeout integer;
      tcp-listen-queue integer;
      tcp-receive-buffer integer;
      tcp-send-buffer integer;
      tkey-dhkey quoted_string integer;
      tkey-domain quoted_string;
      tkey-gssapi-credential quoted_string;
      tkey-gssapi-keytab quoted_string;
      tls-port integer;
      transfer-format ( many-answers | one-answer );
      transfer-message-size integer;
      transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
          ] [ dscp integer ];
      transfers-in integer;
      transfers-out integer;
      transfers-per-ns integer;
      trust-anchor-telemetry boolean; // experimental
      try-tcp-refresh boolean;
      udp-receive-buffer integer;
      udp-send-buffer integer;
      update-check-ksk boolean;
      use-alt-transfer-source boolean;
      use-v4-udp-ports { portrange; ... };
      use-v6-udp-ports { portrange; ... };
      v6-bias integer;
      validate-except { string; ... };
      version ( quoted_string | none );
      zero-no-soa-ttl boolean;
      zero-no-soa-ttl-cache boolean;
      zone-statistics ( full | terse | none | boolean );
};

  PARENTAL-AGENTS

parental-agents string [ port integer ] [
    dscp integer ] { ( remote-servers |
    ipv4_address [ port integer ] |
    ipv6_address [ port integer ] ) [ key
    string ] [ tls string ]; ... };

  PLUGIN

plugin ( query ) string [ { unspecified-text
    } ];

  PRIMARIES

primaries string [ port integer ] [ dscp
    integer ] { ( remote-servers |
    ipv4_address [ port integer ] |
    ipv6_address [ port integer ] ) [ key
    string ] [ tls string ]; ... };

  SERVER

server netprefix {
      bogus boolean;
      edns boolean;
      edns-udp-size integer;
      edns-version integer;
      keys server_key;
      max-udp-size integer;
      notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
          [ dscp integer ];
      padding integer;
      provide-ixfr boolean;
      query-source ( ( [ address ] ( ipv4_address | * ) [ port (
          integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
          port ( integer | * ) ) ) [ dscp integer ];
      query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
          integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
          port ( integer | * ) ) ) [ dscp integer ];
      request-expire boolean;
      request-ixfr boolean;
      request-nsid boolean;
      send-cookie boolean;
      tcp-keepalive boolean;
      tcp-only boolean;
      transfer-format ( many-answers | one-answer );
      transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
          ] [ dscp integer ];
      transfers integer;
};

  STATISTICS-CHANNELS

statistics-channels {
      inet ( ipv4_address | ipv6_address |
          * ) [ port ( integer | * ) ] [
          allow { address_match_element; ...
          } ];
};

  TLS

tls string {
      ca-file quoted_string;
      cert-file quoted_string;
      ciphers string;
      dhparam-file quoted_string;
      hostname quoted_string;
      key-file quoted_string;
      prefer-server-ciphers boolean;
      protocols { string; ... };
      session-tickets boolean;
};

  TRUST-ANCHORS

trust-anchors { string ( static-key |
    initial-key | static-ds | initial-ds )
    integer integer integer
    quoted_string; ... };

  TRUSTED-KEYS

Deprecated - see DNSSEC-KEYS.

trusted-keys { string integer
    integer integer
    quoted_string; ... };, deprecated

  VIEW

view string [ class ] {
      allow-new-zones boolean;
      allow-notify { address_match_element; ... };
      allow-query { address_match_element; ... };
      allow-query-cache { address_match_element; ... };
      allow-query-cache-on { address_match_element; ... };
      allow-query-on { address_match_element; ... };
      allow-recursion { address_match_element; ... };
      allow-recursion-on { address_match_element; ... };
      allow-transfer [ port integer ] [ transport string ] {
          address_match_element; ... };
      allow-update { address_match_element; ... };
      allow-update-forwarding { address_match_element; ... };
      also-notify [ port integer ] [ dscp integer ] { (
          remote-servers | ipv4_address [ port integer ] |
          ipv6_address [ port integer ] ) [ key string ] [ tls
          string ]; ... };
      alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
          ] [ dscp integer ];
      alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
          * ) ] [ dscp integer ];
      attach-cache string;
      auth-nxdomain boolean;
      auto-dnssec ( allow | maintain | off );
      catalog-zones { zone string [ default-primaries [ port integer
          ] [ dscp integer ] { ( remote-servers | ipv4_address [
          port integer ] | ipv6_address [ port integer ] ) [ key
          string ] [ tls string ]; ... } ] [ zone-directory
          quoted_string ] [ in-memory boolean ] [ min-update-interval
          duration ]; ... };
      check-dup-records ( fail | warn | ignore );
      check-integrity boolean;
      check-mx ( fail | warn | ignore );
      check-mx-cname ( fail | warn | ignore );
      check-names ( primary | master |
          secondary | slave | response ) (
          fail | warn | ignore );
      check-sibling boolean;
      check-spf ( warn | ignore );
      check-srv-cname ( fail | warn | ignore );
      check-wildcard boolean;
      clients-per-query integer;
      deny-answer-addresses { address_match_element; ... } [
          except-from { string; ... } ];
      deny-answer-aliases { string; ... } [ except-from { string; ...
          } ];
      dialup ( notify | notify-passive | passive | refresh | boolean );
      disable-algorithms string { string;
          ... };
      disable-ds-digests string { string;
          ... };
      disable-empty-zone string;
      dlz string {
              database string;
              search boolean;
      };
      dns64 netprefix {
              break-dnssec boolean;
              clients { address_match_element; ... };
              exclude { address_match_element; ... };
              mapped { address_match_element; ... };
              recursive-only boolean;
              suffix ipv6_address;
      };
      dns64-contact string;
      dns64-server string;
      dnskey-sig-validity integer;
      dnsrps-enable boolean;
      dnsrps-options { unspecified-text };
      dnssec-accept-expired boolean;
      dnssec-dnskey-kskonly boolean;
      dnssec-loadkeys-interval integer;
      dnssec-must-be-secure string boolean;
      dnssec-policy string;
      dnssec-secure-to-insecure boolean;
      dnssec-update-mode ( maintain | no-resign );
      dnssec-validation ( yes | no | auto );
      dnstap { ( all | auth | client | forwarder | resolver | update ) [
          ( query | response ) ]; ... };
      dual-stack-servers [ port integer ] { ( quoted_string [ port
          integer ] [ dscp integer ] | ipv4_address [ port
          integer ] [ dscp integer ] | ipv6_address [ port
          integer ] [ dscp integer ] ); ... };
      dyndb string quoted_string {
          unspecified-text };
      edns-udp-size integer;
      empty-contact string;
      empty-server string;
      empty-zones-enable boolean;
      fetch-quota-params integer fixedpoint fixedpoint fixedpoint;
      fetches-per-server integer [ ( drop | fail ) ];
      fetches-per-zone integer [ ( drop | fail ) ];
      forward ( first | only );
      forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
          | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
      glue-cache boolean;// deprecated
      ipv4only-contact string;
      ipv4only-enable boolean;
      ipv4only-server string;
      ixfr-from-differences ( primary | master | secondary | slave |
          boolean );
      key string {
              algorithm string;
              secret string;
      };
      key-directory quoted_string;
      lame-ttl duration;
      lmdb-mapsize sizeval;
      managed-keys { string (
          static-key | initial-key
          | static-ds | initial-ds
          ) integer integer
          integer
          quoted_string; ... };, deprecated
      masterfile-format ( raw | text );
      masterfile-style ( full | relative );
      match-clients { address_match_element; ... };
      match-destinations { address_match_element; ... };
      match-recursive-only boolean;
      max-cache-size ( default | unlimited | sizeval | percentage );
      max-cache-ttl duration;
      max-clients-per-query integer;
      max-ixfr-ratio ( unlimited | percentage );
      max-journal-size ( default | unlimited | sizeval );
      max-ncache-ttl duration;
      max-records integer;
      max-recursion-depth integer;
      max-recursion-queries integer;
      max-refresh-time integer;
      max-retry-time integer;
      max-stale-ttl duration;
      max-transfer-idle-in integer;
      max-transfer-idle-out integer;
      max-transfer-time-in integer;
      max-transfer-time-out integer;
      max-udp-size integer;
      max-zone-ttl ( unlimited | duration );
      message-compression boolean;
      min-cache-ttl duration;
      min-ncache-ttl duration;
      min-refresh-time integer;
      min-retry-time integer;
      minimal-any boolean;
      minimal-responses ( no-auth | no-auth-recursive | boolean );
      multi-master boolean;
      new-zones-directory quoted_string;
      no-case-compress { address_match_element; ... };
      nocookie-udp-size integer;
      notify ( explicit | master-only | primary-only | boolean );
      notify-delay integer;
      notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
          [ dscp integer ];
      notify-to-soa boolean;
      nta-lifetime duration;
      nta-recheck duration;
      nxdomain-redirect string;
      parental-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      parental-source-v6 ( ipv6_address | * ) [ port ( integer | * )
          ] [ dscp integer ];
      plugin ( query ) string [ {
          unspecified-text } ];
      preferred-glue string;
      prefetch integer [ integer ];
      provide-ixfr boolean;
      qname-minimization ( strict | relaxed | disabled | off );
      query-source ( ( [ address ] ( ipv4_address | * ) [ port (
          integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
          port ( integer | * ) ) ) [ dscp integer ];
      query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
          integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
          port ( integer | * ) ) ) [ dscp integer ];
      rate-limit {
              all-per-second integer;
              errors-per-second integer;
              exempt-clients { address_match_element; ... };
              ipv4-prefix-length integer;
              ipv6-prefix-length integer;
              log-only boolean;
              max-table-size integer;
              min-table-size integer;
              nodata-per-second integer;
              nxdomains-per-second integer;
              qps-scale integer;
              referrals-per-second integer;
              responses-per-second integer;
              slip integer;
              window integer;
      };
      recursion boolean;
      request-expire boolean;
      request-ixfr boolean;
      request-nsid boolean;
      require-server-cookie boolean;
      resolver-nonbackoff-tries integer;
      resolver-query-timeout integer;
      resolver-retry-interval integer;
      response-padding { address_match_element; ... } block-size
          integer;
      response-policy { zone string [ add-soa boolean ] [ log
          boolean ] [ max-policy-ttl duration ] [ min-update-interval
          duration ] [ policy ( cname | disabled | drop | given | no-op
          | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
          recursive-only boolean ] [ nsip-enable boolean ] [
          nsdname-enable boolean ]; ... } [ add-soa boolean ] [
          break-dnssec boolean ] [ max-policy-ttl duration ] [
          min-update-interval duration ] [ min-ns-dots integer ] [
          nsip-wait-recurse boolean ] [ nsdname-wait-recurse boolean
          ] [ qname-wait-recurse boolean ] [ recursive-only boolean ]
          [ nsip-enable boolean ] [ nsdname-enable boolean ] [
          dnsrps-enable boolean ] [ dnsrps-options { unspecified-text
          } ];
      root-delegation-only [ exclude { string; ... } ];
      root-key-sentinel boolean;
      rrset-order { [ class string ] [ type string ] [ name
          quoted_string ] string string; ... };
      send-cookie boolean;
      serial-update-method ( date | increment | unixtime );
      server netprefix {
              bogus boolean;
              edns boolean;
              edns-udp-size integer;
              edns-version integer;
              keys server_key;
              max-udp-size integer;
              notify-source ( ipv4_address | * ) [ port ( integer | *
                  ) ] [ dscp integer ];
              notify-source-v6 ( ipv6_address | * ) [ port ( integer
                  | * ) ] [ dscp integer ];
              padding integer;
              provide-ixfr boolean;
              query-source ( ( [ address ] ( ipv4_address | * ) [ port
                  ( integer | * ) ] ) | ( [ [ address ] (
                  ipv4_address | * ) ] port ( integer | * ) ) ) [
                  dscp integer ];
              query-source-v6 ( ( [ address ] ( ipv6_address | * ) [
                  port ( integer | * ) ] ) | ( [ [ address ] (
                  ipv6_address | * ) ] port ( integer | * ) ) ) [
                  dscp integer ];
              request-expire boolean;
              request-ixfr boolean;
              request-nsid boolean;
              send-cookie boolean;
              tcp-keepalive boolean;
              tcp-only boolean;
              transfer-format ( many-answers | one-answer );
              transfer-source ( ipv4_address | * ) [ port ( integer |
                  * ) ] [ dscp integer ];
              transfer-source-v6 ( ipv6_address | * ) [ port (
                  integer | * ) ] [ dscp integer ];
              transfers integer;
      };
      servfail-ttl duration;
      sig-signing-nodes integer;
      sig-signing-signatures integer;
      sig-signing-type integer;
      sig-validity-interval integer [ integer ];
      sortlist { address_match_element; ... };
      stale-answer-client-timeout ( disabled | off | integer );
      stale-answer-enable boolean;
      stale-answer-ttl duration;
      stale-cache-enable boolean;
      stale-refresh-time duration;
      synth-from-dnssec boolean;
      transfer-format ( many-answers | one-answer );
      transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
          dscp integer ];
      transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
          ] [ dscp integer ];
      trust-anchor-telemetry boolean; // experimental
      trust-anchors { string ( static-key |
          initial-key | static-ds | initial-ds
          ) integer integer integer
          quoted_string; ... };
      trusted-keys { string
          integer integer
          integer
          quoted_string; ... };, deprecated
      try-tcp-refresh boolean;
      update-check-ksk boolean;
      use-alt-transfer-source boolean;
      v6-bias integer;
      validate-except { string; ... };
      zero-no-soa-ttl boolean;
      zero-no-soa-ttl-cache boolean;
      zone-statistics ( full | terse | none | boolean );
};

  ZONE

Any of these zone statements can also be set inside the view statement.

zone <string> [ <class> ] {
      type primary;
      allow-query { <address_match_element>; ... };
      allow-query-on { <address_match_element>; ... };
      allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
      allow-update { <address_match_element>; ... };
      also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
      alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      auto-dnssec ( allow | maintain | off );
      check-dup-records ( fail | warn | ignore );
      check-integrity <boolean>;
      check-mx ( fail | warn | ignore );
      check-mx-cname ( fail | warn | ignore );
      check-names ( fail | warn | ignore );
      check-sibling <boolean>;
      check-spf ( warn | ignore );
      check-srv-cname ( fail | warn | ignore );
      check-wildcard <boolean>;
      database <string>;
      dialup ( notify | notify-passive | passive | refresh | <boolean> );
      dlz <string>;
      dnskey-sig-validity <integer>;
      dnssec-dnskey-kskonly <boolean>;
      dnssec-loadkeys-interval <integer>;
      dnssec-policy <string>;
      dnssec-secure-to-insecure <boolean>;
      dnssec-update-mode ( maintain | no-resign );
      file <quoted_string>;
      forward ( first | only );
      forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
      inline-signing <boolean>;
      ixfr-from-differences <boolean>;
      journal <quoted_string>;
      key-directory <quoted_string>;
      masterfile-format ( raw | text );
      masterfile-style ( full | relative );
      max-ixfr-ratio ( unlimited | <percentage> );
      max-journal-size ( default | unlimited | <sizeval> );
      max-records <integer>;
      max-transfer-idle-out <integer>;
      max-transfer-time-out <integer>;
      max-zone-ttl ( unlimited | <duration> );
      notify ( explicit | master-only | primary-only | <boolean> );
      notify-delay <integer>;
      notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      notify-to-soa <boolean>;
      parental-agents [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
      parental-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      parental-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      serial-update-method ( date | increment | unixtime );
      sig-signing-nodes <integer>;
      sig-signing-signatures <integer>;
      sig-signing-type <integer>;
      sig-validity-interval <integer> [ <integer> ];
      update-check-ksk <boolean>;
      update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | krb5-subdomain-self-rhs | ms-self | ms-selfsub | ms-subdomain | ms-subdomain-self-rhs | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
      zero-no-soa-ttl <boolean>;
      zone-statistics ( full | terse | none | <boolean> );
};

zone <string> [ <class> ] {
      type secondary;
      allow-notify { <address_match_element>; ... };
      allow-query { <address_match_element>; ... };
      allow-query-on { <address_match_element>; ... };
      allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
      allow-update-forwarding { <address_match_element>; ... };
      also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
      alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      auto-dnssec ( allow | maintain | off );
      check-names ( fail | warn | ignore );
      database <string>;
      dialup ( notify | notify-passive | passive | refresh | <boolean> );
      dlz <string>;
      dnskey-sig-validity <integer>;
      dnssec-dnskey-kskonly <boolean>;
      dnssec-loadkeys-interval <integer>;
      dnssec-policy <string>;
      dnssec-update-mode ( maintain | no-resign );
      file <quoted_string>;
      forward ( first | only );
      forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
      inline-signing <boolean>;
      ixfr-from-differences <boolean>;
      journal <quoted_string>;
      key-directory <quoted_string>;
      masterfile-format ( raw | text );
      masterfile-style ( full | relative );
      max-ixfr-ratio ( unlimited | <percentage> );
      max-journal-size ( default | unlimited | <sizeval> );
      max-records <integer>;
      max-refresh-time <integer>;
      max-retry-time <integer>;
      max-transfer-idle-in <integer>;
      max-transfer-idle-out <integer>;
      max-transfer-time-in <integer>;
      max-transfer-time-out <integer>;
      min-refresh-time <integer>;
      min-retry-time <integer>;
      multi-master <boolean>;
      notify ( explicit | master-only | primary-only | <boolean> );
      notify-delay <integer>;
      notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      notify-to-soa <boolean>;
      parental-agents [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
      parental-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      parental-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      primaries [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
      request-expire <boolean>;
      request-ixfr <boolean>;
      sig-signing-nodes <integer>;
      sig-signing-signatures <integer>;
      sig-signing-type <integer>;
      sig-validity-interval <integer> [ <integer> ];
      transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      try-tcp-refresh <boolean>;
      update-check-ksk <boolean>;
      use-alt-transfer-source <boolean>;
      zero-no-soa-ttl <boolean>;
      zone-statistics ( full | terse | none | <boolean> );
};

zone <string> [ <class> ] {
      type mirror;
      allow-notify { <address_match_element>; ... };
      allow-query { <address_match_element>; ... };
      allow-query-on { <address_match_element>; ... };
      allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
      allow-update-forwarding { <address_match_element>; ... };
      also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
      alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      check-names ( fail | warn | ignore );
      database <string>;
      file <quoted_string>;
      ixfr-from-differences <boolean>;
      journal <quoted_string>;
      masterfile-format ( raw | text );
      masterfile-style ( full | relative );
      max-ixfr-ratio ( unlimited | <percentage> );
      max-journal-size ( default | unlimited | <sizeval> );
      max-records <integer>;
      max-refresh-time <integer>;
      max-retry-time <integer>;
      max-transfer-idle-in <integer>;
      max-transfer-idle-out <integer>;
      max-transfer-time-in <integer>;
      max-transfer-time-out <integer>;
      min-refresh-time <integer>;
      min-retry-time <integer>;
      multi-master <boolean>;
      notify ( explicit | master-only | primary-only | <boolean> );
      notify-delay <integer>;
      notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      primaries [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
      request-expire <boolean>;
      request-ixfr <boolean>;
      transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      try-tcp-refresh <boolean>;
      use-alt-transfer-source <boolean>;
      zero-no-soa-ttl <boolean>;
      zone-statistics ( full | terse | none | <boolean> );
};

zone <string> [ <class> ] {
      type forward;
      delegation-only <boolean>;
      forward ( first | only );
      forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
};

zone <string> [ <class> ] {
      type hint;
      check-names ( fail | warn | ignore );
      delegation-only <boolean>;
      file <quoted_string>;
};

zone <string> [ <class> ] {
      type redirect;
      allow-query { <address_match_element>; ... };
      allow-query-on { <address_match_element>; ... };
      dlz <string>;
      file <quoted_string>;
      masterfile-format ( raw | text );
      masterfile-style ( full | relative );
      max-records <integer>;
      max-zone-ttl ( unlimited | <duration> );
      primaries [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
      zone-statistics ( full | terse | none | <boolean> );
};

zone <string> [ <class> ] {
      type static-stub;
      allow-query { <address_match_element>; ... };
      allow-query-on { <address_match_element>; ... };
      forward ( first | only );
      forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
      max-records <integer>;
      server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
      server-names { <string>; ... };
      zone-statistics ( full | terse | none | <boolean> );
};

zone <string> [ <class> ] {
      type stub;
      allow-query { <address_match_element>; ... };
      allow-query-on { <address_match_element>; ... };
      check-names ( fail | warn | ignore );
      database <string>;
      delegation-only <boolean>;
      dialup ( notify | notify-passive | passive | refresh | <boolean> );
      file <quoted_string>;
      forward ( first | only );
      forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
      masterfile-format ( raw | text );
      masterfile-style ( full | relative );
      max-records <integer>;
      max-refresh-time <integer>;
      max-retry-time <integer>;
      max-transfer-idle-in <integer>;
      max-transfer-time-in <integer>;
      min-refresh-time <integer>;
      min-retry-time <integer>;
      multi-master <boolean>;
      primaries [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
      transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
      use-alt-transfer-source <boolean>;
      zone-statistics ( full | terse | none | <boolean> );
};

zone <string> [ <class> ] {
      type delegation-only;
};

zone <string> [ <class> ] {
      in-view <string>;
};

FILES

@sysconfdir@/named.conf

SEE ALSO

named(8), named-checkconf(8), rndc(8), rndc-confgen(8), tsig-keygen(8), BIND 9 Administrator Reference Manual.

AUTHOR
Internet Systems Consortium

COPYRIGHT
2022, Internet Systems Consortium