named-checkconf [-h] [-v] [-j] [-t ] {filename} [directory-p] [-z]
named-checkconf checks the syntax, but not the semantics, of a named configuration file. The file is parsed @@ -52,7 +52,7 @@
named-checkconf returns an exit status of 1 if errors were detected and 0 otherwise.
named-compilezone [-d] [-j] [-q] [-v] [-c ] [class-C ] [mode-f ] [format-F ] [format-i ] [mode-k ] [mode-m ] [mode-n ] [mode-r ] [mode-s ] [style-t ] [directory-w ] [directory-D] [-W ] {mode-o } {zonename} {filename}filename
named-checkzone checks the syntax and integrity of a zone file. It performs the same checks as named does when loading a @@ -53,7 +53,7 @@
named-checkzone returns an exit status of 1 if errors were detected and 0 otherwise.
ddns-confgen [-a ] [algorithm-h] [-k ] [keyname-r ] [ -s randomfilename | -z zone ] [-q] [name]
ddns-confgen generates a key for use by nsupdate and named. It simplifies configuration @@ -58,7 +58,7 @@
rndc-confgen [-a] [-b ] [keysize-c ] [keyfile-h] [-k ] [keyname-p ] [port-r ] [randomfile-s ] [address-t ] [chrootdir-u ]user
rndc-confgen generates configuration files for rndc. It can be used as a @@ -48,7 +48,7 @@
dig [global-queryopt...] [query...]
dig (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and @@ -80,7 +80,7 @@
The -b option sets the source IP address of the query
to address. This must be a valid
@@ -230,7 +230,7 @@
dig provides a number of query options which affect the way in which lookups are made and the results displayed. Some of @@ -561,7 +561,7 @@
The BIND 9 implementation of dig supports @@ -607,7 +607,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
If dig has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. @@ -621,14 +621,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
host(1), named(8), dnssec-keygen(8), @@ -636,7 +636,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
There are probably too many query options.
diff --git a/bin/dig/host.1 b/bin/dig/host.1 index 82b3aea18b..b6eb81ba40 100644 --- a/bin/dig/host.1 +++ b/bin/dig/host.1 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: host.1,v 1.31 2009/07/11 01:12:45 tbox Exp $ +.\" $Id$ .\" .hy 0 .ad l diff --git a/bin/dig/host.html b/bin/dig/host.html index d7fe697a5b..d5fb6e735f 100644 --- a/bin/dig/host.html +++ b/bin/dig/host.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -32,7 +32,7 @@host [-aCdlnrsTwv] [-c ] [class-N ] [ndots-R ] [number-t ] [type-W ] [wait-m ] [flag-4] [-6] {name} [server]
host is a simple utility for performing DNS lookups. It is normally used to convert names to IP addresses and vice versa. @@ -184,7 +184,7 @@
If host has been built with IDN (internationalized domain name) support, it can accept and display non-ASCII domain names. @@ -198,12 +198,12 @@
dig(1), named(8).
diff --git a/bin/dig/nslookup.1 b/bin/dig/nslookup.1 index b6c8cded7e..f988995ba8 100644 --- a/bin/dig/nslookup.1 +++ b/bin/dig/nslookup.1 @@ -12,7 +12,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: nslookup.1,v 1.16 2010/02/23 01:14:31 tbox Exp $ +.\" $Id$ .\" .hy 0 .ad l diff --git a/bin/dig/nslookup.html b/bin/dig/nslookup.html index c0d4ded161..4bf6aab5c4 100644 --- a/bin/dig/nslookup.html +++ b/bin/dig/nslookup.html @@ -13,7 +13,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -21,7 +21,7 @@nslookup — query Internet name servers interactively
@@ -31,7 +31,7 @@nslookup [-option] [name | -] [server]
Nslookup is a program to query Internet domain name servers. Nslookup has two modes: interactive and non-interactive. Interactive mode allows @@ -43,7 +43,7 @@
Interactive mode is entered in the following cases:
@@ -78,7 +78,7 @@ nslookup -query=hinfo -timeout=10host [server]Andrew Cherenson
diff --git a/bin/dnssec/dnssec-dsfromkey.8 b/bin/dnssec/dnssec-dsfromkey.8 index 10e4ffcd05..437aa371cf 100644 --- a/bin/dnssec/dnssec-dsfromkey.8 +++ b/bin/dnssec/dnssec-dsfromkey.8 @@ -12,7 +12,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-dsfromkey.8,v 1.13 2010/12/24 01:14:20 tbox Exp $ +.\" $Id$ .\" .hy 0 .ad l diff --git a/bin/dnssec/dnssec-dsfromkey.html b/bin/dnssec/dnssec-dsfromkey.html index 49cfa7e999..3031c391af 100644 --- a/bin/dnssec/dnssec-dsfromkey.html +++ b/bin/dnssec/dnssec-dsfromkey.html @@ -13,7 +13,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -32,14 +32,14 @@dnssec-dsfromkey {-s} [-1] [-2] [-a ] [alg-K ] [directory-l ] [domain-s] [-c ] [class-f ] [file-A] [-v ] {dnsname}level
dnssec-dsfromkey outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s).
The keyfile can be designed by the key identification
Knnnn.+aaa+iiiii or the full file name
@@ -129,13 +129,13 @@
dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, @@ -145,7 +145,7 @@
dnssec-keyfromlabel {-l label} [-3] [-a ] [algorithm-A ] [date/offset-c ] [class-D ] [date/offset-E ] [engine-f ] [flag-G] [-I ] [date/offset-k] [-K ] [directory-n ] [nametype-P ] [date/offset-p ] [protocol-R ] [date/offset-t ] [type-v ] [level-y] {name}
When dnssec-keyfromlabel completes successfully, @@ -249,7 +249,7 @@
dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, @@ -257,7 +257,7 @@
dnssec-keygen [-a ] [algorithm-b ] [keysize-n ] [nametype-3] [-A ] [date/offset-C] [-c ] [class-D ] [date/offset-E ] [engine-e] [-f ] [flag-G] [-g ] [generator-h] [-I ] [date/offset-i ] [interval-K ] [directory-k] [-P ] [date/offset-p ] [protocol-q] [-R ] [date/offset-r ] [randomdev-S ] [key-s ] [strength-t ] [type-v ] [level-z] {name}
dnssec-keygen generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate keys for use with @@ -46,7 +46,7 @@
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -319,7 +319,7 @@
To generate a 768-bit DSA key for the domain
example.com, the following command would be
@@ -386,7 +386,7 @@
dnssec-signzone(8), BIND 9 Administrator Reference Manual, RFC 2539, @@ -395,7 +395,7 @@
dnssec-revoke [-hr] [-v ] [level-K ] [directory-E ] [engine-f] [-R] {keyfile}
dnssec-revoke reads a DNSSEC key file, sets the REVOKED bit on the key as defined in RFC 5011, and creates a new pair of key files containing the @@ -39,7 +39,7 @@
dnssec-settime [-f] [-K ] [directory-P ] [date/offset-A ] [date/offset-R ] [date/offset-I ] [date/offset-D ] [date/offset-h] [-v ] [level-E ] {keyfile}engine
dnssec-settime
reads a DNSSEC private key file and sets the key timing metadata
as specified by the -P, -A,
@@ -57,7 +57,7 @@
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -169,7 +169,7 @@
dnssec-settime can also be used to print the timing metadata associated with a key. @@ -195,7 +195,7 @@
dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, @@ -203,7 +203,7 @@
dnssec-signzone [-a] [-c ] [class-d ] [directory-E ] [engine-e ] [end-time-f ] [output-file-g] [-h] [-K ] [directory-k ] [key-l ] [domain-i ] [interval-I ] [input-format-j ] [jitter-N ] [soa-serial-format-o ] [origin-O ] [output-format-p] [-P] [-r ] [randomdev-S] [-s ] [start-time-T ] [ttl-t] [-u] [-v ] [level-x] [-z] [-3 ] [salt-H ] [iterations-A] {zonefile} [key...]
dnssec-signzone signs a zone. It generates NSEC and RRSIG records and produces a signed version of the @@ -43,7 +43,7 @@
The following command signs the example.com
zone with the DSA key generated by dnssec-keygen
@@ -409,14 +409,14 @@ db.example.com.signed
%
lwresd — lightweight resolver daemon
@@ -32,7 +32,7 @@lwresd [-c ] [config-file-C ] [config-file-d ] [debug-level-f] [-g] [-i ] [pid-file-m ] [flag-n ] [#cpus-P ] [port-p ] [port-s] [-t ] [directory-u ] [user-v] [-4] [-6]
lwresd is the daemon providing name lookup services to clients that use the BIND 9 lightweight resolver @@ -67,7 +67,7 @@
named.conf
named.conf is the configuration file
for
named. Statements are enclosed
@@ -50,14 +50,14 @@
masters string [ port integer ] {
( masters | ipv4_address [port integer] |
@@ -75,7 +75,7 @@ masters
server ( ipv4_address[/prefixlen] | ipv6_address[/prefixlen] ) {
bogus boolean;
@@ -97,7 +97,7 @@ server
trusted-keys {
domain_name flags protocol algorithm key; ...
@@ -105,7 +105,7 @@ trusted-keys
managed-keys {
domain_name initial-key flags protocol algorithm key; ...
@@ -113,7 +113,7 @@ managed-keys
controls {
inet ( ipv4_address | ipv6_address | * )
@@ -125,7 +125,7 @@ controls
view string optional_class {
match-clients { address_match_element; ... };
@@ -523,7 +523,7 @@ view
zone string optional_class {
type ( master | slave | stub | hint |
@@ -618,12 +618,12 @@ zone
named(8), named-checkconf(8), rndc(8), diff --git a/bin/named/named.html b/bin/named/named.html index b638e3593c..cf3cb2678f 100644 --- a/bin/named/named.html +++ b/bin/named/named.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -32,7 +32,7 @@named [-4] [-6] [-c ] [config-file-d ] [debug-level-E ] [engine-name-f] [-g] [-m ] [flag-n ] [#cpus-p ] [port-s] [-S ] [#max-socks-t ] [directory-u ] [user-v] [-V] [-x ]cache-file
named is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more @@ -47,7 +47,7 @@
In routine operation, signals should not be used to control the nameserver; rndc should be used @@ -249,7 +249,7 @@
The named configuration file is too complex to describe in detail here. A complete description is provided @@ -266,7 +266,7 @@
nsupdate [-d] [-D] [[-g] | [-o] | [-l] | [-y ] | [[hmac:]keyname:secret-k ]] [keyfile-t ] [timeout-u ] [udptimeout-r ] [udpretries-R ] [randomdev-v] [filename]
nsupdate is used to submit Dynamic DNS Update requests as defined in RFC 2136 to a name server. @@ -192,7 +192,7 @@
The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8 index 8b5514c504..7197ed0b92 100644 --- a/bin/rndc/rndc.8 +++ b/bin/rndc/rndc.8 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: rndc.8,v 1.43 2009/07/11 01:12:46 tbox Exp $ +.\" $Id$ .\" .hy 0 .ad l diff --git a/bin/rndc/rndc.conf.5 b/bin/rndc/rndc.conf.5 index 16534233aa..694a4815da 100644 --- a/bin/rndc/rndc.conf.5 +++ b/bin/rndc/rndc.conf.5 @@ -13,7 +13,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: rndc.conf.5,v 1.41 2009/07/11 01:12:46 tbox Exp $ +.\" $Id$ .\" .hy 0 .ad l diff --git a/bin/rndc/rndc.conf.html b/bin/rndc/rndc.conf.html index 28f7d100f7..b0f904b2ab 100644 --- a/bin/rndc/rndc.conf.html +++ b/bin/rndc/rndc.conf.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -32,7 +32,7 @@rndc.conf
rndc.conf is the configuration file
for rndc, the BIND 9 name server control
utility. This file has a similar structure and syntax to
@@ -117,7 +117,7 @@
The name server must be configured to accept rndc connections and
to recognize the key specified in the rndc.conf
@@ -201,7 +201,7 @@
rndc [-b ] [source-address-c ] [config-file-k ] [key-file-s ] [server-p ] [port-V] [-y ] {command}key_id
rndc controls the operation of a name server. It supersedes the ndc utility @@ -61,7 +61,7 @@
source-address@@ -133,7 +133,7 @@
rndc does not yet support all the commands of the BIND 8 ndc utility. @@ -147,7 +147,7 @@
arpaname {ipaddress ...}
arpaname translates IP addresses (IPv4 and IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names.
genrandom [-n ] {numbersize} {filename}
genrandom generates a file or a set of files containing a specified quantity @@ -40,7 +40,7 @@
isc-hmac-fixup {algorithm} {secret}
Versions of BIND 9 up to and including BIND 9.6 had a bug causing HMAC-SHA* TSIG keys which were longer than the digest length of the @@ -57,7 +57,7 @@
Secrets that have been converted by isc-hmac-fixup are shortened, but as this is how the HMAC protocol works in @@ -68,14 +68,14 @@
named-journalprint {journal}
named-journalprint prints the contents of a zone journal file in a human-readable @@ -57,7 +57,7 @@
nsec3hash {salt} {algorithm} {iterations} {domain}
nsec3hash generates an NSEC3 hash based on a set of NSEC3 parameters. This can be used to check the validity @@ -39,7 +39,7 @@
Table of Contents
The Berkeley Internet Name Domain (BIND) implements a @@ -87,7 +87,7 @@
In this document, Chapter 1 introduces the basic DNS and BIND concepts. Chapter 2 @@ -116,7 +116,7 @@
In this document, we use the following general typographic conventions: @@ -243,7 +243,7 @@
The purpose of this document is to explain the installation and upkeep of the BIND (Berkeley Internet @@ -253,7 +253,7 @@
The Domain Name System (DNS) is a hierarchical, distributed database. It stores information for mapping Internet host names to @@ -275,7 +275,7 @@
The data stored in the DNS is identified by domain names that are organized as a tree according to organizational or administrative boundaries. Each node of the tree, @@ -321,7 +321,7 @@
To properly operate a name server, it is important to understand the difference between a zone @@ -374,7 +374,7 @@
Each zone is served by at least one authoritative name server, @@ -391,7 +391,7 @@
The authoritative server where the master copy of the zone data is maintained is called the @@ -411,7 +411,7 @@
The other authoritative servers, the slave servers (also known as secondary servers) @@ -427,7 +427,7 @@
Usually all of the zone's authoritative servers are listed in NS records in the parent zone. These NS records constitute @@ -462,7 +462,7 @@
The resolver libraries provided by most operating systems are stub resolvers, meaning that they are not @@ -489,7 +489,7 @@
Even a caching name server does not necessarily perform the complete recursive lookup itself. Instead, it can @@ -516,7 +516,7 @@
The BIND name server can simultaneously act as diff --git a/doc/arm/Bv9ARM.ch02.html b/doc/arm/Bv9ARM.ch02.html index 4d1c46ce37..95c9cd810d 100644 --- a/doc/arm/Bv9ARM.ch02.html +++ b/doc/arm/Bv9ARM.ch02.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -45,16 +45,16 @@Table of Contents
DNS hardware requirements have traditionally been quite modest. @@ -73,7 +73,7 @@
CPU requirements for BIND 9 range from i486-class machines @@ -84,7 +84,7 @@
The memory of the server has to be large enough to fit the cache and zones loaded off disk. The max-cache-size @@ -107,7 +107,7 @@
For name server intensive environments, there are two alternative configurations that may be used. The first is where clients and @@ -124,7 +124,7 @@
ISC BIND 9 compiles and runs on a large number diff --git a/doc/arm/Bv9ARM.ch03.html b/doc/arm/Bv9ARM.ch03.html index cbbda63544..4ca4775a3f 100644 --- a/doc/arm/Bv9ARM.ch03.html +++ b/doc/arm/Bv9ARM.ch03.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -47,14 +47,14 @@The following sample configuration is appropriate for a caching-only name server for use by clients internal to a corporation. All @@ -98,7 +98,7 @@ zone "0.0.127.in-addr.arpa" {
This sample configuration is for an authoritative-only server
that is the master server for "example.com"
@@ -146,7 +146,7 @@ zone "eng.example.com" {
A primitive form of load balancing can be achieved in the DNS by using multiple records @@ -289,10 +289,10 @@ zone "eng.example.com" {
This section describes several indispensable diagnostic, administrative and monitoring tools available to the system @@ -888,7 +888,7 @@ controls {
Certain UNIX signals cause the name server to take specific actions, as described in the following table. These signals can diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index dc7ec88c7b..10c957cf47 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -49,59 +49,59 @@Setting up different views, or visibility, of the DNS space to internal and external resolvers is usually referred to as a @@ -288,7 +288,7 @@
Let's say a company named Example, Inc.
(example.com)
@@ -545,7 +545,7 @@ nameserver 172.16.72.4
A shared secret is generated to be shared between host1 and host2. An arbitrary key name is chosen: "host1-host2.". The key name must @@ -553,7 +553,7 @@ nameserver 172.16.72.4
The following command will generate a 128-bit (16 byte) HMAC-SHA256 key as described above. Longer keys are better, but shorter keys @@ -577,7 +577,7 @@ nameserver 172.16.72.4
The shared secret is simply a random sequence of bits, encoded in base-64. Most ASCII strings are valid base-64 strings (assuming @@ -592,7 +592,7 @@ nameserver 172.16.72.4
This is beyond the scope of DNS. A secure transport mechanism should be used. This could be secure FTP, ssh, telephone, etc. @@ -600,7 +600,7 @@ nameserver 172.16.72.4
Imagine host1 and host 2 are @@ -627,7 +627,7 @@ key host1-host2. {
Since keys are shared between two hosts only, the server must
be told when keys are to be used. The following is added to the named.conf file
@@ -659,7 +659,7 @@ server 10.1.2.3 {
BIND allows IP addresses and ranges to be specified in ACL @@ -686,7 +686,7 @@ allow-update { key host1-host2. ;};
The processing of TSIG signed messages can result in several errors. If a signed message is sent to a non-TSIG aware @@ -712,7 +712,7 @@ allow-update { key host1-host2. ;};
TKEY is a mechanism for automatically generating a shared secret between two hosts. There are several "modes" of @@ -748,7 +748,7 @@ allow-update { key host1-host2. ;};
BIND 9 partially supports DNSSEC SIG(0) transaction signatures as specified in RFC 2535 and RFC 2931. @@ -809,7 +809,7 @@ allow-update { key host1-host2. ;};
The dnssec-keygen program is used to generate keys. @@ -865,7 +865,7 @@ allow-update { key host1-host2. ;};
The dnssec-signzone program is used to sign a zone. @@ -907,7 +907,7 @@ allow-update { key host1-host2. ;};
To enable named to respond appropriately to DNS requests from DNSSEC aware clients, @@ -1067,7 +1067,7 @@ options { from insecure to signed and back again. A secure zone can use either NSEC or NSEC3 chains.
+Converting from insecure to secureChanging a zone from insecure to secure can be done in two ways: using a dynamic DNS update, or the auto-dnssec zone option.
@@ -1093,7 +1093,7 @@ options { well. An NSEC chain will be generated as part of the initial signing process. +Dynamic DNS update methodTo insert the keys via dynamic update:
% nsupdate
@@ -1129,7 +1129,7 @@ options {
While the initial signing and NSEC/NSEC3 chain generation
is happening, other updates are possible as well.
+Fully automatic zone signing
To enable automatic signing, add the
auto-dnssec option to the zone statement in
named.conf.
@@ -1164,7 +1164,7 @@ options {
configuration. If this has not been done, the configuration will
fail.
+Private-type records
The state of the signing process is signaled by
private-type records (with a default type value of 65534). When
signing is complete, these records will have a nonzero value for
@@ -1205,12 +1205,12 @@ options {
+DNSKEY rollovers
As with insecure-to-secure conversions, rolling DNSSEC
keys can be done in two ways: using a dynamic DNS update, or the
auto-dnssec zone option.
+Dynamic DNS update method
To perform key rollovers via dynamic update, you need to add
the K* files for the new keys so that
named can find them. You can then add the new
@@ -1232,7 +1232,7 @@ options {
named will clean out any signatures generated
by the old key after the update completes.
+Automatic key rollovers
When a new key reaches its activation date (as set by
dnssec-keygen or dnssec-settime),
if the auto-dnssec zone option is set to
@@ -1247,27 +1247,27 @@ options {
completes in 30 days, after which it will be safe to remove the
old key from the DNSKEY RRset.
+NSEC3PARAM rollovers via UPDATE
Add the new NSEC3PARAM record via dynamic update. When the
new NSEC3 chain has been generated, the NSEC3PARAM flag field
will be zero. At this point you can remove the old NSEC3PARAM
record. The old chain will be removed after the update request
completes.
+Converting from NSEC to NSEC3
To do this, you just need to add an NSEC3PARAM record. When
the conversion is complete, the NSEC chain will have been removed
and the NSEC3PARAM record will have a zero flag field. The NSEC3
chain will be generated before the NSEC chain is
destroyed.
+Converting from NSEC3 to NSEC
To do this, use nsupdate to
remove all NSEC3PARAM records with a zero flag
field. The NSEC chain will be generated before the NSEC3 chain is
removed.
+Converting from secure to insecure
To convert a signed zone to unsigned using dynamic DNS,
delete all the DNSKEY records from the zone apex using
nsupdate. All signatures, NSEC or NSEC3 chains,
@@ -1282,14 +1282,14 @@ options {
allow instead (or it will re-sign).
+Periodic re-signing
In any secure zone which supports dynamic updates, named
will periodically re-sign RRsets which have not been re-signed as
a result of some update action. The signature lifetimes will be
adjusted so as to spread the re-sign load over time rather than
all at once.
+NSEC3 and OPTOUT
named only supports creating new NSEC3 chains
where all the NSEC3 records in the zone have the same OPTOUT
@@ -1311,7 +1311,7 @@ options {
configuration files.
To configure a validating resolver to use RFC 5011 to
maintain a trust anchor, configure the trust anchor using a
managed-keys statement. Information about
@@ -1322,7 +1322,7 @@ options {
To set up an authoritative zone for RFC 5011 trust anchor
maintenance, generate two (or more) key signing keys (KSKs) for
the zone. Sign the zone with one of them; this is the "active"
@@ -1396,7 +1396,7 @@ $ dnssec-signzone -S -K keys example.net<
Debian Linux, Solaris x86 and Windows Server 2003.
See the HSM vendor documentation for information about
installing, initializing, testing and troubleshooting the
HSM.
@@ -1473,7 +1473,7 @@ $ patch -p1 -d openssl-0.9.8s \
when we configure BIND 9.
The AEP Keyper is a highly secure key storage device,
but does not provide hardware cryptographic acceleration. It
can carry out cryptographic operations, but it is probably
@@ -1505,7 +1505,7 @@ $ ./Configure linux-generic32 -m32 -pthread \
The SCA-6000 PKCS #11 provider is installed as a system
library, libpkcs11. It is a true crypto accelerator, up to 4
times faster than any CPU, so the flavor shall be
@@ -1527,7 +1527,7 @@ $ ./Configure solaris64-x86_64-cc \
SoftHSM is a software library provided by the OpenDNSSEC
project (http://www.opendnssec.org) which provides a PKCS#11
interface to a virtual HSM, implemented in the form of encrypted
@@ -1587,12 +1587,12 @@ $ ./Configure linux-x86_64 -pthread \
When building BIND 9, the location of the custom-built
OpenSSL library must be specified via configure.
To link with the PKCS #11 provider, threads must be
enabled in the BIND 9 build.
The PKCS #11 library for the AEP Keyper is currently
@@ -1608,7 +1608,7 @@ $ ./configure CC="gcc -m32" --enable-threads \
To link with the PKCS #11 provider, threads must be
enabled in the BIND 9 build.
@@ -1626,7 +1626,7 @@ $ ./configure CC="cc -xarch=amd64" --enable-thre
$ cd ../bind9
$ ./configure --enable-threads \
@@ -1643,7 +1643,7 @@ $ ./configure --enable-threads \
BIND 9 includes a minimal set of tools to operate the
HSM, including
pkcs11-keygen to generate a new key pair
@@ -1661,7 +1661,7 @@ $ ./configure --enable-threads \
First, we must set up the runtime environment so the
OpenSSL and PKCS #11 libraries can be loaded:
@@ -1749,7 +1749,7 @@ example.net.signed
The OpenSSL engine can be specified in
named and all of the BIND
dnssec-* tools by using the "-E
@@ -1770,7 +1770,7 @@ $ dnssec-signzone -E '' -S example.net
If you want
named to dynamically re-sign zones using HSM
keys, and/or to to sign new records inserted via nsupdate, then
@@ -1806,7 +1806,7 @@ $ dnssec-signzone -E '' -S example.net
BIND 9 fully supports all currently
defined forms of IPv6 name to address and address to name
@@ -1844,7 +1844,7 @@ $ dnssec-signzone -E '' -S example.net
The IPv6 AAAA record is a parallel to the IPv4 A record,
and, unlike the deprecated A6 record, specifies the entire
@@ -1863,7 +1863,7 @@ host 3600 IN AAAA 2001:db8::1
When looking up an address in nibble format, the address
components are simply reversed, just as in IPv4, and
diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html
index 95329db629..d20b6d8333 100644
--- a/doc/arm/Bv9ARM.ch05.html
+++ b/doc/arm/Bv9ARM.ch05.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -45,13 +45,13 @@
Table of Contents
Traditionally applications have been linked with a stub resolver
library that sends recursive DNS queries to a local caching name
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index a34bf9ffd8..7ed4094b26 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -48,58 +48,58 @@
Configuration File Elements
Configuration File Grammar
-- acl Statement Grammar
+- acl Statement Grammar
- acl Statement Definition and
Usage
-- controls Statement Grammar
+- controls Statement Grammar
- controls Statement Definition and
Usage
-- include Statement Grammar
-- include Statement Definition and
+
- include Statement Grammar
+- include Statement Definition and
Usage
-- key Statement Grammar
-- key Statement Definition and Usage
-- logging Statement Grammar
-- logging Statement Definition and
+
- key Statement Grammar
+- key Statement Definition and Usage
+- logging Statement Grammar
+- logging Statement Definition and
Usage
-- lwres Statement Grammar
-- lwres Statement Definition and Usage
-- masters Statement Grammar
-- masters Statement Definition and
+
- lwres Statement Grammar
+- lwres Statement Definition and Usage
+- masters Statement Grammar
+- masters Statement Definition and
Usage
-- options Statement Grammar
+- options Statement Grammar
- options Statement Definition and
Usage
- server Statement Grammar
- server Statement Definition and
Usage
- statistics-channels Statement Grammar
-- statistics-channels Statement Definition and
+
- statistics-channels Statement Definition and
Usage
- trusted-keys Statement Grammar
-- trusted-keys Statement Definition
+
- trusted-keys Statement Definition
and Usage
-- managed-keys Statement Grammar
+- managed-keys Statement Grammar
- managed-keys Statement Definition
and Usage
- view Statement Grammar
-- view Statement Definition and Usage
+- view Statement Definition and Usage
- zone
Statement Grammar
-- zone Statement Definition and Usage
+- zone Statement Definition and Usage
Zone File
+Zone File
- Types of Resource Records and When to Use Them
-- Discussion of MX Records
+- Discussion of MX Records
- Setting TTLs
-- Inverse Mapping in IPv4
-- Other Zone File Directives
-- BIND Master File Extension: the $GENERATE Directive
+- Inverse Mapping in IPv4
+- Other Zone File Directives
+- BIND Master File Extension: the $GENERATE Directive
- Additional File Formats
BIND9 Statistics
@@ -477,7 +477,7 @@
Address Match Lists
address_match_list = address_match_list_element ;
[ address_match_list_element; ... ]
address_match_list_element = [ ! ] (ip_address [/length] |
@@ -486,7 +486,7 @@
Address match lists are primarily used to determine access
control for various server operations. They are also used in
@@ -570,7 +570,7 @@
The BIND 9 comment syntax allows for
comments to appear
@@ -580,7 +580,7 @@
/* This is a BIND comment as in C */
@@ -596,7 +596,7 @@
Comments may appear anywhere that whitespace may appear in
a BIND configuration file.
@@ -848,7 +848,7 @@
acl acl-name {
address_match_list
};
@@ -930,7 +930,7 @@
controls {
[ inet ( ip_addr | * ) [ port ip_port ]
allow { address_match_list }
@@ -1054,12 +1054,12 @@
include filename;
The include statement inserts the
@@ -1074,7 +1074,7 @@
key key_id {
algorithm string;
secret string;
@@ -1083,7 +1083,7 @@
The key statement defines a shared
secret key for use with TSIG (see the section called “TSIG”)
@@ -1130,7 +1130,7 @@
logging {
[ channel channel_name {
( file path_name
@@ -1154,7 +1154,7 @@
The logging statement configures a
@@ -1188,7 +1188,7 @@
All log output goes to one or more channels;
you can make as many of them as you want.
@@ -1766,7 +1766,7 @@ category notify { null; };
The query-errors category is
specifically intended for debugging purposes: To identify
@@ -1994,7 +1994,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
This is the grammar of the lwres
statement in the named.conf file:
@@ -2010,7 +2010,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
The lwres statement configures the
name
@@ -2061,7 +2061,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
masters name [port ip_port] { ( masters_list |
ip_addr [port ip_port] [key key] ) ; [...] };
@@ -2069,7 +2069,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
masters
lists allow for a common set of masters to be easily used by
@@ -2078,7 +2078,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
This is the grammar of the options
statement in the named.conf file:
@@ -3665,7 +3665,7 @@ options {
The forwarding facility can be used to create a large site-wide
cache on a few servers, reducing traffic over links to external
@@ -3709,7 +3709,7 @@ options {
Dual-stack servers are used as servers of last resort to work
around
@@ -3920,7 +3920,7 @@ options {
The interfaces and ports that the server will answer queries
from may be specified using the listen-on option. listen-on takes
@@ -4379,7 +4379,7 @@ avoid-v6-udp-ports {};
use-v4-udp-ports,
avoid-v4-udp-ports,
@@ -4421,7 +4421,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
The server's usage of many system resources can be limited.
Scaled values are allowed when specifying resource limits. For
@@ -4583,7 +4583,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
- cleaning-interval
@@ -5423,7 +5423,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
BIND 9 provides the ability to filter
out DNS responses from external DNS servers containing
@@ -5546,7 +5546,7 @@ deny-answer-aliases { "example.net"; };
BIND 9 includes an intentionally limited
mechanism to modify DNS responses for recursive requests
@@ -5981,7 +5981,7 @@ ns.domain.com.rpz-nsdname CNAME .
The statistics-channels statement
@@ -6041,7 +6041,7 @@ ns.domain.com.rpz-nsdname CNAME .
The trusted-keys statement defines
@@ -6081,7 +6081,7 @@ ns.domain.com.rpz-nsdname CNAME .
managed-keys {
string initial-key number number number string ;
[ string initial-key number number number string ; [...]]
@@ -6216,7 +6216,7 @@ ns.domain.com.rpz-nsdname CNAME .
The view statement is a powerful
feature
@@ -6505,10 +6505,10 @@ zone zone_name [