The purpose of this document is to explain the installation -and upkeep of the BIND software package, and we +and upkeep of the BIND (Berkeley Internet Name Domain) software package, and we begin by reviewing the fundamentals of the Domain Name System (DNS) as they relate to BIND.
diff --git a/doc/arm/Bv9ARM.ch03.html b/doc/arm/Bv9ARM.ch03.html index fb35ea96f4..b5ce516956 100644 --- a/doc/arm/Bv9ARM.ch03.html +++ b/doc/arm/Bv9ARM.ch03.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -55,7 +55,7 @@The remote name daemon control (rndc) program allows the system administrator to control the operation of a nameserver. + In BIND 9.2, rndc + supports all the commands of the BIND 8 ndc + utility except ndc start and + ndc restart, which were also + not supported in ndc's channel mode. If you run rndc without any options it will display a usage message as follows:
rndc [-c config] [-s server] [-p port] [-y key] command [command...]
rndc.key file and not modify
Certain UNIX signals cause the name server to take specific actions, as described in the following table. These signals can be sent using the kill command.
diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index e79d6cf571..80ccaa2bd3 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -48,30 +48,31 @@Setting up different views, or visibility, of DNS space to internal and external resolvers is usually referred to as a Split DNS setup. There are several reasons an organization @@ -166,7 +167,9 @@ to allow internal networks that are behind filters or in RFC 1918 space (reserved IP space, as documented in RFC 1918) to resolve DNS on the Internet. Split DNS can also be used to allow mail from outside back in to the internal network.
-Here is an example of a split DNS setup:
+Let's say a company named Example, Inc. (example.com) has several corporate sites that have an internal network with reserved Internet Protocol (IP) space and an external demilitarized zone (DMZ), @@ -332,6 +335,7 @@ nameserver 172.16.72.3 nameserver 172.16.72.4
-y command line options.
A shared secret is generated to be shared between host1 and host2. An arbitrary key name is chosen: "host1-host2.". The key name must be the same on both hosts.
The following command will generate a 128-bit (16 byte) HMAC-MD5 key as described above. Longer keys are better, but shorter keys are easier to read. Note that the maximum key length is 512 bits; @@ -375,7 +379,7 @@ be used as the shared secret.
The shared secret is simply a random sequence of bits, encoded in base-64. Most ASCII strings are valid base-64 strings (assuming the length is a multiple of 4 and only valid characters are used), @@ -386,13 +390,13 @@ a similar program to generate base-64 encoded data.
This is beyond the scope of DNS. A secure transport mechanism should be used. This could be secure FTP, ssh, telephone, etc.
Imagine host1 and host 2 are
both servers. The following is added to each server's named.conf file:
@@ -413,7 +417,7 @@ the same key.Since keys are shared between two hosts only, the server must be told when keys are to be used. The following is added to the
named.conffile for host1, if the IP address of host2 is @@ -436,7 +440,7 @@ sign request messages to host1.BIND allows IP addresses and ranges to be specified in ACL definitions and allow-{ query | transfer | update } directives. @@ -454,7 +458,7 @@ allow-update { key host1-host2. ;};
The processing of TSIG signed messages can result in several errors. If a signed message is sent to a non-TSIG aware server, a FORMERR (format error) will be returned, since @@ -471,13 +475,13 @@ allow-update { key host1-host2. ;}; outside of the allowed range, the response will be signed with the TSIG extended error code set to BADTIME, and the time values will be adjusted so that the response can be successfully - verified. In any of these cases, the message's rcode is set to + verified. In any of these cases, the message's rcode (response code) is set to NOTAUTH (not authenticated).
TKEY is a mechanism for automatically generating a shared secret between two hosts. There are several "modes" of TKEY that specify how the key is @@ -503,7 +507,7 @@ allow-update { key host1-host2. ;};
BIND 9 partially supports DNSSEC SIG(0) transaction signatures as specified in RFC 2535. SIG(0) uses public/private keys to authenticate messages. Access control is performed in the @@ -542,7 +546,7 @@ allow-update { key host1-host2. ;}; zone key of another zone above this one in the DNS tree.
The dnssec-keygen program is used to generate keys.
A secure zone must contain one or more zone keys. The @@ -560,7 +564,7 @@ allow-update { key host1-host2. ;};
Two output files will be produced:
Kchild.example.+003+12345.keyandKchild.example.+003+12345.private(where - 12345 is an example of a key tag). The key file names contain + 12345 is an example of a key tag). The key filenames contain the key name (child.example.), algorithm (3 is DSA, 1 is RSA, etc.), and the key tag (12345 in this case). The private key (in the.privatefile) is @@ -575,7 +579,7 @@ allow-update { key host1-host2. ;};The dnssec-makekeyset program is used to create a key set from one or more keys.
Once the zone keys have been generated, a key set must be @@ -603,7 +607,7 @@ allow-update { key host1-host2. ;};
The dnssec-signkey program is used to sign one child's keyset.
If the
child.examplezone has any @@ -623,7 +627,7 @@ allow-update { key host1-host2. ;};The dnssec-signzone program is used to sign a zone.
Any
signedkeyfiles corresponding to @@ -646,7 +650,7 @@ allow-update { key host1-host2. ;};Unlike in BIND 8, data is not verified on load in BIND 9, so zone keys for authoritative zones do not need to be specified @@ -658,7 +662,7 @@ statement, as described later in this document.
BIND 9 fully supports all currently defined forms of IPv6 name to address and address to name lookups. It will also use IPv6 addresses to make queries when @@ -680,7 +684,7 @@ statement, as described later in this document.
see the section called “IPv6 addresses (A6)”.The AAAA record is a parallel to the IPv4 A record. It specifies the entire address in a single record. For example,
@@ -691,7 +695,7 @@ host 3600 IN AAAA 2001:db8::1When looking up an address in nibble format, the address components are simply reversed, just as in IPv4, and
@@ -45,13 +45,13 @@IP6.ARPA.is appended to the resulting name. diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html index 3c61475533..10d9a5670e 100644 --- a/doc/arm/Bv9ARM.ch05.html +++ b/doc/arm/Bv9ARM.ch05.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +Table of Contents
Traditionally applications have been linked with a stub resolver library that sends recursive DNS queries to a local caching name server.
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index f986dc539c..d32421682f 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -48,44 +48,44 @@
dotted_decimal notation.
ip_port
An IP port number.
- number is limited to 0 through 65535, with values
+The number is limited to 0 through 65535, with values
below 1024 typically restricted to root-owned processes. In some
cases, an asterisk (`*') character can be used as a placeholder to
select a random high-numbered port.
address_match_list= address_match_list_element ; [ address_match_list_element; ... ]address_match_list_element= [ ! ] (ip_address [/length] | @@ -233,7 +233,7 @@ are restricted to slave and stub zones.Address match lists are primarily used to determine access control for various server operations. They are also used to define priorities for querying other nameservers and to set the addresses @@ -288,14 +288,14 @@ other 1.2.3.* hosts fall through.
The BIND 9 comment syntax allows for comments to appear - anywhere that white space may appear in a BIND configuration + anywhere that whitespace may appear in a BIND configuration file. To appeal to programmers of all kinds, they can be written in C, C++, or shell/perl constructs.
/* This is a BIND comment as in C */@@ -308,8 +308,8 @@ other 1.2.3.* hosts fall through. +
Comments may appear anywhere that whitespace may appear in a BIND configuration file.
C-style comments start with the two characters /* (slash, star) and end with */ (star, slash). Because they are completely @@ -417,7 +417,7 @@ a per-server basis.
configuration.acl acl-name { address_match_list }; @@ -470,7 +470,7 @@ complete set of local IPv6 addresses for a host.controls { inet ( ip_addr | * ) [ port ip_port ] allow {address_match_list} keys {key_list}; @@ -569,12 +569,12 @@ statement: controls { };.includefilename;The include statement inserts the specified file at the point that the include statement is encountered. The include @@ -585,7 +585,7 @@ statement: controls { };.
keykey_id{ algorithmstring; secretstring; @@ -594,7 +594,7 @@ statement: controls { };.The key statement defines a shared secret key for use with TSIG, see the section called “TSIG”.
@@ -622,7 +622,7 @@ string.
logging { [ channelchannel_name{ ( filepath name@@ -646,7 +646,7 @@ string.The logging statement configures a wide variety of logging options for the nameserver. Its channel phrase associates output methods, format options and severity levels with @@ -669,7 +669,7 @@ channels, or to standard error if the "
-g" option was specified.All log output goes to one or more channels; you can make as many of them as you want.
Every channel definition must include a destination clause that @@ -964,7 +964,7 @@ a delegation-only in a hint or stu
This is the grammar of the lwres statement in the
named.conffile:lwres { @@ -977,10 +977,10 @@ statement in thenamed.conffile:The lwres statement configures the name server to also act as a light-weight resolver daemon. (See -the section called “Running a Resolver Daemon”.) There may be be multiple +the section called “Running a Resolver Daemon”.) There may be multiple lwres statements configuring lightweight resolver servers with different properties.
The listen-on statement specifies a list of @@ -1005,7 +1005,7 @@ exact match lookup before search path elements are appended.
This is the grammar of the options statement in the
named.conffile:options { @@ -1104,7 +1104,7 @@ statement in thenamed.conffile:The options statement sets up global options to be used by BIND. This statement may appear only once in a configuration file. If more than one occurrence is found, @@ -1364,7 +1364,7 @@ in the statistics-file. See also
This option is obsolete. -If you need to disable IXFR to a particular server or servers see +If you need to disable IXFR to a particular server or servers, see the information on the provide-ixfr option in the section called “server Statement Definition and Usage”. See also the section called “Incremental Zone Transfers (IXFR)”. @@ -1459,7 +1459,7 @@ The use of this option for any other purpose is discouraged.
The forwarding facility can be used to create a large site-wide
cache on a few servers, reducing traffic over links to external
nameservers. It can also be used to allow queries by servers that
@@ -1536,7 +1536,7 @@ from these addresses will not be responded to. The default is
+Interfaces
The interfaces and ports that the server will answer queries
from may be specified using the listen-on option. listen-on takes
an optional port, and an If the server doesn't know the answer to a question, it will
query other nameservers. query-source specifies
the address and port used for such queries. For queries sent over
@@ -1741,7 +1741,7 @@ but applies to notify messages sent to IPv6 addresses.address_match_list.
@@ -1578,7 +1578,7 @@ the server will not listen on any IPv6 address.
The server's usage of many system resources can be limited.
Scaled values are allowed when specifying resource limits. For
example, 1G can be used instead of
@@ -1785,7 +1785,7 @@ may use. The default is default.
The following options set limits on the server's resource consumption that are enforced internally by the server rather than the operating system.
@@ -1818,7 +1818,7 @@ records are purged from the cache only when their TTLs expire.The server will remove expired resource records @@ -1845,7 +1845,7 @@ every statistics-interval minutes. 60. If set to 0, no statistics will be logged.
Not yet implemented in BIND9.
+Not yet implemented in BIND 9.
trusted-keys {
string number number number string ;
[ string number number number string ; [...]]
@@ -2292,7 +2292,7 @@ supported.
The trusted-keys statement defines DNSSEC
security roots. DNSSEC is described in the section called “DNSSEC”. A security root is defined when the public key for a non-authoritative
@@ -2308,7 +2308,7 @@ key data.
view view_name [class] {
match-clients { address_match_list } ;
match-destinations { address_match_list } ;
@@ -2321,7 +2321,7 @@ key data.
The view statement is a powerful new feature
of BIND 9 that lets a name server answer a DNS query differently
depending on who is asking. It is particularly useful for implementing
@@ -2504,10 +2504,10 @@ zone zone_name [
example.com might place
the zone contents into a file called
ex/example.com where ex/ is
@@ -2618,7 +2618,7 @@ from forwarders.
The zone's name may optionally be followed by a class. If
a class is not specified, class IN (for Internet),
is assumed. This is correct for the vast majority of cases.
@@ -2633,7 +2633,7 @@ in the mid-1970s. Zone data for it can be specified with the
+Zone Options
- allow-notify
See the description of
@@ -2849,7 +2849,7 @@ SIG, NS, SOA, and NXT. Types may be specified by name, including
@@ -2859,7 +2859,7 @@ Since the publication of RFC 1034, several new RRs have been identified
and implemented in the DNS. These are also included.
A domain name identifies a node. Each node has a set of
resource information, which may be empty. The set of resource
information associated with a particular name is composed of
@@ -3134,7 +3134,7 @@ used as "pointers" to other data in the DNS.
RRs are represented in binary form in the packets of the DNS
protocol, and are usually represented in highly encoded form when
stored in a nameserver or resolver. In the examples provided in
@@ -3224,7 +3224,7 @@ each of a different class.
As described above, domain servers store information as a
series of resource records, each of which contains a particular
piece of information about a given domain name (which is usually,
@@ -3341,7 +3341,7 @@ can be explicitly specified, for example, 1h30m.
Reverse name resolution (that is, translation from IP address
to name) is achieved by means of the in-addr.arpa domain
and PTR records. Entries in the in-addr.arpa domain are made in
@@ -3379,7 +3379,7 @@ that the example is relative to the listed origin.
The Master File Format was initially defined in RFC 1035 and
has subsequently been extended. While the Master File Format itself
is class independent all records in a Master File must be of the same
@@ -3388,7 +3388,7 @@ class.
and $TTL.
Syntax: $ORIGIN
domain-name [ comment]
$ORIGIN sets the domain name that will
@@ -3403,7 +3403,7 @@ WWW CNAME MAIN-SERVER
Syntax: $INCLUDE
filename [
origin ] [ comment ]
@@ -3427,7 +3427,7 @@ This could be construed as a deviation from RFC 1035, a feature, or both.
Syntax: $TTL
default-ttl [
comment ]
@@ -3438,7 +3438,7 @@ with undefined TTLs. Valid TTLs are of the range 0-2147483647 seconds.
.
Syntax: $GENERATE range lhs type rhs [ comment ]
$GENERATE is used to create a series of
resource records that only differ from each other by an iterator. $GENERATE can
@@ -3471,16 +3471,16 @@ or start-stop/step. If the first form is used, then step is set to
lhs
-lhs describes the
+
This describes the
owner name of the resource records to be created. Any single
$ (dollar sign) symbols
within the lhs side are replaced by the iterator
value.
-To get a $ in the output you need to escape the $
+To get a $ in the output, you need to escape the $
using a backslash \,
e.g. \$. The $ may optionally be followed
by modifiers which change the offset from the interator, field width and base.
-Modifiers are introduced by a { immediately following the
+Modifiers are introduced by a { (left brace) immediately following the
$ as ${offset[,width[,base]]}.
For example, ${-20,3,d} which subtracts 20 from the current value,
prints the result as a decimal in a zero-padded field of width 3. Available
@@ -3501,7 +3501,7 @@ PTR, CNAME, DNAME, A, AAAA and NS.
rhs
A domain name. It is processed
+
rhs is a domain name. It is processed
similarly to lhs.
diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html
index 2bf8d9d643..6f01f2a7fb 100644
--- a/doc/arm/Bv9ARM.ch07.html
+++ b/doc/arm/Bv9ARM.ch07.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -46,11 +46,11 @@
Table of Contents
- Access Control Lists
-- chroot and setuid (for
+
- Chroot and Setuid (for
UNIX servers)
- Dynamic Update Security
@@ -102,7 +102,7 @@ see the AUSCERT advisory at
On UNIX servers, it is possible to run BIND in a chrooted environment
(using the chroot() function) by specifying the "-t"
@@ -117,7 +117,7 @@ user 202:
/usr/local/bin/named -u 202 -t /var/named
In order for a chroot environment to
work properly in a particular directory
(for example, /var/named),
@@ -129,7 +129,7 @@ like directory and
-Unlike with earlier versions of BIND, you will typically
+Unlike with earlier versions of BIND, you typically will
not need to compile named
statically nor install shared libraries under the new root.
However, depending on your operating system, you may need
@@ -142,7 +142,7 @@ to set up things like
Prior to running the named daemon, use
the touch utility (to change file access and
modification times) or the chown utility (to
diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html
index da585cd0c7..1bb7349efb 100644
--- a/doc/arm/Bv9ARM.ch08.html
+++ b/doc/arm/Bv9ARM.ch08.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -45,18 +45,18 @@
Table of Contents
The best solution to solving installation and
configuration issues is to take preventative measures by setting
up logging files beforehand. The log files provide a
@@ -66,7 +66,7 @@
Zone serial numbers are just numbers — they aren't date
related. A lot of people set them to a number that represents a
date, usually of the form YYYYMMDDRR. A number of people
@@ -87,7 +87,7 @@
The Internet Software Consortium (ISC) offers a wide range
of support and service agreements for BIND and DHCP servers. Four
levels of premium support are available and each level includes
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 648aa20938..16c38a2fc0 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -43,26 +43,26 @@
Table of Contents
Although the "official" beginning of the Domain Name
System occurred in 1984 with the publication of RFC 920, the
@@ -106,7 +106,7 @@ by Phil Almquist, Robert Elz, Alan Barrett, Paul Albitz, Bryan Beecher, Andrew
Partan, Andy Cherenson, Tom Limoncelli, Berthold Paffrath, Fuat
Baran, Anant Kumar, Art Harkin, Win Treese, Don Lewis, Christophe
Wolfhugel, and others.
-BIND version 4.9.2 was sponsored by Vixie Enterprises. Paul
+
In 1994, BIND version 4.9.2 was sponsored by Vixie Enterprises. Paul
Vixie became BIND's principal architect/programmer.
BIND versions from 4.9.3 onward have been developed and maintained
by the Internet Software Consortium with support being provided
@@ -126,7 +126,7 @@ individuals.
Classes of Resource Records
The [hesiod] class is an information service
developed by MIT's Project Athena. It is used to share information
about various systems databases, such as users, groups, printers
@@ -135,7 +135,7 @@ hesiod.
The chaos class is used to specify zone
data for the MIT-developed CHAOSnet, a LAN protocol created in the
mid-1970s.
@@ -144,7 +144,7 @@ mid-1970s.
@@ -154,7 +154,8 @@ scalable Internet routing. There are three types of addresses: Anycast,
an identifier for a set of interfaces; and Multicast,
an identifier for a set of interfaces. Here we describe the global
-Unicast address scheme. For more information, see RFC 2374.
+Unicast address scheme. For more information, see RFC 3587,
+"Global Unicast Address Format."
The aggregatable global Unicast address format is as follows:
@@ -324,17 +325,17 @@ the number of the RFC). RFCs are also available via the Web at
Standards
-[RFC974] Mail Routing and the Domain System. January 1986.
+[RFC974] Mail Routing and the Domain System. January 1986.
@@ -342,22 +343,22 @@ Specification. November 1987.
Proposed Standards
-[RFC2181] Clarifications to the DNS Specification. July 1997.
+[RFC2181] Clarifications to the DNS Specification. July 1997.
-[RFC2308] Negative Caching of DNS Queries. March 1998.
+[RFC2308] Negative Caching of DNS Queries. March 1998.
-[RFC1995] Incremental Zone Transfer in DNS. August 1996.
+[RFC1995] Incremental Zone Transfer in DNS. August 1996.
-[RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996.
+[RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996.
-[RFC2136] Dynamic Updates in the Domain Name System. April 1997.
+[RFC2136] Dynamic Updates in the Domain Name System. April 1997.
-[RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000.
+[RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000.
@@ -368,85 +369,85 @@ Specification. November 1987.
RFCs are undergoing major revision by the IETF.
-[RFC1886] DNS Extensions to support IP version 6. December 1995.
+[RFC1886] DNS Extensions to support IP version 6. December 1995.
-[RFC2065] Domain Name System Security Extensions. January 1997.
+[RFC2065] Domain Name System Security Extensions. January 1997.
-[RFC2137] Secure Domain Name System Dynamic Update. April 1997.
+[RFC2137] Secure Domain Name System Dynamic Update. April 1997.
Other Important RFCs About DNS Implementation
-[RFC1535] A Security Problem and Proposed Correction With Widely Deployed DNS Software.. October 1993.
+[RFC1535] A Security Problem and Proposed Correction With Widely Deployed DNS Software.. October 1993.
Resource Record Types
-[RFC1706] DNS NSAP Resource Records. October 1994.
+[RFC1706] DNS NSAP Resource Records. October 1994.
-[RFC2168] Resolution of Uniform Resource Identifiers using
+[RFC2168] Resolution of Uniform Resource Identifiers using
the Domain Name System. June 1997.
-[RFC1876] A Means for Expressing Location Information in the Domain
+[RFC1876] A Means for Expressing Location Information in the Domain
Name System. January 1996.
-[RFC2052] A DNS RR for Specifying the Location of
+[RFC2052] A DNS RR for Specifying the Location of
Services.. October 1996.
DNS and the Internet
-[RFC1101] DNS Encoding of Network Names and Other Types. April 1989.
+[RFC1101] DNS Encoding of Network Names and Other Types. April 1989.
-[RFC1123] Requirements for Internet Hosts - Application and Support. October 1989.
+[RFC1123] Requirements for Internet Hosts - Application and Support. October 1989.
DNS Operations
-[RFC1537] Common DNS Data File Configuration Errors. October 1993.
+[RFC1537] Common DNS Data File Configuration Errors. October 1993.
-[RFC1912] Common DNS Operational and Configuration Errors. February 1996.
+[RFC1912] Common DNS Operational and Configuration Errors. February 1996.
@@ -457,28 +458,28 @@ Conformant Global Address Mapping. January 1998
DNS-related, are not concerned with implementing software.
-[RFC1464] Using the Domain Name System To Store Arbitrary String Attributes. May 1993.
+[RFC1464] Using the Domain Name System To Store Arbitrary String Attributes. May 1993.
-[RFC1713] Tools for DNS Debugging. November 1994.
+[RFC1713] Tools for DNS Debugging. November 1994.
-[RFC1794] DNS Support for Load Balancing. April 1995.
+[RFC1794] DNS Support for Load Balancing. April 1995.
-[RFC2240] A Legal Basis for Domain Name Allocation. November 1997.
+[RFC2240] A Legal Basis for Domain Name Allocation. November 1997.
-[RFC2345] Domain Names and Company Name Retrieval. May 1998.
+[RFC2345] Domain Names and Company Name Retrieval. May 1998.
-[RFC2352] A Convention For Using Legal Names as Domain Names. May 1998.
+[RFC2352] A Convention For Using Legal Names as Domain Names. May 1998.
Obsolete and Unimplemented Experimental RRs
@@ -498,14 +499,14 @@ after which they are deleted unless updated by their authors.
-DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates.
+DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates.
diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html
index 19b7cff1f4..6c4d15ec43 100644
--- a/doc/arm/Bv9ARM.html
+++ b/doc/arm/Bv9ARM.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -84,7 +84,7 @@
Nameserver Operations
4. Advanced Concepts
@@ -92,35 +92,36 @@
Dynamic Update
Incremental Zone Transfers (IXFR)
-Split DNS
+Split DNS
+TSIG
-- Generate Shared Keys for Each Pair of Hosts
-- Copying the Shared Secret to Both Machines
-- Informing the Servers of the Key's Existence
-- Instructing the Server to Use the Key
-- TSIG Key Based Access Control
-- Errors
+- Generate Shared Keys for Each Pair of Hosts
+- Copying the Shared Secret to Both Machines
+- Informing the Servers of the Key's Existence
+- Instructing the Server to Use the Key
+- TSIG Key Based Access Control
+- Errors
TKEY
-SIG(0)
+TKEY
+SIG(0)
DNSSEC
IPv6 Support in BIND 9
+IPv6 Support in BIND 9
5. The BIND 9 Lightweight Resolver
6. BIND 9 Configuration Reference
@@ -128,77 +129,77 @@
Configuration File Elements
Configuration File Grammar
-- acl Statement Grammar
+- acl Statement Grammar
- acl Statement Definition and
Usage
-- controls Statement Grammar
+- controls Statement Grammar
- controls Statement Definition and Usage
-- include Statement Grammar
-- include Statement Definition and Usage
-- key Statement Grammar
-- key Statement Definition and Usage
-- logging Statement Grammar
-- logging Statement Definition and Usage
-- lwres Statement Grammar
-- lwres Statement Definition and Usage
-- options Statement Grammar
-- options Statement Definition and Usage
+- include Statement Grammar
+- include Statement Definition and Usage
+- key Statement Grammar
+- key Statement Definition and Usage
+- logging Statement Grammar
+- logging Statement Definition and Usage
+- lwres Statement Grammar
+- lwres Statement Definition and Usage
+- options Statement Grammar
+- options Statement Definition and Usage
- server Statement Grammar
- server Statement Definition and Usage
-- trusted-keys Statement Grammar
-- trusted-keys Statement Definition
+
- trusted-keys Statement Grammar
+- trusted-keys Statement Definition
and Usage
-- view Statement Grammar
-- view Statement Definition and Usage
+- view Statement Grammar
+- view Statement Definition and Usage
- zone
Statement Grammar
-- zone Statement Definition and Usage
+- zone Statement Definition and Usage
Zone File
+Zone File
- Types of Resource Records and When to Use Them
-- Discussion of MX Records
+- Discussion of MX Records
- Setting TTLs
-- Inverse Mapping in IPv4
-- Other Zone File Directives
-- BIND Master File Extension: the $GENERATE Directive
+- Inverse Mapping in IPv4
+- Other Zone File Directives
+- BIND Master File Extension: the $GENERATE Directive
7. BIND 9 Security Considerations
8. Troubleshooting
A. Appendices