named.conf(4) named.conf(4)
NAME [Toc] [Back]
named.conf - configuration file for NameDaemon
SYNOPSIS [Toc] [Back]
/etc/named.conf
DESCRIPTION [Toc] [Back]
BIND 9 configuration is broadly similar to BIND 8.x. However, there
are a few new areas of configuration, such as views. BIND 8.x
configuration files should work with few alterations in BIND 9.2,
although more complex configurations need to be reviewed to check if
they can be more efficiently implemented using the new features
implemented in BIND 9.2. BIND 4.9.7 configuration files can be
converted to the BIND 9.2 format using the shell script,
/usr/bin/named-bootconf.sh.
Configuration File Elements [Toc] [Back]
The following configuration elements are used in BIND 9.2
configuration file documentation:
acl_name The name of an address_match_list as defined by the acl
statement.
address_match_list
A list of one or more ip_addr, ip_prefix, key_id, or
acl_name elements.
domain_name A quoted string which will be used as a DNS name, for
example my.test.domain.
dotted_decimal One or more integers valued 0 through 255 separated
only by dots (.), such as 123, 45.67 or 89.123.45.67.
ip4_addr An IPv4 address with exactly four elements in
dotted_decimal notation.
ip6_addr An IPv6 address, such as fe80::200:f8ff:fe01:9742.
ip_addr An ip4_addr or ip6_addr.
ip_port An IP port number. This is limited to 0 through 65535,
with values below 1024 typically restricted to rootowned
processes. In some cases, an asterisk (*)
character can be used as a placeholder to select a
random high-numbered port.
ip_prefix An IP network specified as an ip_addr, followed by a
slash (/) and then the number of bits in the netmask.
Trailing zeros in ip_addr may be omitted. For example,
127/8 is the network 127.0.0.0 with netmask 255.0.0.0
and 1.2.3.0/28 is network 1.2.3.0 with netmask
Hewlett-Packard Company - 1 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
255.255.255.240.
key_id A domain_name representing the name of a shared key, to
be used for transaction security.
key_list A list of one or more key_ids, separated by semicolons
and ending with a semicolon.
number A non-negative 32-bit unsigned integer (i.e., a number
between 0 and 4294967295, inclusive). Its acceptable
value might further be limited by the context in which
it is used.
path_name A quoted string which will be used as a pathname, such
as zones/master/my.test.domain.
size_spec A number, the word "unlimited", or the word "default".
An unlimited size_spec requests unlimited use, or the
maximum available amount. A default size_spec uses the
limit that was in force when the server was started. A
number can optionally be followed by a scaling factor:
"K" or "k" for kilobytes, "M" or "m" for megabytes, and
"G" or "g" for gigabytes, which scale by 1024,
1024*1024, and 1024*1024*1024 respectively. The value
must be representable as a 64-bit unsigned integer (0
to 18446744073709551615, inclusive). Using "unlimited"
is the best way to set a really large number.
yes_or_no Either "yes" or "no". The words "true" and "false" are
also accepted, as are the numbers 1 and 0.
dialup_option One of yes, no, notify, notify-passive, refresh or
passive. When used in a zone, notify-passive,
refresh, and passive are restricted to slave and stub
zones.
Address Match Lists Syntax [Toc] [Back]
address_match_list3D address_match_list_element ;
[ address_match_list_element; ... ]
address_match_list_element3D [ ! ] (ip_address [/length] |
key key_id | acl_name | { address_match_list } )
Address Match Lists Definition and Usage [Toc] [Back]
Address match lists are primarily used to determine access control for
various server operations. They are also used to define priorities
for querying other nameservers and to set the addresses on which named
will listen for queries. The elements which constitute an address
match list may be any of the following:
+ an IP address (IPv4 or IPv6)
Hewlett-Packard Company - 2 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
+ an IP prefix (in the `/'-notation)
+ a key ID, as defined by the key statement
+ the name of an address match list previously defined with the acl
statement
+ a nested address match list enclosed in braces
Elements can be negated with a leading exclamation mark (!). The
match list names of any, none, localhost, and localnets are
predefined. For more information on these match list names, refer to
the acl statement section. The addition of the key clause made the
name of this syntactic element something of a misnomer, since security
keys can be used to validate access without regard to a host or
network address. However, the term "address match list" is still
being used.
When a given IP address or prefix is compared to an address match
list, the list is traversed in order until an element matches. The
interpretation of a match depends on whether the list is being used
for access control, defining listen-on ports and whether the element
was negated. When used as an access control list, a non-negated match
allows access and a negated match denies access. If there is no
match, access is denied.
The clauses allow-notify, allow-query, allow-transfer, allow-update,
and blackhole which can be specified in the options and/or zone use
the address match lists. Similarly, the listen-on option causes the
server not to accept queries on any of the machine's addresses which
do not match the list.
Because of the first-match aspect of the algorithm, an element that
defines a subset of another element in the list should come before the
broader element, regardless of whether either is negated. For
example, in 1.2.3/24; ! 1.2.3.13; the 1.2.3.13 element is not of any
use because the algorithm will match any lookup for 1.2.3.13 to the
1.2.3/24 element. Using ! 1.2.3.13; 1.2.3/24 fixes that problem by
having 1.2.3.13 blocked by the negation but all other 1.2.3.* hosts
fall through.
Comment Syntax [Toc] [Back]
Comments in BIND 9.2 configuration file can be written in C, C++, or
shell/perl constructs.
WARNING: Unlike a zone file, you cannot use semicolon (;) character to
start a comment in the BIND 9.2 configuration file. The semicolon
indicates the end of a configuration statement.
Configuration File Grammar [Toc] [Back]
A BIND 9.2 configuration file consists of statements and comments.
Hewlett-Packard Company - 3 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
Statements end with a semicolon. Statements and comments are the only
elements that can appear without enclosing braces. Many statements
contain a block of substatements, which are terminated with a
semicolon. The following statements are supported:
acl defines a named IP address matching list, for access
control and other uses.
controls declares control channels to be used by the rndc
utility.
include includes a file.
key specifies key information for use in authentication and
authorization using TSIG.
logging specifies what the server logs, and where the log
messages are sent.
options controls global server configuration options and sets
defaults for other statements.
server sets certain configuration options on a per-server
basis.
trusted-keys defines trusted DNSSEC keys.
view defines a view.
zone defines a zone.
The logging and options statements may occur only once per
configuration.
acl Statement Grammar
acl acl-name {
address_match_list
};
acl Statement Definition and Usage
The acl statement assigns a symbolic name to an address match list.
It gets its name from the primary use of address match lists: "Access
Control Lists" (ACLs). Note that an address match list's name must be
defined with acl before it can be used elsewhere; no forward
references are allowed. The following ACLs are built-in:
any Matches all hosts.
none Matches no hosts.
Hewlett-Packard Company - 4 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
localhost Matches the IPv4 addresses of all network
interfaces on the system.
localnets Matches any host on an IPv4 network for which the
system has an interface.
The localhost and localnets ACLs do not currently support IPv6 (i.e.,
localhost does not match the host's IPv6 addresses, and localnets does
not match the host's attached IPv6 networks) due to the lack of a
standard method of determining the complete set of local IPv6
addresses for a host.
controls Statement Grammar
controls {
inet (ip_addr| * ) [port ip_port] allow { address_match_list }
keys { key_list };
[ inet ...; ]
};
controls Statement Definition and Usage
The controls statement declares control channels to be used by system
administrators to affect the operation of the local nameserver. These
control channels are used by the rndc utility to send commands to and
retrieve non-DNS results from a nameserver.
An inet control channel is a TCP/IP socket accessible to the Internet,
created at the specified ip_port on the specified ip_addr. If no port
is specified, port 953 is used by default. * cannot be used for
ip_port.
The ability to issue commands over the control channel is restricted
by the allow and keys clauses. Connections to the control channel are
permitted based on the address permissions in address_match_list.
key_id members of the address_match_list are ignored, and instead are
interpreted independently based on the key_list. Each key_id in the
key_list is allowed to be used to authenticate commands and responses
given over the control channel by digitally signing each message
between the server and a command client. All commands to the control
channel must be signed by one of its specified keys to be honored.
If no controls statement is present, named will set up a default
control channel listening on the loopback address 127.0.0.1 and its
IPv6 counterpart ::1. In this case, and also when the controls
statement is present but does not have a keys clause, named will
attempt to load the command channel key from the file rndc.key in
/etc. To create a rndc.key file, run rndc-confgen -a. The rndc.key
feature was implemented to ease the transition of systems from BIND 8,
which did not have digital signatures on its command channel messages
and thus did not have a keys clause.
Hewlett-Packard Company - 5 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
Since the rndc.key feature is only intended to allow the backwardcompatible
usage of BIND 8 configuration files, this feature does not
have a high degree of configurability. You cannot easily change the
key name or the size of the secret, so you should make a rndc.conf
with your own key if you wish to change them. The rndc.key file also
has its permissions set such that only the owner of the file (the user
that named is running as) can access it. If you desire greater
flexibility in allowing other users to access rndc commands, then you
need to create an rndc.conf and make it group-readable by a group that
contains the users who should have access.
The UNIX control channel type of BIND 8 is not supported in BIND 9.2,
and is not expected to be added in future releases. If it is present
in the controls statement from a BIND 8 configuration file, it is
ignored and a warning is logged.
include Statement Grammar
include filename;
include Statement Definition and Usage
The include statement inserts the specified file at the point where
the include statement is encountered. The include statement
facilitates the administration of configuration files by permitting
the reading or writing of some things but not others. For example,
the statement could include private keys that are readable only by a
nameserver.
key Statement Grammar
key key_id {
algorithm string;
secret string;
};
key Statement Definition and Usage
The key statement defines a shared secret key for use with TSIG. The
key statement can occur at the top level of the configuration file or
inside a view statement. Keys defined in top-level key statements can
be used in all views. Keys intended for use in a controls statement
must be defined at the top level.
The key_id, also known as the key name, is a domain name uniquely
identifying the key. It can be used in a server statement to sign
requests with this key or in address match lists to verify that
incoming requests have been signed with a key matching this name,
algorithm, and secret.
The algorithm_id is a string that specifies a security/authentication
algorithm. "hmac-md5" is the only algorithm which is currently
supported with TSIG authentication. The secret_string is a base-64
encoded secret string to be used by the algorithm.
Hewlett-Packard Company - 6 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
logging Statement Grammar
logging {
[ channel channel_name {
( file path name
[ versions ( number | unlimited ) ]
[ size size spec ]
| syslog syslog_facility
| stderr
| null );
[ severity (critical | error | warning | notice |
info | debug [ level ] | dynamic ); ]
[ print-category yes or no; ]
[ print-severity yes or no; ]
[ print-time yes or no; ]
}; ]
[ category category_name {
channel_name ; [ channel_name ; ... ]
}; ]
...
};
logging Statement Definition and Usage
The logging statement configures a wide variety of logging options for
the nameserver. Its channel phrase associates output methods, format
options and severity levels with a name that can be used with the
category phrase to select how various classes of messages are logged.
Only one logging statement is used to define any number of channels
and categories. If there is no logging statement, the logging
configuration will be:
logging {
category "unmatched" { "null"; };
category "default" { "default_syslog"; "default_debug"; };
};
In BIND 9.2, the logging configuration is established only when the
entire configuration file has been parsed. In BIND 8, it was
established as soon as the logging statement was parsed. When the
server starts up, all logging messages related to syntax errors in the
configuration file go to the default channels, or to standard error if
the -g option was specified.
The channel Phrase [Toc] [Back]
All log output goes to one or more user defined or pre-defined
channels; Every channel definition must include a destination clause
that says whether messages selected for the channel go to a file, or
to a particular syslog facility, or to the standard error stream, or
are discarded. It can optionally also limit the message severity
level that will be accepted by the channel (the default is info) , and
whether to include a named-generated time stamp, the category name
Hewlett-Packard Company - 7 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
and/or severity level (the default is not to include any). The
channel options are irrelevant when the null destination clause
discards all messages sent to the channel.
The file destination clause directs the channel to a disk file. It
can include limitations both on file size limit and number of versions
of the file, saved each time the file is opened.
If you use the versions log file option, then named will retain that
many backup versions of the file by renaming them when opening.
For example, if you choose to keep three old versions of the file
lamers.log, then just before it is opened:
lamers.log.1 is renamed to lamers.log.2,
lamers.log.0 is renamed to lamers.log.1, and
lamers.log is renamed to lamers.log.0.
Use versions unlimited; if you do not want to limit the number of
versions. If a size option is associated with the log file, then
renaming is only done when the file being opened exceeds the indicated
size. No backup versions are kept by default; any existing log file
is simply appended.
The size option for files is used to limit log growth. If the file
size exceeds the limit, then named will stop writing to the file
unless it has a versions option associated with it. If backup
versions are kept, the files are rolled as described above and a new
file is opened. If there is no versions option, no more data will be
written to the log until the log file is removed or truncated to less
than the maximum size. The default behavior is not to limit the size
of the file.
Example usage of the size and versions options:
channel "an_example_channel" {
file "example.log" versions 3 size 20m;
print-time yes;
print-category yes;
};
The syslog destination clause directs the channel to the system log.
Its argument is a syslog facility as described in the syslog(3C) man
page. The syslog(3C) man page describes how syslog will handle
messages sent to this facility. If you have a system which uses a
very old version of syslog that uses only two arguments to the
openlog() function, then syslog destination clause is ignored.
Hewlett-Packard Company - 8 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
The severity clause works like syslog's "priorities", except that they
can also be used if you are writing straight to a file rather than
using syslog. Messages which are not at least of the severity level
given will not be selected for the channel; messages of higher
severity levels will be accepted. If you are using syslog, then the
syslog.conf priorities will also determine what eventually passes
through.
For example, defining a channel facility and severity as daemon and
debug but only logging daemon.warning via syslog.conf will cause
messages of severity info and notice to be dropped. If the situation
were reversed, with named writing messages of only warning or higher,
then syslogd would print all messages it received from the channel.
The stderr destination clause directs the channel to the server's
standard error stream. This is intended for use when the server is
running as a foreground process, for example when debugging the
configuration.
The server can supply extensive debugging information when it is in
debugging mode. If the server's global debug level is greater than
zero, then debugging mode will be active. The global debug level is
set either by starting the named server with the -d flag followed by a
positive integer, or by running rndc trace. The global debug level
can be set to zero, and debugging mode turned off, by running rndc
notrace. All debugging messages in the server have a debug level, and
higher debug levels give more detailed output. For example:
channel "specific_debug_level" {
file "foo";
severity debug 3;
};
In the above example, channels that specify a particular debug
severity will get debugging output of level 3 or less any time the
server is in debugging mode, regardless of the global debugging level.
Channels with dynamic severity use the server's global level to
determine what messages to print.
If print-time has been turned on, then the date and time will be
logged. print-time may be specified for a syslog channel, but is
usually pointless since syslog also prints the date and time. If
print-category is requested, then the category of the message will be
logged as well. Finally, if print-severity is ON, then the severity
level of the message will be logged. The print- options may be used
in any combination, and will always be printed in the order: time,
category, severity. Here is an example where all three print- options
are ON:
28-Feb-2000 15:05:32.863 general: notice: running
Hewlett-Packard Company - 9 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
There are four pre-defined channels that are used for named's default
logging as follows:
channel "default_syslog" {
syslog daemon; // send to syslog's daemon
// facility
severity info; // only send priority info
// and higher
};
channel "default_debug" {
file "named.run"; // write to named.run in
// the working directory
// Note: stderr is used instead
// of "named.run"
// if the server is started
// with the '-f' option.
severity dynamic; // log at the server's
// current debug level
};
channel "default_stderr" { // writes to stderr
stderr;
severity info; // only send priority info
// and higher
};
channel "null" {
null; // toss anything sent to
// this channel
};
The default_debug channel has the special property that it only
produces output when the server's debug level is a non-zero value. It
normally writes to a file named.run in the server's working directory.
For security reasons, when the -u command line option is used, the
named.run file is created only after named has changed to the new UID,
and any debug output is generated while named is starting up and still
running as root is discarded. If you need to capture this output, you
must run the server with the -g option and redirect standard error to
a file.
Once a channel is defined, it cannot be redefined. Thus you cannot
alter the built-in channels directly, but you can modify the default
logging by pointing categories at channels you have defined.
The category Phrase [Toc] [Back]
Pre-defined categories allow the administrator to fine-tune what
messages they want to log and where they want to log those messages
to. If a list of channels is not specified for a category, then log
Hewlett-Packard Company - 10 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
messages in that category will be sent to the default category
instead. If you do not specify a default category, the following
category is used:
category "default" { "default_syslog"; "default_debug"; };
For example, if you want to log security events to a file and also
wish to keep the default logging behavior, you need to specify the
following:
channel "my_security_channel" {
file "my_security_file";
severity info;
};
category "security" {
"my_security_channel";
"default_syslog";
"default_debug";
};
To discard all messages in a category, specify the null channel as
follows:
category "xfer-out" { "null"; };
category "notify" { "null"; };
Following are the available categories and brief descriptions of the
types of log information they contain. More categories may be added
in future BIND releases.
default The default category defines the logging options for
those categories where no specific configuration has
been defined.
general The catch-all. All unclassified categories belong to
this category.
database Messages relating to the databases used internally by
the name server to store zone and cache data.
security Approval and denial of requests.
config Configuration file parsing and processing.
resolver DNS resolution, such as recursive lookups performed on
behalf of clients by a caching name server.
xfer-in Zone transfers the server is receiving.
Hewlett-Packard Company - 11 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
xfer-out Zone transfers the server is sending.
notify The NOTIFY protocol
client Processing of client requests
unmatched Messages that named was unable to determine the class
of or for which there was no matching view. A one-line
summary is also logged to the client category. This
category is best sent to a file or stderr, by default
it is sent to the null channel.
network Network operations
update Dynamic updates
queries Enable query logging
dispatch Dispatching of incoming packets to the server modules
where they are to be processed.
dnssec DNSSEC and TSIG protocol processing.
lame-servers Lame servers. These are misconfigurations in remote
servers, discovered by BIND 9 when trying to query
those servers during resolution.
lwres Statement Grammar
This is the grammar of the lwres statement in the named.conf file:
lwres {
[ listen-on { ip_addr [port ip_port] ; [ ip_addr [port ip_port] ;
... ] }; ]
[ view view_name; ]
[ search { domain_name ; [ domain_name ; ... ] }; ]
[ ndots number; ]
};
lwres Statement Definition and Usage
The lwres statement configures the name server to also act as a
lightweight resolver server. There may be be multiple lwres
statements configuring lightweight resolver servers with different
properties. The listen-on statement specifies a list of addresses and
ports that a lightweight resolver daemon should accept requests on.
If no port is specified, port 921 is used. If this statement is
omitted, requests will be accepted on 127.0.0.1, port 921.
The view statement binds this instance of a lightweight resolver
daemon to a view in the DNS namespace, so that the response will be
constructed in the same manner as a normal DNS query matching this
view. If this statement is omitted, the default view is used, and if
Hewlett-Packard Company - 12 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
there is no default view, an error is triggered.
The search statement is equivalent to the search statement in
/etc/resolv.conf. It provides a list of domains which are appended to
relative names in queries.
The ndots statement is equivalent to the ndots statement in
/etc/resolv.conf. It indicates the minimum number of dots in a
relative domain name that should result in an exact match lookup
before search path elements are appended.
options Statement Grammar
This is the grammar of the options statement in the named.conf file:
options {
[ version version_string; ]
[ directory path_name; ]
[ tkey-domain domainname; ]
[ tkey-dhkey key_name key_tag; ]
[ dump-file path_name; ]
[ pid-file path_name; ]
[ statistics-file path_name; ]
[ zone-statistics yes_or_no; ]
[ auth-nxdomain yes_or_no; ]
[ dialup dialup_option; ]
[ minimal-responses yes_or_no; ]
[ notify yes_or_no | explicit; ]
[ recursion yes_or_no; ]
[ forward ( only | first ); ]
[ forwarders { ip_addr [port ip_port] ;
[ ip_addr [port ip_port] ; ... ] }; ]
[ allow-notify { address_match_list }; ]
[ allow-query { address_match_list }; ]
[ allow-transfer { address_match_list }; ]
[ allow-recursion { address_match_list }; ]
[ allow-v6-synthesis { address_match_list }; ]
[ blackhole { address_match_list }; ]
[ listen-on [ port ip_port ] { address_match_list }; ]
[ listen-on-v6 [ port ip_port ] { address_match_list }; ]
[ query-source [ address ( ip_addr | * ) ]
[ port ( ip_port | * ) ]; ]
[ max-transfer-time-in number; ]
[ max-transfer-time-out number; ]
[ max-transfer-idle-in number; ]
[ max-transfer-idle-out number; ]
[ tcp-clients number; ]
[ recursive-clients number; ]
[ serial-query-rate number; ]
[ transfer-format ( one-answer | many-answers ); ]
[ transfers-in number; ]
[ transfers-out number; ]
Hewlett-Packard Company - 13 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
[ transfers-per-ns number; ]
[ transfer-source (ip4_addr | *) [port ip_port] ; ]
[ transfer-source-v6 (ip6_addr | *) [port ip_port] ; ]
[ notify-source (ip4_addr | *) [port ip_port] ; ]
[ notify-source-v6 (ip6_addr | *) [port ip_port] ; ]
[ also-notify { ip_addr [port ip_port] ;
[ ip_addr [port ip_port] ; ... ] }; ]
[ coresize size_spec ; ]
[ datasize size_spec ; ]
[ files size_spec ; ]
[ stacksize size_spec ; ]
[ cleaning-interval number; ]
[ heartbeat-interval number; ]
[ interface-interval number; ]
[ sortlist { address_match_list }];
[ lame-ttl number; ]
[ max-ncache-ttl number; ]
[ max-cache-ttl number; ]
[ sig-validity-interval number ; ]
[ use-ixfr yes_or_no ; ]
[ provide-ixfr yes_or_no; ]
[ request-ixfr yes_or_no; ]
[ min-refresh-time number ; ]
[ max-refresh-time number ; ]
[ min-retry-time number ; ]
[ max-retry-time number ; ]
[ port ip_port; ]
[ additional-from-auth yes_or_no ; ]
[ additional-from-cache yes_or_no ; ]
[ random-device path_name ; ]
[ max-cache-size size_spec ; ]
[ match-mapped-addresses yes_or_no; ]
[ edns yes_or_no; ]
};
options Statement Definition and Usage
The options statement sets up global options to be used by BIND. This
statement may appear only once in a configuration file. If more than
one occurrence is found, the first occurrence determines the actual
options used, and a warning will be generated. If there is no options
statement, an options block with each option set to its default will
be used.
version The version that the server should report via a query
of name version.bind in class CHAOS. Default is the
real version number of this server.
directory The working directory of the server. Any non-absolute
pathnames in the configuration file will be taken as
relative to this directory. The default location for
most server output files (e.g. named.run) is this
Hewlett-Packard Company - 14 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
directory. If a directory is not specified, the
working directory defaults to (.), the directory from
which the server was started. The directory specified
should be an absolute path.
tkey-domain The domain appended to the names of all shared keys
generated with TKEY. When a client requests a TKEY
exchange, it may or may not specify the desired name
for the key. If present, the name of the shared key
will be client specified part + tkey-domain.
Otherwise, the name of the shared key will be random
hex digits + tkey-domain. In most cases, the domain
name should be the server's domain name.
tkey-dhkey The Diffie-Hellman key used by the server to generate
shared keys with clients using the Diffie-Hellman mode
of TKEY. The server must be able to load the public
and private keys from files in the working directory.
In most cases, the keyname should be the server's host
name.
dump-file The pathname of the file to which the server dumps the
database with rndc dumpdb. Default is named_dump.db.
pid-file The pathname of the file in which the server writes its
process ID. If not specified, the default pathname
/var/run/named.pid The pid-file is used by programs
that need to send signals to the running nameserver.
statistics-file
The pathname of the file in which the server appends
statistics using rndc stats. Default is named.stats in
the server's current directory.
port The UDP/TCP port number the server uses for receiving
and sending DNS protocol traffic. Default is 53. This
option is mainly intended for server testing; a server
using a port other than 53 will not be able to
communicate with the global DNS.
random-device The source of entropy to be used by the server.
Entropy is primarily needed for DNSSEC operations, such
as TKEY transactions and dynamic update of signed
zones. This option specifies the device (or file) from
which to read entropy. If this is a file, operations
requiring entropy will fail when the file has been
exhausted. The default value is /dev/random (or
equivalent) when present, and none otherwise. The
random-device option takes effect during the initial
configuration load at server startup time and is
ignored on subsequent reloads.
Hewlett-Packard Company - 15 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
Boolean Options [Toc] [Back]
auth-nxdomain
If "yes", then the AA bit is always set on NXDOMAIN
responses, even if the server is not actually
authoritative. The default is "no". If you are using an
old version of BIND, you might need to set this option to
"yes".
dialup If "yes", then the server treats all zones as if they are
doing zone transfers across a dial on demand dialup link,
which can be brought up by traffic originating from this
server. This has different effects according to zone type
and concentrates the zone maintenance so that it all
happens in a short interval, once every heartbeat-interval
and hopefully during the one call. It also suppresses
some of the normal zone maintenance traffic. The default
is "no". The dialup option may also be specified in the
view and zone statements, in which case, it overrides the
global dialup option.
If the zone is a master zone then the server will send out
a NOTIFY request to all the slaves. This will trigger the
zone serial number check in the slave (provided, it
supports NOTIFY) allowing the slave to verify the zone
while the connection is active.
If the zone is a slave or stub zone, then the server will
suppress the regular "zone up to date" (refresh) queries
and only perform them when the heartbeat-interval expires
in addition to sending NOTIFY requests.
Finer control can be achieved by using notify which only
sends NOTIFY messages, notify-passive which sends NOTIFY
messages and suppresses the normal refresh queries,
refresh which suppresses normal refresh processing and
sends refresh queries when the heartbeat-interval expires
and passive which just disables normal refresh processing.
minimal-responses
If "yes", then the server will only add records to the
authority when generating responses and additional data
sections when they are required (e.g. delegations,
negative responses). This may improve the performance of
the server. Default is "no".
notify If "yes" (the default), DNS NOTIFY messages are sent when
a zone for which the server is authoritative, changes.
The messages are sent to the servers listed in the zone's
NS records (except the master server identified in the SOA
MNAME field), and to any servers listed in the also-notify
option. If explicit, notify messages are sent only to
Hewlett-Packard Company - 16 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
servers explicitly listed using also-notify. If "no", no
notify messages are sent.
The notify option may also be specified in the zone
statement, in which case it overrides the notify specified
in the options statement. It needs to be turned off only
when the slaves crash.
recursion If "yes", and a DNS query requests recursion, then the
server will attempt to answer the query. If recursion is
off and the server does not know the answer, it will
return a referral response. The default is "yes". Note
that setting recursion to "no" does not prevent clients
from getting data from the server's cache; it only
prevents new data from being cached as an effect of client
queries. Caching may still occur as an effect of the
server's internal operation, such as NOTIFY address
lookups.
zone-statistics
If "yes", the server will, by default, collect statistical
data on all zones in the server. These statistics may be
accessed using rndc stats, which will dump them to the
file listed in the statistics-file.
provide-ixfr
clause determines whether the local server, acting as
master, will respond with an incremental zone transfer
when the given remote server, a slave, requests it. If
set to "yes", incremental transfer will be provided
whenever possible. If set to "no", all transfers to the
remote server will be non-incremental. If not set, the
value of the provide-ixfr option in the view or global
options block is used as a default.
request-ixfr
The request-ixfr clause determines whether the local
server, acting as a slave, will request incremental zone
transfers from the given remote server, a master. If not
set, the value of the request-ixfr option in the view or
global options block is used as a default.
additional-from-auth, additional-from-cache
These options control the behavior of an authoritative
server when answering queries which have additional data,
or when following CNAME and DNAME chains.
When both of these options are set to "yes" (the default)
and a query is being answered from authoritative data (a
zone configured into the server), the additional data
section of the reply will be filled in using data from
Hewlett-Packard Company - 17 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
other authoritative zones and from the cache. In some
situations this is undesirable, such as when there is
concern over the correctness of the cache, or in servers
where slave zones may be added and modified by untrusted
third parties. Also, avoiding the search for this
additional data will speed up server operations at the
possible expense of additional queries to resolve what
would otherwise be provided in the additional section.
For example, if a query asks for an MX record for host
foo.example.com, and the record found is "MX 10
mail.example.net", normally the address records (A, A6,
and AAAA) for mail.example.net will be provided as well,
if known. Set these options to "no" to disable this
behavior. These options are intended for use in
authoritative-only servers, or in authoritative-only
views. Attempts to set them to "no" without also
specifying recursion "no" will cause the server to ignore
the options and log a warning message.
Specifying additional-from-cache no actually disables the
use of the cache not only for additional data lookups but
also when looking up the answer. This is usually the
desired behavior in an authoritative-only server where the
correctness of the cached data is an issue.
When a name server is non-recursively queried for a name
that is not below the apex of any served zone, it normally
answers with an "upwards referral" to the root servers or
the servers of some other known parent of the query name.
Since the data in an upwards referral comes from the
cache, the server will not be able to provide upwards
referrals when additional-from-cache no has been
specified. Instead, it will respond to such queries with
REFUSED. This should not cause any problems since upwards
referrals are not required for the resolution process.
match-mapped-addresses
If "yes", then an IPv4-mapped IPv6 address will match any
address match list entries that match the corresponding
IPv4 address.
edns (Extended DNS) clause determines whether the local server
will attempt to use EDNS when communicating with any
remote server. Default is "yes". If "no" then EDNS will
not be used when communicating with any remote server.
Then, to enable the EDNS feature for a server, the
customer needs to set edns yes in the server statement for
that server.
Hewlett-Packard Company - 18 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
Forwarding [Toc] [Back]
The forwarding facility can be used to create a large site-wide cache
on a few servers, reducing traffic over links to external nameservers.
It can also be used to allow queries by servers that do not have
direct access to the Internet, but wish to look up exterior names
anyway. Forwarding occurs only on those queries for which the server
is not authoritative and does not have the answer in its cache.
forward This option is useful only if the forwarders list is not
empty. The default value first, causes the server to
query the forwarders first, and if that is unable to
answer the question, the server will then look for the
answer itself. If only is specified, the server will only
query the forwarders.
forwarders Specifies the IP addresses to be used for forwarding. The
default is the empty list (no forwarding).
Forwarding can also be configured on a per-domain basis, allowing for
the global forwarding options to be overridden in a variety of ways.
You can set a particular domain to use different forwarders, or have a
different forward only/first: behavior, or not forward at all.
Access Control [Toc] [Back]
Access to the server can be restricted based on the IP address of the
requesting system.
allow-notify Specifies which hosts are allowed to notify slaves of a
zone change in addition to the zone masters. allow-
notify may also be specified in the zone statement, in
which case it overrides the options allow-notify
statement. It is only meaningful for a slave zone. If
not specified, the default is to process notify
messages only from a zone's master.
allow-query Specifies which hosts are allowed to ask ordinary
questions. allow-query may also be specified in the
zone statement, in which case it overrides the options
allow-query statement. If not specified, the default
is to allow queries from all hosts.
allow-recursion
Specifies which hosts are allowed to make recursive
queries through this server. If not specified, the
default is to allow recursive queries from all hosts.
Note that disallowing recursive queries for a host does
not prevent the host from retrieving data that is
already in the server's cache.
allow-v6-synthesis
Specifies the hosts which need to receive synthetic
Hewlett-Packard Company - 19 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
responses to IPv6 queries. See below for more details.
allow-transfer Specifies the hosts which are allowed to receive zone
transfers from the server. allow-transfer may also be
specified in the zone statement, in which case it
overrides the options allow-transfer statement. If not
specified, the default is to allow transfers from all
hosts.
blackhole Specifies a list of addresses that the server will not
accept queries from or use to resolve a query. Queries
from these addresses will not be responded to. Default
is none.
Interfaces [Toc] [Back]
The interfaces and ports that the server will answer queries from, may
be specified using the listen-on option. listen-on takes an optional
port, and an address_match_list The server will listen on all
interfaces allowed by the address match list. If a port is not
specified, port 53 will be used.
Multiple listen-on statements are allowed. For example,
listen-on { 5.6.7.8; };
listen-on port 1234 { !1.2.3.4; 1.2/16; };
will enable the nameserver on port 53 for the IP address 5.6.7.8, and
on port 1234 of an address on the machine in net 1.2 that is not
1.2.3.4. If no listen-on is specified, the server will listen on port
53 on all interfaces. The listen-on-v6 option is used to specify the
ports on which the server will listen for incoming queries sent using
IPv6.
The server does not bind a separate socket to each IPv6 interface
address as it does for IPv4. Instead, it always listens on the IPv6
wildcard address. Therefore, the only values allowed for the
address_match_list argument to the listen-on-v6 statement are:
{ any; }
and
{ none;}
Multiple listen-on-v6 options can be used to listen on multiple ports:
listen-on-v6 port 53 { any; };
listen-on-v6 port 1234 { any; };
To make the server not to listen on any IPv6 address, use
listen-on-v6 { none; };
Hewlett-Packard Company - 20 - HP-UX 11i Version 2: Sep 2004
named.conf(4) named.conf(4)
If no listen-on-v6 statement is specified, the server will not listen
on any IPv6 address.
Query Address [Toc] [Back]
If the server is unable to answer a question, it will query other
nameservers. query-source specifies the address and port used for
such queries. For queries sent over IPv6, there is a separate query-
source-v6 option. If address is * or is omitted, a wildcard IP
address (INADDR_ANY) will be used. If port is * or is omitted, a
random unprivileged port will be used. Default address and port are:
query-source address * port *;
query-source-v6 address * port *
Note: The address specified in the query-source option is used for
both UDP and TCP queries, but the port applies only to UDP queries.
TCP queries always use a random unprivileged port.
Zone Transfers [Toc] [Back]
BIND has mechanisms in place to facilitate zone transfers and set
limits on the amount of load that transfers place on the system. The
following options apply t
|
