named.conf.4 (2010 09)

ManualsBrandsHP ManualsSoftwareHP-UX Manpages

named.conf(4) named.conf(4)

(BIND 9.3)

NAME

named.conf - conﬁguration ﬁle for Internet domain name server

SYNOPSIS

/etc/named.conf

DESCRIPTION

named.conf is the conﬁguration ﬁle for the

named name server daemon. The default path name is

/etc/named.conf

BIND 9 conﬁguration is broadly similar to BIND 8.x. However, there are a few new areas of

conﬁguration, such as views. BIND 8.x conﬁguration ﬁles should work with few alterations in BIND 9.3,

although more complex conﬁgurations need to be reviewed to see if they can be more efﬁciently imple-

mented using the new features implemented in BIND 9.3. BIND 4.9.7 conﬁguration ﬁles can be con-

verted to the BIND 9.3 format using the shell script,

/usr/bin/named-bootconf.sh

Syntax Rules

In the syntax descriptions in this manpage, the following typographic rules apply:

literal Characters in this font should be entered as is.

variable Characters in this font should be replaced with appropriate values.

( ) Parentheses are metacharacters that enclose required content. (The brace characters

(

{}) are used in the conﬁguration syntax as block delimiters.)

[ ] Brackets are metacharacters that enclose optional content.

| Bars within parentheses and brackets are metacharacters that separate alternatives.

token ... [ ]... ( )...

Trailing ellipses are metacharacters that indicate that the previous token, parenthesized

item, or bracketed item may be repeated.

Conﬁguration File Elements

The following conﬁguration elements are used in the BIND 9.3 conﬁguration ﬁle grammar:

acl_name The name of an address_match_list as deﬁned by an

acl statement.

address_match_list

A list of one or more ip_addr , ip_preﬁx, key_id ,oracl_name elements.

dialup_option One of

yes

, no, notify, notify-passive, refresh,orpassive. When used in a

zone,

notify-passive,

refresh, and passive are restricted to slave and stub

zones.

domain_name A quoted string that is used as a DNS name; for example,

"my.test.domain"

dotted_decimal One or more integers valued 0 through 255 separated only by periods (

.), such as 123,

45.67,or89.123.45.67.

ip4_addr An IPv4 address with exactly four elements in dotted_decimal notation.

ip6_addr An IPv6 address, such as

fe80::200:f8ff:fe01:9742.

ip_addr An ip4_addr or ip6_addr .

ip_port An IP port number. This is limited to 0 through 65535, with values below 1024 typically

restricted to root-owned processes. In some cases, an asterisk (

*) character can be used

as a placeholder to select a random high-numbered port.

ip_prefix An IP network speciﬁed as an ip_addr , followed by a slash (

/) and then the number of

bits in the netmask. Trailing zero elements in ip_addr may be omitted. For example,

127/8 is the network 127.0.0.0 with netmask 255.0.0.0 and 1.2.3.0/28 is the

network 1.2.3.0 with netmask 255.255.255.240.

key_id A domain_name representing the name of a shared key, to be used for transaction secu-

rity.

key_list A list of one or more key_id s, separated by semicolons and ending with a semicolon.

number A nonnegative 32-bit unsigned integer (that is, a number between 0 and 4294967295,

inclusive). Its acceptable value might further be limited by the context in which it is

HP-UX 11i Version 3: September 2010 − 1 − Hewlett-Packard Company 1

Summary of content (38 pages)

PAGE 1
named.conf(4) named.conf(4) (BIND 9.3) NAME named.conf - configuration file for Internet domain name server SYNOPSIS /etc/named.conf DESCRIPTION named.conf is the configuration file for the named name server daemon. The default path name is /etc/named.conf. BIND 9 configuration is broadly similar to BIND 8.x. However, there are a few new areas of configuration, such as views. BIND 8.x configuration files should work with few alterations in BIND 9.
PAGE 2
named.conf(4) named.conf(4) (BIND 9.3) used. path_name A quoted string that is used as a path name, such as "zones/master/my.test.domain". size_spec One of the following: number A decimal number, optionally be followed by a scaling factor: K or k for kilobytes, M or m for megabytes, and G or g for gigabytes, which scale by 1024, 1024*1024, and 1024*1024*1024 respectively. The value must be representable as a 64-bit unsigned integer (0 to 18446744073709551615, inclusive).
PAGE 3
named.conf(4) named.conf(4) (BIND 9.3) by having 1.2.3.13 blocked by the negation but all other 1.2.3.* hosts fall through. Comment Syntax Comments in the BIND 9.3 configuration file can be written in the following styles: C: /* comment */ C++: // to end of line UNIX: # to end of line Note: Unlike a zone file, you cannot use a semicolon (;) character to start a comment in the BIND 9.3 configuration file. The semicolon indicates the end of a configuration statement.
PAGE 4
named.conf(4) named.conf(4) (BIND 9.3) The controls Statement controls Statement Grammar controls { ( inet ( ip_addr | * ) [ port ip_port ] allow { address_match_list } keys { key_list }; )... }; controls Statement Definition and Usage The controls statement declares control channels to be used by system administrators to control the operation of the local name server. These control channels are used by the rndc utility to send commands to and retrieve non-DNS results from a name server.
PAGE 5
named.conf(4) named.conf(4) (BIND 9.3) key Statement Definition and Usage The key statement defines a shared secret key for use with TSIG. The key statement can occur at the top level of the configuration file or inside a view statement. Keys defined in top-level key statements can be used in all views. Keys intended for use in a controls statement must be defined at the top level. key_id A domain name uniquely identifying the key. Also known as the key name.
PAGE 6
named.conf(4) named.conf(4) (BIND 9.3) any). The file destination clause directs the channel to a disk file. It can include limitations on both the file size and the number of versions of the file that are saved each time the file is opened. If you use the versions log file option, then named will retain that many backup versions of the file by renaming them when opening. For example, if you choose to keep three old versions of the file lamers.log, then, just before it is opened: lamers.log.
PAGE 7
named.conf(4) named.conf(4) (BIND 9.3) If print-time is on, then the date and time will be logged. print-time may be specified for a syslog channel, but that is usually pointless, since syslog also prints the date and time. If print-category is on, then the category of the message is logged as well. If print-severity is on, then the severity level of the message will be logged. The print-* options may be used in any combination, and will always be printed in the order time, category, severity.
PAGE 8
named.conf(4) named.conf(4) (BIND 9.
PAGE 9
named.conf(4) named.conf(4) (BIND 9.3) The lwres Statement lwres Statement Grammar lwres { [ listen-on { ( ip_addr [ port ip_port ] ; )... }; ] [ ndots number ; ] [ search { domain_name ; [ domain_name ; ]... }; ] [ view view_name ; ] }; lwres Statement Definition and Usage The lwres statement configures the name server to also act as a lightweight resolver server. There may be be multiple lwres statements configuring lightweight resolver servers with different properties.
PAGE 10
named.conf(4) named.conf(4) (BIND 9.
PAGE 11
named.conf(4) named.conf(4) (BIND 9.3) [ stacksize size_spec ; ] // Periodic Task Interval Options [ cleaning-interval number ; ] [ heartbeat-interval number ; ] [ interface-interval number ; ] // Query Address Options [ query-source [ address ( ip_addr | * ) ] [ port ( ip_port | * ) ] ; ] [ query-source-v6 [ address ( ip_addr | * ) ] [ port ( ip_port | * ) ] ; ] // RRset Ordering Option [ rrset-order { order_spec ; [ order_spec ; ]...
PAGE 12
named.conf(4) named.conf(4) (BIND 9.3) General Options directory The working directory of the server. Any nonabsolute path names in the configuration file will be taken as relative to this directory. The default location for most server output files (for example, named.run) is this directory. If a directory is not specified, the working directory defaults to the directory from which the server was started (.). The directory specified should be an absolute path.
PAGE 13
named.conf(4) named.conf(4) (BIND 9.3) options { root-delegation-only exclude { "de"; "lv"; "us"; "museum"; }; }; statistics-file The path name of the file in which the server appends statistics using rndc stats. The default is named.stats in the server’s current directory. The file format is described in The Statistics File section. tkey-dhkey The Diffie-Hellman key used by the server to generate shared keys with clients using the Diffie-Hellman mode of TKEY.
PAGE 14
named.conf(4) named.conf(4) (BIND 9.3) The rules for legal host names and mail domains are derived from RFC 952 and RFC 821 as modified by RFC 1123. check-names applies to the owner names of A, AAAA, and MX records. It also applies to the domain names in the rrdata of NS, SOA, and MX, records. It also applies to the rrdata of PTR records where the owner name indicated that it is a reverse lookup of a host name (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, IP6.INT).
PAGE 15
named.conf(4) named.conf(4) (BIND 9.3) presence of the logging category queries. recursion If yes and a DNS query requests recursion, then the server will attempt to answer the query. If no and the server does not know the answer, it will return a referral response. The default is yes. Note that setting recursion to no does not prevent clients from getting data from the server’s cache; it only prevents new data from being cached as an effect of client queries.
PAGE 16
named.conf(4) named.conf(4) (BIND 9.3) Built-In Server Information Zone Options The server provides some helpful diagnostic information through a number of built-in zones under the pseudo-top-level-domain bind in the CHAOS class. These zones are part of a built-in view of class CHAOS which is separate from the default view of class IN; therefore, any global server options such as allowquery do not apply the these zones.
PAGE 17
named.conf(4) named.conf(4) (BIND 9.3) forward This option is useful only if the forwarders list is not empty. The default value first, causes the server to query the forwarders first, and if that is unable to answer the question, the server will then look for the answer itself. If only is specified, the server will only query the forwarders. forwarders Specifies the IP addresses to be used for forwarding. The default is the empty list (no forwarding).
PAGE 18
named.conf(4) named.conf(4) (BIND 9.3) amount of memory used by the server, but it can be used to raise an operating system data size limit that is too small by default. If you wish to limit the amount of memory used by the server, use the max-cache-size and recursive-clients options instead; see the Server Resource Limit Options section. files The maximum number of files the server may have open concurrently. The default is unlimited. stacksize The maximum amount of stack memory the server may use.
PAGE 19
named.conf(4) named.conf(4) (BIND 9.3) In this example, any responses for type A records in class IN that have host.example.com as a suffix, are always returned in random order. All other records are returned in cyclic order. rrset-order { class IN type A name "host.example.com" order random; order cyclic; }; If multiple rrset-order statements appear, they are not combined; the last one applies.
PAGE 20
named.conf(4) named.conf(4) (BIND 9.3) host on the 192.168.4/24 or the 192.168.5/24 network will only prefer other addresses on their directly connected networks. sortlist { { localhost; // IF { localnets; // THEN 192.168.1/24; // { 192.168.2/24; 192.168.3/24; the local host first fit on the following nets }; }; }; { 192.168.1/24; // IF on class C 192.168.1 { 192.168.1/24; // THEN use .1, or .2 or .3 { 192.168.2/24; 192.168.3/24; }; }; }; { 192.168.2/24; // IF on class C 192.168.2 { 192.168.
PAGE 21
named.conf(4) named.conf(4) (BIND 9.3) and stub zones, and clamp the SOA refresh and retry times to the specified values. sig-validity-interval Specifies the number of days into the future when DNSSEC signatures that were automatically generated as a result of dynamic updates will expire. The default is 30 days. The maximum is 10 years (3660 days). The signature inception time is unconditionally set to one hour before the current time to allow for a limited amount of clock skew.
PAGE 22
named.conf(4) named.conf(4) (BIND 9.3) transferred. many-answers packs as many resource records as possible into a message. many-answers is more efficient, but is only supported by relatively new slave servers, such as BIND 9.3, BIND 8.x, and patched versions of BIND 4.9.x. The default is many-answers. transfer-format may be overridden on a per-server basis by using the server statement.
PAGE 23
named.conf(4) named.conf(4) (BIND 9.3) edns (Extended DNS) Determines whether the local server will attempt to use EDNS when communicating with the remote server. The default is yes. keys Identifies a key_id defined by a key statement, to be used for transaction security when talking to the remote server. The key statement must come before the server statement that references it.
PAGE 24
named.conf(4) named.conf(4) (BIND 9.3) The view Statement view Statement Grammar view view_name [ class ] { [ match-clients { address_match_list } ; ] [ match-destinations { address_match_list } ; ] [ match-recursive-only { yes_or_no } ; ] [ view_option ; ]... [ zone_statement ; ]... }; view Statement Definition and Usage The view statement lets a name server answer a DNS query differently depending on who is asking.
PAGE 25
named.conf(4) named.conf(4) (BIND 9.3) view "external" { match-clients { any; }; // Refuse recursive service to external clients. recursion no; // Provide a restricted view of the example.com zone // containing only publicly accessible hosts. zone "example.com" { type master; file "example-external.
PAGE 26
named.conf(4) named.conf(4) (BIND 9.3) type IN The Internet class. This is the default. IN is correct for the vast majority of cases. HS, Hesiod This class is named for an information service from MIT’s Project Athena. It is used to share information about various systems databases, such as users, groups, printers and so on. CHAOS Another MIT development is Chaosnet, a LAN protocol created in the mid-1970s. The type of the zone.
PAGE 27
named.conf(4) named.conf(4) (BIND 9.3) the authority section will be treated as NXDOMAIN. This does not apply to the zone apex. This should not be applied to leaf zones. delegation-only has no effect on answers received from forwarders. allow-notify See the description in The options Statement section. allow-query See the description in The options Statement section. allow-transfer See the description in The options Statement section.
PAGE 28
named.conf(4) named.conf(4) (BIND 9.3) ixfr-from-differences If yes and the server loads a new version of a master zone from its zone file or receives a new version of a slave file by a nonincremental zone transfer, it will compare the new version to the previous one and calculate a set of differences. The differences are then logged in the zone’s journal file such that the changes can be transmitted to downstream slaves as an incremental zone transfer.
PAGE 29
named.conf(4) named.conf(4) (BIND 9.3) use-alt-transfer-source See the description in The options Statement section. zone-statistics If yes, the server will keep statistical information for this zone, which can be dumped to the statistics-file defined in the server options. Dynamic Update Policies BIND 9.3 supports two alternative methods of granting clients the right to perform dynamic updates to a zone, configured by the allow-update and update-policy options, respectively.
PAGE 30
named.conf(4) named.conf(4) (BIND 9.3) optionally a zone name, and optionally a view name. The lines without view and zone listed are global statistics for the entire server. Lines with a zone and view name are for the given view and zone (the view name is omitted for the default view). The statistics dump ends with the line --- Statistics Dump --- (973798949) where the number is identical to the number in the beginning line.
PAGE 31
named.conf(4) named.conf(4) (BIND 9.3) For example, $ORIGIN $ORIGIN WWW com. example CNAME MAIN-SERVER is equivalent to: $ORIGIN WWW example.com. CNAME MAIN-SERVER is equivalent to: WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM. The $INCLUDE Directive The $INCLUDE directive reads and processes a file as if it were included into the file at this point. Syntax $INCLUDE filename [ origin ] filename The name of the file to be included. origin The origin for the data in the included file.
PAGE 32
named.conf(4) named.conf(4) (BIND 9.3) characters. The available base values are d (decimal), o (octal), x (lowercase hexadecimal), and X (uppercase hexadecimal). The default modifier is ${0,0,d}. To get a $ in the output, escape the $ with a backslash (\); for example, \$. For compatibility with earlier versions, $$ is still recognized as indicating a literal $ in the output. ttl The TTL for the generated records. If it is omitted, the normal TTL inheritance rules apply.
PAGE 33
named.conf(4) named.conf(4) (BIND 9.3) domain_name A standard domain name. If domain_name does not end with a period (.), it is relative and the current origin is appended to it. If domain_name ends with a period (.), it is absolute. blank If the first character of the record is blank, the previous owner_name is used. ttl The Time to Live (TTL) of the RR. This field is a 32-bit integer in units of seconds and is primarily used by resolvers when they cache RRs.
PAGE 34
named.conf(4) named.conf(4) (BIND 9.3) PX Provides mappings between RFC 822 and X.400 addresses. Described in RFC 2163. SIG (signature) Contains data authenticated in the secure DNS. Described in RFC 2535. rrdata SOA Identifies the start of a zone of authority in a zone file. See the SOA Resource Records section. Described in RFC 1035. SRV Information about the well-known network services, such as SMTP, that a domain supports. Supersedes WKS. Described in RFC 2282. TXT Text records.
PAGE 35
named.conf(4) named.conf(4) (BIND 9.3) retry A 32-bit integer time to wait in seconds before retrying a failed refresh. See the Time Specification section for more detail. expire A 32-bit integer time interval in seconds after which the zone is no longer authoritative. See the Time Specification section for more detail. minimum The TTL in seconds for resolvers that cache negative responses. See the Time to Live (TTL) and Time Specification sections for more detail.
PAGE 36
named.conf(4) named.conf(4) (BIND 9.3) Here’s a table of convenient values: Seconds in an Integer Value minimum 0 seconds 1 minute 60 seconds 1 hour 3600 seconds 1 day 86400 seconds 7 days 604800 seconds 30 days 2592000 seconds 24855 days 2147472000 seconds maximum 2147483647 seconds For convenience, some units can be explicitly specified; you can use h for hours, m for minutes, and s for seconds. For example, 1h30m.
PAGE 37
named.conf(4) named.conf(4) (BIND 9.3) HP-UX IP Address and Client Management Administrator’s Guide , available online at http://www.hp.com/go/hpux-networking-docs. BIND 9 Administrator Reference Manual , available from the Internet Systems Consortium at http://www.isc.org/sw/bind/arm93.
PAGE 38
(Notes) A (Notes) nA 38 Hewlett-Packard Company −1− HP-UX 11i Version 3: September 2010