*nix Documentation Project
·  Home
 +   man pages
·  Linux HOWTOs
·  FreeBSD Tips
·  *niX Forums

  man pages->HP-UX 11i man pages -> named.conf (4)              


 named.conf(4)                                                 named.conf(4)

 NAME    [Toc]    [Back]
      named.conf - configuration file for NameDaemon

 SYNOPSIS    [Toc]    [Back]

 DESCRIPTION    [Toc]    [Back]
      BIND 9 configuration is broadly similar to BIND 8.x.  However, there
      are a few new areas of configuration, such as views.  BIND 8.x
      configuration files should work with few alterations in BIND 9.2,
      although more complex configurations need to be reviewed to check if
      they can be more efficiently implemented using the new features
      implemented in BIND 9.2.  BIND 4.9.7 configuration files can be
      converted to the BIND 9.2 format using the shell script,

    Configuration File Elements    [Toc]    [Back]
      The following configuration elements are used in BIND 9.2
      configuration file documentation:

      acl_name       The name of an address_match_list as defined by the acl

                     A list of one or more ip_addr, ip_prefix, key_id, or
                     acl_name elements.

      domain_name    A quoted string which will be used as a DNS name, for
                     example my.test.domain.

      dotted_decimal One or more integers valued 0 through 255 separated
                     only by dots (.), such as 123, 45.67 or

      ip4_addr       An IPv4 address with exactly four elements in
                     dotted_decimal notation.

      ip6_addr       An IPv6 address, such as fe80::200:f8ff:fe01:9742.

      ip_addr        An ip4_addr or ip6_addr.

      ip_port        An IP port number.  This is limited to 0 through 65535,
                     with values below 1024 typically restricted to rootowned
 processes.  In some cases, an asterisk (*)
                     character can be used as a placeholder to select a
                     random high-numbered port.

      ip_prefix      An IP network specified as an ip_addr, followed by a
                     slash (/) and then the number of bits in the netmask.
                     Trailing zeros in ip_addr may be omitted.  For example,
                     127/8 is the network with netmask
                     and is network with netmask

 Hewlett-Packard Company            - 1 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)


      key_id         A domain_name representing the name of a shared key, to
                     be used for transaction security.

      key_list       A list of one or more key_ids, separated by semicolons
                     and ending with a semicolon.

      number         A non-negative 32-bit unsigned integer (i.e., a number
                     between 0 and 4294967295, inclusive).  Its acceptable
                     value might further be limited by the context in which
                     it is used.

      path_name      A quoted string which will be used as a pathname, such
                     as zones/master/my.test.domain.

      size_spec      A number, the word "unlimited", or the word "default".
                     An unlimited size_spec requests unlimited use, or the
                     maximum available amount.  A default size_spec uses the
                     limit that was in force when the server was started.  A
                     number can optionally be followed by a scaling factor:
                     "K" or "k" for kilobytes, "M" or "m" for megabytes, and
                     "G" or "g" for gigabytes, which scale by 1024,
                     1024*1024, and 1024*1024*1024 respectively.  The value
                     must be representable as a 64-bit unsigned integer (0
                     to 18446744073709551615, inclusive).  Using "unlimited"
                     is the best way to set a really large number.

      yes_or_no      Either "yes" or "no".  The words "true" and "false" are
                     also accepted, as are the numbers 1 and 0.

      dialup_option  One of yes, no, notify, notify-passive, refresh or
                     passive.  When used in a zone,  notify-passive,
                     refresh, and passive are restricted to slave and stub

    Address Match Lists Syntax    [Toc]    [Back]
      address_match_list3D address_match_list_element ;
       [ address_match_list_element; ... ]
      address_match_list_element3D [ ! ] (ip_address [/length] |
       key key_id | acl_name | { address_match_list } )

    Address Match Lists Definition and Usage    [Toc]    [Back]
      Address match lists are primarily used to determine access control for
      various server operations.  They are also used to define priorities
      for querying other nameservers and to set the addresses on which named
      will listen for queries.  The elements which constitute an address
      match list may be any of the following:

      +  an IP address (IPv4 or IPv6)

 Hewlett-Packard Company            - 2 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

      +  an IP prefix (in the `/'-notation)

      +  a key ID, as defined by the key statement

      +  the name of an address match list previously defined with the acl

      +  a nested address match list enclosed in braces

      Elements can be negated with a leading exclamation mark (!).  The
      match list names of any, none, localhost, and localnets are
      predefined.  For more information on these match list names, refer to
      the acl statement section.  The addition of the key clause made the
      name of this syntactic element something of a misnomer, since security
      keys can be used to validate access without regard to a host or
      network address.  However, the term "address match list" is still
      being used.

      When a given IP address or prefix is compared to an address match
      list, the list is traversed in order until an element matches.  The
      interpretation of a match depends on whether the list is being used
      for access control, defining listen-on ports and whether the element
      was negated.  When used as an access control list, a non-negated match
      allows access and a negated match denies access.  If there is no
      match, access is denied.

      The clauses allow-notify, allow-query, allow-transfer, allow-update,
      and blackhole which can be specified in the options and/or zone use
      the address match lists.  Similarly, the listen-on option causes the
      server not to accept queries on any of the machine's addresses which
      do not match the list.

      Because of the first-match aspect of the algorithm, an element that
      defines a subset of another element in the list should come before the
      broader element, regardless of whether either is negated.  For
      example, in 1.2.3/24; !; the element is not of any
      use because the algorithm will match any lookup for to the
      1.2.3/24 element.  Using !; 1.2.3/24 fixes that problem by
      having blocked by the negation but all other 1.2.3.* hosts
      fall through.

    Comment Syntax    [Toc]    [Back]
      Comments in BIND 9.2 configuration file can be written in C, C++, or
      shell/perl constructs.

      WARNING: Unlike a zone file, you cannot use semicolon (;) character to
      start a comment in the BIND 9.2 configuration file.  The semicolon
      indicates the end of a configuration statement.

    Configuration File Grammar    [Toc]    [Back]
      A BIND 9.2 configuration file consists of statements and comments.

 Hewlett-Packard Company            - 3 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

      Statements end with a semicolon.  Statements and comments are the only
      elements that can appear without enclosing braces.  Many statements
      contain a block of substatements, which are terminated with a
      semicolon.  The following statements are supported:

      acl            defines a named IP address matching list, for access
                     control and other uses.

      controls       declares control channels to be used by the rndc

      include        includes a file.

      key            specifies key information for use in authentication and
                     authorization using TSIG.

      logging        specifies what the server logs, and where the log
                     messages are sent.

      options        controls global server configuration options and sets
                     defaults for other statements.

      server         sets certain configuration options on a per-server

      trusted-keys   defines trusted DNSSEC keys.

      view           defines a view.

      zone           defines a zone.

      The logging and options statements may occur only once per

    acl Statement Grammar
           acl acl-name {

    acl Statement Definition and Usage
      The acl statement assigns a symbolic name to an address match list.
      It gets its name from the primary use of address match lists: "Access
      Control Lists" (ACLs).  Note that an address match list's name must be
      defined with acl before it can be used elsewhere; no forward
      references are allowed.  The following ACLs are built-in:

           any            Matches all hosts.

           none           Matches no hosts.

 Hewlett-Packard Company            - 4 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

           localhost      Matches the IPv4 addresses of all network
                          interfaces on the system.

           localnets      Matches any host on an IPv4 network for which the
                          system has an interface.

      The localhost and localnets ACLs do not currently support IPv6 (i.e.,
      localhost does not match the host's IPv6 addresses, and localnets does
      not match the host's attached IPv6 networks) due to the lack of a
      standard method of determining the complete set of local IPv6
      addresses for a host.

    controls Statement Grammar
           controls {
             inet (ip_addr| * ) [port ip_port] allow { address_match_list }
                keys { key_list };
             [ inet ...; ]

    controls Statement Definition and Usage
      The controls statement declares control channels to be used by system
      administrators to affect the operation of the local nameserver.  These
      control channels are used by the rndc utility to send commands to and
      retrieve non-DNS results from a nameserver.

      An inet control channel is a TCP/IP socket accessible to the Internet,
      created at the specified ip_port on the specified ip_addr.  If no port
      is specified, port 953 is used by default.  * cannot be used for

      The ability to issue commands over the control channel is restricted
      by the allow and keys clauses.  Connections to the control channel are
      permitted based on the address permissions in address_match_list.
      key_id members of the address_match_list are ignored, and instead are
      interpreted independently based on the key_list.  Each key_id in the
      key_list is allowed to be used to authenticate commands and responses
      given over the control channel by digitally signing each message
      between the server and a command client.  All commands to the control
      channel must be signed by one of its specified keys to be honored.

      If no controls statement is present, named will set up a default
      control channel listening on the loopback address and its
      IPv6 counterpart ::1. In this case, and also when the controls
      statement is present but does not have a keys clause, named will
      attempt to load the command channel key from the file rndc.key in
      /etc.  To create a rndc.key file, run rndc-confgen -a.  The rndc.key
      feature was implemented to ease the transition of systems from BIND 8,
      which did not have digital signatures on its command channel messages
      and thus did not have a keys clause.

 Hewlett-Packard Company            - 5 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

      Since the rndc.key feature is only intended to allow the backwardcompatible
 usage of BIND 8 configuration files, this feature does not
      have a high degree of configurability.  You cannot easily change the
      key name or the size of the secret, so you should make a rndc.conf
      with your own key if you wish to change them.  The rndc.key file also
      has its permissions set such that only the owner of the file (the user
      that named is running as) can access it.  If you desire greater
      flexibility in allowing other users to access rndc commands, then you
      need to create an rndc.conf and make it group-readable by a group that
      contains the users who should have access.

      The UNIX control channel type of BIND 8 is not supported in BIND 9.2,
      and is not expected to be added in future releases.  If it is present
      in the controls statement from a BIND 8 configuration file, it is
      ignored and a warning is logged.

    include Statement Grammar
           include filename;

    include Statement Definition and Usage
      The include statement inserts the specified file at the point where
      the include statement is encountered.  The include statement
      facilitates the administration of configuration files by permitting
      the reading or writing of some things but not others.  For example,
      the statement could include private keys that are readable only by a

    key Statement Grammar
           key key_id {
              algorithm string;
              secret string;

    key Statement Definition and Usage
      The key statement defines a shared secret key for use with TSIG.  The
      key statement can occur at the top level of the configuration file or
      inside a view statement.  Keys defined in top-level key statements can
      be used in all views.  Keys intended for use in a controls statement
      must be defined at the top level.

      The key_id, also known as the key name, is a domain name uniquely
      identifying the key.  It can be used in a server statement to sign
      requests with this key or in address match lists to verify that
      incoming requests have been signed with a key matching this name,
      algorithm, and secret.

      The algorithm_id is a string that specifies a security/authentication
      algorithm.  "hmac-md5" is the only algorithm which is currently
      supported with TSIG authentication.  The secret_string is a base-64
      encoded secret string to be used by the algorithm.

 Hewlett-Packard Company            - 6 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

    logging Statement Grammar
           logging {
              [ channel channel_name {
                ( file path name
                    [ versions ( number | unlimited ) ]
                    [ size size spec ]
                  | syslog syslog_facility
                  | stderr
                  | null );
                [ severity (critical | error | warning | notice |
                            info | debug [ level ] | dynamic ); ]
                [ print-category yes or no; ]
                [ print-severity yes or no; ]
                [ print-time yes or no; ]
              }; ]
              [ category category_name {
                channel_name ; [ channel_name ; ... ]
              }; ]

    logging Statement Definition and Usage
      The logging statement configures a wide variety of logging options for
      the nameserver.  Its channel phrase associates output methods, format
      options and severity levels with a name that can be used with the
      category phrase to select how various classes of messages are logged.

      Only one logging statement is used to define any number of channels
      and categories.  If there is no logging statement, the logging
      configuration will be:

           logging {
                category "unmatched" { "null"; };
                category "default" { "default_syslog"; "default_debug"; };

      In BIND 9.2, the logging configuration is established only when the
      entire configuration file has been parsed.  In BIND 8, it was
      established as soon as the logging statement was parsed.  When the
      server starts up, all logging messages related to syntax errors in the
      configuration file go to the default channels, or to standard error if
      the -g option was specified.

    The channel Phrase    [Toc]    [Back]
      All log output goes to one or more user defined or pre-defined
      channels; Every channel definition must include a destination clause
      that says whether messages selected for the channel go to a file, or
      to a particular syslog facility, or to the standard error stream, or
      are discarded.  It can optionally also limit the message severity
      level that will be accepted by the channel (the default is info) , and
      whether to include a named-generated time stamp, the category name

 Hewlett-Packard Company            - 7 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

      and/or severity level (the default is not to include any).  The
      channel options are irrelevant when the null destination clause
      discards all messages sent to the channel.

      The file destination clause directs the channel to a disk file.  It
      can include limitations both on file size limit and number of versions
      of the file, saved each time the file is opened.

      If you use the versions log file option, then named will retain that
      many backup versions of the file by renaming them when opening.

      For example, if you choose to keep three old versions of the file
      lamers.log, then just before it is opened:

           lamers.log.1 is renamed to lamers.log.2,

           lamers.log.0 is renamed to lamers.log.1, and

           lamers.log is renamed to lamers.log.0.

      Use versions unlimited; if you do not want to limit the number of
      versions.  If a size option is associated with the log file, then
      renaming is only done when the file being opened exceeds the indicated
      size.  No backup versions are kept by default; any existing log file
      is simply appended.

      The size option for files is used to limit log growth.  If the file
      size exceeds the limit, then named will stop writing to the file
      unless it has a versions option associated with it.  If backup
      versions are kept, the files are rolled as described above and a new
      file is opened.  If there is no versions option, no more data will be
      written to the log until the log file is removed or truncated to less
      than the maximum size.  The default behavior is not to limit the size
      of the file.

      Example usage of the size and versions options:

           channel "an_example_channel" {
               file "example.log" versions 3 size 20m;
               print-time yes;
               print-category yes;

      The syslog destination clause directs the channel to the system log.
      Its argument is a syslog facility as described in the syslog(3C) man
      page.  The syslog(3C) man page describes how syslog will handle
      messages sent to this facility.  If you have a system which uses a
      very old version of syslog that uses only two arguments to the
      openlog() function, then syslog destination clause is ignored.

 Hewlett-Packard Company            - 8 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

      The severity clause works like syslog's "priorities", except that they
      can also be used if you are writing straight to a file rather than
      using syslog.  Messages which are not at least of the severity level
      given will not be selected for the channel; messages of higher
      severity levels will be accepted.  If you are using syslog, then the
      syslog.conf priorities will also determine what eventually passes

      For example, defining a channel facility and severity as daemon and
      debug but only logging daemon.warning via syslog.conf will cause
      messages of severity info and notice to be dropped.  If the situation
      were reversed, with named writing messages of only warning or higher,
      then syslogd would print all messages it received from the channel.

      The stderr destination clause directs the channel to the server's
      standard error stream.  This is intended for use when the server is
      running as a foreground process, for example when debugging the

      The server can supply extensive debugging information when it is in
      debugging mode.  If the server's global debug level is greater than
      zero, then debugging mode will be active.  The global debug level is
      set either by starting the named server with the -d flag followed by a
      positive integer, or by running rndc trace.  The global debug level
      can be set to zero, and debugging mode turned off, by running rndc
      notrace.  All debugging messages in the server have a debug level, and
      higher debug levels give more detailed output.  For example:

           channel "specific_debug_level" {
               file "foo";
               severity debug 3;

      In the above example, channels that specify a particular debug
      severity will get debugging output of level 3 or less any time the
      server is in debugging mode, regardless of the global debugging level.
      Channels with dynamic severity use the server's global level to
      determine what messages to print.

      If print-time has been turned on, then the date and time will be
      logged.  print-time may be specified for a syslog channel, but is
      usually pointless since syslog also prints the date and time.  If
      print-category is requested, then the category of the message will be
      logged as well.  Finally, if print-severity is ON, then the severity
      level of the message will be logged.  The print- options may be used
      in any combination, and will always be printed in the order: time,
      category, severity.  Here is an example where all three print- options
      are ON:

      28-Feb-2000 15:05:32.863 general: notice: running

 Hewlett-Packard Company            - 9 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

      There are four pre-defined channels that are used for named's default
      logging as follows:

      channel "default_syslog" {
          syslog daemon;                      // send to syslog's daemon
                                              // facility
          severity info;                      // only send priority info
                                              // and higher

      channel "default_debug" {
          file "named.run";                   // write to named.run in
                                              // the working directory
                                              // Note: stderr is used instead
                                              // of "named.run"
                                              // if the server is started
                                              // with the '-f' option.
          severity dynamic;                   // log at the server's
                                              // current debug level

      channel "default_stderr" {              // writes to stderr
          severity info;                      // only send priority info
                                              // and higher

      channel "null" {
         null;                                // toss anything sent to
                                              // this channel

      The default_debug channel has the special property that it only
      produces output when the server's debug level is a non-zero value.  It
      normally writes to a file named.run in the server's working directory.

      For security reasons, when the -u command line option is used, the
      named.run file is created only after named has changed to the new UID,
      and any debug output is generated while named is starting up and still
      running as root is discarded.  If you need to capture this output, you
      must run the server with the -g option and redirect standard error to
      a file.

      Once a channel is defined, it cannot be redefined.  Thus you cannot
      alter the built-in channels directly, but you can modify the default
      logging by pointing categories at channels you have defined.

    The category Phrase    [Toc]    [Back]
      Pre-defined categories allow the administrator to fine-tune what
      messages they want to log and where they want to log those messages
      to.  If a list of channels is not specified for a category, then log

 Hewlett-Packard Company           - 10 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

      messages in that category will be sent to the default category
      instead.  If you do not specify a default category, the following
      category is used:

           category "default" { "default_syslog"; "default_debug"; };

      For example, if you want to log security events to a file and also
      wish to keep the default logging behavior, you need to specify the

      channel "my_security_channel" {
          file "my_security_file";
          severity info;

      category "security" {

      To discard all messages in a category, specify the null channel as

           category "xfer-out" { "null"; };
           category "notify" { "null"; };

      Following are the available categories and brief descriptions of the
      types of log information they contain.  More categories may be added
      in future BIND releases.

      default        The default category defines the logging options for
                     those categories where no specific configuration has
                     been defined.

      general        The catch-all.  All unclassified categories belong to
                     this category.

      database       Messages relating to the databases used internally by
                     the name server to store zone and cache data.

      security       Approval and denial of requests.

      config         Configuration file parsing and processing.

      resolver       DNS resolution, such as recursive lookups performed on
                     behalf of clients by a caching name server.

      xfer-in        Zone transfers the server is receiving.

 Hewlett-Packard Company           - 11 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

      xfer-out       Zone transfers the server is sending.

      notify         The NOTIFY protocol

      client         Processing of client requests

      unmatched      Messages that named was unable to determine the class
                     of or for which there was no matching view.  A one-line
                     summary is also logged to the client category.  This
                     category is best sent to a file or stderr, by default
                     it is sent to the null channel.

      network        Network operations

      update         Dynamic updates

      queries        Enable query logging

      dispatch       Dispatching of incoming packets to the server modules
                     where they are to be processed.

      dnssec         DNSSEC and TSIG protocol processing.

      lame-servers   Lame servers.  These are misconfigurations in remote
                     servers, discovered by BIND 9 when trying to query
                     those servers during resolution.

    lwres Statement Grammar
      This is the grammar of the lwres statement in the named.conf file:

      lwres {
          [ listen-on { ip_addr [port ip_port] ; [ ip_addr [port ip_port] ;
              ... ] }; ]
          [ view view_name; ]
          [ search { domain_name ; [ domain_name ; ... ] }; ]
          [ ndots number; ]

    lwres Statement Definition and Usage
      The lwres statement configures the name server to also act as a
      lightweight resolver server.  There may be be multiple lwres
      statements configuring lightweight resolver servers with different
      properties.  The listen-on statement specifies a list of addresses and
      ports that a lightweight resolver daemon should accept requests on.
      If no port is specified, port 921 is used.  If this statement is
      omitted, requests will be accepted on, port 921.

      The view statement binds this instance of a lightweight resolver
      daemon to a view in the DNS namespace, so that the response will be
      constructed in the same manner as a normal DNS query matching this
      view.  If this statement is omitted, the default view is used, and if

 Hewlett-Packard Company           - 12 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

      there is no default view, an error is triggered.

      The search statement is equivalent to the search statement in
      /etc/resolv.conf.  It provides a list of domains which are appended to
      relative names in queries.

      The ndots statement is equivalent to the ndots statement in
      /etc/resolv.conf.  It indicates the minimum number of dots in a
      relative domain name that should result in an exact match lookup
      before search path elements are appended.

    options Statement Grammar
      This is the grammar of the options statement in the named.conf file:

      options {
          [ version version_string; ]
          [ directory path_name; ]
          [ tkey-domain domainname; ]
          [ tkey-dhkey key_name key_tag; ]
          [ dump-file path_name; ]
          [ pid-file path_name; ]
          [ statistics-file path_name; ]
          [ zone-statistics yes_or_no; ]
          [ auth-nxdomain yes_or_no; ]
          [ dialup dialup_option; ]
          [ minimal-responses yes_or_no; ]
          [ notify yes_or_no | explicit; ]
          [ recursion yes_or_no; ]
          [ forward ( only | first ); ]
          [ forwarders { ip_addr [port ip_port] ;
                       [ ip_addr [port ip_port] ; ... ] }; ]
          [ allow-notify { address_match_list }; ]
          [ allow-query { address_match_list }; ]
          [ allow-transfer { address_match_list }; ]
          [ allow-recursion { address_match_list }; ]
          [ allow-v6-synthesis { address_match_list }; ]
          [ blackhole { address_match_list }; ]
          [ listen-on [ port ip_port ] { address_match_list }; ]
          [ listen-on-v6 [ port ip_port ] { address_match_list }; ]
          [ query-source [ address ( ip_addr | * ) ]
                               [ port ( ip_port | * ) ]; ]
          [ max-transfer-time-in number; ]
          [ max-transfer-time-out number; ]
          [ max-transfer-idle-in number; ]
          [ max-transfer-idle-out number; ]
          [ tcp-clients number; ]
          [ recursive-clients number; ]
          [ serial-query-rate number; ]
          [ transfer-format ( one-answer | many-answers ); ]
          [ transfers-in  number; ]
          [ transfers-out number; ]

 Hewlett-Packard Company           - 13 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

          [ transfers-per-ns number; ]
          [ transfer-source (ip4_addr | *) [port ip_port] ; ]
          [ transfer-source-v6 (ip6_addr | *) [port ip_port] ; ]
          [ notify-source (ip4_addr | *) [port ip_port] ; ]
          [ notify-source-v6 (ip6_addr | *) [port ip_port] ; ]
          [ also-notify { ip_addr [port ip_port] ;
                           [ ip_addr [port ip_port] ; ... ] }; ]
          [ coresize size_spec ; ]
          [ datasize size_spec ; ]
          [ files size_spec ; ]
          [ stacksize size_spec ; ]
          [ cleaning-interval number; ]
          [ heartbeat-interval number; ]
          [ interface-interval number; ]
          [ sortlist { address_match_list }];
          [ lame-ttl number; ]
          [ max-ncache-ttl number; ]
          [ max-cache-ttl number; ]
          [ sig-validity-interval number ; ]
          [ use-ixfr yes_or_no ; ]
          [ provide-ixfr yes_or_no; ]
          [ request-ixfr yes_or_no; ]
          [ min-refresh-time number ; ]
          [ max-refresh-time number ; ]
          [ min-retry-time number ; ]
          [ max-retry-time number ; ]
          [ port ip_port; ]
          [ additional-from-auth yes_or_no ; ]
          [ additional-from-cache yes_or_no ; ]
          [ random-device path_name ; ]
          [ max-cache-size size_spec ; ]
          [ match-mapped-addresses yes_or_no; ]
          [ edns yes_or_no; ]

    options Statement Definition and Usage
      The options statement sets up global options to be used by BIND.  This
      statement may appear only once in a configuration file.  If more than
      one occurrence is found, the first occurrence determines the actual
      options used, and a warning will be generated.  If there is no options
      statement, an options block with each option set to its default will
      be used.

      version        The version that the server should report via a query
                     of name version.bind in class CHAOS.  Default is the
                     real version number of this server.

      directory      The working directory of the server.  Any non-absolute
                     pathnames in the configuration file will be taken as
                     relative to this directory.  The default location for
                     most server output files (e.g. named.run) is this

 Hewlett-Packard Company           - 14 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

                     directory.  If a directory is not specified, the
                     working directory defaults to (.), the directory from
                     which the server was started.  The directory specified
                     should be an absolute path.

      tkey-domain    The domain appended to the names of all shared keys
                     generated with TKEY.  When a client requests a TKEY
                     exchange, it may or may not specify the desired name
                     for the key.  If present, the name of the shared key
                     will be client specified part + tkey-domain.
                     Otherwise, the name of the shared key will be random
                     hex digits + tkey-domain.  In most cases, the domain
                     name should be the server's domain name.

      tkey-dhkey     The Diffie-Hellman key used by the server to generate
                     shared keys with clients using the Diffie-Hellman mode
                     of TKEY.  The server must be able to load the public
                     and private keys from files in the working directory.
                     In most cases, the keyname should be the server's host

      dump-file      The pathname of the file to which the server dumps the
                     database with rndc dumpdb.  Default is named_dump.db.

      pid-file       The pathname of the file in which the server writes its
                     process ID.  If not specified, the default pathname
                     /var/run/named.pid The pid-file is used by programs
                     that need to send signals to the running nameserver.

                     The pathname of the file in which the server appends
                     statistics using rndc stats.  Default is named.stats in
                     the server's current directory.

      port           The UDP/TCP port number the server uses for receiving
                     and sending DNS protocol traffic.  Default is 53.  This
                     option is mainly intended for server testing; a server
                     using a port other than 53 will not be able to
                     communicate with the global DNS.

      random-device  The source of entropy to be used by the server.
                     Entropy is primarily needed for DNSSEC operations, such
                     as TKEY transactions and dynamic update of signed
                     zones.  This option specifies the device (or file) from
                     which to read entropy.  If this is a file, operations
                     requiring entropy will fail when the file has been
                     exhausted.  The default value is /dev/random (or
                     equivalent) when present, and none otherwise.  The
                     random-device option takes effect during the initial
                     configuration load at server startup time and is
                     ignored on subsequent reloads.

 Hewlett-Packard Company           - 15 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

    Boolean Options    [Toc]    [Back]
                  If "yes", then the AA bit is always set on NXDOMAIN
                  responses, even if the server is not actually
                  authoritative.  The default is "no".  If you are using an
                  old version of BIND, you might need to set this option to

      dialup      If "yes", then the server treats all zones as if they are
                  doing zone transfers across a dial on demand dialup link,
                  which can be brought up by traffic originating from this
                  server.  This has different effects according to zone type
                  and concentrates the zone maintenance so that it all
                  happens in a short interval, once every heartbeat-interval
                  and hopefully during the one call.  It also suppresses
                  some of the normal zone maintenance traffic.  The default
                  is "no".  The dialup option may also be specified in the
                  view and zone statements, in which case, it overrides the
                  global dialup option.

                  If the zone is a master zone then the server will send out
                  a NOTIFY request to all the slaves.  This will trigger the
                  zone serial number check in the slave (provided, it
                  supports NOTIFY) allowing the slave to verify the zone
                  while the connection is active.

                  If the zone is a slave or stub zone, then the server will
                  suppress the regular "zone up to date" (refresh) queries
                  and only perform them when the heartbeat-interval expires
                  in addition to sending NOTIFY requests.

                  Finer control can be achieved by using notify which only
                  sends NOTIFY messages, notify-passive which sends NOTIFY
                  messages and suppresses the normal refresh queries,
                  refresh which suppresses normal refresh processing and
                  sends refresh queries when the heartbeat-interval expires
                  and passive which just disables normal refresh processing.

                  If "yes", then the server will only add records to the
                  authority when generating responses and additional data
                  sections when they are required (e.g.  delegations,
                  negative responses).  This may improve the performance of
                  the server.  Default is "no".

      notify      If "yes" (the default), DNS NOTIFY messages are sent when
                  a zone for which the server is authoritative, changes.
                  The messages are sent to the servers listed in the zone's
                  NS records (except the master server identified in the SOA
                  MNAME field), and to any servers listed in the also-notify
                  option.  If explicit, notify messages are sent only to

 Hewlett-Packard Company           - 16 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

                  servers explicitly listed using also-notify.  If "no", no
                  notify messages are sent.

                  The notify option may also be specified in the zone
                  statement, in which case it overrides the notify specified
                  in the options statement.  It needs to be turned off only
                  when the slaves crash.

      recursion   If "yes", and a DNS query requests recursion, then the
                  server will attempt to answer the query.  If recursion is
                  off and the server does not know the answer, it will
                  return a referral response.  The default is "yes".  Note
                  that setting recursion to "no" does not prevent clients
                  from getting data from the server's cache; it only
                  prevents new data from being cached as an effect of client
                  queries.  Caching may still occur as an effect of the
                  server's internal operation, such as NOTIFY address

                  If "yes", the server will, by default, collect statistical
                  data on all zones in the server.  These statistics may be
                  accessed using rndc stats, which will dump them to the
                  file listed in the statistics-file.

                  clause determines whether the local server, acting as
                  master, will respond with an incremental zone transfer
                  when the given remote server, a slave, requests it.  If
                  set to "yes", incremental transfer will be provided
                  whenever possible.  If set to "no", all transfers to the
                  remote server will be non-incremental.  If not set, the
                  value of the provide-ixfr option in the view or global
                  options block is used as a default.

                  The request-ixfr clause determines whether the local
                  server, acting as a slave, will request incremental zone
                  transfers from the given remote server, a master.  If not
                  set, the value of the request-ixfr option in the view or
                  global options block is used as a default.

      additional-from-auth, additional-from-cache
                  These options control the behavior of an authoritative
                  server when answering queries which have additional data,
                  or when following CNAME and DNAME chains.

                  When both of these options are set to "yes" (the default)
                  and a query is being answered from authoritative data (a
                  zone configured into the server), the additional data
                  section of the reply will be filled in using data from

 Hewlett-Packard Company           - 17 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

                  other authoritative zones and from the cache.  In some
                  situations this is undesirable, such as when there is
                  concern over the correctness of the cache, or in servers
                  where slave zones may be added and modified by untrusted
                  third parties.  Also, avoiding the search for this
                  additional data will speed up server operations at the
                  possible expense of additional queries to resolve what
                  would otherwise be provided in the additional section.
                  For example, if a query asks for an MX record for host
                  foo.example.com, and the record found is "MX 10
                  mail.example.net", normally the address records (A, A6,
                  and AAAA) for mail.example.net will be provided as well,
                  if known.  Set these options to "no" to disable this
                  behavior.  These options are intended for use in
                  authoritative-only servers, or in authoritative-only
                  views.  Attempts to set them to "no" without also
                  specifying recursion "no" will cause the server to ignore
                  the options and log a warning message.

                  Specifying additional-from-cache no actually disables the
                  use of the cache not only for additional data lookups but
                  also when looking up the answer.  This is usually the
                  desired behavior in an authoritative-only server where the
                  correctness of the cached data is an issue.

                  When a name server is non-recursively queried for a name
                  that is not below the apex of any served zone, it normally
                  answers with an "upwards referral" to the root servers or
                  the servers of some other known parent of the query name.

                  Since the data in an upwards referral comes from the
                  cache, the server will not be able to provide upwards
                  referrals when additional-from-cache no has been
                  specified.  Instead, it will respond to such queries with
                  REFUSED.  This should not cause any problems since upwards
                  referrals are not required for the resolution process.

                  If "yes", then an IPv4-mapped IPv6 address will match any
                  address match list entries that match the corresponding
                  IPv4 address.

      edns        (Extended DNS) clause determines whether the local server
                  will attempt to use EDNS when communicating with any
                  remote server.  Default is "yes".  If "no" then EDNS will
                  not be used when communicating with any remote server.
                  Then, to enable the EDNS feature for a server, the
                  customer needs to set edns yes in the server statement for
                  that server.

 Hewlett-Packard Company           - 18 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

    Forwarding    [Toc]    [Back]
      The forwarding facility can be used to create a large site-wide cache
      on a few servers, reducing traffic over links to external nameservers.
      It can also be used to allow queries by servers that do not have
      direct access to the Internet, but wish to look up exterior names
      anyway.  Forwarding occurs only on those queries for which the server
      is not authoritative and does not have the answer in its cache.

      forward     This option is useful only if the forwarders list is not
                  empty.  The default value first, causes the server to
                  query the forwarders first, and if that is unable to
                  answer the question, the server will then look for the
                  answer itself.  If only is specified, the server will only
                  query the forwarders.

      forwarders  Specifies the IP addresses to be used for forwarding.  The
                  default is the empty list (no forwarding).

      Forwarding can also be configured on a per-domain basis, allowing for
      the global forwarding options to be overridden in a variety of ways.
      You can set a particular domain to use different forwarders, or have a
      different forward only/first: behavior, or not forward at all.

    Access Control    [Toc]    [Back]
      Access to the server can be restricted based on the IP address of the
      requesting system.

      allow-notify   Specifies which hosts are allowed to notify slaves of a
                     zone change in addition to the zone masters.  allow-
                     notify may also be specified in the zone statement, in
                     which case it overrides the options allow-notify
                     statement.  It is only meaningful for a slave zone.  If
                     not specified, the default is to process notify
                     messages only from a zone's master.

      allow-query    Specifies which hosts are allowed to ask ordinary
                     questions.  allow-query may also be specified in the
                     zone statement, in which case it overrides the options
                     allow-query statement.  If not specified, the default
                     is to allow queries from all hosts.

                     Specifies which hosts are allowed to make recursive
                     queries through this server.  If not specified, the
                     default is to allow recursive queries from all hosts.
                     Note that disallowing recursive queries for a host does
                     not prevent the host from retrieving data that is
                     already in the server's cache.

                     Specifies the hosts which need to receive synthetic

 Hewlett-Packard Company           - 19 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

                     responses to IPv6 queries.  See below for more details.

      allow-transfer Specifies the hosts which are allowed to receive zone
                     transfers from the server.  allow-transfer may also be
                     specified in the zone statement, in which case it
                     overrides the options allow-transfer statement.  If not
                     specified, the default is to allow transfers from all

      blackhole      Specifies a list of addresses that the server will not
                     accept queries from or use to resolve a query.  Queries
                     from these addresses will not be responded to.  Default
                     is none.

    Interfaces    [Toc]    [Back]
      The interfaces and ports that the server will answer queries from, may
      be specified using the listen-on option.  listen-on takes an optional
      port, and an address_match_list The server will listen on all
      interfaces allowed by the address match list.  If a port is not
      specified, port 53 will be used.

      Multiple listen-on statements are allowed.  For example,

           listen-on {; };
           listen-on port 1234 { !; 1.2/16; };

      will enable the nameserver on port 53 for the IP address, and
      on port 1234 of an address on the machine in net 1.2 that is not  If no listen-on is specified, the server will listen on port
      53 on all interfaces.  The listen-on-v6 option is used to specify the
      ports on which the server will listen for incoming queries sent using

      The server does not bind a separate socket to each IPv6 interface
      address as it does for IPv4.  Instead, it always listens on the IPv6
      wildcard address.  Therefore, the only values allowed for the
      address_match_list argument to the listen-on-v6 statement are:

           { any; }
           { none;}

      Multiple listen-on-v6 options can be used to listen on multiple ports:

           listen-on-v6 port 53 { any; };
           listen-on-v6 port 1234 { any; };

      To make the server not to listen on any IPv6 address, use

           listen-on-v6 { none; };

 Hewlett-Packard Company           - 20 -      HP-UX 11i Version 2: Sep 2004

 named.conf(4)                                                 named.conf(4)

      If no listen-on-v6 statement is specified, the server will not listen
      on any IPv6 address.

    Query Address    [Toc]    [Back]
      If the server is unable to answer a question, it will query other
      nameservers.  query-source specifies the address and port used for
      such queries.  For queries sent over IPv6, there is a separate query-
      source-v6 option.  If address is * or is omitted, a wildcard IP
      address (INADDR_ANY) will be used.  If port is * or is omitted, a
      random unprivileged port will be used.  Default address and port are:

           query-source address * port *;
           query-source-v6 address * port *

      Note: The address specified in the query-source option is used for
      both UDP and TCP queries, but the port applies only to UDP queries.
      TCP queries always use a random unprivileged port.

    Zone Transfers    [Toc]    [Back]
      BIND has mechanisms in place to facilitate zone transfers and set
      limits on the amount of load that transfers place on the system.  The
      following options apply t

 Similar pages
Name OS Title
apt.conf Linux Configuration file for APT
amd.conf FreeBSD amd configuration file
man.conf OpenBSD configuration file for man(1)
slp.conf HP-UX Configuration file for SLP Agents
evmchannel.conf Tru64 EVM channel configuration file
tcpd.conf HP-UX configuration file for tcpd
ftpaccess HP-UX ftpd configuration file
isakmpd.conf OpenBSD configuration file for isakmpd
pccard.conf FreeBSD pccardd(8) configuration file
rndc.conf HP-UX rndc configuration file
Copyright © 2004-2005 DeniX Solutions SRL
newsletter delivery service