mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-27 12:38:24 +00:00
Code Issues Releases Wiki Activity
bind/doc/misc/options

763 lines
33 KiB
Plaintext
Raw Normal View History

regenerate
2017-09-12 00:26:30 +00:00
Add missing comment markers to doc/misc/ grammar files These files can be consumed by scripts, so obviously missing comment markers wreak havoc.
2022-05-11 08:03:40 +02:00
// This is a summary of the named.conf options supported by
// this version of BIND 9.
regenerate
2017-09-12 00:26:30 +00:00
acl <string> { <address_match_element>; ... }; // may occur multiple times
controls {
inet ( <ipv4_address> | <ipv6_address> |
* ) [ port ( <integer> | * ) ] allow
{ <address_match_element>; ... } [
keys { <string>; ... } ] [ read-only
<boolean> ]; // may occur multiple times
unix <quoted_string> perm <integer>
owner <integer> group <integer> [
keys { <string>; ... } ] [ read-only
<boolean> ]; // may occur multiple times
}; // may occur multiple times
dlz <string> {
database <string>;
search <boolean>;
}; // may occur multiple times
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
dnssec-policy <string> {
prep 9.15.6
2019-11-17 07:25:57 +00:00
dnskey-ttl <duration>;
build doc
2020-03-09 15:40:00 -07:00
keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
<duration_or_unlimited> algorithm <string> [ <integer> ]; ... };
rename 'zone-max-ttl' to 'max-zone-ttl' for consistency
2020-02-05 22:09:48 -08:00
max-zone-ttl <duration>;
Change nsec3param salt config to saltlen Upon request from Mark, change the configuration of salt to salt length. Introduce a new function 'dns_zone_checknsec3aram' that can be used upon reconfiguration to check if the existing NSEC3 parameters are in sync with the configuration. If a salt is used that matches the configured salt length, don't change the NSEC3 parameters.
2020-10-23 15:02:19 +02:00
nsec3param [ iterations <integer> ] [ optout <boolean> ] [
salt-length <integer> ];
prep 9.15.6
2019-11-17 07:25:57 +00:00
parent-ds-ttl <duration>;
parent-propagation-delay <duration>;
Make 'parent-registration-delay' obsolete With the introduction of 'checkds', the 'parent-registration-delay' option becomes obsolete.
2020-07-31 09:58:59 +02:00
parent-registration-delay <duration>; // obsolete
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
publish-safety <duration>;
Add purge-keys config option Add a new option 'purge-keys' to 'dnssec-policy' that will purge key files for deleted keys. The option determines how long key files should be retained prior to removing the corresponding files from disk. If set to 0, the option is disabled and 'named' will not remove key files from disk.
2021-02-08 12:02:19 +01:00
purge-keys <duration>;
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
retire-safety <duration>;
signatures-refresh <duration>;
signatures-validity <duration>;
signatures-validity-dnskey <duration>;
prep 9.15.6
2019-11-17 07:25:57 +00:00
zone-propagation-delay <duration>;
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
}; // may occur multiple times
regenerate
2017-09-12 00:26:30 +00:00
dyndb <string> <quoted_string> {
<unspecified-text> }; // may occur multiple times
Add parser support for DoH configuration options This commit adds stub parser support and tests for: - an "http" global option for HTTP/2 endpoint configuration. - command line options to set http or https port numbers by specifying -p http=PORT or -p https=PORT. (NOTE: this change only affects syntax; specifying HTTP and HTTPS ports on the command line currently has no effect.) - named.conf options "http-port" and "https-port" - HTTPSPORT environment variable for use when running tests.
2020-09-16 12:21:32 -07:00
http <string> {
endpoints { <quoted_string>; ... };
Update grammar reference documentation This commit updates the named grammar reference according to the latest changes.
2021-05-20 14:00:04 +03:00
listener-clients <integer>;
streams-per-connection <integer>;
Add parser support for DoH configuration options This commit adds stub parser support and tests for: - an "http" global option for HTTP/2 endpoint configuration. - command line options to set http or https port numbers by specifying -p http=PORT or -p https=PORT. (NOTE: this change only affects syntax; specifying HTTP and HTTPS ports on the command line currently has no effect.) - named.conf options "http-port" and "https-port" - HTTPSPORT environment variable for use when running tests.
2020-09-16 12:21:32 -07:00
}; // may occur multiple times
regenerate
2017-09-12 00:26:30 +00:00
key <string> {
algorithm <string>;
secret <string>;
}; // may occur multiple times
logging {
category <string> { <string>; ... }; // may occur multiple times
channel <string> {
buffered <boolean>;
file <quoted_string> [ versions ( unlimited | <integer> ) ]
[ size <size> ] [ suffix ( increment | timestamp ) ];
null;
print-category <boolean>;
print-severity <boolean>;
print-time ( iso8601 | iso8601-utc | local | <boolean> );
severity <log_severity>;
stderr;
syslog [ <syslog_facility> ];
}; // may occur multiple times
};
prep 9.15.1
2019-06-03 19:29:39 +00:00
managed-keys { <string> ( static-key
Document initial-ds and static-ds keywords
2019-09-19 14:52:49 -07:00
| initial-key | static-ds |
initial-ds ) <integer> <integer>
<integer> <quoted_string>; ... }; // may occur multiple times, deprecated
regenerate
2017-09-12 00:26:30 +00:00
options {
allow-new-zones <boolean>;
allow-notify { <address_match_element>; ... };
allow-query { <address_match_element>; ... };
allow-query-cache { <address_match_element>; ... };
allow-query-cache-on { <address_match_element>; ... };
allow-query-on { <address_match_element>; ... };
allow-recursion { <address_match_element>; ... };
allow-recursion-on { <address_match_element>; ... };
Extend ACL syntax handling code with 'port' and 'transport' options This commit extends ACL syntax handling code with 'port' and 'transport' options. Currently, the extended syntax is available only for allow-transfer options.
2021-11-04 16:52:49 +02:00
allow-transfer [ port <integer> ] [ transport <string> ] {
<address_match_element>; ... };
regenerate
2017-09-12 00:26:30 +00:00
allow-update { <address_match_element>; ... };
allow-update-forwarding { <address_match_element>; ... };
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
also-notify [ port <integer> ] [ dscp <integer> ] { (
<remote-servers> | <ipv4_address> [ port <integer> ] |
<ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls
<string> ]; ... };
regenerate
2017-09-12 00:26:30 +00:00
alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * )
] [ dscp <integer> ];
alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
* ) ] [ dscp <integer> ];
prep 9.13.2
2018-07-03 07:31:31 +00:00
answer-cookie <boolean>;
regenerate
2017-09-12 00:26:30 +00:00
attach-cache <string>;
Update doc files Run make doc after all the code changes related to #1086.
2020-12-08 15:10:54 +01:00
auth-nxdomain <boolean>;
regenerate
2017-09-12 00:26:30 +00:00
auto-dnssec ( allow | maintain | off );
automatic-interface-scan <boolean>;
avoid-v4-udp-ports { <portrange>; ... };
avoid-v6-udp-ports { <portrange>; ... };
bindkeys-file <quoted_string>;
blackhole { <address_match_element>; ... };
add a CFG_CLAUSEFLAG_NODOC flag for use with outdated terms "masters" and "default-masters" are now flagged so they will not be included in the named.conf man page, despite being accepted as valid options by the parser for backward compatibiility.
2022-02-25 16:33:30 -08:00
catalog-zones { zone <string> [ default-primaries [ port <integer>
] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [
port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key
<string> ] [ tls <string> ]; ... } ] [ zone-directory
<quoted_string> ] [ in-memory <boolean> ] [ min-update-interval
<duration> ]; ... };
regenerate
2017-09-12 00:26:30 +00:00
check-dup-records ( fail | warn | ignore );
check-integrity <boolean>;
check-mx ( fail | warn | ignore );
check-mx-cname ( fail | warn | ignore );
regen master
2017-12-16 01:09:51 +00:00
check-names ( primary | master |
secondary | slave | response ) (
fail | warn | ignore ); // may occur multiple times
regenerate
2017-09-12 00:26:30 +00:00
check-sibling <boolean>;
check-spf ( warn | ignore );
check-srv-cname ( fail | warn | ignore );
check-wildcard <boolean>;
clients-per-query <integer>;
Add new default siphash24 cookie algorithm, but keep AES as legacy This commit changes the BIND cookie algorithms to match draft-sury-toorop-dnsop-server-cookies-00. Namely, it changes the Client Cookie algorithm to use SipHash 2-4, adds the new Server Cookie algorithm using SipHash 2-4, and changes the default for the Server Cookie algorithm to be siphash24. Add siphash24 cookie algorithm, and make it keep legacy aes as
2019-07-21 14:26:49 -04:00
cookie-algorithm ( aes | siphash24 );
regenerate
2017-09-12 00:26:30 +00:00
cookie-secret <string>; // may occur multiple times
coresize ( default | unlimited | <sizeval> );
datasize ( default | unlimited | <sizeval> );
deny-answer-addresses { <address_match_element>; ... } [
option to disable validation under specified names - added new 'validate-except' option, which configures an NTA with expiry of 0xffffffff. NTAs with that value in the expiry field do not expire, are are not written out when saving the NTA table and are not dumped by rndc secroots
2018-04-30 16:10:17 -07:00
except-from { <string>; ... } ];
deny-answer-aliases { <string>; ... } [ except-from { <string>; ...
} ];
regenerate
2017-09-12 00:26:30 +00:00
dialup ( notify | notify-passive | passive | refresh | <boolean> );
directory <quoted_string>;
disable-algorithms <string> { <string>;
... }; // may occur multiple times
disable-ds-digests <string> { <string>;
... }; // may occur multiple times
disable-empty-zone <string>; // may occur multiple times
dns64 <netprefix> {
break-dnssec <boolean>;
clients { <address_match_element>; ... };
exclude { <address_match_element>; ... };
mapped { <address_match_element>; ... };
recursive-only <boolean>;
suffix <ipv6_address>;
}; // may occur multiple times
dns64-contact <string>;
dns64-server <string>;
regenerate doc
2018-05-21 19:59:10 +00:00
dnskey-sig-validity <integer>;
Remove the last bits of '// not configured' from doc/misc/options
2020-06-22 13:58:19 +02:00
dnsrps-enable <boolean>;
dnsrps-options { <unspecified-text> };
regenerate
2017-09-12 00:26:30 +00:00
dnssec-accept-expired <boolean>;
dnssec-dnskey-kskonly <boolean>;
dnssec-loadkeys-interval <integer>;
dnssec-must-be-secure <string> <boolean>; // may occur multiple times
prep 9.15.6
2019-11-17 07:25:57 +00:00
dnssec-policy <string>;
regenerate
2017-09-12 00:26:30 +00:00
dnssec-secure-to-insecure <boolean>;
dnssec-update-mode ( maintain | no-resign );
dnssec-validation ( yes | no | auto );
prevent "primaries" lists from having duplicate names it is now an error to have two primaries lists with the same name. this is true regardless of whether the "primaries" or "masters" keywords were used to define them.
2020-06-25 21:59:56 -07:00
dnstap { ( all | auth | client | forwarder | resolver | update ) [
( query | response ) ]; ... };
dnstap-identity ( <quoted_string> | none | hostname );
dnstap-output ( file | unix ) <quoted_string> [ size ( unlimited |
<size> ) ] [ versions ( unlimited | <integer> ) ] [ suffix (
increment | timestamp ) ];
dnstap-version ( <quoted_string> | none );
regenerate
2017-09-12 00:26:30 +00:00
dscp <integer>;
dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
<integer> ] [ dscp <integer> ] | <ipv4_address> [ port
<integer> ] [ dscp <integer> ] | <ipv6_address> [ port
<integer> ] [ dscp <integer> ] ); ... };
dump-file <quoted_string>;
edns-udp-size <integer>;
empty-contact <string>;
empty-server <string>;
empty-zones-enable <boolean>;
fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
fetches-per-server <integer> [ ( drop | fail ) ];
fetches-per-zone <integer> [ ( drop | fail ) ];
files ( default | unlimited | <sizeval> );
flush-zones-on-shutdown <boolean>;
forward ( first | only );
forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
| <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
prevent "primaries" lists from having duplicate names it is now an error to have two primaries lists with the same name. this is true regardless of whether the "primaries" or "masters" keywords were used to define them.
2020-06-25 21:59:56 -07:00
fstrm-set-buffer-hint <integer>;
fstrm-set-flush-timeout <integer>;
fstrm-set-input-queue-size <integer>;
fstrm-set-output-notify-threshold <integer>;
fstrm-set-output-queue-model ( mpsc | spsc );
fstrm-set-output-queue-size <integer>;
fstrm-set-reopen-interval <duration>;
Convert the documentation to Sphinx documentation format The ARM and the manpages have been converted into Sphinx documentation format. Sphinx uses reStructuredText as its markup language, and many of its strengths come from the power and straightforwardness of reStructuredText and its parsing and translating suite, the Docutils.
2019-03-31 12:49:47 +02:00
geoip-directory ( <quoted_string> | none );
regenerate
2017-09-12 00:26:30 +00:00
heartbeat-interval <integer>;
hostname ( <quoted_string> | none );
Update grammar reference documentation This commit updates the named grammar reference according to the latest changes.
2021-05-20 14:00:04 +03:00
http-listener-clients <integer>;
Add parser support for DoH configuration options This commit adds stub parser support and tests for: - an "http" global option for HTTP/2 endpoint configuration. - command line options to set http or https port numbers by specifying -p http=PORT or -p https=PORT. (NOTE: this change only affects syntax; specifying HTTP and HTTPS ports on the command line currently has no effect.) - named.conf options "http-port" and "https-port" - HTTPSPORT environment variable for use when running tests.
2020-09-16 12:21:32 -07:00
http-port <integer>;
Update grammar reference documentation This commit updates the named grammar reference according to the latest changes.
2021-05-20 14:00:04 +03:00
http-streams-per-connection <integer>;
Add parser support for DoH configuration options This commit adds stub parser support and tests for: - an "http" global option for HTTP/2 endpoint configuration. - command line options to set http or https port numbers by specifying -p http=PORT or -p https=PORT. (NOTE: this change only affects syntax; specifying HTTP and HTTPS ports on the command line currently has no effect.) - named.conf options "http-port" and "https-port" - HTTPSPORT environment variable for use when running tests.
2020-09-16 12:21:32 -07:00
https-port <integer>;
prep 9.15.6
2019-11-17 07:25:57 +00:00
interface-interval <duration>;
Implement ipv4only.arpa forward and reverse zones as per RFC 8880.
2018-07-05 15:29:30 +10:00
ipv4only-contact <string>;
ipv4only-enable <boolean>;
ipv4only-server <string>;
regen master
2017-12-16 01:09:51 +00:00
ixfr-from-differences ( primary | master | secondary | slave |
<boolean> );
Declare the keep-response-order obsolete The keep-response-order option has been introduced when TCP pipelining has been introduced to BIND 9 as a failsafe for possibly non-compliant clients. Declare the keep-response-order obsolete as all DNS clients should either support out-of-order processing or don't send more DNS queries until the DNS response for the previous one has been received.
2022-01-27 10:13:10 +01:00
keep-response-order { <address_match_element>; ... }; // obsolete
regenerate
2017-09-12 00:26:30 +00:00
key-directory <quoted_string>;
prep 9.15.6
2019-11-17 07:25:57 +00:00
lame-ttl <duration>;
regenerate
2017-09-12 00:26:30 +00:00
listen-on [ port <integer> ] [ dscp
Add parser support for DoH configuration options This commit adds stub parser support and tests for: - an "http" global option for HTTP/2 endpoint configuration. - command line options to set http or https port numbers by specifying -p http=PORT or -p https=PORT. (NOTE: this change only affects syntax; specifying HTTP and HTTPS ports on the command line currently has no effect.) - named.conf options "http-port" and "https-port" - HTTPSPORT environment variable for use when running tests.
2020-09-16 12:21:32 -07:00
<integer> ] [ tls <string> ] [ http
<string> ] {
regenerate
2017-09-12 00:26:30 +00:00
<address_match_element>; ... }; // may occur multiple times
listen-on-v6 [ port <integer> ] [ dscp
Add parser support for DoH configuration options This commit adds stub parser support and tests for: - an "http" global option for HTTP/2 endpoint configuration. - command line options to set http or https port numbers by specifying -p http=PORT or -p https=PORT. (NOTE: this change only affects syntax; specifying HTTP and HTTPS ports on the command line currently has no effect.) - named.conf options "http-port" and "https-port" - HTTPSPORT environment variable for use when running tests.
2020-09-16 12:21:32 -07:00
<integer> ] [ tls <string> ] [ http
<string> ] {
regenerate
2017-09-12 00:26:30 +00:00
<address_match_element>; ... }; // may occur multiple times
Convert the documentation to Sphinx documentation format The ARM and the manpages have been converted into Sphinx documentation format. Sphinx uses reStructuredText as its markup language, and many of its strengths come from the power and straightforwardness of reStructuredText and its parsing and translating suite, the Docutils.
2019-03-31 12:49:47 +02:00
lmdb-mapsize <sizeval>;
regenerate
2017-09-12 00:26:30 +00:00
lock-file ( <quoted_string> | none );
managed-keys-directory <quoted_string>;
Remove the mastefile-format map option As previously announced, this commit removes the masterfile-format format 'map' from named, all the tools, the documentation and the system tests.
2021-09-16 11:46:13 +02:00
masterfile-format ( raw | text );
regenerate
2017-09-12 00:26:30 +00:00
masterfile-style ( full | relative );
match-mapped-addresses <boolean>;
max-cache-size ( default | unlimited | <sizeval> | <percentage> );
prep 9.15.6
2019-11-17 07:25:57 +00:00
max-cache-ttl <duration>;
regenerate
2017-09-12 00:26:30 +00:00
max-clients-per-query <integer>;
build doc
2020-03-09 15:40:00 -07:00
max-ixfr-ratio ( unlimited | <percentage> );
regenerate
2017-09-12 00:26:30 +00:00
max-journal-size ( default | unlimited | <sizeval> );
prep 9.15.6
2019-11-17 07:25:57 +00:00
max-ncache-ttl <duration>;
regenerate
2017-09-12 00:26:30 +00:00
max-records <integer>;
max-recursion-depth <integer>;
max-recursion-queries <integer>;
max-refresh-time <integer>;
max-retry-time <integer>;
max-rsa-exponent-size <integer>;
prep 9.15.6
2019-11-17 07:25:57 +00:00
max-stale-ttl <duration>;
regenerate
2017-09-12 00:26:30 +00:00
max-transfer-idle-in <integer>;
max-transfer-idle-out <integer>;
max-transfer-time-in <integer>;
max-transfer-time-out <integer>;
max-udp-size <integer>;
prep 9.15.6
2019-11-17 07:25:57 +00:00
max-zone-ttl ( unlimited | <duration> );
regenerate
2017-09-12 00:26:30 +00:00
memstatistics <boolean>;
memstatistics-file <quoted_string>;
message-compression <boolean>;
prep 9.15.6
2019-11-17 07:25:57 +00:00
min-cache-ttl <duration>;
min-ncache-ttl <duration>;
regenerate
2017-09-12 00:26:30 +00:00
min-refresh-time <integer>;
min-retry-time <integer>;
minimal-any <boolean>;
minimal-responses ( no-auth | no-auth-recursive | <boolean> );
multi-master <boolean>;
new-zones-directory <quoted_string>;
no-case-compress { <address_match_element>; ... };
nocookie-udp-size <integer>;
add "primary-only" as a synonym for "master-only" update the "notify" option to use RFC 8499 terminology as well.
2020-06-17 02:45:07 -07:00
notify ( explicit | master-only | primary-only | <boolean> );
regenerate
2017-09-12 00:26:30 +00:00
notify-delay <integer>;
notify-rate <integer>;
notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
dscp <integer> ];
notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]
[ dscp <integer> ];
notify-to-soa <boolean>;
nsec3-test-zone <boolean>; // test only
prep 9.15.6
2019-11-17 07:25:57 +00:00
nta-lifetime <duration>;
nta-recheck <duration>;
regenerate
2017-09-12 00:26:30 +00:00
nxdomain-redirect <string>;
Add "parental-source[-v6]" config option Similar to "notify-source" and "transfer-source", add options to set the source address when querying parental agents for DS records.
2021-05-14 11:33:51 +02:00
parental-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
dscp <integer> ];
parental-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
] [ dscp <integer> ];
regenerate
2017-09-12 00:26:30 +00:00
pid-file ( <quoted_string> | none );
port <integer>;
preferred-glue <string>;
prefetch <integer> [ <integer> ];
provide-ixfr <boolean>;
prep 9.13.2
2018-07-03 07:31:31 +00:00
qname-minimization ( strict | relaxed | disabled | off );
regenerate
2017-09-12 00:26:30 +00:00
query-source ( ( [ address ] ( <ipv4_address> | * ) [ port (
<integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ]
port ( <integer> | * ) ) ) [ dscp <integer> ];
query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port (
<integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ]
port ( <integer> | * ) ) ) [ dscp <integer> ];
querylog <boolean>;
regen master
2017-09-29 01:08:37 +00:00
random-device ( <quoted_string> | none );
regenerate
2017-09-12 00:26:30 +00:00
rate-limit {
all-per-second <integer>;
errors-per-second <integer>;
exempt-clients { <address_match_element>; ... };
ipv4-prefix-length <integer>;
ipv6-prefix-length <integer>;
log-only <boolean>;
max-table-size <integer>;
min-table-size <integer>;
nodata-per-second <integer>;
nxdomains-per-second <integer>;
qps-scale <integer>;
referrals-per-second <integer>;
responses-per-second <integer>;
slip <integer>;
window <integer>;
};
recursing-file <quoted_string>;
recursion <boolean>;
recursive-clients <integer>;
request-expire <boolean>;
request-ixfr <boolean>;
request-nsid <boolean>;
require-server-cookie <boolean>;
remove all references to isc_socket and related types Removed socket.c, socket.h, and all references to isc_socket_t, isc_socketmgr_t, isc_sockevent_t, etc.
2021-10-03 00:27:52 -07:00
reserved-sockets <integer>; // deprecated
regenerate
2017-09-12 00:26:30 +00:00
resolver-nonbackoff-tries <integer>;
resolver-query-timeout <integer>;
resolver-retry-interval <integer>;
response-padding { <address_match_element>; ... } block-size
<integer>;
add the ability to control whether SOA records are added response-policy modified answers
2019-02-14 17:50:10 +11:00
response-policy { zone <string> [ add-soa <boolean> ] [ log
prep 9.15.6
2019-11-17 07:25:57 +00:00
<boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval
<duration> ] [ policy ( cname | disabled | drop | given | no-op
| nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [
add the ability to control whether SOA records are added response-policy modified answers
2019-02-14 17:50:10 +11:00
recursive-only <boolean> ] [ nsip-enable <boolean> ] [
nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [
prep 9.15.6
2019-11-17 07:25:57 +00:00
break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [
min-update-interval <duration> ] [ min-ns-dots <integer> ] [
regen master
2020-04-09 11:22:03 +00:00
nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean>
] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ]
[ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [
dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text>
} ];
Rename the configuration option to load balance sockets to reuseport After some back and forth, it was decidede to match the configuration option with unbound ("so-reuseport"), PowerDNS ("reuseport") and/or nginx ("reuseport").
2022-04-06 17:00:24 +02:00
reuseport <boolean>;
option to disable validation under specified names - added new 'validate-except' option, which configures an NTA with expiry of 0xffffffff. NTAs with that value in the expiry field do not expire, are are not written out when saving the NTA table and are not dumped by rndc secroots
2018-04-30 16:10:17 -07:00
root-delegation-only [ exclude { <string>; ... } ];
add named.conf option root-key-sentinel
2018-03-13 15:17:22 +11:00
root-key-sentinel <boolean>;
regenerate
2017-09-12 00:26:30 +00:00
rrset-order { [ class <string> ] [ type <string> ] [ name
<quoted_string> ] <string> <string>; ... };
secroots-file <quoted_string>;
send-cookie <boolean>;
serial-query-rate <integer>;
serial-update-method ( date | increment | unixtime );
server-id ( <quoted_string> | none | hostname );
prep 9.15.6
2019-11-17 07:25:57 +00:00
servfail-ttl <duration>;
regenerate
2017-09-12 00:26:30 +00:00
session-keyalg <string>;
session-keyfile ( <quoted_string> | none );
session-keyname <string>;
sig-signing-nodes <integer>;
sig-signing-signatures <integer>;
sig-signing-type <integer>;
sig-validity-interval <integer> [ <integer> ];
sortlist { <address_match_element>; ... };
stacksize ( default | unlimited | <sizeval> );
Add documentation for stale-answer-client-timeout
2020-12-23 12:16:26 -03:00
stale-answer-client-timeout ( disabled | off | <integer> );
regenerate
2017-09-12 00:26:30 +00:00
stale-answer-enable <boolean>;
prep 9.15.6
2019-11-17 07:25:57 +00:00
stale-answer-ttl <duration>;
Add stale-cache-enable option and disable serve-stable by default The current serve-stale implementation in BIND 9 stores all received records in the cache for a max-stale-ttl interval (default 12 hours). This allows DNS operators to turn the serve-stale answers in an event of large authoritative DNS outage. The caching of the stale answers needs to be enabled before the outage happens or the feature would be otherwise useless. The negative consequence of the default setting is the inevitable cache-bloat that happens for every and each DNS operator running named. In this MR, a new configuration option `stale-cache-enable` is introduced that allows the operators to selectively enable or disable the serve-stale feature of BIND 9 based on their decision. The newly introduced option has been disabled by default, e.g. serve-stale is disabled in the default configuration and has to be enabled if required.
2020-07-21 10:38:55 +02:00
stale-cache-enable <boolean>;
Update ARM and other documents
2020-11-04 20:02:58 -03:00
stale-refresh-time <duration>;
regenerate
2017-09-12 00:26:30 +00:00
startup-notify-rate <integer>;
statistics-file <quoted_string>;
Update doc files Run make doc after all the code changes related to #1086.
2020-12-08 15:10:54 +01:00
suppress-initial-notify <boolean>; // obsolete
regenerate
2017-09-12 00:26:30 +00:00
synth-from-dnssec <boolean>;
tcp-advertised-timeout <integer>;
tcp-clients <integer>;
tcp-idle-timeout <integer>;
tcp-initial-timeout <integer>;
tcp-keepalive-timeout <integer>;
tcp-listen-queue <integer>;
Add configuration option to set send/recv buffers on the nm sockets This commit adds a new configuration option to set the receive and send buffer sizes on the TCP and UDP netmgr sockets. The default is `0` which doesn't set any value and just uses the value set by the operating system. There's no magic value here - set it too small and the performance will drop, set it too large, the buffers can fill-up with queries that have already timeouted on the client side and nobody is interested for the answer and this would just make the server clog up even more by making it produce useless work. The `netstat -su` can be used on POSIX systems to monitor the receive and send buffer errors.
2020-12-02 20:51:38 +01:00
tcp-receive-buffer <integer>;
tcp-send-buffer <integer>;
regenerate
2017-09-12 00:26:30 +00:00
tkey-dhkey <quoted_string> <integer>;
tkey-domain <quoted_string>;
tkey-gssapi-credential <quoted_string>;
tkey-gssapi-keytab <quoted_string>;
DoT test Preliminary test for DNSoverTLS - add the dot-port template to system tests, test a simple query to an authoritative.
2020-10-12 23:06:55 +02:00
tls-port <integer>;
regenerate
2017-09-12 00:26:30 +00:00
transfer-format ( many-answers | one-answer );
transfer-message-size <integer>;
transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
dscp <integer> ];
transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
] [ dscp <integer> ];
transfers-in <integer>;
transfers-out <integer>;
transfers-per-ns <integer>;
trust-anchor-telemetry <boolean>; // experimental
try-tcp-refresh <boolean>;
Add configuration option to set send/recv buffers on the nm sockets This commit adds a new configuration option to set the receive and send buffer sizes on the TCP and UDP netmgr sockets. The default is `0` which doesn't set any value and just uses the value set by the operating system. There's no magic value here - set it too small and the performance will drop, set it too large, the buffers can fill-up with queries that have already timeouted on the client side and nobody is interested for the answer and this would just make the server clog up even more by making it produce useless work. The `netstat -su` can be used on POSIX systems to monitor the receive and send buffer errors.
2020-12-02 20:51:38 +01:00
udp-receive-buffer <integer>;
udp-send-buffer <integer>;
regenerate
2017-09-12 00:26:30 +00:00
update-check-ksk <boolean>;
use-alt-transfer-source <boolean>;
use-v4-udp-ports { <portrange>; ... };
use-v6-udp-ports { <portrange>; ... };
v6-bias <integer>;
option to disable validation under specified names - added new 'validate-except' option, which configures an NTA with expiry of 0xffffffff. NTAs with that value in the expiry field do not expire, are are not written out when saving the NTA table and are not dumped by rndc secroots
2018-04-30 16:10:17 -07:00
validate-except { <string>; ... };
regenerate
2017-09-12 00:26:30 +00:00
version ( <quoted_string> | none );
zero-no-soa-ttl <boolean>;
zero-no-soa-ttl-cache <boolean>;
zone-statistics ( full | terse | none | <boolean> );
};
Add parental-agents configuration Introduce a way to configure parental agents that can be used to query DS records to be used in automatic key rollovers.
2021-05-07 11:36:40 +02:00
parental-agents <string> [ port <integer> ] [
dscp <integer> ] { ( <remote-servers> |
<ipv4_address> [ port <integer> ] |
<ipv6_address> [ port <integer> ] ) [ key
<string> ] [ tls <string> ]; ... }; // may occur multiple times
prep 9.13.5
2018-12-07 03:11:45 +00:00
plugin ( query ) <string> [ { <unspecified-text>
} ]; // may occur multiple times
add "primaries" as a synonym for "masters" in named.conf as "type primary" is preferred over "type master" now, it makes sense to make "primaries" available as a synonym too. added a correctness check to ensure "primaries" and "masters" cannot both be used in the same zone.
2020-06-17 02:02:27 -07:00
primaries <string> [ port <integer> ] [ dscp
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
<integer> ] { ( <remote-servers> |
<ipv4_address> [ port <integer> ] |
<ipv6_address> [ port <integer> ] ) [ key
<string> ] [ tls <string> ]; ... }; // may occur multiple times
add "primaries" as a synonym for "masters" in named.conf as "type primary" is preferred over "type master" now, it makes sense to make "primaries" available as a synonym too. added a correctness check to ensure "primaries" and "masters" cannot both be used in the same zone.
2020-06-17 02:02:27 -07:00
regenerate
2017-09-12 00:26:30 +00:00
server <netprefix> {
bogus <boolean>;
edns <boolean>;
edns-udp-size <integer>;
edns-version <integer>;
keys <server_key>;
max-udp-size <integer>;
notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
dscp <integer> ];
notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]
[ dscp <integer> ];
padding <integer>;
provide-ixfr <boolean>;
query-source ( ( [ address ] ( <ipv4_address> | * ) [ port (
<integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ]
port ( <integer> | * ) ) ) [ dscp <integer> ];
query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port (
<integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ]
port ( <integer> | * ) ) ) [ dscp <integer> ];
request-expire <boolean>;
request-ixfr <boolean>;
request-nsid <boolean>;
send-cookie <boolean>;
tcp-keepalive <boolean>;
tcp-only <boolean>;
transfer-format ( many-answers | one-answer );
transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
dscp <integer> ];
transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
] [ dscp <integer> ];
transfers <integer>;
}; // may occur multiple times
statistics-channels {
inet ( <ipv4_address> | <ipv6_address> |
* ) [ port ( <integer> | * ) ] [
allow { <address_match_element>; ...
} ]; // may occur multiple times
}; // may occur multiple times
add parser support for TLS configuration options This commit adds stub parser support and tests for: - "tls" statement, specifying key and cert. - an optional "tls" keyvalue in listen-on statements for DoT configuration. Documentation for these options has also been added to the ARM, but needs further work.
2020-09-16 12:21:32 -07:00
tls <string> {
Restore disabled unused 'tls' options: 'ca-file' and 'hostname' This commit restores the 'tls' options disabled in 78b73d0865ef00062f3bca45cdbc3ca5ccb2ed43.
2022-01-25 18:05:04 +02:00
ca-file <quoted_string>;
add parser support for TLS configuration options This commit adds stub parser support and tests for: - "tls" statement, specifying key and cert. - an optional "tls" keyvalue in listen-on statements for DoT configuration. Documentation for these options has also been added to the ARM, but needs further work.
2020-09-16 12:21:32 -07:00
cert-file <quoted_string>;
Add "ciphers" options to the "tls" clause This commit adds support for setting TLS cipher list string in the format specified in the OpenSSL documentation (https://www.openssl.org/docs/man1.1.1/man1/ciphers.html). The syntax of the cipher list is verified so that specifying the wrong string will prevent the configuration from being loaded.
2021-09-20 14:25:59 +03:00
ciphers <string>;
DH-parameters loading support This commit adds support for loading DH-parameters (Diffie-Hellman parameters) via the new "dhparam-file" option within "tls" clause. In particular, Diffie-Hellman parameters are needed to enable the range of forward-secrecy enabled cyphers for TLSv1.2, which are getting silently disabled otherwise.
2021-09-16 14:48:30 +03:00
dhparam-file <quoted_string>;
add parser support for TLS configuration options This commit adds stub parser support and tests for: - "tls" statement, specifying key and cert. - an optional "tls" keyvalue in listen-on statements for DoT configuration. Documentation for these options has also been added to the ARM, but needs further work.
2020-09-16 12:21:32 -07:00
key-file <quoted_string>;
Add "prefer-server-ciphers" options to the "tls" clause This commit adds support for enforcing the preference of server ciphers over the client ones. This way, the server attains control over the ciphers priority and, thus, can choose more strong cyphers when a client prioritises less strong ciphers over the more strong ones, which is beneficial when trying to achieve Perfect Forward Secrecy.
2021-09-20 16:53:27 +03:00
prefer-server-ciphers <boolean>;
Add "protocols" options to the "tls" clause This commit adds the ability to specify allowed TLS protocols versions within the "tls" clause. If an unsupported TLS protocol version is specified in a file, the configuration file will not pass verification. Also, this commit adds strict checks for "tls" clauses verification, in particular: - it ensures that loading configuration files containing duplicated "tls" clauses is not allowed; - it ensures that loading configuration files containing "tls" clauses missing "cert-file" or "key-file" is not allowed; - it ensures that loading configuration files containing "tls" clauses named as "ephemeral" or "none" is not allowed.
2021-09-13 15:39:36 +03:00
protocols { <string>; ... };
Rename "hostname" to "remote-hostname" within "tls" This commit renames "hostname" to "remote-hostname" within "tls" options to avoid semantic conflicts with generic "options" configuration.
2022-05-03 16:51:33 +03:00
remote-hostname <quoted_string>;
Add "session-tickets" options to the "tls" clause This commit adds the ability to enable or disable stateless TLS session resumption tickets (see RFC5077). Having this ability is twofold. Firstly, these tickets are encrypted by the server, and the algorithm might be weaker than the algorithm negotiated during the TLS session establishment (it is in general the case for TLSv1.2, but the generic principle applies to TLSv1.3 as well, despite it having better ciphers for session tickets). Thus, they might compromise Perfect Forward Secrecy. Secondly, disabling it might be necessary if the same TLS key/cert pair is supposed to be used by multiple servers to achieve, e.g., load balancing because the session ticket by default gets generated in runtime, while to achieve successful session resumption ability, in this case, would have required using a shared key. The proper alternative to having the ability to disable stateless TLS session resumption tickets is to implement a proper session tickets key rollover mechanism so that key rotation might be performed often (e.g. once an hour) to not compromise forward secrecy while retaining the associated performance benefits. That is much more work, though. On the other hand, having the ability to disable session tickets allows having a deployable configuration right now in the cases when either forward secrecy is wanted or sharing the TLS key/cert pair between multiple servers is needed (or both).
2021-09-21 14:09:56 +03:00
session-tickets <boolean>;
add parser support for TLS configuration options This commit adds stub parser support and tests for: - "tls" statement, specifying key and cert. - an optional "tls" keyvalue in listen-on statements for DoT configuration. Documentation for these options has also been added to the ARM, but needs further work.
2020-09-16 12:21:32 -07:00
}; // may occur multiple times
prep 9.15.7
2019-12-12 23:36:53 +00:00
trust-anchors { <string> ( static-key |
initial-key | static-ds | initial-ds )
<integer> <integer> <integer>
<quoted_string>; ... }; // may occur multiple times
update documentation - change references to trusted-keys to dnssec-keys with static-key - rebuild doc/misc/options and other generated grammar doc - add a "see MANAGED-KEYS" note when building named.conf.docbook
2018-10-03 13:08:30 -07:00
trusted-keys { <string> <integer>
<integer> <integer>
<quoted_string>; ... }; // may occur multiple times, deprecated
regenerate
2017-09-12 00:26:30 +00:00
view <string> [ <class> ] {
allow-new-zones <boolean>;
allow-notify { <address_match_element>; ... };
allow-query { <address_match_element>; ... };
allow-query-cache { <address_match_element>; ... };
allow-query-cache-on { <address_match_element>; ... };
allow-query-on { <address_match_element>; ... };
allow-recursion { <address_match_element>; ... };
allow-recursion-on { <address_match_element>; ... };
Extend ACL syntax handling code with 'port' and 'transport' options This commit extends ACL syntax handling code with 'port' and 'transport' options. Currently, the extended syntax is available only for allow-transfer options.
2021-11-04 16:52:49 +02:00
allow-transfer [ port <integer> ] [ transport <string> ] {
<address_match_element>; ... };
regenerate
2017-09-12 00:26:30 +00:00
allow-update { <address_match_element>; ... };
allow-update-forwarding { <address_match_element>; ... };
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
also-notify [ port <integer> ] [ dscp <integer> ] { (
<remote-servers> | <ipv4_address> [ port <integer> ] |
<ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls
<string> ]; ... };
regenerate
2017-09-12 00:26:30 +00:00
alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * )
] [ dscp <integer> ];
alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
* ) ] [ dscp <integer> ];
attach-cache <string>;
Update doc files Run make doc after all the code changes related to #1086.
2020-12-08 15:10:54 +01:00
auth-nxdomain <boolean>;
regenerate
2017-09-12 00:26:30 +00:00
auto-dnssec ( allow | maintain | off );
add a CFG_CLAUSEFLAG_NODOC flag for use with outdated terms "masters" and "default-masters" are now flagged so they will not be included in the named.conf man page, despite being accepted as valid options by the parser for backward compatibiility.
2022-02-25 16:33:30 -08:00
catalog-zones { zone <string> [ default-primaries [ port <integer>
] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [
port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key
<string> ] [ tls <string> ]; ... } ] [ zone-directory
<quoted_string> ] [ in-memory <boolean> ] [ min-update-interval
<duration> ]; ... };
regenerate
2017-09-12 00:26:30 +00:00
check-dup-records ( fail | warn | ignore );
check-integrity <boolean>;
check-mx ( fail | warn | ignore );
check-mx-cname ( fail | warn | ignore );
regen master
2017-12-16 01:09:51 +00:00
check-names ( primary | master |
secondary | slave | response ) (
fail | warn | ignore ); // may occur multiple times
regenerate
2017-09-12 00:26:30 +00:00
check-sibling <boolean>;
check-spf ( warn | ignore );
check-srv-cname ( fail | warn | ignore );
check-wildcard <boolean>;
clients-per-query <integer>;
deny-answer-addresses { <address_match_element>; ... } [
option to disable validation under specified names - added new 'validate-except' option, which configures an NTA with expiry of 0xffffffff. NTAs with that value in the expiry field do not expire, are are not written out when saving the NTA table and are not dumped by rndc secroots
2018-04-30 16:10:17 -07:00
except-from { <string>; ... } ];
deny-answer-aliases { <string>; ... } [ except-from { <string>; ...
} ];
regenerate
2017-09-12 00:26:30 +00:00
dialup ( notify | notify-passive | passive | refresh | <boolean> );
disable-algorithms <string> { <string>;
... }; // may occur multiple times
disable-ds-digests <string> { <string>;
... }; // may occur multiple times
disable-empty-zone <string>; // may occur multiple times
dlz <string> {
database <string>;
search <boolean>;
}; // may occur multiple times
dns64 <netprefix> {
break-dnssec <boolean>;
clients { <address_match_element>; ... };
exclude { <address_match_element>; ... };
mapped { <address_match_element>; ... };
recursive-only <boolean>;
suffix <ipv6_address>;
}; // may occur multiple times
dns64-contact <string>;
dns64-server <string>;
regenerate doc
2018-05-21 19:59:10 +00:00
dnskey-sig-validity <integer>;
Remove the last bits of '// not configured' from doc/misc/options
2020-06-22 13:58:19 +02:00
dnsrps-enable <boolean>;
dnsrps-options { <unspecified-text> };
regenerate
2017-09-12 00:26:30 +00:00
dnssec-accept-expired <boolean>;
dnssec-dnskey-kskonly <boolean>;
dnssec-loadkeys-interval <integer>;
dnssec-must-be-secure <string> <boolean>; // may occur multiple times
prep 9.15.6
2019-11-17 07:25:57 +00:00
dnssec-policy <string>;
regenerate
2017-09-12 00:26:30 +00:00
dnssec-secure-to-insecure <boolean>;
dnssec-update-mode ( maintain | no-resign );
dnssec-validation ( yes | no | auto );
prevent "primaries" lists from having duplicate names it is now an error to have two primaries lists with the same name. this is true regardless of whether the "primaries" or "masters" keywords were used to define them.
2020-06-25 21:59:56 -07:00
dnstap { ( all | auth | client | forwarder | resolver | update ) [
( query | response ) ]; ... };
regenerate
2017-09-12 00:26:30 +00:00
dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
<integer> ] [ dscp <integer> ] | <ipv4_address> [ port
<integer> ] [ dscp <integer> ] | <ipv6_address> [ port
<integer> ] [ dscp <integer> ] ); ... };
dyndb <string> <quoted_string> {
<unspecified-text> }; // may occur multiple times
edns-udp-size <integer>;
empty-contact <string>;
empty-server <string>;
empty-zones-enable <boolean>;
fetch-quota-params <integer> <fixedpoint> <fixedpoint> <fixedpoint>;
fetches-per-server <integer> [ ( drop | fail ) ];
fetches-per-zone <integer> [ ( drop | fail ) ];
forward ( first | only );
forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
| <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
Implement ipv4only.arpa forward and reverse zones as per RFC 8880.
2018-07-05 15:29:30 +10:00
ipv4only-contact <string>;
ipv4only-enable <boolean>;
ipv4only-server <string>;
regen master
2017-12-16 01:09:51 +00:00
ixfr-from-differences ( primary | master | secondary | slave |
<boolean> );
regenerate
2017-09-12 00:26:30 +00:00
key <string> {
algorithm <string>;
secret <string>;
}; // may occur multiple times
key-directory <quoted_string>;
prep 9.15.6
2019-11-17 07:25:57 +00:00
lame-ttl <duration>;
Convert the documentation to Sphinx documentation format The ARM and the manpages have been converted into Sphinx documentation format. Sphinx uses reStructuredText as its markup language, and many of its strengths come from the power and straightforwardness of reStructuredText and its parsing and translating suite, the Docutils.
2019-03-31 12:49:47 +02:00
lmdb-mapsize <sizeval>;
prep 9.15.1
2019-06-03 19:29:39 +00:00
managed-keys { <string> (
static-key | initial-key
Document initial-ds and static-ds keywords
2019-09-19 14:52:49 -07:00
| static-ds | initial-ds
prep 9.15.1
2019-06-03 19:29:39 +00:00
) <integer> <integer>
<integer>
<quoted_string>; ... }; // may occur multiple times, deprecated
Remove the mastefile-format map option As previously announced, this commit removes the masterfile-format format 'map' from named, all the tools, the documentation and the system tests.
2021-09-16 11:46:13 +02:00
masterfile-format ( raw | text );
regenerate
2017-09-12 00:26:30 +00:00
masterfile-style ( full | relative );
match-clients { <address_match_element>; ... };
match-destinations { <address_match_element>; ... };
match-recursive-only <boolean>;
max-cache-size ( default | unlimited | <sizeval> | <percentage> );
prep 9.15.6
2019-11-17 07:25:57 +00:00
max-cache-ttl <duration>;
regenerate
2017-09-12 00:26:30 +00:00
max-clients-per-query <integer>;
build doc
2020-03-09 15:40:00 -07:00
max-ixfr-ratio ( unlimited | <percentage> );
regenerate
2017-09-12 00:26:30 +00:00
max-journal-size ( default | unlimited | <sizeval> );
prep 9.15.6
2019-11-17 07:25:57 +00:00
max-ncache-ttl <duration>;
regenerate
2017-09-12 00:26:30 +00:00
max-records <integer>;
max-recursion-depth <integer>;
max-recursion-queries <integer>;
max-refresh-time <integer>;
max-retry-time <integer>;
prep 9.15.6
2019-11-17 07:25:57 +00:00
max-stale-ttl <duration>;
regenerate
2017-09-12 00:26:30 +00:00
max-transfer-idle-in <integer>;
max-transfer-idle-out <integer>;
max-transfer-time-in <integer>;
max-transfer-time-out <integer>;
max-udp-size <integer>;
prep 9.15.6
2019-11-17 07:25:57 +00:00
max-zone-ttl ( unlimited | <duration> );
regenerate
2017-09-12 00:26:30 +00:00
message-compression <boolean>;
prep 9.15.6
2019-11-17 07:25:57 +00:00
min-cache-ttl <duration>;
min-ncache-ttl <duration>;
regenerate
2017-09-12 00:26:30 +00:00
min-refresh-time <integer>;
min-retry-time <integer>;
minimal-any <boolean>;
minimal-responses ( no-auth | no-auth-recursive | <boolean> );
multi-master <boolean>;
new-zones-directory <quoted_string>;
no-case-compress { <address_match_element>; ... };
nocookie-udp-size <integer>;
add "primary-only" as a synonym for "master-only" update the "notify" option to use RFC 8499 terminology as well.
2020-06-17 02:45:07 -07:00
notify ( explicit | master-only | primary-only | <boolean> );
regenerate
2017-09-12 00:26:30 +00:00
notify-delay <integer>;
notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
dscp <integer> ];
notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]
[ dscp <integer> ];
notify-to-soa <boolean>;
nsec3-test-zone <boolean>; // test only
prep 9.15.6
2019-11-17 07:25:57 +00:00
nta-lifetime <duration>;
nta-recheck <duration>;
regenerate
2017-09-12 00:26:30 +00:00
nxdomain-redirect <string>;
Add "parental-source[-v6]" config option Similar to "notify-source" and "transfer-source", add options to set the source address when querying parental agents for DS records.
2021-05-14 11:33:51 +02:00
parental-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
dscp <integer> ];
parental-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
] [ dscp <integer> ];
prep 9.13.5
2018-12-07 03:11:45 +00:00
plugin ( query ) <string> [ {
<unspecified-text> } ]; // may occur multiple times
regenerate
2017-09-12 00:26:30 +00:00
preferred-glue <string>;
prefetch <integer> [ <integer> ];
provide-ixfr <boolean>;
prep 9.13.2
2018-07-03 07:31:31 +00:00
qname-minimization ( strict | relaxed | disabled | off );
regenerate
2017-09-12 00:26:30 +00:00
query-source ( ( [ address ] ( <ipv4_address> | * ) [ port (
<integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ]
port ( <integer> | * ) ) ) [ dscp <integer> ];
query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port (
<integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ]
port ( <integer> | * ) ) ) [ dscp <integer> ];
rate-limit {
all-per-second <integer>;
errors-per-second <integer>;
exempt-clients { <address_match_element>; ... };
ipv4-prefix-length <integer>;
ipv6-prefix-length <integer>;
log-only <boolean>;
max-table-size <integer>;
min-table-size <integer>;
nodata-per-second <integer>;
nxdomains-per-second <integer>;
qps-scale <integer>;
referrals-per-second <integer>;
responses-per-second <integer>;
slip <integer>;
window <integer>;
};
recursion <boolean>;
request-expire <boolean>;
request-ixfr <boolean>;
request-nsid <boolean>;
require-server-cookie <boolean>;
resolver-nonbackoff-tries <integer>;
resolver-query-timeout <integer>;
resolver-retry-interval <integer>;
response-padding { <address_match_element>; ... } block-size
<integer>;
add the ability to control whether SOA records are added response-policy modified answers
2019-02-14 17:50:10 +11:00
response-policy { zone <string> [ add-soa <boolean> ] [ log
prep 9.15.6
2019-11-17 07:25:57 +00:00
<boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval
<duration> ] [ policy ( cname | disabled | drop | given | no-op
| nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [
add the ability to control whether SOA records are added response-policy modified answers
2019-02-14 17:50:10 +11:00
recursive-only <boolean> ] [ nsip-enable <boolean> ] [
nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [
prep 9.15.6
2019-11-17 07:25:57 +00:00
break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [
min-update-interval <duration> ] [ min-ns-dots <integer> ] [
regen master
2020-04-09 11:22:03 +00:00
nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean>
] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ]
[ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [
dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text>
} ];
option to disable validation under specified names - added new 'validate-except' option, which configures an NTA with expiry of 0xffffffff. NTAs with that value in the expiry field do not expire, are are not written out when saving the NTA table and are not dumped by rndc secroots
2018-04-30 16:10:17 -07:00
root-delegation-only [ exclude { <string>; ... } ];
regenerate doc
2018-05-21 19:59:10 +00:00
root-key-sentinel <boolean>;
regenerate
2017-09-12 00:26:30 +00:00
rrset-order { [ class <string> ] [ type <string> ] [ name
<quoted_string> ] <string> <string>; ... };
send-cookie <boolean>;
serial-update-method ( date | increment | unixtime );
server <netprefix> {
bogus <boolean>;
edns <boolean>;
edns-udp-size <integer>;
edns-version <integer>;
keys <server_key>;
max-udp-size <integer>;
notify-source ( <ipv4_address> | * ) [ port ( <integer> | *
) ] [ dscp <integer> ];
notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer>
| * ) ] [ dscp <integer> ];
padding <integer>;
provide-ixfr <boolean>;
query-source ( ( [ address ] ( <ipv4_address> | * ) [ port
( <integer> | * ) ] ) | ( [ [ address ] (
<ipv4_address> | * ) ] port ( <integer> | * ) ) ) [
dscp <integer> ];
query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [
port ( <integer> | * ) ] ) | ( [ [ address ] (
<ipv6_address> | * ) ] port ( <integer> | * ) ) ) [
dscp <integer> ];
request-expire <boolean>;
request-ixfr <boolean>;
request-nsid <boolean>;
send-cookie <boolean>;
tcp-keepalive <boolean>;
tcp-only <boolean>;
transfer-format ( many-answers | one-answer );
transfer-source ( <ipv4_address> | * ) [ port ( <integer> |
* ) ] [ dscp <integer> ];
transfer-source-v6 ( <ipv6_address> | * ) [ port (
<integer> | * ) ] [ dscp <integer> ];
transfers <integer>;
}; // may occur multiple times
prep 9.15.6
2019-11-17 07:25:57 +00:00
servfail-ttl <duration>;
regenerate
2017-09-12 00:26:30 +00:00
sig-signing-nodes <integer>;
sig-signing-signatures <integer>;
sig-signing-type <integer>;
sig-validity-interval <integer> [ <integer> ];
sortlist { <address_match_element>; ... };
Add documentation for stale-answer-client-timeout
2020-12-23 12:16:26 -03:00
stale-answer-client-timeout ( disabled | off | <integer> );
regenerate
2017-09-12 00:26:30 +00:00
stale-answer-enable <boolean>;
prep 9.15.6
2019-11-17 07:25:57 +00:00
stale-answer-ttl <duration>;
Add stale-cache-enable option and disable serve-stable by default The current serve-stale implementation in BIND 9 stores all received records in the cache for a max-stale-ttl interval (default 12 hours). This allows DNS operators to turn the serve-stale answers in an event of large authoritative DNS outage. The caching of the stale answers needs to be enabled before the outage happens or the feature would be otherwise useless. The negative consequence of the default setting is the inevitable cache-bloat that happens for every and each DNS operator running named. In this MR, a new configuration option `stale-cache-enable` is introduced that allows the operators to selectively enable or disable the serve-stale feature of BIND 9 based on their decision. The newly introduced option has been disabled by default, e.g. serve-stale is disabled in the default configuration and has to be enabled if required.
2020-07-21 10:38:55 +02:00
stale-cache-enable <boolean>;
Update ARM and other documents
2020-11-04 20:02:58 -03:00
stale-refresh-time <duration>;
Update doc files Run make doc after all the code changes related to #1086.
2020-12-08 15:10:54 +01:00
suppress-initial-notify <boolean>; // obsolete
regenerate
2017-09-12 00:26:30 +00:00
synth-from-dnssec <boolean>;
transfer-format ( many-answers | one-answer );
transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [
dscp <integer> ];
transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
] [ dscp <integer> ];
trust-anchor-telemetry <boolean>; // experimental
prep 9.15.7
2019-12-12 23:36:53 +00:00
trust-anchors { <string> ( static-key |
initial-key | static-ds | initial-ds
) <integer> <integer> <integer>
<quoted_string>; ... }; // may occur multiple times
update documentation - change references to trusted-keys to dnssec-keys with static-key - rebuild doc/misc/options and other generated grammar doc - add a "see MANAGED-KEYS" note when building named.conf.docbook
2018-10-03 13:08:30 -07:00
trusted-keys { <string>
<integer> <integer>
<integer>
<quoted_string>; ... }; // may occur multiple times, deprecated
regenerate
2017-09-12 00:26:30 +00:00
try-tcp-refresh <boolean>;
update-check-ksk <boolean>;
use-alt-transfer-source <boolean>;
v6-bias <integer>;
option to disable validation under specified names - added new 'validate-except' option, which configures an NTA with expiry of 0xffffffff. NTAs with that value in the expiry field do not expire, are are not written out when saving the NTA table and are not dumped by rndc secroots
2018-04-30 16:10:17 -07:00
validate-except { <string>; ... };
regenerate
2017-09-12 00:26:30 +00:00
zero-no-soa-ttl <boolean>;
zero-no-soa-ttl-cache <boolean>;
zone-statistics ( full | terse | none | <boolean> );
}; // may occur multiple times
Reference in New Issue Copy Permalink