Obsolete and Unimplemented Experimental RFC
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch01.html b/contrib/bind9/doc/arm/Bv9ARM.ch01.html
index 1f942de17a82..30e9e0da4724 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch01.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch01.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -45,17 +45,17 @@
@@ -71,7 +71,7 @@
The Berkeley Internet Name Domain
(BIND) implements a
@@ -87,7 +87,7 @@
-Organization of This Document
+
Organization of This Document
In this document, Section 1 introduces
the basic DNS and BIND concepts. Section 2
@@ -107,8 +107,8 @@
security considerations, and
Section 8 contains troubleshooting help. The
main body of the document is followed by several
- Appendices which contain useful reference
- information, such as a Bibliography and
+ appendices which contain useful reference
+ information, such as a bibliography and
historic information related to BIND
and the Domain Name
System.
@@ -116,7 +116,7 @@
-Conventions Used in This Document
+
Conventions Used in This Document
In this document, we use the following general typographic
conventions:
@@ -243,17 +243,17 @@
-The Domain Name System (DNS)
+
The Domain Name System (
DNS)
The purpose of this document is to explain the installation
- and upkeep of the BIND software
- package, and we
+ and upkeep of the BIND (Berkeley Internet
+ Name Domain) software package, and we
begin by reviewing the fundamentals of the Domain Name System
(DNS) as they relate to BIND.
The Domain Name System (DNS) is a hierarchical, distributed
database. It stores information for mapping Internet host names to
@@ -273,7 +273,7 @@
-Domains and Domain Names
+
Domains and Domain Names
The data stored in the DNS is identified by domain names that are organized as a tree according to
organizational or administrative boundaries. Each node of the tree,
@@ -319,7 +319,7 @@
To properly operate a name server, it is important to understand
the difference between a zone
@@ -372,7 +372,7 @@
-Authoritative Name Servers
+
Authoritative Name Servers
Each zone is served by at least
one authoritative name server,
@@ -389,7 +389,7 @@
The authoritative server where the master copy of the zone
data is maintained is called the
@@ -409,7 +409,7 @@
The other authoritative servers, the slave
servers (also known as secondary servers)
@@ -425,7 +425,7 @@
Usually all of the zone's authoritative servers are listed in
NS records in the parent zone. These NS records constitute
@@ -460,7 +460,7 @@
The resolver libraries provided by most operating systems are
stub resolvers, meaning that they are not
@@ -487,7 +487,7 @@
Even a caching name server does not necessarily perform
the complete recursive lookup itself. Instead, it can
@@ -514,7 +514,7 @@
-Name Servers in Multiple Roles
+
Name Servers in Multiple Roles
The BIND name server can
simultaneously act as
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch02.html b/contrib/bind9/doc/arm/Bv9ARM.ch02.html
index 9d859d69752a..cbf6c15b65dd 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch02.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch02.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -45,16 +45,16 @@
DNS hardware requirements have
traditionally been quite modest.
@@ -73,7 +73,7 @@
CPU requirements for BIND 9 range from
i486-class machines
@@ -84,7 +84,7 @@
The memory of the server has to be large enough to fit the
cache and zones loaded off disk. The max-cache-size
@@ -93,7 +93,7 @@
traffic.
Additionally, if additional section caching
(the section called “Additional Section Caching”) is enabled,
- the max-acache-size can be used to
+ the max-acache-size option can be used to
limit the amount
of memory used by the mechanism.
It is still good practice to have enough memory to load
@@ -107,7 +107,7 @@
-Name Server Intensive Environment Issues
+
Name Server Intensive Environment Issues
For name server intensive environments, there are two alternative
configurations that may be used. The first is where clients and
@@ -124,7 +124,7 @@
-Supported Operating Systems
+
Supported Operating Systems
ISC BIND 9 compiles and runs on a large
number
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch03.html b/contrib/bind9/doc/arm/Bv9ARM.ch03.html
index 351927dbcdd0..18f2711517c9 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch03.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch03.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -47,14 +47,14 @@
- Sample Configurations
-- A Caching-only Name Server
-- An Authoritative-only Name Server
+- A Caching-only Name Server
+- An Authoritative-only Name Server
-- Load Balancing
-- Name Server Operations
+- Load Balancing
+- Name Server Operations
-- Tools for Use With the Name Server Daemon
-- Signals
+- Tools for Use With the Name Server Daemon
+- Signals
@@ -68,7 +68,7 @@
Sample Configurations
-A Caching-only Name Server
+
A Caching-only Name Server
The following sample configuration is appropriate for a caching-only
name server for use by clients internal to a corporation. All
@@ -95,7 +95,7 @@ zone "0.0.127.in-addr.arpa" {
-An Authoritative-only Name Server
+
An Authoritative-only Name Server
This sample configuration is for an authoritative-only server
that is the master server for "example.com
"
@@ -137,11 +137,11 @@ zone "eng.example.com" {
A primitive form of load balancing can be achieved in
- the DNS by using multiple A records for
- one name.
+ the DNS by using multiple records
+ (such as multiple A records) for one name.
For example, if you have three WWW servers with network addresses
@@ -280,10 +280,10 @@ zone "eng.example.com" {
-Tools for Use With the Name Server Daemon
+
Tools for Use With the Name Server Daemon
This section describes several indispensable diagnostic,
administrative and monitoring tools available to the system
@@ -336,7 +336,7 @@ zone "eng.example.com" {
functionality
can be extended with the use of options.
-host
[-aCdlrTwv] [-c class
] [-N ndots
] [-t type
] [-W timeout
] [-R retries
] hostname
[server
]
+host
[-aCdlnrsTwv] [-c class
] [-N ndots
] [-t type
] [-W timeout
] [-R retries
] [-m flag
] [-4] [-6] hostname
[server
]
For more information and a list of available commands and
options, see the host man
@@ -425,6 +425,12 @@ zone "eng.example.com" {
(rndc) program allows the
system
administrator to control the operation of a name server.
+ Since BIND 9.2, rndc
+ supports all the commands of the BIND 8 ndc
+ utility except ndc start and
+ ndc restart, which were also
+ not supported in ndc's
+ channel mode.
If you run rndc without any
options
it will display a usage message as follows:
@@ -584,14 +590,6 @@ zone "eng.example.com" {
on.
-
- In BIND 9.2, rndc
- supports all the commands of the BIND 8 ndc
- utility except ndc start and
- ndc restart, which were also
- not supported in ndc's
- channel mode.
-
A configuration file is required, since all
communication with the server is authenticated with
@@ -741,7 +739,7 @@ controls {
Certain UNIX signals cause the name server to take specific
actions, as described in the following table. These signals can
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch04.html b/contrib/bind9/doc/arm/Bv9ARM.ch04.html
index d7be205900f0..09507fe53cbc 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch04.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch04.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -49,28 +49,29 @@
Dynamic Update
- The journal file
Incremental Zone Transfers (IXFR)
-Split DNS
+Split DNS
+- Example split DNS setup
TSIG
-- Generate Shared Keys for Each Pair of Hosts
-- Copying the Shared Secret to Both Machines
-- Informing the Servers of the Key's Existence
-- Instructing the Server to Use the Key
-- TSIG Key Based Access Control
-- Errors
+- Generate Shared Keys for Each Pair of Hosts
+- Copying the Shared Secret to Both Machines
+- Informing the Servers of the Key's Existence
+- Instructing the Server to Use the Key
+- TSIG Key Based Access Control
+- Errors
-TKEY
-SIG(0)
+TKEY
+SIG(0)
DNSSEC
-- Generating Keys
-- Signing the Zone
-- Configuring Servers
+- Generating Keys
+- Signing the Zone
+- Configuring Servers
-IPv6 Support in BIND 9
+IPv6 Support in BIND 9
-- Address Lookups Using AAAA Records
-- Address to Name Lookups Using Nibble Format
+- Address Lookups Using AAAA Records
+- Address to Name Lookups Using Nibble Format
@@ -204,7 +205,7 @@
Setting up different views, or visibility, of the DNS space to
internal and external resolvers is usually referred to as a
@@ -222,7 +223,7 @@
However, since listing addresses of internal servers that
external clients cannot possibly reach can result in
connection delays and other annoyances, an organization may
- choose to use a Split DNS to present a consistant view of itself
+ choose to use a Split DNS to present a consistent view of itself
to the outside world.
@@ -232,9 +233,9 @@
on the Internet. Split DNS can also be used to allow mail from outside
back in to the internal network.
-
- Here is an example of a split DNS setup:
-
+
+
Let's say a company named Example, Inc.
(example.com
)
@@ -450,6 +451,7 @@ nameserver 172.16.72.3
nameserver 172.16.72.4
+
@@ -479,7 +481,7 @@ nameserver 172.16.72.4
-Generate Shared Keys for Each Pair of Hosts
+
Generate Shared Keys for Each Pair of Hosts
A shared secret is generated to be shared between host1 and host2.
An arbitrary key name is chosen: "host1-host2.". The key name must
@@ -487,7 +489,7 @@ nameserver 172.16.72.4
The following command will generate a 128-bit (16 byte) HMAC-MD5
key as described above. Longer keys are better, but shorter keys
@@ -512,7 +514,7 @@ nameserver 172.16.72.4
The shared secret is simply a random sequence of bits, encoded
in base-64. Most ASCII strings are valid base-64 strings (assuming
@@ -527,7 +529,7 @@ nameserver 172.16.72.4
-Copying the Shared Secret to Both Machines
+
Copying the Shared Secret to Both Machines
This is beyond the scope of DNS. A secure transport mechanism
should be used. This could be secure FTP, ssh, telephone, etc.
@@ -535,7 +537,7 @@ nameserver 172.16.72.4
-Informing the Servers of the Key's Existence
+
Informing the Servers of the Key's Existence
Imagine host1 and host 2
are
@@ -564,7 +566,7 @@ key host1-host2. {
-Instructing the Server to Use the Key
+
Instructing the Server to Use the Key
Since keys are shared between two hosts only, the server must
be told when keys are to be used. The following is added to the named.conf
file
@@ -596,7 +598,7 @@ server 10.1.2.3 {
-TSIG Key Based Access Control
+
TSIG Key Based Access Control
BIND allows IP addresses and ranges
to be specified in ACL
@@ -624,7 +626,7 @@ allow-update { key host1-host2. ;};
The processing of TSIG signed messages can result in
several errors. If a signed message is sent to a non-TSIG aware
@@ -643,14 +645,14 @@ allow-update { key host1-host2. ;};
outside of the allowed range, the response will be signed with
the TSIG extended error code set to BADTIME, and the time values
will be adjusted so that the response can be successfully
- verified. In any of these cases, the message's rcode is set to
+ verified. In any of these cases, the message's rcode (response code) is set to
NOTAUTH (not authenticated).
TKEY
is a mechanism for automatically generating a shared secret
between two hosts. There are several "modes" of
@@ -686,7 +688,7 @@ allow-update { key host1-host2. ;};
BIND 9 partially supports DNSSEC SIG(0)
transaction signatures as specified in RFC 2535 and RFC2931.
@@ -715,7 +717,7 @@ allow-update { key host1-host2. ;};
Cryptographic authentication of DNS information is possible
through the DNS Security (DNSSEC-bis) extensions,
- defined in RFC 4033, RFC 4034 and RFC 4035.
+ defined in RFC 4033, RFC 4034, and RFC 4035.
This section describes the creation and use of DNSSEC signed zones.
@@ -747,7 +749,7 @@ allow-update { key host1-host2. ;};
The dnssec-keygen program is used to
generate keys.
@@ -775,7 +777,7 @@ allow-update { key host1-host2. ;};
Kchild.example.+005+12345.key
and
Kchild.example.+005+12345.private
(where
- 12345 is an example of a key tag). The key file names contain
+ 12345 is an example of a key tag). The key filenames contain
the key name (child.example.
),
algorithm (3
is DSA, 1 is RSAMD5, 5 is RSASHA1, etc.), and the key tag (12345 in
@@ -798,7 +800,7 @@ allow-update { key host1-host2. ;};
The dnssec-signzone program is used
to
@@ -835,14 +837,14 @@ allow-update { key host1-host2. ;};
dnssec-signzone
will also produce a keyset and dsset files and optionally a
dlvset file. These are used to provide the parent zone
- administators with the DNSKEYs
(or their
+ administrators with the DNSKEYs
(or their
corresponding DS
records) that are the
secure entry point to the zone.
To enable named to respond appropriately
to DNS requests from DNSSEC aware clients,
@@ -851,7 +853,7 @@ allow-update { key host1-host2. ;};
To enable named to validate answers from
other servers both dnssec-enable and
- dnssec-validate must be set and some
+ dnssec-validation must be set and some
trusted-keys must be configured
into named.conf
.
@@ -930,7 +932,7 @@ options {
BIND 9 fully supports all currently
defined forms of IPv6
@@ -969,7 +971,7 @@ options {
-Address Lookups Using AAAA Records
+
Address Lookups Using AAAA Records
The IPv6 AAAA record is a parallel to the IPv4 A record,
and, unlike the deprecated A6 record, specifies the entire
@@ -988,7 +990,7 @@ host 3600 IN AAAA 2001:db8::1
-Address to Name Lookups Using Nibble Format
+
Address to Name Lookups Using Nibble Format
When looking up an address in nibble format, the address
components are simply reversed, just as in IPv4, and
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch05.html b/contrib/bind9/doc/arm/Bv9ARM.ch05.html
index 458d93378fa4..80418b9a22da 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch05.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch05.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -45,13 +45,13 @@
-The Lightweight Resolver Library
+
The Lightweight Resolver Library
Traditionally applications have been linked with a stub resolver
library that sends recursive DNS queries to a local caching name
diff --git a/contrib/bind9/doc/arm/Bv9ARM.ch06.html b/contrib/bind9/doc/arm/Bv9ARM.ch06.html
index 69c4855f4374..d829a177a3d9 100644
--- a/contrib/bind9/doc/arm/Bv9ARM.ch06.html
+++ b/contrib/bind9/doc/arm/Bv9ARM.ch06.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -48,52 +48,52 @@
Configuration File Elements
- Address Match Lists
-- Comment Syntax
+- Comment Syntax
Configuration File Grammar
-- acl Statement Grammar
+- acl Statement Grammar
- acl Statement Definition and
Usage
-- controls Statement Grammar
+- controls Statement Grammar
- controls Statement Definition and
Usage
-- include Statement Grammar
-- include Statement Definition and
+
- include Statement Grammar
+- include Statement Definition and
Usage
-- key Statement Grammar
-- key Statement Definition and Usage
-- logging Statement Grammar
-- logging Statement Definition and
+
- key Statement Grammar
+- key Statement Definition and Usage
+- logging Statement Grammar
+- logging Statement Definition and
Usage
-- lwres Statement Grammar
-- lwres Statement Definition and Usage
-- masters Statement Grammar
-- masters Statement Definition and
+
- lwres Statement Grammar
+- lwres Statement Definition and Usage
+- masters Statement Grammar
+- masters Statement Definition and
Usage
-- options Statement Grammar
+- options Statement Grammar
- options Statement Definition and
Usage
- server Statement Grammar
- server Statement Definition and
Usage
-- trusted-keys Statement Grammar
-- trusted-keys Statement Definition
+
- trusted-keys Statement Grammar
+- trusted-keys Statement Definition
and Usage
- view Statement Grammar
-- view Statement Definition and Usage
+- view Statement Definition and Usage
- zone
Statement Grammar
-- zone Statement Definition and Usage
+- zone Statement Definition and Usage
-Zone File
+Zone File
- Types of Resource Records and When to Use Them
-- Discussion of MX Records
+- Discussion of MX Records
- Setting TTLs
-- Inverse Mapping in IPv4
-- Other Zone File Directives
-- BIND Master File Extension: the $GENERATE Directive
+- Inverse Mapping in IPv4
+- Other Zone File Directives
+- BIND Master File Extension: the $GENERATE Directive
- Additional File Formats
@@ -266,7 +266,7 @@
An IP port number .
- number is limited to 0
+ The number is limited to 0
through 65535, with values
below 1024 typically restricted to use by processes running
as root.
@@ -428,7 +428,7 @@
Address Match Lists
address_match_list = address_match_list_element ;
[ address_match_list_element; ... ]
address_match_list_element = [ ! ] (ip_address [/length] |
@@ -437,7 +437,7 @@
Address match lists are primarily used to determine access
control for various server operations. They are also used in
@@ -515,17 +515,17 @@
The BIND 9 comment syntax allows for
comments to appear
- anywhere that white space may appear in a BIND configuration
+ anywhere that whitespace may appear in a BIND configuration
file. To appeal to programmers of all kinds, they can be written
in the C, C++, or shell/perl style.
/* This is a BIND comment as in C */
@@ -540,9 +540,9 @@
- Comments may appear anywhere that white space may appear in
+ Comments may appear anywhere that whitespace may appear in
a BIND configuration file.
@@ -774,7 +774,7 @@
acl acl-name {
address_match_list
};
@@ -857,7 +857,7 @@
-controls Statement Grammar
+ controls Statement Grammar
controls {
[ inet ( ip_addr | * ) [ port ip_port ] allow { address_match_list }
keys { key_list }; ]
@@ -979,12 +979,12 @@
-include Statement Grammar
+ include Statement Grammar
include filename ;
-include Statement Definition and
+include Statement Definition and
Usage
The include statement inserts the
@@ -999,7 +999,7 @@
key key_id {
algorithm string ;
secret string ;
@@ -1008,7 +1008,7 @@
-key Statement Definition and Usage
+ key Statement Definition and Usage
The key statement defines a shared
secret key for use with TSIG (see the section called “TSIG”)
@@ -1046,7 +1046,7 @@
hmac-sha256 , hmac-sha384
and hmac-sha512 TSIG authentication.
Truncated hashes are supported by appending the minimum
- number of required bits preceeded by a dash, e.g.
+ number of required bits preceded by a dash, e.g.
hmac-sha1-80 . The
secret_string is the secret
to be used by the algorithm, and is treated as a base-64
@@ -1055,7 +1055,7 @@
-logging Statement Grammar
+ logging Statement Grammar
logging {
[ channel channel_name {
( file path name
@@ -1079,7 +1079,7 @@
-logging Statement Definition and
+logging Statement Definition and
Usage
The logging statement configures a
@@ -1113,7 +1113,7 @@
All log output goes to one or more channels;
you can make as many of them as you want.
@@ -1632,7 +1632,7 @@ category notify { null; };
This is the grammar of the lwres
statement in the named.conf file:
@@ -1647,12 +1647,12 @@ category notify { null; };
-lwres Statement Definition and Usage
+ lwres Statement Definition and Usage
The lwres statement configures the
name
server to also act as a lightweight resolver server. (See
- the section called “Running a Resolver Daemon”.) There may be be multiple
+ the section called “Running a Resolver Daemon”.) There may be multiple
lwres statements configuring
lightweight resolver servers with different properties.
@@ -1698,14 +1698,14 @@ category notify { null; };
-masters Statement Grammar
+ masters Statement Grammar
masters name [port ip_port ] { ( masters_list | ip_addr [port ip_port ] [key key ] ) ; [...] };
-masters Statement Definition and
+masters Statement Definition and
Usage
masters
lists allow for a common set of masters to be easily used by
@@ -1714,7 +1714,7 @@ category notify { null; };
-options Statement Grammar
+ options Statement Grammar
This is the grammar of the options
statement in the named.conf file:
@@ -1732,6 +1732,7 @@ category notify { null; };
[ dump-file path_name ; ]
[ memstatistics-file path_name ; ]
[ pid-file path_name ; ]
+ [ recursing-file path_name ; ]
[ statistics-file path_name ; ]
[ zone-statistics yes_or_no ; ]
[ auth-nxdomain yes_or_no ; ]
@@ -1809,6 +1810,7 @@ category notify { null; };
[ alt-transfer-source (ip4_addr | * ) [port ip_port ] ; ]
[ alt-transfer-source-v6 (ip6_addr | * ) [port ip_port ] ; ]
[ use-alt-transfer-source yes_or_no ; ]
+ [ notify-delay seconds ; ]
[ notify-source (ip4_addr | * ) [port ip_port ] ; ]
[ notify-source-v6 (ip6_addr | * ) [port ip_port ] ; ]
[ also-notify { ip_addr [port ip_port ] ; [ ip_addr [port ip_port ] ; ... ] }; ]
@@ -1951,12 +1953,20 @@ digits" + "tkey-domain ". In most cases,
If not specified, the default is named_dump.db .
memstatistics-file
-
+
+
The pathname of the file the server writes memory
- usage statistics to on exit. If not specified,
- the default is
- named.memstats .
-
+ usage statistics to on exit. If specified the
+ statistics will be written to the file on exit.
+
+
+ In BIND 9.5 and later this will
+ default to named.memstats .
+ BIND 9.5 will also introduce
+ memstatistics to control the
+ writing.
+
+
pid-file
The pathname of the file the server writes its process ID
@@ -1966,10 +1976,17 @@ digits" + "tkey-domain ". In most cases,
name server. Specifying pid-file none disables the
use of a PID file — no file will be written and any
existing one will be removed. Note that none
- is a keyword, not a file name, and therefore is not enclosed
+ is a keyword, not a filename, and therefore is not enclosed
in
double quotes.
+recursing-file
+
+ The pathname of the file the server dumps
+ the queries that are currently recursing when instructed
+ to do so with rndc recursing.
+ If not specified, the default is named.recursing .
+
statistics-file
The pathname of the file the server appends statistics
@@ -2472,7 +2489,7 @@ options {
This option is obsolete.
If you need to disable IXFR to a particular server or
- servers see
+ servers, see
the information on the provide-ixfr option
in the section called “server Statement Definition and
@@ -2660,6 +2677,7 @@ options {
Accept expired signatures when verifying DNSSEC signatures.
The default is no .
+ Setting this option to "yes" leaves named vulnerable to replay attacks.
querylog
@@ -2694,7 +2712,7 @@ options {
and MX records.
It also applies to the RDATA of PTR records where the owner
name indicated that it is a reverse lookup of a hostname
- (the owner name ends in IN-ADDR.ARPA, IP6.ARPA or IP6.INT).
+ (the owner name ends in IN-ADDR.ARPA, IP6.ARPA, or IP6.INT).
check-mx
@@ -2723,7 +2741,7 @@ options {
MX and SRV records only in-zone hostnames are
checked (for out-of-zone hostnames use named-checkzone).
For NS records only names below top of zone are
- checked (for out-of-zone names and glue consistancy
+ checked (for out-of-zone names and glue consistency
checks use named-checkzone). The default is
yes.
@@ -2771,7 +2789,7 @@ options {
The forwarding facility can be used to create a large site-wide
cache on a few servers, reducing traffic over links to external
@@ -2815,7 +2833,7 @@ options {
Dual-stack servers are used as servers of last resort to work
around
@@ -2970,7 +2988,7 @@ options {
The interfaces and ports that the server will answer queries
from may be specified using the listen-on option. listen-on takes
@@ -3050,7 +3068,7 @@ listen-on-v6 port 1234 { !2001:db8::/32; any; };
If the server doesn't know the answer to a question, it will
query other name servers. query-source specifies
@@ -3330,7 +3348,7 @@ query-source-v6 address * port *;
avoid-v4-udp-ports
and avoid-v6-udp-ports specify a list
of IPv4 and IPv6 UDP ports that will not be used as system
@@ -3344,7 +3362,7 @@ query-source-v6 address * port *;
-Operating System Resource Limits
+ Operating System Resource Limits
The server's usage of many system resources can be limited.
Scaled values are allowed when specifying resource limits. For
@@ -3403,7 +3421,7 @@ query-source-v6 address * port *;
The following options set limits on the server's
resource consumption that are enforced internally by the
@@ -3481,7 +3499,7 @@ query-source-v6 address * port *;
- cleaning-interval
@@ -3529,7 +3547,7 @@ query-source-v6 address * port *;
Note
Not yet implemented in
- BIND9.
+ BIND 9.
@@ -3869,7 +3887,7 @@ query-source-v6 address * port *;
values are 512 to 4096 (values outside this range
will be silently adjusted). The default value is
4096. The usual reason for setting edns-udp-size to
- a non-default value it to get UDP answers to pass
+ a non-default value is to get UDP answers to pass
through broken firewalls that block fragmented
packets and/or block UDP packets that are greater
than 512 bytes.
@@ -3884,6 +3902,8 @@ query-source-v6 address * port *;
answers to pass through broken firewalls that
block fragmented packets and/or block UDP packets
that are greater than 512 bytes.
+ This is independent of the advertised receive
+ buffer (edns-udp-size).
masterfile-format
Specifies
@@ -3943,6 +3963,11 @@ query-source-v6 address * port *;
recursive-clients.
+notify-delay
+
+ The delay, in seconds, between sending sets of notify
+ messages for a zone. The default is zero.
+
@@ -4013,7 +4038,7 @@ query-source-v6 address * port *;
Named has some built-in empty zones (SOA and NS records only).
These are for zones that should normally be answered locally
and which queries should not be sent to the Internet's root
- servers. The offical servers which cover these namespaces
+ servers. The official servers which cover these namespaces
return NXDOMAIN responses to these queries. In particular,
these cover the reverse namespace for addresses from RFC 1918 and
RFC 3330. They also include the reverse namespace for IPv6 local
@@ -4076,10 +4101,10 @@ query-source-v6 address * port *;
If you are using the address ranges covered here, you should
already have reverse zones covering the addresses you use.
In practice this appears to not be the case with many queries
- being made to the infrustructure servers for names in these
+ being made to the infrastructure servers for names in these
spaces. So many in fact that sacrificial servers were needed
to be deployed to channel the query load away from the
- infrustructure servers.
+ infrastructure servers.
Note
@@ -4226,6 +4251,32 @@ query-source-v6 address * port *;
|
+
+
+ duplicate
+ |
+
+
+ The number of queries which the server attempted to
+ recurse but discover a existing query with the same
+ IP address, port, query id, name, type and class
+ already being processed.
+
+ |
+
+
+
+ dropped
+ |
+
+
+ The number of queries for which the server
+ discovered a excessive number of existing
+ recursive queries for the same name, type and
+ class and were subsequently dropped.
+
+ |
+
@@ -4528,7 +4579,7 @@ query-source-v6 address * port *;
-trusted-keys Statement Grammar
+
trusted-keys Statement Grammar
trusted-keys {
string
number
number
number
string
;
[ string
number
number
number
string
; [...]]
@@ -4537,7 +4588,7 @@ query-source-v6 address * port *;
-trusted-keys Statement Definition
+trusted-keys Statement Definition
and Usage
The trusted-keys statement defines
@@ -4580,7 +4631,7 @@ query-source-v6 address * port *;
-view Statement Definition and Usage
+
view Statement Definition and Usage
The view statement is a powerful
feature
@@ -4724,6 +4775,7 @@ view "external" {
[ max-transfer-idle-out number
; ]
[ max-transfer-time-out number
; ]
[ notify yes_or_no
| explicit
| master-only
; ]
+ [ notify-delay seconds
; ]
[ pubkey number
number
number
string
; ]
[ notify-source (ip4_addr
| *
) [port ip_port
] ; ]
[ notify-source-v6 (ip6_addr
| *
) [port ip_port
] ; ]
@@ -4831,10 +4883,10 @@ zone zone_name
[
-zone Statement Definition and Usage
+
zone Statement Definition and Usage