contrib/bind9/doc/misc/options

   1
   2 This is a summary of the named.conf options supported by
   3 this version of BIND 9.
   4
   5 acl <string> { <address_match_element>; ... };
   6
   7 controls {
   8         inet ( <ipv4_address> | <ipv6_address> | * ) [ port ( <integer> | *
   9             ) ] allow { <address_match_element>; ... } [ keys { <string>;
  10             ... } ];
  11         unix <quoted_string> perm <integer> owner <integer> group <integer>
  12             [ keys { <string>; ... } ];
  13 };
  14
  15 dlz <string> {
  16         database <string>;
  17 };
  18
  19 key <string> {
  20         algorithm <string>;
  21         secret <string>;
  22 };
  23
  24 logging {
  25         category <string> { <string>; ... };
  26         channel <string> {
  27                 file <quoted_string> [ versions ( "unlimited" | <integer> )
  28                     ] [ size <size> ];
  29                 null;
  30                 print-category <boolean>;
  31                 print-severity <boolean>;
  32                 print-time <boolean>;
  33                 severity <log_severity>;
  34                 stderr;
  35                 syslog <optional_facility>;
  36         };
  37 };
  38
  39 lwres {
  40         listen-on [ port <integer> ] { ( <ipv4_address> | <ipv6_address> )
  41             [ port <integer> ]; ... };
  42         ndots <integer>;
  43         search { <string>; ... };
  44         view <string> <optional_class>;
  45 };
  46
  47 managed-keys { <string> <string> <integer> <integer> <integer>
  48     <quoted_string>; ... };
  49
  50 masters <string> [ port <integer> ] { ( <masters> | <ipv4_address> [ port
  51     <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
  52
  53 options {
  54         acache-cleaning-interval <integer>;
  55         acache-enable <boolean>;
  56         additional-from-auth <boolean>;
  57         additional-from-cache <boolean>;
  58         allow-new-zones <boolean>;
  59         allow-notify { <address_match_element>; ... };
  60         allow-query { <address_match_element>; ... };
  61         allow-query-cache { <address_match_element>; ... };
  62         allow-query-cache-on { <address_match_element>; ... };
  63         allow-query-on { <address_match_element>; ... };
  64         allow-recursion { <address_match_element>; ... };
  65         allow-recursion-on { <address_match_element>; ... };
  66         allow-transfer { <address_match_element>; ... };
  67         allow-update { <address_match_element>; ... };
  68         allow-update-forwarding { <address_match_element>; ... };
  69         allow-v6-synthesis { <address_match_element>; ... }; // obsolete
  70         also-notify [ port <integer> ] { ( <ipv4_address> | <ipv6_address>
  71             ) [ port <integer> ]; ... };
  72         alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
  73         alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
  74             * ) ];
  75         attach-cache <string>;
  76         auth-nxdomain <boolean>; // default changed
  77         avoid-v4-udp-ports { <portrange>; ... };
  78         avoid-v6-udp-ports { <portrange>; ... };
  79         bindkeys-file <quoted_string>;
  80         blackhole { <address_match_element>; ... };
  81         cache-file <quoted_string>;
  82         check-dup-records ( fail | warn | ignore );
  83         check-integrity <boolean>;
  84         check-mx ( fail | warn | ignore );
  85         check-mx-cname ( fail | warn | ignore );
  86         check-names ( master | slave | response ) ( fail | warn | ignore );
  87         check-sibling <boolean>;
  88         check-srv-cname ( fail | warn | ignore );
  89         check-wildcard <boolean>;
  90         cleaning-interval <integer>;
  91         clients-per-query <integer>;
  92         coresize <size>;
  93         datasize <size>;
  94         deallocate-on-exit <boolean>; // obsolete
  95         deny-answer-addresses { <address_match_element>; ... } [
  96             except-from { <quoted_string>; ... } ];
  97         deny-answer-aliases { <quoted_string>; ... } [ except-from {
  98             <quoted_string>; ... } ];
  99         dialup <dialuptype>;
 100         directory <quoted_string>;
 101         disable-algorithms <string> { <string>; ... };
 102         disable-empty-zone <string>;
 103         dns64 <netprefix> {
 104                 break-dnssec <boolean>;
 105                 clients { <address_match_element>; ... };
 106                 exclude { <address_match_element>; ... };
 107                 mapped { <address_match_element>; ... };
 108                 recursive-only <boolean>;
 109                 suffix <ipv6_address>;
 110         };
 111         dns64-contact <string>;
 112         dns64-server <string>;
 113         dnssec-accept-expired <boolean>;
 114         dnssec-dnskey-kskonly <boolean>;
 115         dnssec-enable <boolean>;
 116         dnssec-lookaside ( <string> trust-anchor <string> | auto );
 117         dnssec-must-be-secure <string> <boolean>;
 118         dnssec-secure-to-insecure <boolean>;
 119         dnssec-validation ( yes | no | auto );
 120         dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
 121             <integer> ] | <ipv4_address> [ port <integer> ] |
 122             <ipv6_address> [ port <integer> ] ); ... };
 123         dump-file <quoted_string>;
 124         edns-udp-size <integer>;
 125         empty-contact <string>;
 126         empty-server <string>;
 127         empty-zones-enable <boolean>;
 128         fake-iquery <boolean>; // obsolete
 129         fetch-glue <boolean>; // obsolete
 130         files <size>;
 131         filter-aaaa { <address_match_element>; ... }; // not configured
 132         filter-aaaa-on-v4 <v4_aaaa>; // not configured
 133         flush-zones-on-shutdown <boolean>;
 134         forward ( first | only );
 135         forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> )
 136             [ port <integer> ]; ... };
 137         has-old-clients <boolean>; // obsolete
 138         heartbeat-interval <integer>;
 139         host-statistics <boolean>; // not implemented
 140         host-statistics-max <integer>; // not implemented
 141         hostname ( <quoted_string> | none );
 142         interface-interval <integer>;
 143         ixfr-from-differences <ixfrdiff>;
 144         key-directory <quoted_string>;
 145         lame-ttl <integer>;
 146         listen-on [ port <integer> ] { <address_match_element>; ... };
 147         listen-on-v6 [ port <integer> ] { <address_match_element>; ... };
 148         maintain-ixfr-base <boolean>; // obsolete
 149         managed-keys-directory <quoted_string>;
 150         masterfile-format ( text | raw );
 151         match-mapped-addresses <boolean>;
 152         max-acache-size <size_no_default>;
 153         max-cache-size <size_no_default>;
 154         max-cache-ttl <integer>;
 155         max-clients-per-query <integer>;
 156         max-ixfr-log-size <size>; // obsolete
 157         max-journal-size <size_no_default>;
 158         max-ncache-ttl <integer>;
 159         max-refresh-time <integer>;
 160         max-retry-time <integer>;
 161         max-transfer-idle-in <integer>;
 162         max-transfer-idle-out <integer>;
 163         max-transfer-time-in <integer>;
 164         max-transfer-time-out <integer>;
 165         max-udp-size <integer>;
 166         memstatistics <boolean>;
 167         memstatistics-file <quoted_string>;
 168         min-refresh-time <integer>;
 169         min-retry-time <integer>;
 170         min-roots <integer>; // not implemented
 171         minimal-responses <boolean>;
 172         multi-master <boolean>;
 173         multiple-cnames <boolean>; // obsolete
 174         named-xfer <quoted_string>; // obsolete
 175         notify <notifytype>;
 176         notify-delay <integer>;
 177         notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
 178         notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
 179         notify-to-soa <boolean>;
 180         nsec3-test-zone <boolean>; // test only
 181         pid-file ( <quoted_string> | none );
 182         port <integer>;
 183         preferred-glue <string>;
 184         provide-ixfr <boolean>;
 185         query-source <querysource4>;
 186         query-source-v6 <querysource6>;
 187         querylog <boolean>;
 188         queryport-pool-ports <integer>; // obsolete
 189         queryport-pool-updateinterval <integer>; // obsolete
 190         random-device <quoted_string>;
 191         recursing-file <quoted_string>;
 192         recursion <boolean>;
 193         recursive-clients <integer>;
 194         request-ixfr <boolean>;
 195         request-nsid <boolean>;
 196         reserved-sockets <integer>;
 197         resolver-query-timeout <integer>;
 198         response-policy {
 199                 zone <string> [ policy ( given | no-op | nxdomain | nodata
 200                     | cname <domain> ) ];
 201         };
 202         rfc2308-type1 <boolean>; // not yet implemented
 203         root-delegation-only [ exclude { <quoted_string>; ... } ];
 204         rrset-order { [ class <string> ] [ type <string> ] [ name
 205             <quoted_string> ] <string> <string>; ... };
 206         secroots-file <quoted_string>;
 207         serial-queries <integer>; // obsolete
 208         serial-query-rate <integer>;
 209         server-id ( <quoted_string> | none | hostname );
 210         session-keyalg <string>;
 211         session-keyfile ( <quoted_string> | none );
 212         session-keyname <string>;
 213         sig-signing-nodes <integer>;
 214         sig-signing-signatures <integer>;
 215         sig-signing-type <integer>;
 216         sig-validity-interval <integer> [ <integer> ];
 217         sortlist { <address_match_element>; ... };
 218         stacksize <size>;
 219         statistics-file <quoted_string>;
 220         statistics-interval <integer>; // not yet implemented
 221         suppress-initial-notify <boolean>; // not yet implemented
 222         tcp-clients <integer>;
 223         tcp-listen-queue <integer>;
 224         tkey-dhkey <quoted_string> <integer>;
 225         tkey-domain <quoted_string>;
 226         tkey-gssapi-credential <quoted_string>;
 227         tkey-gssapi-keytab <quoted_string>;
 228         topology { <address_match_element>; ... }; // not implemented
 229         transfer-format ( many-answers | one-answer );
 230         transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
 231         transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
 232         transfers-in <integer>;
 233         transfers-out <integer>;
 234         transfers-per-ns <integer>;
 235         treat-cr-as-space <boolean>; // obsolete
 236         try-tcp-refresh <boolean>;
 237         update-check-ksk <boolean>;
 238         use-alt-transfer-source <boolean>;
 239         use-id-pool <boolean>; // obsolete
 240         use-ixfr <boolean>;
 241         use-queryport-pool <boolean>; // obsolete
 242         use-v4-udp-ports { <portrange>; ... };
 243         use-v6-udp-ports { <portrange>; ... };
 244         version ( <quoted_string> | none );
 245         zero-no-soa-ttl <boolean>;
 246         zero-no-soa-ttl-cache <boolean>;
 247         zone-statistics <boolean>;
 248 };
 249
 250 server <netprefix> {
 251         bogus <boolean>;
 252         edns <boolean>;
 253         edns-udp-size <integer>;
 254         keys <server_key>;
 255         max-udp-size <integer>;
 256         notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
 257         notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
 258         provide-ixfr <boolean>;
 259         query-source <querysource4>;
 260         query-source-v6 <querysource6>;
 261         request-ixfr <boolean>;
 262         support-ixfr <boolean>; // obsolete
 263         transfer-format ( many-answers | one-answer );
 264         transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
 265         transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
 266         transfers <integer>;
 267 };
 268
 269 statistics-channels {
 270         inet ( <ipv4_address> | <ipv6_address> | * ) [ port ( <integer> | *
 271             ) ] [ allow { <address_match_element>; ... } ];
 272 };
 273
 274 trusted-keys { <string> <integer> <integer> <integer> <quoted_string>; ... };
 275
 276 view <string> <optional_class> {
 277         acache-cleaning-interval <integer>;
 278         acache-enable <boolean>;
 279         additional-from-auth <boolean>;
 280         additional-from-cache <boolean>;
 281         allow-new-zones <boolean>;
 282         allow-notify { <address_match_element>; ... };
 283         allow-query { <address_match_element>; ... };
 284         allow-query-cache { <address_match_element>; ... };
 285         allow-query-cache-on { <address_match_element>; ... };
 286         allow-query-on { <address_match_element>; ... };
 287         allow-recursion { <address_match_element>; ... };
 288         allow-recursion-on { <address_match_element>; ... };
 289         allow-transfer { <address_match_element>; ... };
 290         allow-update { <address_match_element>; ... };
 291         allow-update-forwarding { <address_match_element>; ... };
 292         allow-v6-synthesis { <address_match_element>; ... }; // obsolete
 293         also-notify [ port <integer> ] { ( <ipv4_address> | <ipv6_address>
 294             ) [ port <integer> ]; ... };
 295         alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
 296         alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
 297             * ) ];
 298         attach-cache <string>;
 299         auth-nxdomain <boolean>; // default changed
 300         cache-file <quoted_string>;
 301         check-dup-records ( fail | warn | ignore );
 302         check-integrity <boolean>;
 303         check-mx ( fail | warn | ignore );
 304         check-mx-cname ( fail | warn | ignore );
 305         check-names ( master | slave | response ) ( fail | warn | ignore );
 306         check-sibling <boolean>;
 307         check-srv-cname ( fail | warn | ignore );
 308         check-wildcard <boolean>;
 309         cleaning-interval <integer>;
 310         clients-per-query <integer>;
 311         database <string>;
 312         deny-answer-addresses { <address_match_element>; ... } [
 313             except-from { <quoted_string>; ... } ];
 314         deny-answer-aliases { <quoted_string>; ... } [ except-from {
 315             <quoted_string>; ... } ];
 316         dialup <dialuptype>;
 317         disable-algorithms <string> { <string>; ... };
 318         disable-empty-zone <string>;
 319         dlz <string> {
 320                 database <string>;
 321         };
 322         dns64 <netprefix> {
 323                 break-dnssec <boolean>;
 324                 clients { <address_match_element>; ... };
 325                 exclude { <address_match_element>; ... };
 326                 mapped { <address_match_element>; ... };
 327                 recursive-only <boolean>;
 328                 suffix <ipv6_address>;
 329         };
 330         dns64-contact <string>;
 331         dns64-server <string>;
 332         dnssec-accept-expired <boolean>;
 333         dnssec-dnskey-kskonly <boolean>;
 334         dnssec-enable <boolean>;
 335         dnssec-lookaside ( <string> trust-anchor <string> | auto );
 336         dnssec-must-be-secure <string> <boolean>;
 337         dnssec-secure-to-insecure <boolean>;
 338         dnssec-validation ( yes | no | auto );
 339         dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
 340             <integer> ] | <ipv4_address> [ port <integer> ] |
 341             <ipv6_address> [ port <integer> ] ); ... };
 342         edns-udp-size <integer>;
 343         empty-contact <string>;
 344         empty-server <string>;
 345         empty-zones-enable <boolean>;
 346         fetch-glue <boolean>; // obsolete
 347         filter-aaaa { <address_match_element>; ... }; // not configured
 348         filter-aaaa-on-v4 <v4_aaaa>; // not configured
 349         forward ( first | only );
 350         forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> )
 351             [ port <integer> ]; ... };
 352         ixfr-from-differences <ixfrdiff>;
 353         key <string> {
 354                 algorithm <string>;
 355                 secret <string>;
 356         };
 357         key-directory <quoted_string>;
 358         lame-ttl <integer>;
 359         maintain-ixfr-base <boolean>; // obsolete
 360         managed-keys { <string> <string> <integer> <integer> <integer>
 361             <quoted_string>; ... };
 362         masterfile-format ( text | raw );
 363         match-clients { <address_match_element>; ... };
 364         match-destinations { <address_match_element>; ... };
 365         match-recursive-only <boolean>;
 366         max-acache-size <size_no_default>;
 367         max-cache-size <size_no_default>;
 368         max-cache-ttl <integer>;
 369         max-clients-per-query <integer>;
 370         max-ixfr-log-size <size>; // obsolete
 371         max-journal-size <size_no_default>;
 372         max-ncache-ttl <integer>;
 373         max-refresh-time <integer>;
 374         max-retry-time <integer>;
 375         max-transfer-idle-in <integer>;
 376         max-transfer-idle-out <integer>;
 377         max-transfer-time-in <integer>;
 378         max-transfer-time-out <integer>;
 379         max-udp-size <integer>;
 380         min-refresh-time <integer>;
 381         min-retry-time <integer>;
 382         min-roots <integer>; // not implemented
 383         minimal-responses <boolean>;
 384         multi-master <boolean>;
 385         notify <notifytype>;
 386         notify-delay <integer>;
 387         notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
 388         notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
 389         notify-to-soa <boolean>;
 390         nsec3-test-zone <boolean>; // test only
 391         preferred-glue <string>;
 392         provide-ixfr <boolean>;
 393         query-source <querysource4>;
 394         query-source-v6 <querysource6>;
 395         queryport-pool-ports <integer>; // obsolete
 396         queryport-pool-updateinterval <integer>; // obsolete
 397         recursion <boolean>;
 398         request-ixfr <boolean>;
 399         request-nsid <boolean>;
 400         resolver-query-timeout <integer>;
 401         response-policy {
 402                 zone <string> [ policy ( given | no-op | nxdomain | nodata
 403                     | cname <domain> ) ];
 404         };
 405         rfc2308-type1 <boolean>; // not yet implemented
 406         root-delegation-only [ exclude { <quoted_string>; ... } ];
 407         rrset-order { [ class <string> ] [ type <string> ] [ name
 408             <quoted_string> ] <string> <string>; ... };
 409         server <netprefix> {
 410                 bogus <boolean>;
 411                 edns <boolean>;
 412                 edns-udp-size <integer>;
 413                 keys <server_key>;
 414                 max-udp-size <integer>;
 415                 notify-source ( <ipv4_address> | * ) [ port ( <integer> | *
 416                     ) ];
 417                 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer>
 418                     | * ) ];
 419                 provide-ixfr <boolean>;
 420                 query-source <querysource4>;
 421                 query-source-v6 <querysource6>;
 422                 request-ixfr <boolean>;
 423                 support-ixfr <boolean>; // obsolete
 424                 transfer-format ( many-answers | one-answer );
 425                 transfer-source ( <ipv4_address> | * ) [ port ( <integer> |
 426                     * ) ];
 427                 transfer-source-v6 ( <ipv6_address> | * ) [ port (
 428                     <integer> | * ) ];
 429                 transfers <integer>;
 430         };
 431         sig-signing-nodes <integer>;
 432         sig-signing-signatures <integer>;
 433         sig-signing-type <integer>;
 434         sig-validity-interval <integer> [ <integer> ];
 435         sortlist { <address_match_element>; ... };
 436         suppress-initial-notify <boolean>; // not yet implemented
 437         topology { <address_match_element>; ... }; // not implemented
 438         transfer-format ( many-answers | one-answer );
 439         transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
 440         transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
 441         trusted-keys { <string> <integer> <integer> <integer>
 442             <quoted_string>; ... };
 443         try-tcp-refresh <boolean>;
 444         update-check-ksk <boolean>;
 445         use-alt-transfer-source <boolean>;
 446         use-queryport-pool <boolean>; // obsolete
 447         zero-no-soa-ttl <boolean>;
 448         zero-no-soa-ttl-cache <boolean>;
 449         zone <string> <optional_class> {
 450                 allow-notify { <address_match_element>; ... };
 451                 allow-query { <address_match_element>; ... };
 452                 allow-query-on { <address_match_element>; ... };
 453                 allow-transfer { <address_match_element>; ... };
 454                 allow-update { <address_match_element>; ... };
 455                 allow-update-forwarding { <address_match_element>; ... };
 456                 also-notify [ port <integer> ] { ( <ipv4_address> |
 457                     <ipv6_address> ) [ port <integer> ]; ... };
 458                 alt-transfer-source ( <ipv4_address> | * ) [ port (
 459                     <integer> | * ) ];
 460                 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port (
 461                     <integer> | * ) ];
 462                 auto-dnssec ( allow | maintain | off );
 463                 check-dup-records ( fail | warn | ignore );
 464                 check-integrity <boolean>;
 465                 check-mx ( fail | warn | ignore );
 466                 check-mx-cname ( fail | warn | ignore );
 467                 check-names ( fail | warn | ignore );
 468                 check-sibling <boolean>;
 469                 check-srv-cname ( fail | warn | ignore );
 470                 check-wildcard <boolean>;
 471                 database <string>;
 472                 delegation-only <boolean>;
 473                 dialup <dialuptype>;
 474                 dnssec-dnskey-kskonly <boolean>;
 475                 dnssec-secure-to-insecure <boolean>;
 476                 file <quoted_string>;
 477                 forward ( first | only );
 478                 forwarders [ port <integer> ] { ( <ipv4_address> |
 479                     <ipv6_address> ) [ port <integer> ]; ... };
 480                 ixfr-base <quoted_string>; // obsolete
 481                 ixfr-from-differences <boolean>;
 482                 ixfr-tmp-file <quoted_string>; // obsolete
 483                 journal <quoted_string>;
 484                 key-directory <quoted_string>;
 485                 maintain-ixfr-base <boolean>; // obsolete
 486                 masterfile-format ( text | raw );
 487                 masters [ port <integer> ] { ( <masters> | <ipv4_address> [
 488                     port <integer> ] | <ipv6_address> [ port <integer> ] )
 489                     [ key <string> ]; ... };
 490                 max-ixfr-log-size <size>; // obsolete
 491                 max-journal-size <size_no_default>;
 492                 max-refresh-time <integer>;
 493                 max-retry-time <integer>;
 494                 max-transfer-idle-in <integer>;
 495                 max-transfer-idle-out <integer>;
 496                 max-transfer-time-in <integer>;
 497                 max-transfer-time-out <integer>;
 498                 min-refresh-time <integer>;
 499                 min-retry-time <integer>;
 500                 multi-master <boolean>;
 501                 notify <notifytype>;
 502                 notify-delay <integer>;
 503                 notify-source ( <ipv4_address> | * ) [ port ( <integer> | *
 504                     ) ];
 505                 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer>
 506                     | * ) ];
 507                 notify-to-soa <boolean>;
 508                 nsec3-test-zone <boolean>; // test only
 509                 pubkey <integer> <integer> <integer>
 510                     <quoted_string>; // obsolete
 511                 server-addresses { ( <ipv4_address> | <ipv6_address> ) [
 512                     port <integer> ]; ... };
 513                 server-names { <quoted_string>; ... };
 514                 sig-signing-nodes <integer>;
 515                 sig-signing-signatures <integer>;
 516                 sig-signing-type <integer>;
 517                 sig-validity-interval <integer> [ <integer> ];
 518                 transfer-source ( <ipv4_address> | * ) [ port ( <integer> |
 519                     * ) ];
 520                 transfer-source-v6 ( <ipv6_address> | * ) [ port (
 521                     <integer> | * ) ];
 522                 try-tcp-refresh <boolean>;
 523                 type ( master | slave | stub | static-stub | hint | forward
 524                     | delegation-only );
 525                 update-check-ksk <boolean>;
 526                 update-policy ( local | { ( grant | deny ) <string> ( name
 527                     | subdomain | wildcard | self | selfsub | selfwild |
 528                     krb5-self | ms-self | krb5-subdomain | ms-subdomain |
 529                     tcp-self | 6to4-self | zonesub | external ) [ <string>
 530                     ] <rrtypelist>; ... };
 531                 use-alt-transfer-source <boolean>;
 532                 zero-no-soa-ttl <boolean>;
 533                 zone-statistics <boolean>;
 534         };
 535         zone-statistics <boolean>;
 536 };
 537
 538 zone <string> <optional_class> {
 539         allow-notify { <address_match_element>; ... };
 540         allow-query { <address_match_element>; ... };
 541         allow-query-on { <address_match_element>; ... };
 542         allow-transfer { <address_match_element>; ... };
 543         allow-update { <address_match_element>; ... };
 544         allow-update-forwarding { <address_match_element>; ... };
 545         also-notify [ port <integer> ] { ( <ipv4_address> | <ipv6_address>
 546             ) [ port <integer> ]; ... };
 547         alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
 548         alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
 549             * ) ];
 550         auto-dnssec ( allow | maintain | off );
 551         check-dup-records ( fail | warn | ignore );
 552         check-integrity <boolean>;
 553         check-mx ( fail | warn | ignore );
 554         check-mx-cname ( fail | warn | ignore );
 555         check-names ( fail | warn | ignore );
 556         check-sibling <boolean>;
 557         check-srv-cname ( fail | warn | ignore );
 558         check-wildcard <boolean>;
 559         database <string>;
 560         delegation-only <boolean>;
 561         dialup <dialuptype>;
 562         dnssec-dnskey-kskonly <boolean>;
 563         dnssec-secure-to-insecure <boolean>;
 564         file <quoted_string>;
 565         forward ( first | only );
 566         forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> )
 567             [ port <integer> ]; ... };
 568         ixfr-base <quoted_string>; // obsolete
 569         ixfr-from-differences <boolean>;
 570         ixfr-tmp-file <quoted_string>; // obsolete
 571         journal <quoted_string>;
 572         key-directory <quoted_string>;
 573         maintain-ixfr-base <boolean>; // obsolete
 574         masterfile-format ( text | raw );
 575         masters [ port <integer> ] { ( <masters> | <ipv4_address> [ port
 576             <integer> ] | <ipv6_address> [ port <integer> ] ) [ key
 577             <string> ]; ... };
 578         max-ixfr-log-size <size>; // obsolete
 579         max-journal-size <size_no_default>;
 580         max-refresh-time <integer>;
 581         max-retry-time <integer>;
 582         max-transfer-idle-in <integer>;
 583         max-transfer-idle-out <integer>;
 584         max-transfer-time-in <integer>;
 585         max-transfer-time-out <integer>;
 586         min-refresh-time <integer>;
 587         min-retry-time <integer>;
 588         multi-master <boolean>;
 589         notify <notifytype>;
 590         notify-delay <integer>;
 591         notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
 592         notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
 593         notify-to-soa <boolean>;
 594         nsec3-test-zone <boolean>; // test only
 595         pubkey <integer> <integer> <integer> <quoted_string>; // obsolete
 596         server-addresses { ( <ipv4_address> | <ipv6_address> ) [ port
 597             <integer> ]; ... };
 598         server-names { <quoted_string>; ... };
 599         sig-signing-nodes <integer>;
 600         sig-signing-signatures <integer>;
 601         sig-signing-type <integer>;
 602         sig-validity-interval <integer> [ <integer> ];
 603         transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
 604         transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
 605         try-tcp-refresh <boolean>;
 606         type ( master | slave | stub | static-stub | hint | forward |
 607             delegation-only );
 608         update-check-ksk <boolean>;
 609         update-policy ( local | { ( grant | deny ) <string> ( name |
 610             subdomain | wildcard | self | selfsub | selfwild | krb5-self |
 611             ms-self | krb5-subdomain | ms-subdomain | tcp-self | 6to4-self
 612             | zonesub | external ) [ <string> ] <rrtypelist>; ... };
 613         use-alt-transfer-source <boolean>;
 614         zero-no-soa-ttl <boolean>;
 615         zone-statistics <boolean>;
 616 };
 617