adam/jarl
1
0 Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases 34 Wiki Activity

Jarl 0.1.0: manage BIND through a web UI, REST API and CLI

Browse Source 
Jarl keeps a BIND 9.20 server's whole configuration (views, ACLs, TSIG
keys, zones of every type, records, named.conf options) in SQLite and
renders named.conf, keys.conf and zone files from it.

Every change goes through one changeset pipeline: whole-configuration
validation, named-checkconf -z and named-checkzone in a staging
directory, atomic install, rndc reconfig/reload, serial verification
with rndc zonestatus, and rollback if named does not load the change.
Changes apply one at a time by default or are bundled and applied
together. Applied changesets can be reverted.

- jarld: the daemon with the REST API and an embedded web UI, plus import,
  adopt, check, resync, backup and local user recovery commands
- jarl: the CLI, including ACME DNS-01 hooks for certbot and acme.sh
- users with argon2id passwords and CSRF-protected sessions; hashed API
  tokens with granular grants and roles; an audit log
- systemd unit, sysusers.d/tmpfiles.d files, Makefile
- unit tests, integration tests against a real named, scripts/e2e.sh
- docs/ guides, README and CHANGELOG

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
abrown38andClaude Opus 5.5 committed 2026-10-07 15:03:13 +00:00
commit bd6b8778e4
122 files changed
+29217
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/catalog/data/statements-9.20.tsv
+356
View File
@@ -0,0 +1,356 @@
# Statement index from the BIND 9.20.24 ARM, section 8.3 "Statements"
# (https://bind9.readthedocs.io/en/v9.20.24/reference.html#statements).
# Format: name<TAB>description<TAB>tags (comma separated)
acl Assigns a symbolic name to an address match list. server
algorithm Defines the algorithm to be used in a key clause. security
all-per-second Limits UDP responses of all kinds. query
allow-new-zones Controls the ability to add zones at runtime via rndc addzone. server, zone
allow-notify Defines an address_match_list that is allowed to send NOTIFY messages for the zone, in addition to addresses defined in the primaries option for the zone. transfer
allow-proxy Defines an address_match_list for the client addresses allowed to send PROXYv2 headers. server
allow-proxy-on Defines an address_match_list for the interface addresses allowed to accept PROXYv2 headers. The option is mostly intended for multi-homed configurations. server
allow-query Specifies which hosts (an IP address list) are allowed to send queries to this resolver. query
allow-query-cache Specifies which hosts (an IP address list) can access this server's cache and thus effectively controls recursion. query
allow-query-cache-on Specifies which hosts (from an IP address list) can access this server's cache. It is used on servers with multiple interfaces. query
allow-query-on Specifies which local addresses (an IP address list) are allowed to send queries to this resolver. This option is used in multi-homed configurations. query
allow-recursion Defines an address_match_list of clients that are allowed to perform recursive queries. query
allow-recursion-on Specifies which local addresses can accept recursive queries. query, server
allow-transfer Defines an address_match_list of hosts that are allowed to transfer the zone information from this server. transfer
allow-update Defines an address_match_list of hosts that are allowed to submit dynamic updates for primary zones. transfer
allow-update-forwarding Defines an address_match_list of hosts that are allowed to submit dynamic updates to a secondary server for transmission to a primary. transfer
also-notify Defines one or more hosts that are sent NOTIFY messages when zone changes occur. transfer
answer-cookie Controls whether COOKIE EDNS replies are sent in response to client queries. query
attach-cache Allows multiple views to share a single cache database. view
auth-nxdomain Controls whether BIND, acting as a resolver, provides authoritative NXDOMAIN (domain does not exist) answers. query
automatic-interface-scan Controls the automatic rescanning of network interfaces when addresses are added or removed. server
avoid-v4-udp-ports Specifies the range(s) of ports to be excluded from use as sources for UDP/IPv4 messages. deprecated
avoid-v6-udp-ports Specifies the range(s) of ports to be excluded from use as sources for UDP/IPv6 messages. deprecated
bindkeys-file Specifies the pathname of a file to override the built-in trusted keys provided by named. dnssec
blackhole Defines an address_match_list of hosts to ignore. The server will neither respond to queries from nor send queries to these addresses. query
bogus Allows a remote server to be ignored. server
break-dnssec Enables dns64 synthesis even if the validated result would cause a DNSSEC validation failure. query
buffered Controls flushing of log messages. logging
ca-file Specifies the path to a file containing TLS certificates for trusted CA authorities, used to verify remote peer certificates. server, security
catalog-zones Configures catalog zones in named.conf. zone
category Specifies the type of data logged to a particular channel. logging
cdnskey Specifies whether a CDNSKEY record should be published during KSK rollover. dnssec
cds-digest-types Specifies the digest types to use for CDS resource records. dnssec
cert-file Specifies the path to a file containing the TLS certificate for a connection. server, security
channel Defines a stream of data that can be independently logged. logging
check-dup-records Checks primary zones for records that are treated as different by DNSSEC but are semantically equal in plain DNS. dnssec, query
check-integrity Performs post-load zone integrity checks on primary zones. zone
check-mx Checks whether an MX record appears to refer to an IP address. zone
check-mx-cname Sets the response to MX records that refer to CNAMEs. zone
check-names Restricts the character set and syntax of certain domain names in primary files and/or DNS responses received from the network. query, server
check-sibling Specifies whether to check for sibling glue when performing integrity checks. zone
check-spf Specifies whether to check for a TXT Sender Policy Framework record, if an SPF record is present. zone
check-srv-cname Sets the response to SRV records that refer to CNAMEs. zone
check-svcb Specifies whether to perform additional checks on SVCB records. zone
check-wildcard Checks for non-terminal wildcards. zone
checkds Controls whether DS queries are sent to parental agents. dnssec
cipher-suites Specifies a list of allowed cipher suites in the order of preference for TLSv1.3 only. security
ciphers Specifies a list of allowed ciphers in the order of preference for TLSv1.2 only. security
clients Specifies an access control list (ACL) of clients that are affected by a given dns64 directive. query
clients-per-query Sets the initial minimum number of simultaneous recursive clients accepted by the server for any given query before the server drops additional clients. server
controls Specifies control channels to be used to manage the name server. server
cookie-algorithm Sets the algorithm to be used when generating a server cookie. server
cookie-secret Specifies a shared secret used for generating and verifying EDNS COOKIE options within an anycast cluster. server
database Specifies the type of database to be used to store zone data. zone
deny-answer-addresses Rejects A or AAAA records if the corresponding IPv4 or IPv6 addresses match a given address_match_list. query
deny-answer-aliases Rejects CNAME or DNAME records if the "alias" name matches a given list of domain_name elements. query
dhparam-file Specifies the path to a file containing Diffie-Hellman parameters, for enabling cipher suites. server, security
dialup Concentrates zone maintenance so that all transfers take place once every heartbeat-interval, ideally during a single call. deprecated
directory Sets the server's working directory. server
disable-algorithms Disables DNSSEC algorithms from a specified zone. dnssec
disable-ds-digests Disables DS digest types from a specified zone. dnssec, zone
disable-empty-zone Disables individual empty zones. server, zone
dlz Configures a Dynamically Loadable Zone (DLZ) database in named.conf. zone
dns64 Instructs named to return mapped IPv4 addresses to AAAA queries when there are no AAAA records. query
dns64-contact Specifies the name of the contact for dns64 zones. server
dns64-server Specifies the name of the server for dns64 zones. server
dnskey-sig-validity obsolete
dnskey-ttl Specifies the time-to-live (TTL) for DNSKEY resource records. dnssec
dnsrps-enable Turns on the DNS Response Policy Service (DNSRPS) interface. server, security
dnsrps-library Specifies the path to the DNS Response Policy Service (DNSRPS) provider library. server, security
dnsrps-options Provides additional RPZ configuration settings, which are passed to the DNS Response Policy Service (DNSRPS) provider library. server, security
dnssec-accept-expired Instructs BIND 9 to accept expired DNSSEC signatures when validating. dnssec
dnssec-dnskey-kskonly obsolete
dnssec-loadkeys-interval Sets the frequency of automatic checks of the DNSSEC key repository. dnssec
dnssec-must-be-secure Defines hierarchies that must or may not be secure (signed and validated). deprecated
dnssec-policy Defines a key and signing policy (KASP) for zones. dnssec
dnssec-secure-to-insecure obsolete
dnssec-update-mode obsolete
dnssec-validation Enables DNSSEC validation in named. dnssec
dnstap Enables logging of dnstap messages. logging
dnstap-identity Specifies an identity string to send in dnstap messages. logging
dnstap-output Configures the path to which the dnstap frame stream is sent. logging
dnstap-version Specifies a version string to send in dnstap messages. logging
dual-stack-servers Specifies host names or addresses of machines with access to both IPv4 and IPv6 transports. server
dump-file Indicates the pathname of the file where the server dumps the database after rndc dumpdb. logging
dyndb Configures a DynDB database in named.conf. zone
edns Controls the use of the EDNS0 (RFC 2671) feature. server
edns-udp-size Sets the maximum advertised EDNS UDP buffer size to control the size of packets received from authoritative servers in response to recursive queries. query
edns-version Sets the maximum EDNS VERSION that is sent to the server(s) by the resolver. server
empty-contact Specifies the contact name in the returned SOA record for empty zones. server, zone
empty-server Specifies the server name in the returned SOA record for empty zones. server, zone
empty-zones-enable Enables or disables all empty zones. server, zone
endpoints Specifies a list of HTTP query paths on which to listen. server, query
errors-per-second Limits the number of errors for a valid domain name and record type. server
exclude Allows a list of IPv6 addresses to be ignored if they appear in a domain name's AAAA records in dns64. query
exempt-clients Exempts specific clients or client groups from rate limiting. query
fetch-quota-params Sets the parameters for dynamic resizing of the fetches-per-server quota in response to detected congestion. server, query
fetches-per-server Sets the maximum number of simultaneous iterative queries allowed to be sent by a server to an upstream name server before the server blocks additional queries. server, query
fetches-per-zone Sets the maximum number of simultaneous iterative queries allowed to any one domain before the server blocks new queries for data in or beneath that zone. server, query
file Specifies the zone's filename. zone
flush-zones-on-shutdown Controls whether pending zone writes are flushed when the name server exits. zone
forward Allows or disallows fallback to recursion if forwarding has failed; it is always used in conjunction with the forwarders statement. query
forwarders Defines one or more resolvers to which queries are forwarded. query
fstrm-set-buffer-hint Sets the number of accumulated bytes in the output buffer before forcing a buffer flush. logging
fstrm-set-flush-timeout Sets the number of seconds that unflushed data remains in the output buffer. logging
fstrm-set-input-queue-size Sets the number of queue entries to allocate for each input queue. logging
fstrm-set-output-notify-threshold Sets the number of outstanding queue entries allowed on an input queue before waking the I/O thread. logging
fstrm-set-output-queue-model Sets the queuing semantics to use for queue objects. logging
fstrm-set-output-queue-size Sets the number of queue entries allocated for each output queue. logging
fstrm-set-reopen-interval Sets the number of seconds to wait between attempts to reopen a closed output stream. logging
geoip-directory Specifies the directory containing GeoIP database files. server
heartbeat-interval Sets the interval at which the server performs zone maintenance tasks for all zones marked as dialup. deprecated
hostname Specifies the hostname of the server to return in response to a hostname.bind query. server
http Configures HTTP endpoints on which to listen for DNS-over-HTTPS (DoH) queries. server, query
http-listener-clients Limits the number of active concurrent connections on a per-listener basis. server
http-port Specifies the TCP port number the server uses to receive and send unencrypted DNS traffic via HTTP. server, query
http-streams-per-connection Limits the number of active concurrent HTTP/2 streams on a per-connection basis. server
https-port Specifies the TCP port number the server uses to receive and send DNS-over-HTTPS protocol traffic. server, query
in-view Specifies the view in which a given zone is defined. view, zone
inet Specifies a TCP socket as a control channel. server
inline-signing Specifies whether BIND 9 maintains a separate signed version of a zone. dnssec, zone
interface-interval Sets the interval at which the server scans the network interface list. server
ipv4-prefix-length Specifies the prefix lengths of IPv4 address blocks. server
ipv4only-contact Specifies the contact for the IPV4ONLY.ARPA zone created by dns64. server
ipv4only-enable Enables automatic IPv4 zones if a dns64 block is configured. query
ipv4only-server Specifies the name of the server for the IPV4ONLY.ARPA zone created by dns64. server, query
ipv6-prefix-length Specifies the prefix lengths of IPv6 address blocks. server
ixfr-from-differences Controls how IXFR transfers are calculated. transfer
journal Allows the default journal's filename to be overridden. zone
key Defines a shared secret key for use with TSIG or the command channel. security
key-directory Indicates the directory where public and private DNSSEC key files are found. dnssec
key-file Specifies the path to a file containing the private TLS key for a connection. server, security
key-store Configures a DNSSEC key store. dnssec
keys Specifies one or more server_key s to be used with a remote server. server, security
lame-ttl Sets the resolver's lame cache. server
listen-on Specifies the IPv4 addresses on which a server listens for DNS queries. server
listen-on-v6 Specifies the IPv6 addresses on which a server listens for DNS queries. server
listener-clients Specifies a per-listener quota for active connections. server, query
lmdb-mapsize Sets a maximum size for the memory map of the new-zone database in LMDB database format. server
log-only Tests rate-limiting parameters without actually dropping any requests. logging, query
logging Configures logging options for the name server. logging
managed-keys deprecated
managed-keys-directory Specifies the directory in which to store the files that track managed DNSSEC keys. dnssec
manual-mode Run key management in a manual mode. dnssec
mapped Specifies an access control list (ACL) of IPv4 addresses that are to be mapped to the corresponding A RRset in dns64. query
masterfile-format Specifies the file format of zone files. zone, server
masterfile-style Specifies the format of zone files during a dump, when the masterfile-format is text. server
match-clients Specifies a view of DNS namespace for a given subset of client IP addresses. view
match-destinations Specifies a view of DNS namespace for a given subset of destination IP addresses. view
match-mapped-addresses Allows IPv4-mapped IPv6 addresses to match address-match list entries for corresponding IPv4 addresses. server
match-recursive-only Specifies that only recursive requests can match this view of the DNS namespace. view
max-cache-size Sets the maximum amount of memory to use for an individual cache database and its associated metadata. server
max-cache-ttl Specifies the maximum time (in seconds) that the server caches ordinary (positive) answers. server
max-clients-per-query Sets the maximum number of simultaneous recursive clients accepted by the server for any given query before the server drops additional clients. server
max-ixfr-ratio Sets the maximum size for IXFR responses to zone transfer requests. transfer
max-journal-size Controls the size of journal files. transfer
max-ncache-ttl Specifies the maximum retention time (in seconds) for storage of negative answers in the server's cache. server
max-query-count Sets the maximum number of iterative queries while servicing a recursive query. server, query
max-query-restarts Sets the maximum number of chained CNAMEs to follow server, query
max-records Sets the maximum number of records permitted in a zone. zone, server
max-records-per-type Sets the maximum number of records that can be stored in an RRset. server
max-recursion-depth Sets the maximum number of levels of recursion permitted at any one time while servicing a recursive query. server
max-recursion-queries Sets the maximum number of iterative queries while servicing a recursive query. server, query
max-refresh-time Limits the zone refresh interval to no less often than the specified value, in seconds. transfer
max-retry-time Limits the zone refresh retry interval to no less often than the specified value, in seconds. transfer
max-rsa-exponent-size Sets the maximum RSA exponent size (in bits) when validating. dnssec, query
max-stale-ttl Specifies the maximum time that the server retains records past their normal expiry, to return them as stale records. server
max-table-size Sets the maximum size of the table used to track requests and rate-limit responses. server
max-transfer-idle-in Specifies the number of minutes after which inbound zone transfers making no progress are terminated. transfer
max-transfer-idle-out Specifies the number of minutes after which outbound zone transfers making no progress are terminated. transfer
max-transfer-time-in Specifies the number of minutes after which inbound zone transfers are terminated. transfer
max-transfer-time-out Specifies the number of minutes after which outbound zone transfers are terminated. transfer
max-types-per-name Sets the maximum number of RR types that can be stored for an owner name. server
max-udp-size Sets the maximum EDNS UDP message size sent by named. query
max-validation-failures-per-fetch Sets the maximum number of DNSSEC validation failures that can happen in a single fetch. server
max-validations-per-fetch Sets the maximum number of DNSSEC validations that can happen in a single fetch. server
max-zone-ttl Specifies a maximum permissible time-to-live (TTL) value, in seconds. deprecated
memstatistics Controls whether memory statistics are written to the file specified by memstatistics-file at exit. server, logging
memstatistics-file Sets the pathname of the file where the server writes memory usage statistics on exit. logging
message-compression Controls whether DNS name compression is used in responses to regular queries. query
min-cache-ttl Specifies the minimum time (in seconds) that the server caches ordinary (positive) answers. server
min-ncache-ttl Specifies the minimum retention time (in seconds) for storage of negative answers in the server's cache. server
min-refresh-time Limits the zone refresh interval to no more often than the specified value, in seconds. transfer
min-retry-time Limits the zone refresh retry interval to no more often than the specified value, in seconds. transfer
min-table-size Sets the minimum size of the table used to track requests and rate-limit responses. query
min-transfer-rate-in Specifies the minimum traffic rate below which inbound zone transfers are terminated. transfer
minimal-any Controls whether the server replies with only one of the RRsets for a query name, when generating a positive response to a query of type ANY over UDP. query
minimal-responses Controls whether the server only adds records to the authority and additional data sections when they are required (e.g. delegations, negative responses). This improves server performance. query
multi-master Controls whether serial number mismatch errors are logged. transfer
new-zones-directory Specifies the directory where configuration parameters are stored for zones added by rndc addzone. zone
no-case-compress Specifies a list of addresses that require case-insensitive compression in responses. server
nocookie-udp-size Sets the maximum size of UDP responses that are sent to queries without a valid server COOKIE. query
nodata-per-second Limits the number of empty (NODATA) responses for a valid domain name. query
notify Controls whether NOTIFY messages are sent on zone changes. transfer
notify-defer Sets the defer time (in seconds) before sending NOTIFY messages for a zone. transfer, zone
notify-delay Sets the delay (in seconds) between sending sets of NOTIFY messages for a zone. transfer, zone
notify-rate Specifies the rate at which NOTIFY requests are sent during normal zone maintenance operations. transfer, zone
notify-source Defines the IPv4 address (and optional port) to be used for outgoing NOTIFY messages. transfer
notify-source-v6 Defines the IPv6 address (and optional port) to be used for outgoing NOTIFY messages. transfer
notify-to-soa Controls whether the name servers in the NS RRset are checked against the SOA MNAME. transfer
nsec3param Specifies the use of NSEC3 instead of NSEC, and sets NSEC3 parameters. dnssec
nta-lifetime Specifies the lifetime, in seconds, for negative trust anchors added via rndc nta. dnssec
nta-recheck Specifies the time interval for checking whether negative trust anchors added via rndc nta are still necessary. dnssec
null Causes all messages sent to the logging channel to be discarded. logging
nxdomain-redirect Appends the specified suffix to the original query name, when replacing an NXDOMAIN with a redirect namespace. query
nxdomains-per-second Limits the number of undefined subdomains for a valid domain name. query
offline-ksk Specifies whether the DNSKEY, CDS, and CDNSKEY RRsets are being signed offline. dnssec
options Defines global options to be used by BIND 9. server
padding Adds EDNS Padding options to outgoing messages to increase the packet size. server
parent-ds-ttl Sets the time to live (TTL) of the DS RRset used by the parent zone. dnssec
parent-propagation-delay Sets the propagation delay from the time the parent zone is updated to when the new version is served by all of the parent zone's name servers. dnssec, zone
parental-agents dnssec
parental-source Specifies which local IPv4 source address is used to send parental DS queries. dnssec
parental-source-v6 Specifies which local IPv6 source address is used to send parental DS queries. dnssec
pid-file Specifies the pathname of the file where the server writes its process ID. server
pkcs11-uri dnssec, pkcs11
plugin Configures plugins in named.conf. server
port Specifies the UDP/TCP port number the server uses to receive and send DNS protocol traffic. server, query
prefer-server-ciphers Specifies that server ciphers should be preferred over client ones. server, security
preferred-glue Controls the order of glue records in an A or AAAA response. query
prefetch Specifies the "trigger" time-to-live (TTL) value at which prefetch of the current query takes place. query
primaries Defines one or more servers that zone transfer can be requested from. transfer, zone
print-category Includes the category in log messages. logging
print-severity Includes the severity in log messages. logging
print-time Specifies the time format for log messages. logging
protocols Specifies the allowed versions of the TLS protocol. security
provide-ixfr Controls whether a primary responds to an incremental zone request (IXFR) or only responds with a full zone transfer (AXFR). transfer
publish-safety Increases the amount of time between when keys are published and when they become active, to allow for unforeseen events. dnssec
purge-keys Specifies the amount of time after which DNSSEC keys that have been deleted from the zone can be removed from disk. dnssec
qname-minimization Controls QNAME minimization behavior in the BIND 9 resolver. query
qps-scale Tightens defenses during DNS attacks by scaling back the ratio of the current query-per-second rate. query
query-source Controls the IPv4 address from which queries are issued. If none, then no IPv4 address would be used to issue the query and therefore only IPv6 servers are queried. query
query-source-v6 Controls the IPv6 address from which queries are issued. If none, then no IPv6 address would be used to issue the query and therefore only IPv4 servers are quried. query
querylog Specifies whether query logging should be active when named first starts. logging, server
rate-limit Controls excessive UDP responses, to prevent BIND 9 from being used to amplify reflection denial-of-service (DoS) attacks. query
recursing-file Specifies the pathname of the file where the server dumps queries that are currently recursing via rndc recursing. server
recursion Defines whether recursion and caching are allowed. query
recursive-clients Specifies the maximum number of concurrent recursive queries the server can perform. query
recursive-only Toggles whether dns64 synthesis occurs only for recursive queries. query
referrals-per-second Limits the number of referrals or delegations to a server for a given domain. query
remote-hostname Specifies the expected hostname in the TLS certificate of the remote server. security
remote-servers Defines a list of servers to be used by primary and secondary zones. server
request-expire Specifies whether the local server requests the EDNS EXPIRE value, when acting as a secondary. transfer, query
request-ixfr Controls whether a secondary requests an incremental zone transfer (IXFR) or a full zone transfer (AXFR). transfer
request-nsid Controls whether an empty EDNS(0) NSID (Name Server Identifier) option is sent with all queries to authoritative name servers during iterative resolution. query
require-cookie Controls whether responses without a server cookie are accepted. query
require-server-cookie Controls whether a valid server cookie is required before sending a full response to a UDP request. query
resolver-query-timeout Specifies the length of time, in milliseconds, that a resolver attempts to resolve a recursive query before failing. query
resolver-use-dns64 Specifies whether to apply DNS64 mappings when sending queries. server
response-padding Adds an EDNS Padding option to encrypted messages, to reduce the chance of guessing the contents based on size. query
response-policy Specifies response policy zones for the view or among global options. server, query, zone, security
responselog Specifies whether response logging should be active when named first starts. logging, server
responses-per-second Limits the number of non-empty responses for a valid domain name and record type. query
retire-safety Increases the amount of time a key remains published after it is no longer active, to allow for unforeseen events. dnssec
reuseport Enables kernel load-balancing of sockets. server
root-key-sentinel Controls whether BIND 9 responds to root key sentinel probes. server
rrset-order Defines the order in which equal RRs (RRsets) are returned. query
search Specifies whether a Dynamically Loadable Zone (DLZ) module is queried for an answer to a query name. query
secret Defines a Base64-encoded string to be used as the secret by the algorithm. security
secroots-file Specifies the pathname of the file where the server dumps security roots, when using rndc secroots. dnssec
send-cookie Controls whether a COOKIE EDNS option is sent along with a query. query
serial-query-rate Defines an upper limit on the number of queries per second issued by the server, when querying the SOA RRs used for zone transfers. transfer
serial-update-method Specifies the update method to be used for the zone serial number in the SOA record. zone
server Defines characteristics to be associated with a remote name server. server
server-addresses Specifies a list of IP addresses to which queries should be sent in recursive resolution for a static-stub zone. query, zone
server-id Specifies the ID of the server to return in response to a ID.SERVER query. server
server-names Specifies a list of domain names of name servers that act as authoritative servers of a static-stub zone. zone
servfail-ttl Sets the length of time (in seconds) that a SERVFAIL response is cached. server
session-keyalg Specifies the algorithm to use for the TSIG session key. security
session-keyfile Specifies the pathname of the file where a TSIG session key is written, when generated by named for use by nsupdate -l. security
session-keyname Specifies the key name for the TSIG session key. security
session-tickets Enables or disables session resumption through TLS session tickets. security
severity Defines the priority level of log messages. logging
sig-signing-nodes Specifies the maximum number of nodes to be examined in each quantum, when signing a zone with a new DNSKEY. dnssec
sig-signing-signatures Specifies the threshold for the number of signatures that terminates processing a quantum, when signing a zone with a new DNSKEY. dnssec
sig-signing-type Specifies a private RDATA type to use when generating signing-state records. dnssec
sig-validity-interval obsolete
sig0checks-quota Specifies the maximum number of concurrent SIG(0) signature checks that can be processed by the server. server
sig0checks-quota-exempt Exempts specific clients or client groups from SIG(0) signature checking quota. server
sig0key-checks-limit Specifies the maximum number of SIG(0) keys to consider when trying to verify a message. server
sig0message-checks-limit Specifies the maximum number of matching SIG(0) keys to try to verify a message. server
signatures-jitter Specifies a range for signature expirations. dnssec
signatures-refresh Specifies how frequently an RRSIG record is refreshed. dnssec
signatures-validity Indicates the validity period of an RRSIG record. dnssec
signatures-validity-dnskey Indicates the validity period of DNSKEY records. dnssec
slip Sets the number of "slipped" responses to minimize the use of forged source addresses for an attack. query
sortlist Controls the ordering of RRs returned to the client, based on the client's IP address. query, deprecated
stale-answer-client-timeout Defines the amount of time (in milliseconds) that named waits before attempting to answer a query with a stale RRset from cache. server, query
stale-answer-enable Enables the returning of "stale" cached answers when the name servers for a zone are not answering. server, query
stale-answer-ttl Specifies the time to live (TTL) to be returned on stale answers, in seconds. query
stale-cache-enable Enables the retention of "stale" cached answers. server, query
stale-refresh-time Sets the time window for the return of "stale" cached answers before the next attempt to contact, if the name servers for a given zone are not responding. server, query
startup-notify-rate Specifies the rate at which NOTIFY requests are sent when the name server is first starting, or when new zones have been added. transfer, zone
statistics-channels Specifies the communication channels to be used by system administrators to access statistics information on the name server. logging
statistics-file Specifies the pathname of the file where the server appends statistics, when using rndc stats. logging, server
stderr Directs the logging channel output to the server's standard error stream. logging
streams-per-connection Specifies the maximum number of concurrent HTTP/2 streams over an HTTP/2 connection. server, query
suffix Defines trailing bits for mapped IPv4 address bits in dns64. query
synth-from-dnssec Enables support for RFC 8198, Aggressive Use of DNSSEC-Validated Cache. dnssec
syslog Directs the logging channel to the system log. logging
tcp-advertised-timeout Sets the timeout value (in milliseconds) that the server sends in responses containing the EDNS TCP keepalive option. query
tcp-clients Specifies the maximum number of simultaneous client TCP connections accepted by the server. server
tcp-idle-timeout Sets the amount of time (in milliseconds) that the server waits on an idle TCP connection before closing it, if the EDNS TCP keepalive option is not in use. query
tcp-initial-timeout Sets the amount of time (in milliseconds) that the server waits on a new TCP connection for the first message from the client. server, query
tcp-keepalive Adds EDNS TCP keepalive to messages sent over TCP. server
tcp-keepalive-timeout Sets the amount of time (in milliseconds) that the server waits on an idle TCP connection before closing it, if the EDNS TCP keepalive option is in use. query
tcp-listen-queue Sets the listen-queue depth. server
tcp-only Sets the transport protocol to TCP. server
tcp-receive-buffer Sets the operating system's receive buffer size for TCP sockets. server
tcp-send-buffer Sets the operating system's send buffer size for TCP sockets. server
tkey-gssapi-credential Sets the security credential for authentication keys requested by the GSS-TSIG protocol. security
tkey-gssapi-keytab Sets the KRB5 keytab file to use for GSS-TSIG updates. security
tls Configures a TLS connection. security
tls-port Specifies the TCP port number the server uses to receive and send DNS-over-TLS protocol traffic. server, query
transfer-format Controls whether multiple records can be packed into a message during zone transfers. transfer
transfer-message-size Limits the uncompressed size of DNS messages used in zone transfers over TCP. transfer
transfer-source Defines which local IPv4 address(es) are bound to TCP connections used to fetch zones transferred inbound by the server. transfer
transfer-source-v6 Defines which local IPv6 address(es) are bound to TCP connections used to fetch zones transferred inbound by the server. transfer
transfers Limits the number of concurrent inbound zone transfers from a server. server
transfers-in Limits the number of concurrent inbound zone transfers. transfer
transfers-out Limits the number of concurrent outbound zone transfers. transfer
transfers-per-ns Limits the number of concurrent inbound zone transfers from a remote server. transfer
trust-anchor-telemetry Instructs named to send specially formed queries once per day to domains for which trust anchors have been configured. dnssec
trust-anchors Defines DNSSEC trust anchors. dnssec
trusted-keys deprecated
try-tcp-refresh Specifies that BIND 9 should attempt to refresh a zone using TCP if UDP queries fail. transfer
type Specifies the kind of zone in a given configuration. zone
type forward Contains forwarding statements that apply to queries within a given domain. zone
type hint Contains the initial set of root name servers to be used at BIND 9 startup. zone
type mirror Contains a DNSSEC-validated duplicate of the main data for a zone. zone
type primary Contains the main copy of the data for a zone. zone
type redirect Contains information to answer queries when normal resolution would return NXDOMAIN. zone
type secondary Contains a duplicate of the data for a zone that has been transferred from a primary server. zone
type static-stub Contains statically configured NS records for a zone. zone
type stub Contains a duplicate of the NS records of a zone. zone
udp-receive-buffer Sets the operating system's receive buffer size for UDP sockets. server
udp-send-buffer Sets the operating system's send buffer size for UDP sockets. server
unix Specifies a Unix domain socket as a control channel. obsolete
update-check-ksk obsolete
update-policy Sets fine-grained rules to allow or deny dynamic updates (DDNS), based on requester identity, updated content, etc. transfer
update-quota Specifies the maximum number of concurrent DNS UPDATE messages that can be processed by the server. server
use-v4-udp-ports Specifies a list of ports that are valid sources for UDP/IPv4 messages. deprecated
use-v6-udp-ports Specifies a list of ports that are valid sources for UDP/IPv6 messages. deprecated
v6-bias Indicates the number of milliseconds of preference to give to IPv6 name servers. server, query
validate-except Specifies a list of domain names at and beneath which DNSSEC validation should not be performed. dnssec
version Specifies the version number of the server to return in response to a version.bind query. server
view Allows a name server to answer a DNS query differently depending on who is asking. view
window Specifies the length of time during which responses are tracked. query
zero-no-soa-ttl Specifies whether to set the time to live (TTL) of the SOA record to zero, when returning authoritative negative responses to SOA queries. zone, query, server
zero-no-soa-ttl-cache Sets the time to live (TTL) to zero when caching a negative response to an SOA query. zone, query, server
zone Specifies the zone in a BIND 9 configuration. zone
zone-propagation-delay Sets the propagation delay from the time a zone is first updated to when the new version of the zone is served by all secondary servers. dnssec, zone
zone-statistics Controls the level of statistics gathered for all zones. zone, logging
Can't render this file because it contains an unexpected character in line 1 and column 58.