# Statement index from the BIND 9.20.24 ARM, section 8.3 "Statements" # (https://bind9.readthedocs.io/en/v9.20.24/reference.html#statements). # Format: namedescriptiontags (comma separated) acl Assigns a symbolic name to an address match list. server algorithm Defines the algorithm to be used in a key clause. security all-per-second Limits UDP responses of all kinds. query allow-new-zones Controls the ability to add zones at runtime via rndc addzone. server, zone allow-notify Defines an address_match_list that is allowed to send NOTIFY messages for the zone, in addition to addresses defined in the primaries option for the zone. transfer allow-proxy Defines an address_match_list for the client addresses allowed to send PROXYv2 headers. server allow-proxy-on Defines an address_match_list for the interface addresses allowed to accept PROXYv2 headers. The option is mostly intended for multi-homed configurations. server allow-query Specifies which hosts (an IP address list) are allowed to send queries to this resolver. query allow-query-cache Specifies which hosts (an IP address list) can access this server's cache and thus effectively controls recursion. query allow-query-cache-on Specifies which hosts (from an IP address list) can access this server's cache. It is used on servers with multiple interfaces. query allow-query-on Specifies which local addresses (an IP address list) are allowed to send queries to this resolver. This option is used in multi-homed configurations. query allow-recursion Defines an address_match_list of clients that are allowed to perform recursive queries. query allow-recursion-on Specifies which local addresses can accept recursive queries. query, server allow-transfer Defines an address_match_list of hosts that are allowed to transfer the zone information from this server. transfer allow-update Defines an address_match_list of hosts that are allowed to submit dynamic updates for primary zones. transfer allow-update-forwarding Defines an address_match_list of hosts that are allowed to submit dynamic updates to a secondary server for transmission to a primary. transfer also-notify Defines one or more hosts that are sent NOTIFY messages when zone changes occur. transfer answer-cookie Controls whether COOKIE EDNS replies are sent in response to client queries. query attach-cache Allows multiple views to share a single cache database. view auth-nxdomain Controls whether BIND, acting as a resolver, provides authoritative NXDOMAIN (domain does not exist) answers. query automatic-interface-scan Controls the automatic rescanning of network interfaces when addresses are added or removed. server avoid-v4-udp-ports Specifies the range(s) of ports to be excluded from use as sources for UDP/IPv4 messages. deprecated avoid-v6-udp-ports Specifies the range(s) of ports to be excluded from use as sources for UDP/IPv6 messages. deprecated bindkeys-file Specifies the pathname of a file to override the built-in trusted keys provided by named. dnssec blackhole Defines an address_match_list of hosts to ignore. The server will neither respond to queries from nor send queries to these addresses. query bogus Allows a remote server to be ignored. server break-dnssec Enables dns64 synthesis even if the validated result would cause a DNSSEC validation failure. query buffered Controls flushing of log messages. logging ca-file Specifies the path to a file containing TLS certificates for trusted CA authorities, used to verify remote peer certificates. server, security catalog-zones Configures catalog zones in named.conf. zone category Specifies the type of data logged to a particular channel. logging cdnskey Specifies whether a CDNSKEY record should be published during KSK rollover. dnssec cds-digest-types Specifies the digest types to use for CDS resource records. dnssec cert-file Specifies the path to a file containing the TLS certificate for a connection. server, security channel Defines a stream of data that can be independently logged. logging check-dup-records Checks primary zones for records that are treated as different by DNSSEC but are semantically equal in plain DNS. dnssec, query check-integrity Performs post-load zone integrity checks on primary zones. zone check-mx Checks whether an MX record appears to refer to an IP address. zone check-mx-cname Sets the response to MX records that refer to CNAMEs. zone check-names Restricts the character set and syntax of certain domain names in primary files and/or DNS responses received from the network. query, server check-sibling Specifies whether to check for sibling glue when performing integrity checks. zone check-spf Specifies whether to check for a TXT Sender Policy Framework record, if an SPF record is present. zone check-srv-cname Sets the response to SRV records that refer to CNAMEs. zone check-svcb Specifies whether to perform additional checks on SVCB records. zone check-wildcard Checks for non-terminal wildcards. zone checkds Controls whether DS queries are sent to parental agents. dnssec cipher-suites Specifies a list of allowed cipher suites in the order of preference for TLSv1.3 only. security ciphers Specifies a list of allowed ciphers in the order of preference for TLSv1.2 only. security clients Specifies an access control list (ACL) of clients that are affected by a given dns64 directive. query clients-per-query Sets the initial minimum number of simultaneous recursive clients accepted by the server for any given query before the server drops additional clients. server controls Specifies control channels to be used to manage the name server. server cookie-algorithm Sets the algorithm to be used when generating a server cookie. server cookie-secret Specifies a shared secret used for generating and verifying EDNS COOKIE options within an anycast cluster. server database Specifies the type of database to be used to store zone data. zone deny-answer-addresses Rejects A or AAAA records if the corresponding IPv4 or IPv6 addresses match a given address_match_list. query deny-answer-aliases Rejects CNAME or DNAME records if the "alias" name matches a given list of domain_name elements. query dhparam-file Specifies the path to a file containing Diffie-Hellman parameters, for enabling cipher suites. server, security dialup Concentrates zone maintenance so that all transfers take place once every heartbeat-interval, ideally during a single call. deprecated directory Sets the server's working directory. server disable-algorithms Disables DNSSEC algorithms from a specified zone. dnssec disable-ds-digests Disables DS digest types from a specified zone. dnssec, zone disable-empty-zone Disables individual empty zones. server, zone dlz Configures a Dynamically Loadable Zone (DLZ) database in named.conf. zone dns64 Instructs named to return mapped IPv4 addresses to AAAA queries when there are no AAAA records. query dns64-contact Specifies the name of the contact for dns64 zones. server dns64-server Specifies the name of the server for dns64 zones. server dnskey-sig-validity obsolete dnskey-ttl Specifies the time-to-live (TTL) for DNSKEY resource records. dnssec dnsrps-enable Turns on the DNS Response Policy Service (DNSRPS) interface. server, security dnsrps-library Specifies the path to the DNS Response Policy Service (DNSRPS) provider library. server, security dnsrps-options Provides additional RPZ configuration settings, which are passed to the DNS Response Policy Service (DNSRPS) provider library. server, security dnssec-accept-expired Instructs BIND 9 to accept expired DNSSEC signatures when validating. dnssec dnssec-dnskey-kskonly obsolete dnssec-loadkeys-interval Sets the frequency of automatic checks of the DNSSEC key repository. dnssec dnssec-must-be-secure Defines hierarchies that must or may not be secure (signed and validated). deprecated dnssec-policy Defines a key and signing policy (KASP) for zones. dnssec dnssec-secure-to-insecure obsolete dnssec-update-mode obsolete dnssec-validation Enables DNSSEC validation in named. dnssec dnstap Enables logging of dnstap messages. logging dnstap-identity Specifies an identity string to send in dnstap messages. logging dnstap-output Configures the path to which the dnstap frame stream is sent. logging dnstap-version Specifies a version string to send in dnstap messages. logging dual-stack-servers Specifies host names or addresses of machines with access to both IPv4 and IPv6 transports. server dump-file Indicates the pathname of the file where the server dumps the database after rndc dumpdb. logging dyndb Configures a DynDB database in named.conf. zone edns Controls the use of the EDNS0 (RFC 2671) feature. server edns-udp-size Sets the maximum advertised EDNS UDP buffer size to control the size of packets received from authoritative servers in response to recursive queries. query edns-version Sets the maximum EDNS VERSION that is sent to the server(s) by the resolver. server empty-contact Specifies the contact name in the returned SOA record for empty zones. server, zone empty-server Specifies the server name in the returned SOA record for empty zones. server, zone empty-zones-enable Enables or disables all empty zones. server, zone endpoints Specifies a list of HTTP query paths on which to listen. server, query errors-per-second Limits the number of errors for a valid domain name and record type. server exclude Allows a list of IPv6 addresses to be ignored if they appear in a domain name's AAAA records in dns64. query exempt-clients Exempts specific clients or client groups from rate limiting. query fetch-quota-params Sets the parameters for dynamic resizing of the fetches-per-server quota in response to detected congestion. server, query fetches-per-server Sets the maximum number of simultaneous iterative queries allowed to be sent by a server to an upstream name server before the server blocks additional queries. server, query fetches-per-zone Sets the maximum number of simultaneous iterative queries allowed to any one domain before the server blocks new queries for data in or beneath that zone. server, query file Specifies the zone's filename. zone flush-zones-on-shutdown Controls whether pending zone writes are flushed when the name server exits. zone forward Allows or disallows fallback to recursion if forwarding has failed; it is always used in conjunction with the forwarders statement. query forwarders Defines one or more resolvers to which queries are forwarded. query fstrm-set-buffer-hint Sets the number of accumulated bytes in the output buffer before forcing a buffer flush. logging fstrm-set-flush-timeout Sets the number of seconds that unflushed data remains in the output buffer. logging fstrm-set-input-queue-size Sets the number of queue entries to allocate for each input queue. logging fstrm-set-output-notify-threshold Sets the number of outstanding queue entries allowed on an input queue before waking the I/O thread. logging fstrm-set-output-queue-model Sets the queuing semantics to use for queue objects. logging fstrm-set-output-queue-size Sets the number of queue entries allocated for each output queue. logging fstrm-set-reopen-interval Sets the number of seconds to wait between attempts to reopen a closed output stream. logging geoip-directory Specifies the directory containing GeoIP database files. server heartbeat-interval Sets the interval at which the server performs zone maintenance tasks for all zones marked as dialup. deprecated hostname Specifies the hostname of the server to return in response to a hostname.bind query. server http Configures HTTP endpoints on which to listen for DNS-over-HTTPS (DoH) queries. server, query http-listener-clients Limits the number of active concurrent connections on a per-listener basis. server http-port Specifies the TCP port number the server uses to receive and send unencrypted DNS traffic via HTTP. server, query http-streams-per-connection Limits the number of active concurrent HTTP/2 streams on a per-connection basis. server https-port Specifies the TCP port number the server uses to receive and send DNS-over-HTTPS protocol traffic. server, query in-view Specifies the view in which a given zone is defined. view, zone inet Specifies a TCP socket as a control channel. server inline-signing Specifies whether BIND 9 maintains a separate signed version of a zone. dnssec, zone interface-interval Sets the interval at which the server scans the network interface list. server ipv4-prefix-length Specifies the prefix lengths of IPv4 address blocks. server ipv4only-contact Specifies the contact for the IPV4ONLY.ARPA zone created by dns64. server ipv4only-enable Enables automatic IPv4 zones if a dns64 block is configured. query ipv4only-server Specifies the name of the server for the IPV4ONLY.ARPA zone created by dns64. server, query ipv6-prefix-length Specifies the prefix lengths of IPv6 address blocks. server ixfr-from-differences Controls how IXFR transfers are calculated. transfer journal Allows the default journal's filename to be overridden. zone key Defines a shared secret key for use with TSIG or the command channel. security key-directory Indicates the directory where public and private DNSSEC key files are found. dnssec key-file Specifies the path to a file containing the private TLS key for a connection. server, security key-store Configures a DNSSEC key store. dnssec keys Specifies one or more server_key s to be used with a remote server. server, security lame-ttl Sets the resolver's lame cache. server listen-on Specifies the IPv4 addresses on which a server listens for DNS queries. server listen-on-v6 Specifies the IPv6 addresses on which a server listens for DNS queries. server listener-clients Specifies a per-listener quota for active connections. server, query lmdb-mapsize Sets a maximum size for the memory map of the new-zone database in LMDB database format. server log-only Tests rate-limiting parameters without actually dropping any requests. logging, query logging Configures logging options for the name server. logging managed-keys deprecated managed-keys-directory Specifies the directory in which to store the files that track managed DNSSEC keys. dnssec manual-mode Run key management in a manual mode. dnssec mapped Specifies an access control list (ACL) of IPv4 addresses that are to be mapped to the corresponding A RRset in dns64. query masterfile-format Specifies the file format of zone files. zone, server masterfile-style Specifies the format of zone files during a dump, when the masterfile-format is text. server match-clients Specifies a view of DNS namespace for a given subset of client IP addresses. view match-destinations Specifies a view of DNS namespace for a given subset of destination IP addresses. view match-mapped-addresses Allows IPv4-mapped IPv6 addresses to match address-match list entries for corresponding IPv4 addresses. server match-recursive-only Specifies that only recursive requests can match this view of the DNS namespace. view max-cache-size Sets the maximum amount of memory to use for an individual cache database and its associated metadata. server max-cache-ttl Specifies the maximum time (in seconds) that the server caches ordinary (positive) answers. server max-clients-per-query Sets the maximum number of simultaneous recursive clients accepted by the server for any given query before the server drops additional clients. server max-ixfr-ratio Sets the maximum size for IXFR responses to zone transfer requests. transfer max-journal-size Controls the size of journal files. transfer max-ncache-ttl Specifies the maximum retention time (in seconds) for storage of negative answers in the server's cache. server max-query-count Sets the maximum number of iterative queries while servicing a recursive query. server, query max-query-restarts Sets the maximum number of chained CNAMEs to follow server, query max-records Sets the maximum number of records permitted in a zone. zone, server max-records-per-type Sets the maximum number of records that can be stored in an RRset. server max-recursion-depth Sets the maximum number of levels of recursion permitted at any one time while servicing a recursive query. server max-recursion-queries Sets the maximum number of iterative queries while servicing a recursive query. server, query max-refresh-time Limits the zone refresh interval to no less often than the specified value, in seconds. transfer max-retry-time Limits the zone refresh retry interval to no less often than the specified value, in seconds. transfer max-rsa-exponent-size Sets the maximum RSA exponent size (in bits) when validating. dnssec, query max-stale-ttl Specifies the maximum time that the server retains records past their normal expiry, to return them as stale records. server max-table-size Sets the maximum size of the table used to track requests and rate-limit responses. server max-transfer-idle-in Specifies the number of minutes after which inbound zone transfers making no progress are terminated. transfer max-transfer-idle-out Specifies the number of minutes after which outbound zone transfers making no progress are terminated. transfer max-transfer-time-in Specifies the number of minutes after which inbound zone transfers are terminated. transfer max-transfer-time-out Specifies the number of minutes after which outbound zone transfers are terminated. transfer max-types-per-name Sets the maximum number of RR types that can be stored for an owner name. server max-udp-size Sets the maximum EDNS UDP message size sent by named. query max-validation-failures-per-fetch Sets the maximum number of DNSSEC validation failures that can happen in a single fetch. server max-validations-per-fetch Sets the maximum number of DNSSEC validations that can happen in a single fetch. server max-zone-ttl Specifies a maximum permissible time-to-live (TTL) value, in seconds. deprecated memstatistics Controls whether memory statistics are written to the file specified by memstatistics-file at exit. server, logging memstatistics-file Sets the pathname of the file where the server writes memory usage statistics on exit. logging message-compression Controls whether DNS name compression is used in responses to regular queries. query min-cache-ttl Specifies the minimum time (in seconds) that the server caches ordinary (positive) answers. server min-ncache-ttl Specifies the minimum retention time (in seconds) for storage of negative answers in the server's cache. server min-refresh-time Limits the zone refresh interval to no more often than the specified value, in seconds. transfer min-retry-time Limits the zone refresh retry interval to no more often than the specified value, in seconds. transfer min-table-size Sets the minimum size of the table used to track requests and rate-limit responses. query min-transfer-rate-in Specifies the minimum traffic rate below which inbound zone transfers are terminated. transfer minimal-any Controls whether the server replies with only one of the RRsets for a query name, when generating a positive response to a query of type ANY over UDP. query minimal-responses Controls whether the server only adds records to the authority and additional data sections when they are required (e.g. delegations, negative responses). This improves server performance. query multi-master Controls whether serial number mismatch errors are logged. transfer new-zones-directory Specifies the directory where configuration parameters are stored for zones added by rndc addzone. zone no-case-compress Specifies a list of addresses that require case-insensitive compression in responses. server nocookie-udp-size Sets the maximum size of UDP responses that are sent to queries without a valid server COOKIE. query nodata-per-second Limits the number of empty (NODATA) responses for a valid domain name. query notify Controls whether NOTIFY messages are sent on zone changes. transfer notify-defer Sets the defer time (in seconds) before sending NOTIFY messages for a zone. transfer, zone notify-delay Sets the delay (in seconds) between sending sets of NOTIFY messages for a zone. transfer, zone notify-rate Specifies the rate at which NOTIFY requests are sent during normal zone maintenance operations. transfer, zone notify-source Defines the IPv4 address (and optional port) to be used for outgoing NOTIFY messages. transfer notify-source-v6 Defines the IPv6 address (and optional port) to be used for outgoing NOTIFY messages. transfer notify-to-soa Controls whether the name servers in the NS RRset are checked against the SOA MNAME. transfer nsec3param Specifies the use of NSEC3 instead of NSEC, and sets NSEC3 parameters. dnssec nta-lifetime Specifies the lifetime, in seconds, for negative trust anchors added via rndc nta. dnssec nta-recheck Specifies the time interval for checking whether negative trust anchors added via rndc nta are still necessary. dnssec null Causes all messages sent to the logging channel to be discarded. logging nxdomain-redirect Appends the specified suffix to the original query name, when replacing an NXDOMAIN with a redirect namespace. query nxdomains-per-second Limits the number of undefined subdomains for a valid domain name. query offline-ksk Specifies whether the DNSKEY, CDS, and CDNSKEY RRsets are being signed offline. dnssec options Defines global options to be used by BIND 9. server padding Adds EDNS Padding options to outgoing messages to increase the packet size. server parent-ds-ttl Sets the time to live (TTL) of the DS RRset used by the parent zone. dnssec parent-propagation-delay Sets the propagation delay from the time the parent zone is updated to when the new version is served by all of the parent zone's name servers. dnssec, zone parental-agents dnssec parental-source Specifies which local IPv4 source address is used to send parental DS queries. dnssec parental-source-v6 Specifies which local IPv6 source address is used to send parental DS queries. dnssec pid-file Specifies the pathname of the file where the server writes its process ID. server pkcs11-uri dnssec, pkcs11 plugin Configures plugins in named.conf. server port Specifies the UDP/TCP port number the server uses to receive and send DNS protocol traffic. server, query prefer-server-ciphers Specifies that server ciphers should be preferred over client ones. server, security preferred-glue Controls the order of glue records in an A or AAAA response. query prefetch Specifies the "trigger" time-to-live (TTL) value at which prefetch of the current query takes place. query primaries Defines one or more servers that zone transfer can be requested from. transfer, zone print-category Includes the category in log messages. logging print-severity Includes the severity in log messages. logging print-time Specifies the time format for log messages. logging protocols Specifies the allowed versions of the TLS protocol. security provide-ixfr Controls whether a primary responds to an incremental zone request (IXFR) or only responds with a full zone transfer (AXFR). transfer publish-safety Increases the amount of time between when keys are published and when they become active, to allow for unforeseen events. dnssec purge-keys Specifies the amount of time after which DNSSEC keys that have been deleted from the zone can be removed from disk. dnssec qname-minimization Controls QNAME minimization behavior in the BIND 9 resolver. query qps-scale Tightens defenses during DNS attacks by scaling back the ratio of the current query-per-second rate. query query-source Controls the IPv4 address from which queries are issued. If none, then no IPv4 address would be used to issue the query and therefore only IPv6 servers are queried. query query-source-v6 Controls the IPv6 address from which queries are issued. If none, then no IPv6 address would be used to issue the query and therefore only IPv4 servers are quried. query querylog Specifies whether query logging should be active when named first starts. logging, server rate-limit Controls excessive UDP responses, to prevent BIND 9 from being used to amplify reflection denial-of-service (DoS) attacks. query recursing-file Specifies the pathname of the file where the server dumps queries that are currently recursing via rndc recursing. server recursion Defines whether recursion and caching are allowed. query recursive-clients Specifies the maximum number of concurrent recursive queries the server can perform. query recursive-only Toggles whether dns64 synthesis occurs only for recursive queries. query referrals-per-second Limits the number of referrals or delegations to a server for a given domain. query remote-hostname Specifies the expected hostname in the TLS certificate of the remote server. security remote-servers Defines a list of servers to be used by primary and secondary zones. server request-expire Specifies whether the local server requests the EDNS EXPIRE value, when acting as a secondary. transfer, query request-ixfr Controls whether a secondary requests an incremental zone transfer (IXFR) or a full zone transfer (AXFR). transfer request-nsid Controls whether an empty EDNS(0) NSID (Name Server Identifier) option is sent with all queries to authoritative name servers during iterative resolution. query require-cookie Controls whether responses without a server cookie are accepted. query require-server-cookie Controls whether a valid server cookie is required before sending a full response to a UDP request. query resolver-query-timeout Specifies the length of time, in milliseconds, that a resolver attempts to resolve a recursive query before failing. query resolver-use-dns64 Specifies whether to apply DNS64 mappings when sending queries. server response-padding Adds an EDNS Padding option to encrypted messages, to reduce the chance of guessing the contents based on size. query response-policy Specifies response policy zones for the view or among global options. server, query, zone, security responselog Specifies whether response logging should be active when named first starts. logging, server responses-per-second Limits the number of non-empty responses for a valid domain name and record type. query retire-safety Increases the amount of time a key remains published after it is no longer active, to allow for unforeseen events. dnssec reuseport Enables kernel load-balancing of sockets. server root-key-sentinel Controls whether BIND 9 responds to root key sentinel probes. server rrset-order Defines the order in which equal RRs (RRsets) are returned. query search Specifies whether a Dynamically Loadable Zone (DLZ) module is queried for an answer to a query name. query secret Defines a Base64-encoded string to be used as the secret by the algorithm. security secroots-file Specifies the pathname of the file where the server dumps security roots, when using rndc secroots. dnssec send-cookie Controls whether a COOKIE EDNS option is sent along with a query. query serial-query-rate Defines an upper limit on the number of queries per second issued by the server, when querying the SOA RRs used for zone transfers. transfer serial-update-method Specifies the update method to be used for the zone serial number in the SOA record. zone server Defines characteristics to be associated with a remote name server. server server-addresses Specifies a list of IP addresses to which queries should be sent in recursive resolution for a static-stub zone. query, zone server-id Specifies the ID of the server to return in response to a ID.SERVER query. server server-names Specifies a list of domain names of name servers that act as authoritative servers of a static-stub zone. zone servfail-ttl Sets the length of time (in seconds) that a SERVFAIL response is cached. server session-keyalg Specifies the algorithm to use for the TSIG session key. security session-keyfile Specifies the pathname of the file where a TSIG session key is written, when generated by named for use by nsupdate -l. security session-keyname Specifies the key name for the TSIG session key. security session-tickets Enables or disables session resumption through TLS session tickets. security severity Defines the priority level of log messages. logging sig-signing-nodes Specifies the maximum number of nodes to be examined in each quantum, when signing a zone with a new DNSKEY. dnssec sig-signing-signatures Specifies the threshold for the number of signatures that terminates processing a quantum, when signing a zone with a new DNSKEY. dnssec sig-signing-type Specifies a private RDATA type to use when generating signing-state records. dnssec sig-validity-interval obsolete sig0checks-quota Specifies the maximum number of concurrent SIG(0) signature checks that can be processed by the server. server sig0checks-quota-exempt Exempts specific clients or client groups from SIG(0) signature checking quota. server sig0key-checks-limit Specifies the maximum number of SIG(0) keys to consider when trying to verify a message. server sig0message-checks-limit Specifies the maximum number of matching SIG(0) keys to try to verify a message. server signatures-jitter Specifies a range for signature expirations. dnssec signatures-refresh Specifies how frequently an RRSIG record is refreshed. dnssec signatures-validity Indicates the validity period of an RRSIG record. dnssec signatures-validity-dnskey Indicates the validity period of DNSKEY records. dnssec slip Sets the number of "slipped" responses to minimize the use of forged source addresses for an attack. query sortlist Controls the ordering of RRs returned to the client, based on the client's IP address. query, deprecated stale-answer-client-timeout Defines the amount of time (in milliseconds) that named waits before attempting to answer a query with a stale RRset from cache. server, query stale-answer-enable Enables the returning of "stale" cached answers when the name servers for a zone are not answering. server, query stale-answer-ttl Specifies the time to live (TTL) to be returned on stale answers, in seconds. query stale-cache-enable Enables the retention of "stale" cached answers. server, query stale-refresh-time Sets the time window for the return of "stale" cached answers before the next attempt to contact, if the name servers for a given zone are not responding. server, query startup-notify-rate Specifies the rate at which NOTIFY requests are sent when the name server is first starting, or when new zones have been added. transfer, zone statistics-channels Specifies the communication channels to be used by system administrators to access statistics information on the name server. logging statistics-file Specifies the pathname of the file where the server appends statistics, when using rndc stats. logging, server stderr Directs the logging channel output to the server's standard error stream. logging streams-per-connection Specifies the maximum number of concurrent HTTP/2 streams over an HTTP/2 connection. server, query suffix Defines trailing bits for mapped IPv4 address bits in dns64. query synth-from-dnssec Enables support for RFC 8198, Aggressive Use of DNSSEC-Validated Cache. dnssec syslog Directs the logging channel to the system log. logging tcp-advertised-timeout Sets the timeout value (in milliseconds) that the server sends in responses containing the EDNS TCP keepalive option. query tcp-clients Specifies the maximum number of simultaneous client TCP connections accepted by the server. server tcp-idle-timeout Sets the amount of time (in milliseconds) that the server waits on an idle TCP connection before closing it, if the EDNS TCP keepalive option is not in use. query tcp-initial-timeout Sets the amount of time (in milliseconds) that the server waits on a new TCP connection for the first message from the client. server, query tcp-keepalive Adds EDNS TCP keepalive to messages sent over TCP. server tcp-keepalive-timeout Sets the amount of time (in milliseconds) that the server waits on an idle TCP connection before closing it, if the EDNS TCP keepalive option is in use. query tcp-listen-queue Sets the listen-queue depth. server tcp-only Sets the transport protocol to TCP. server tcp-receive-buffer Sets the operating system's receive buffer size for TCP sockets. server tcp-send-buffer Sets the operating system's send buffer size for TCP sockets. server tkey-gssapi-credential Sets the security credential for authentication keys requested by the GSS-TSIG protocol. security tkey-gssapi-keytab Sets the KRB5 keytab file to use for GSS-TSIG updates. security tls Configures a TLS connection. security tls-port Specifies the TCP port number the server uses to receive and send DNS-over-TLS protocol traffic. server, query transfer-format Controls whether multiple records can be packed into a message during zone transfers. transfer transfer-message-size Limits the uncompressed size of DNS messages used in zone transfers over TCP. transfer transfer-source Defines which local IPv4 address(es) are bound to TCP connections used to fetch zones transferred inbound by the server. transfer transfer-source-v6 Defines which local IPv6 address(es) are bound to TCP connections used to fetch zones transferred inbound by the server. transfer transfers Limits the number of concurrent inbound zone transfers from a server. server transfers-in Limits the number of concurrent inbound zone transfers. transfer transfers-out Limits the number of concurrent outbound zone transfers. transfer transfers-per-ns Limits the number of concurrent inbound zone transfers from a remote server. transfer trust-anchor-telemetry Instructs named to send specially formed queries once per day to domains for which trust anchors have been configured. dnssec trust-anchors Defines DNSSEC trust anchors. dnssec trusted-keys deprecated try-tcp-refresh Specifies that BIND 9 should attempt to refresh a zone using TCP if UDP queries fail. transfer type Specifies the kind of zone in a given configuration. zone type forward Contains forwarding statements that apply to queries within a given domain. zone type hint Contains the initial set of root name servers to be used at BIND 9 startup. zone type mirror Contains a DNSSEC-validated duplicate of the main data for a zone. zone type primary Contains the main copy of the data for a zone. zone type redirect Contains information to answer queries when normal resolution would return NXDOMAIN. zone type secondary Contains a duplicate of the data for a zone that has been transferred from a primary server. zone type static-stub Contains statically configured NS records for a zone. zone type stub Contains a duplicate of the NS records of a zone. zone udp-receive-buffer Sets the operating system's receive buffer size for UDP sockets. server udp-send-buffer Sets the operating system's send buffer size for UDP sockets. server unix Specifies a Unix domain socket as a control channel. obsolete update-check-ksk obsolete update-policy Sets fine-grained rules to allow or deny dynamic updates (DDNS), based on requester identity, updated content, etc. transfer update-quota Specifies the maximum number of concurrent DNS UPDATE messages that can be processed by the server. server use-v4-udp-ports Specifies a list of ports that are valid sources for UDP/IPv4 messages. deprecated use-v6-udp-ports Specifies a list of ports that are valid sources for UDP/IPv6 messages. deprecated v6-bias Indicates the number of milliseconds of preference to give to IPv6 name servers. server, query validate-except Specifies a list of domain names at and beneath which DNSSEC validation should not be performed. dnssec version Specifies the version number of the server to return in response to a version.bind query. server view Allows a name server to answer a DNS query differently depending on who is asking. view window Specifies the length of time during which responses are tracked. query zero-no-soa-ttl Specifies whether to set the time to live (TTL) of the SOA record to zero, when returning authoritative negative responses to SOA queries. zone, query, server zero-no-soa-ttl-cache Sets the time to live (TTL) to zero when caching a negative response to an SOA query. zone, query, server zone Specifies the zone in a BIND 9 configuration. zone zone-propagation-delay Sets the propagation delay from the time a zone is first updated to when the new version of the zone is served by all secondary servers. dnssec, zone zone-statistics Controls the level of statistics gathered for all zones. zone, logging