jarl/internal/catalog/data/statements-9.20.tsv

# Statement index from the BIND 9.20.24 ARM, section 8.3 "Statements"
# (https://bind9.readthedocs.io/en/v9.20.24/reference.html#statements).
# Format: name<TAB>description<TAB>tags (comma separated)
acl	Assigns a symbolic name to an address match list.	server
algorithm	Defines the algorithm to be used in a key clause.	security
all-per-second	Limits UDP responses of all kinds.	query
allow-new-zones	Controls the ability to add zones at runtime via rndc addzone.	server, zone
allow-notify	Defines an address_match_list that is allowed to send NOTIFY messages for the zone, in addition to addresses defined in the primaries option for the zone.	transfer
allow-proxy	Defines an address_match_list for the client addresses allowed to send PROXYv2 headers.	server
allow-proxy-on	Defines an address_match_list for the interface addresses allowed to accept PROXYv2 headers. The option is mostly intended for multi-homed configurations.	server
allow-query	Specifies which hosts (an IP address list) are allowed to send queries to this resolver.	query
allow-query-cache	Specifies which hosts (an IP address list) can access this server's cache and thus effectively controls recursion.	query
allow-query-cache-on	Specifies which hosts (from an IP address list) can access this server's cache. It is used on servers with multiple interfaces.	query
allow-query-on	Specifies which local addresses (an IP address list) are allowed to send queries to this resolver. This option is used in multi-homed configurations.	query
allow-recursion	Defines an address_match_list of clients that are allowed to perform recursive queries.	query
allow-recursion-on	Specifies which local addresses can accept recursive queries.	query, server
allow-transfer	Defines an address_match_list of hosts that are allowed to transfer the zone information from this server.	transfer
allow-update	Defines an address_match_list of hosts that are allowed to submit dynamic updates for primary zones.	transfer
allow-update-forwarding	Defines an address_match_list of hosts that are allowed to submit dynamic updates to a secondary server for transmission to a primary.	transfer
also-notify	Defines one or more hosts that are sent NOTIFY messages when zone changes occur.	transfer
answer-cookie	Controls whether COOKIE EDNS replies are sent in response to client queries.	query
attach-cache	Allows multiple views to share a single cache database.	view
auth-nxdomain	Controls whether BIND, acting as a resolver, provides authoritative NXDOMAIN (domain does not exist) answers.	query
automatic-interface-scan	Controls the automatic rescanning of network interfaces when addresses are added or removed.	server
avoid-v4-udp-ports	Specifies the range(s) of ports to be excluded from use as sources for UDP/IPv4 messages.	deprecated
avoid-v6-udp-ports	Specifies the range(s) of ports to be excluded from use as sources for UDP/IPv6 messages.	deprecated
bindkeys-file	Specifies the pathname of a file to override the built-in trusted keys provided by named.	dnssec
blackhole	Defines an address_match_list of hosts to ignore. The server will neither respond to queries from nor send queries to these addresses.	query
bogus	Allows a remote server to be ignored.	server
break-dnssec	Enables dns64 synthesis even if the validated result would cause a DNSSEC validation failure.	query
buffered	Controls flushing of log messages.	logging
ca-file	Specifies the path to a file containing TLS certificates for trusted CA authorities, used to verify remote peer certificates.	server, security
catalog-zones	Configures catalog zones in named.conf.	zone
category	Specifies the type of data logged to a particular channel.	logging
cdnskey	Specifies whether a CDNSKEY record should be published during KSK rollover.	dnssec
cds-digest-types	Specifies the digest types to use for CDS resource records.	dnssec
cert-file	Specifies the path to a file containing the TLS certificate for a connection.	server, security
channel	Defines a stream of data that can be independently logged.	logging
check-dup-records	Checks primary zones for records that are treated as different by DNSSEC but are semantically equal in plain DNS.	dnssec, query
check-integrity	Performs post-load zone integrity checks on primary zones.	zone
check-mx	Checks whether an MX record appears to refer to an IP address.	zone
check-mx-cname	Sets the response to MX records that refer to CNAMEs.	zone
check-names	Restricts the character set and syntax of certain domain names in primary files and/or DNS responses received from the network.	query, server
check-sibling	Specifies whether to check for sibling glue when performing integrity checks.	zone
check-spf	Specifies whether to check for a TXT Sender Policy Framework record, if an SPF record is present.	zone
check-srv-cname	Sets the response to SRV records that refer to CNAMEs.	zone
check-svcb	Specifies whether to perform additional checks on SVCB records.	zone
check-wildcard	Checks for non-terminal wildcards.	zone
checkds	Controls whether DS queries are sent to parental agents.	dnssec
cipher-suites	Specifies a list of allowed cipher suites in the order of preference for TLSv1.3 only.	security
ciphers	Specifies a list of allowed ciphers in the order of preference for TLSv1.2 only.	security
clients	Specifies an access control list (ACL) of clients that are affected by a given dns64 directive.	query
clients-per-query	Sets the initial minimum number of simultaneous recursive clients accepted by the server for any given query before the server drops additional clients.	server
controls	Specifies control channels to be used to manage the name server.	server
cookie-algorithm	Sets the algorithm to be used when generating a server cookie.	server
cookie-secret	Specifies a shared secret used for generating and verifying EDNS COOKIE options within an anycast cluster.	server
database	Specifies the type of database to be used to store zone data.	zone
deny-answer-addresses	Rejects A or AAAA records if the corresponding IPv4 or IPv6 addresses match a given address_match_list.	query
deny-answer-aliases	Rejects CNAME or DNAME records if the "alias" name matches a given list of domain_name elements.	query
dhparam-file	Specifies the path to a file containing Diffie-Hellman parameters, for enabling cipher suites.	server, security
dialup	Concentrates zone maintenance so that all transfers take place once every heartbeat-interval, ideally during a single call.	deprecated
directory	Sets the server's working directory.	server
disable-algorithms	Disables DNSSEC algorithms from a specified zone.	dnssec
disable-ds-digests	Disables DS digest types from a specified zone.	dnssec, zone
disable-empty-zone	Disables individual empty zones.	server, zone
dlz	Configures a Dynamically Loadable Zone (DLZ) database in named.conf.	zone
dns64	Instructs named to return mapped IPv4 addresses to AAAA queries when there are no AAAA records.	query
dns64-contact	Specifies the name of the contact for dns64 zones.	server
dns64-server	Specifies the name of the server for dns64 zones.	server
dnskey-sig-validity		obsolete
dnskey-ttl	Specifies the time-to-live (TTL) for DNSKEY resource records.	dnssec
dnsrps-enable	Turns on the DNS Response Policy Service (DNSRPS) interface.	server, security
dnsrps-library	Specifies the path to the DNS Response Policy Service (DNSRPS) provider library.	server, security
dnsrps-options	Provides additional RPZ configuration settings, which are passed to the DNS Response Policy Service (DNSRPS) provider library.	server, security
dnssec-accept-expired	Instructs BIND 9 to accept expired DNSSEC signatures when validating.	dnssec
dnssec-dnskey-kskonly		obsolete
dnssec-loadkeys-interval	Sets the frequency of automatic checks of the DNSSEC key repository.	dnssec
dnssec-must-be-secure	Defines hierarchies that must or may not be secure (signed and validated).	deprecated
dnssec-policy	Defines a key and signing policy (KASP) for zones.	dnssec
dnssec-secure-to-insecure		obsolete
dnssec-update-mode		obsolete
dnssec-validation	Enables DNSSEC validation in named.	dnssec
dnstap	Enables logging of dnstap messages.	logging
dnstap-identity	Specifies an identity string to send in dnstap messages.	logging
dnstap-output	Configures the path to which the dnstap frame stream is sent.	logging
dnstap-version	Specifies a version string to send in dnstap messages.	logging
dual-stack-servers	Specifies host names or addresses of machines with access to both IPv4 and IPv6 transports.	server
dump-file	Indicates the pathname of the file where the server dumps the database after rndc dumpdb.	logging
dyndb	Configures a DynDB database in named.conf.	zone
edns	Controls the use of the EDNS0 (RFC 2671) feature.	server
edns-udp-size	Sets the maximum advertised EDNS UDP buffer size to control the size of packets received from authoritative servers in response to recursive queries.	query
edns-version	Sets the maximum EDNS VERSION that is sent to the server(s) by the resolver.	server
empty-contact	Specifies the contact name in the returned SOA record for empty zones.	server, zone
empty-server	Specifies the server name in the returned SOA record for empty zones.	server, zone
empty-zones-enable	Enables or disables all empty zones.	server, zone
endpoints	Specifies a list of HTTP query paths on which to listen.	server, query
errors-per-second	Limits the number of errors for a valid domain name and record type.	server
exclude	Allows a list of IPv6 addresses to be ignored if they appear in a domain name's AAAA records in dns64.	query
exempt-clients	Exempts specific clients or client groups from rate limiting.	query
fetch-quota-params	Sets the parameters for dynamic resizing of the fetches-per-server quota in response to detected congestion.	server, query
fetches-per-server	Sets the maximum number of simultaneous iterative queries allowed to be sent by a server to an upstream name server before the server blocks additional queries.	server, query
fetches-per-zone	Sets the maximum number of simultaneous iterative queries allowed to any one domain before the server blocks new queries for data in or beneath that zone.	server, query
file	Specifies the zone's filename.	zone
flush-zones-on-shutdown	Controls whether pending zone writes are flushed when the name server exits.	zone
forward	Allows or disallows fallback to recursion if forwarding has failed; it is always used in conjunction with the forwarders statement.	query
forwarders	Defines one or more resolvers to which queries are forwarded.	query
fstrm-set-buffer-hint	Sets the number of accumulated bytes in the output buffer before forcing a buffer flush.	logging
fstrm-set-flush-timeout	Sets the number of seconds that unflushed data remains in the output buffer.	logging
fstrm-set-input-queue-size	Sets the number of queue entries to allocate for each input queue.	logging
fstrm-set-output-notify-threshold	Sets the number of outstanding queue entries allowed on an input queue before waking the I/O thread.	logging
fstrm-set-output-queue-model	Sets the queuing semantics to use for queue objects.	logging
fstrm-set-output-queue-size	Sets the number of queue entries allocated for each output queue.	logging
fstrm-set-reopen-interval	Sets the number of seconds to wait between attempts to reopen a closed output stream.	logging
geoip-directory	Specifies the directory containing GeoIP database files.	server
heartbeat-interval	Sets the interval at which the server performs zone maintenance tasks for all zones marked as dialup.	deprecated
hostname	Specifies the hostname of the server to return in response to a hostname.bind query.	server
http	Configures HTTP endpoints on which to listen for DNS-over-HTTPS (DoH) queries.	server, query
http-listener-clients	Limits the number of active concurrent connections on a per-listener basis.	server
http-port	Specifies the TCP port number the server uses to receive and send unencrypted DNS traffic via HTTP.	server, query
http-streams-per-connection	Limits the number of active concurrent HTTP/2 streams on a per-connection basis.	server
https-port	Specifies the TCP port number the server uses to receive and send DNS-over-HTTPS protocol traffic.	server, query
in-view	Specifies the view in which a given zone is defined.	view, zone
inet	Specifies a TCP socket as a control channel.	server
inline-signing	Specifies whether BIND 9 maintains a separate signed version of a zone.	dnssec, zone
interface-interval	Sets the interval at which the server scans the network interface list.	server
ipv4-prefix-length	Specifies the prefix lengths of IPv4 address blocks.	server
ipv4only-contact	Specifies the contact for the IPV4ONLY.ARPA zone created by dns64.	server
ipv4only-enable	Enables automatic IPv4 zones if a dns64 block is configured.	query
ipv4only-server	Specifies the name of the server for the IPV4ONLY.ARPA zone created by dns64.	server, query
ipv6-prefix-length	Specifies the prefix lengths of IPv6 address blocks.	server
ixfr-from-differences	Controls how IXFR transfers are calculated.	transfer
journal	Allows the default journal's filename to be overridden.	zone
key	Defines a shared secret key for use with TSIG or the command channel.	security
key-directory	Indicates the directory where public and private DNSSEC key files are found.	dnssec
key-file	Specifies the path to a file containing the private TLS key for a connection.	server, security
key-store	Configures a DNSSEC key store.	dnssec
keys	Specifies one or more server_key s to be used with a remote server.	server, security
lame-ttl	Sets the resolver's lame cache.	server
listen-on	Specifies the IPv4 addresses on which a server listens for DNS queries.	server
listen-on-v6	Specifies the IPv6 addresses on which a server listens for DNS queries.	server
listener-clients	Specifies a per-listener quota for active connections.	server, query
lmdb-mapsize	Sets a maximum size for the memory map of the new-zone database in LMDB database format.	server
log-only	Tests rate-limiting parameters without actually dropping any requests.	logging, query
logging	Configures logging options for the name server.	logging
managed-keys		deprecated
managed-keys-directory	Specifies the directory in which to store the files that track managed DNSSEC keys.	dnssec
manual-mode	Run key management in a manual mode.	dnssec
mapped	Specifies an access control list (ACL) of IPv4 addresses that are to be mapped to the corresponding A RRset in dns64.	query
masterfile-format	Specifies the file format of zone files.	zone, server
masterfile-style	Specifies the format of zone files during a dump, when the masterfile-format is text.	server
match-clients	Specifies a view of DNS namespace for a given subset of client IP addresses.	view
match-destinations	Specifies a view of DNS namespace for a given subset of destination IP addresses.	view
match-mapped-addresses	Allows IPv4-mapped IPv6 addresses to match address-match list entries for corresponding IPv4 addresses.	server
match-recursive-only	Specifies that only recursive requests can match this view of the DNS namespace.	view
max-cache-size	Sets the maximum amount of memory to use for an individual cache database and its associated metadata.	server
max-cache-ttl	Specifies the maximum time (in seconds) that the server caches ordinary (positive) answers.	server
max-clients-per-query	Sets the maximum number of simultaneous recursive clients accepted by the server for any given query before the server drops additional clients.	server
max-ixfr-ratio	Sets the maximum size for IXFR responses to zone transfer requests.	transfer
max-journal-size	Controls the size of journal files.	transfer
max-ncache-ttl	Specifies the maximum retention time (in seconds) for storage of negative answers in the server's cache.	server
max-query-count	Sets the maximum number of iterative queries while servicing a recursive query.	server, query
max-query-restarts	Sets the maximum number of chained CNAMEs to follow	server, query
max-records	Sets the maximum number of records permitted in a zone.	zone, server
max-records-per-type	Sets the maximum number of records that can be stored in an RRset.	server
max-recursion-depth	Sets the maximum number of levels of recursion permitted at any one time while servicing a recursive query.	server
max-recursion-queries	Sets the maximum number of iterative queries while servicing a recursive query.	server, query
max-refresh-time	Limits the zone refresh interval to no less often than the specified value, in seconds.	transfer
max-retry-time	Limits the zone refresh retry interval to no less often than the specified value, in seconds.	transfer
max-rsa-exponent-size	Sets the maximum RSA exponent size (in bits) when validating.	dnssec, query
max-stale-ttl	Specifies the maximum time that the server retains records past their normal expiry, to return them as stale records.	server
max-table-size	Sets the maximum size of the table used to track requests and rate-limit responses.	server
max-transfer-idle-in	Specifies the number of minutes after which inbound zone transfers making no progress are terminated.	transfer
max-transfer-idle-out	Specifies the number of minutes after which outbound zone transfers making no progress are terminated.	transfer
max-transfer-time-in	Specifies the number of minutes after which inbound zone transfers are terminated.	transfer
max-transfer-time-out	Specifies the number of minutes after which outbound zone transfers are terminated.	transfer
max-types-per-name	Sets the maximum number of RR types that can be stored for an owner name.	server
max-udp-size	Sets the maximum EDNS UDP message size sent by named.	query
max-validation-failures-per-fetch	Sets the maximum number of DNSSEC validation failures that can happen in a single fetch.	server
max-validations-per-fetch	Sets the maximum number of DNSSEC validations that can happen in a single fetch.	server
max-zone-ttl	Specifies a maximum permissible time-to-live (TTL) value, in seconds.	deprecated
memstatistics	Controls whether memory statistics are written to the file specified by memstatistics-file at exit.	server, logging
memstatistics-file	Sets the pathname of the file where the server writes memory usage statistics on exit.	logging
message-compression	Controls whether DNS name compression is used in responses to regular queries.	query
min-cache-ttl	Specifies the minimum time (in seconds) that the server caches ordinary (positive) answers.	server
min-ncache-ttl	Specifies the minimum retention time (in seconds) for storage of negative answers in the server's cache.	server
min-refresh-time	Limits the zone refresh interval to no more often than the specified value, in seconds.	transfer
min-retry-time	Limits the zone refresh retry interval to no more often than the specified value, in seconds.	transfer
min-table-size	Sets the minimum size of the table used to track requests and rate-limit responses.	query
min-transfer-rate-in	Specifies the minimum traffic rate below which inbound zone transfers are terminated.	transfer
minimal-any	Controls whether the server replies with only one of the RRsets for a query name, when generating a positive response to a query of type ANY over UDP.	query
minimal-responses	Controls whether the server only adds records to the authority and additional data sections when they are required (e.g. delegations, negative responses). This improves server performance.	query
multi-master	Controls whether serial number mismatch errors are logged.	transfer
new-zones-directory	Specifies the directory where configuration parameters are stored for zones added by rndc addzone.	zone
no-case-compress	Specifies a list of addresses that require case-insensitive compression in responses.	server
nocookie-udp-size	Sets the maximum size of UDP responses that are sent to queries without a valid server COOKIE.	query
nodata-per-second	Limits the number of empty (NODATA) responses for a valid domain name.	query
notify	Controls whether NOTIFY messages are sent on zone changes.	transfer
notify-defer	Sets the defer time (in seconds) before sending NOTIFY messages for a zone.	transfer, zone
notify-delay	Sets the delay (in seconds) between sending sets of NOTIFY messages for a zone.	transfer, zone
notify-rate	Specifies the rate at which NOTIFY requests are sent during normal zone maintenance operations.	transfer, zone
notify-source	Defines the IPv4 address (and optional port) to be used for outgoing NOTIFY messages.	transfer
notify-source-v6	Defines the IPv6 address (and optional port) to be used for outgoing NOTIFY messages.	transfer
notify-to-soa	Controls whether the name servers in the NS RRset are checked against the SOA MNAME.	transfer
nsec3param	Specifies the use of NSEC3 instead of NSEC, and sets NSEC3 parameters.	dnssec
nta-lifetime	Specifies the lifetime, in seconds, for negative trust anchors added via rndc nta.	dnssec
nta-recheck	Specifies the time interval for checking whether negative trust anchors added via rndc nta are still necessary.	dnssec
null	Causes all messages sent to the logging channel to be discarded.	logging
nxdomain-redirect	Appends the specified suffix to the original query name, when replacing an NXDOMAIN with a redirect namespace.	query
nxdomains-per-second	Limits the number of undefined subdomains for a valid domain name.	query
offline-ksk	Specifies whether the DNSKEY, CDS, and CDNSKEY RRsets are being signed offline.	dnssec
options	Defines global options to be used by BIND 9.	server
padding	Adds EDNS Padding options to outgoing messages to increase the packet size.	server
parent-ds-ttl	Sets the time to live (TTL) of the DS RRset used by the parent zone.	dnssec
parent-propagation-delay	Sets the propagation delay from the time the parent zone is updated to when the new version is served by all of the parent zone's name servers.	dnssec, zone
parental-agents		dnssec
parental-source	Specifies which local IPv4 source address is used to send parental DS queries.	dnssec
parental-source-v6	Specifies which local IPv6 source address is used to send parental DS queries.	dnssec
pid-file	Specifies the pathname of the file where the server writes its process ID.	server
pkcs11-uri		dnssec, pkcs11
plugin	Configures plugins in named.conf.	server
port	Specifies the UDP/TCP port number the server uses to receive and send DNS protocol traffic.	server, query
prefer-server-ciphers	Specifies that server ciphers should be preferred over client ones.	server, security
preferred-glue	Controls the order of glue records in an A or AAAA response.	query
prefetch	Specifies the "trigger" time-to-live (TTL) value at which prefetch of the current query takes place.	query
primaries	Defines one or more servers that zone transfer can be requested from.	transfer, zone
print-category	Includes the category in log messages.	logging
print-severity	Includes the severity in log messages.	logging
print-time	Specifies the time format for log messages.	logging
protocols	Specifies the allowed versions of the TLS protocol.	security
provide-ixfr	Controls whether a primary responds to an incremental zone request (IXFR) or only responds with a full zone transfer (AXFR).	transfer
publish-safety	Increases the amount of time between when keys are published and when they become active, to allow for unforeseen events.	dnssec
purge-keys	Specifies the amount of time after which DNSSEC keys that have been deleted from the zone can be removed from disk.	dnssec
qname-minimization	Controls QNAME minimization behavior in the BIND 9 resolver.	query
qps-scale	Tightens defenses during DNS attacks by scaling back the ratio of the current query-per-second rate.	query
query-source	Controls the IPv4 address from which queries are issued. If none, then no IPv4 address would be used to issue the query and therefore only IPv6 servers are queried.	query
query-source-v6	Controls the IPv6 address from which queries are issued. If none, then no IPv6 address would be used to issue the query and therefore only IPv4 servers are quried.	query
querylog	Specifies whether query logging should be active when named first starts.	logging, server
rate-limit	Controls excessive UDP responses, to prevent BIND 9 from being used to amplify reflection denial-of-service (DoS) attacks.	query
recursing-file	Specifies the pathname of the file where the server dumps queries that are currently recursing via rndc recursing.	server
recursion	Defines whether recursion and caching are allowed.	query
recursive-clients	Specifies the maximum number of concurrent recursive queries the server can perform.	query
recursive-only	Toggles whether dns64 synthesis occurs only for recursive queries.	query
referrals-per-second	Limits the number of referrals or delegations to a server for a given domain.	query
remote-hostname	Specifies the expected hostname in the TLS certificate of the remote server.	security
remote-servers	Defines a list of servers to be used by primary and secondary zones.	server
request-expire	Specifies whether the local server requests the EDNS EXPIRE value, when acting as a secondary.	transfer, query
request-ixfr	Controls whether a secondary requests an incremental zone transfer (IXFR) or a full zone transfer (AXFR).	transfer
request-nsid	Controls whether an empty EDNS(0) NSID (Name Server Identifier) option is sent with all queries to authoritative name servers during iterative resolution.	query
require-cookie	Controls whether responses without a server cookie are accepted.	query
require-server-cookie	Controls whether a valid server cookie is required before sending a full response to a UDP request.	query
resolver-query-timeout	Specifies the length of time, in milliseconds, that a resolver attempts to resolve a recursive query before failing.	query
resolver-use-dns64	Specifies whether to apply DNS64 mappings when sending queries.	server
response-padding	Adds an EDNS Padding option to encrypted messages, to reduce the chance of guessing the contents based on size.	query
response-policy	Specifies response policy zones for the view or among global options.	server, query, zone, security
responselog	Specifies whether response logging should be active when named first starts.	logging, server
responses-per-second	Limits the number of non-empty responses for a valid domain name and record type.	query
retire-safety	Increases the amount of time a key remains published after it is no longer active, to allow for unforeseen events.	dnssec
reuseport	Enables kernel load-balancing of sockets.	server
root-key-sentinel	Controls whether BIND 9 responds to root key sentinel probes.	server
rrset-order	Defines the order in which equal RRs (RRsets) are returned.	query
search	Specifies whether a Dynamically Loadable Zone (DLZ) module is queried for an answer to a query name.	query
secret	Defines a Base64-encoded string to be used as the secret by the algorithm.	security
secroots-file	Specifies the pathname of the file where the server dumps security roots, when using rndc secroots.	dnssec
send-cookie	Controls whether a COOKIE EDNS option is sent along with a query.	query
serial-query-rate	Defines an upper limit on the number of queries per second issued by the server, when querying the SOA RRs used for zone transfers.	transfer
serial-update-method	Specifies the update method to be used for the zone serial number in the SOA record.	zone
server	Defines characteristics to be associated with a remote name server.	server
server-addresses	Specifies a list of IP addresses to which queries should be sent in recursive resolution for a static-stub zone.	query, zone
server-id	Specifies the ID of the server to return in response to a ID.SERVER query.	server
server-names	Specifies a list of domain names of name servers that act as authoritative servers of a static-stub zone.	zone
servfail-ttl	Sets the length of time (in seconds) that a SERVFAIL response is cached.	server
session-keyalg	Specifies the algorithm to use for the TSIG session key.	security
session-keyfile	Specifies the pathname of the file where a TSIG session key is written, when generated by named for use by nsupdate -l.	security
session-keyname	Specifies the key name for the TSIG session key.	security
session-tickets	Enables or disables session resumption through TLS session tickets.	security
severity	Defines the priority level of log messages.	logging
sig-signing-nodes	Specifies the maximum number of nodes to be examined in each quantum, when signing a zone with a new DNSKEY.	dnssec
sig-signing-signatures	Specifies the threshold for the number of signatures that terminates processing a quantum, when signing a zone with a new DNSKEY.	dnssec
sig-signing-type	Specifies a private RDATA type to use when generating signing-state records.	dnssec
sig-validity-interval		obsolete
sig0checks-quota	Specifies the maximum number of concurrent SIG(0) signature checks that can be processed by the server.	server
sig0checks-quota-exempt	Exempts specific clients or client groups from SIG(0) signature checking quota.	server
sig0key-checks-limit	Specifies the maximum number of SIG(0) keys to consider when trying to verify a message.	server
sig0message-checks-limit	Specifies the maximum number of matching SIG(0) keys to try to verify a message.	server
signatures-jitter	Specifies a range for signature expirations.	dnssec
signatures-refresh	Specifies how frequently an RRSIG record is refreshed.	dnssec
signatures-validity	Indicates the validity period of an RRSIG record.	dnssec
signatures-validity-dnskey	Indicates the validity period of DNSKEY records.	dnssec
slip	Sets the number of "slipped" responses to minimize the use of forged source addresses for an attack.	query
sortlist	Controls the ordering of RRs returned to the client, based on the client's IP address.	query, deprecated
stale-answer-client-timeout	Defines the amount of time (in milliseconds) that named waits before attempting to answer a query with a stale RRset from cache.	server, query
stale-answer-enable	Enables the returning of "stale" cached answers when the name servers for a zone are not answering.	server, query
stale-answer-ttl	Specifies the time to live (TTL) to be returned on stale answers, in seconds.	query
stale-cache-enable	Enables the retention of "stale" cached answers.	server, query
stale-refresh-time	Sets the time window for the return of "stale" cached answers before the next attempt to contact, if the name servers for a given zone are not responding.	server, query
startup-notify-rate	Specifies the rate at which NOTIFY requests are sent when the name server is first starting, or when new zones have been added.	transfer, zone
statistics-channels	Specifies the communication channels to be used by system administrators to access statistics information on the name server.	logging
statistics-file	Specifies the pathname of the file where the server appends statistics, when using rndc stats.	logging, server
stderr	Directs the logging channel output to the server's standard error stream.	logging
streams-per-connection	Specifies the maximum number of concurrent HTTP/2 streams over an HTTP/2 connection.	server, query
suffix	Defines trailing bits for mapped IPv4 address bits in dns64.	query
synth-from-dnssec	Enables support for RFC 8198, Aggressive Use of DNSSEC-Validated Cache.	dnssec
syslog	Directs the logging channel to the system log.	logging
tcp-advertised-timeout	Sets the timeout value (in milliseconds) that the server sends in responses containing the EDNS TCP keepalive option.	query
tcp-clients	Specifies the maximum number of simultaneous client TCP connections accepted by the server.	server
tcp-idle-timeout	Sets the amount of time (in milliseconds) that the server waits on an idle TCP connection before closing it, if the EDNS TCP keepalive option is not in use.	query
tcp-initial-timeout	Sets the amount of time (in milliseconds) that the server waits on a new TCP connection for the first message from the client.	server, query
tcp-keepalive	Adds EDNS TCP keepalive to messages sent over TCP.	server
tcp-keepalive-timeout	Sets the amount of time (in milliseconds) that the server waits on an idle TCP connection before closing it, if the EDNS TCP keepalive option is in use.	query
tcp-listen-queue	Sets the listen-queue depth.	server
tcp-only	Sets the transport protocol to TCP.	server
tcp-receive-buffer	Sets the operating system's receive buffer size for TCP sockets.	server
tcp-send-buffer	Sets the operating system's send buffer size for TCP sockets.	server
tkey-gssapi-credential	Sets the security credential for authentication keys requested by the GSS-TSIG protocol.	security
tkey-gssapi-keytab	Sets the KRB5 keytab file to use for GSS-TSIG updates.	security
tls	Configures a TLS connection.	security
tls-port	Specifies the TCP port number the server uses to receive and send DNS-over-TLS protocol traffic.	server, query
transfer-format	Controls whether multiple records can be packed into a message during zone transfers.	transfer
transfer-message-size	Limits the uncompressed size of DNS messages used in zone transfers over TCP.	transfer
transfer-source	Defines which local IPv4 address(es) are bound to TCP connections used to fetch zones transferred inbound by the server.	transfer
transfer-source-v6	Defines which local IPv6 address(es) are bound to TCP connections used to fetch zones transferred inbound by the server.	transfer
transfers	Limits the number of concurrent inbound zone transfers from a server.	server
transfers-in	Limits the number of concurrent inbound zone transfers.	transfer
transfers-out	Limits the number of concurrent outbound zone transfers.	transfer
transfers-per-ns	Limits the number of concurrent inbound zone transfers from a remote server.	transfer
trust-anchor-telemetry	Instructs named to send specially formed queries once per day to domains for which trust anchors have been configured.	dnssec
trust-anchors	Defines DNSSEC trust anchors.	dnssec
trusted-keys		deprecated
try-tcp-refresh	Specifies that BIND 9 should attempt to refresh a zone using TCP if UDP queries fail.	transfer
type	Specifies the kind of zone in a given configuration.	zone
type forward	Contains forwarding statements that apply to queries within a given domain.	zone
type hint	Contains the initial set of root name servers to be used at BIND 9 startup.	zone
type mirror	Contains a DNSSEC-validated duplicate of the main data for a zone.	zone
type primary	Contains the main copy of the data for a zone.	zone
type redirect	Contains information to answer queries when normal resolution would return NXDOMAIN.	zone
type secondary	Contains a duplicate of the data for a zone that has been transferred from a primary server.	zone
type static-stub	Contains statically configured NS records for a zone.	zone
type stub	Contains a duplicate of the NS records of a zone.	zone
udp-receive-buffer	Sets the operating system's receive buffer size for UDP sockets.	server
udp-send-buffer	Sets the operating system's send buffer size for UDP sockets.	server
unix	Specifies a Unix domain socket as a control channel.	obsolete
update-check-ksk		obsolete
update-policy	Sets fine-grained rules to allow or deny dynamic updates (DDNS), based on requester identity, updated content, etc.	transfer
update-quota	Specifies the maximum number of concurrent DNS UPDATE messages that can be processed by the server.	server
use-v4-udp-ports	Specifies a list of ports that are valid sources for UDP/IPv4 messages.	deprecated
use-v6-udp-ports	Specifies a list of ports that are valid sources for UDP/IPv6 messages.	deprecated
v6-bias	Indicates the number of milliseconds of preference to give to IPv6 name servers.	server, query
validate-except	Specifies a list of domain names at and beneath which DNSSEC validation should not be performed.	dnssec
version	Specifies the version number of the server to return in response to a version.bind query.	server
view	Allows a name server to answer a DNS query differently depending on who is asking.	view
window	Specifies the length of time during which responses are tracked.	query
zero-no-soa-ttl	Specifies whether to set the time to live (TTL) of the SOA record to zero, when returning authoritative negative responses to SOA queries.	zone, query, server
zero-no-soa-ttl-cache	Sets the time to live (TTL) to zero when caching a negative response to an SOA query.	zone, query, server
zone	Specifies the zone in a BIND 9 configuration.	zone
zone-propagation-delay	Sets the propagation delay from the time a zone is first updated to when the new version of the zone is served by all secondary servers.	dnssec, zone
zone-statistics	Controls the level of statistics gathered for all zones.	zone, logging