jarl/internal/catalog/data/statements-9.20.tsv

1	# (https://bind9.readthedocs.io/en/v9.20.24/reference.html#statements).
2	# Format: name<TAB>description<TAB>tags (comma separated)
3	acl	Assigns a symbolic name to an address match list.	server
4	algorithm	Defines the algorithm to be used in a key clause.	security
5	all-per-second	Limits UDP responses of all kinds.	query
6	allow-new-zones	Controls the ability to add zones at runtime via rndc addzone.	server, zone
7	allow-notify	Defines an address_match_list that is allowed to send NOTIFY messages for the zone, in addition to addresses defined in the primaries option for the zone.	transfer
8	allow-proxy	Defines an address_match_list for the client addresses allowed to send PROXYv2 headers.	server
9	allow-proxy-on	Defines an address_match_list for the interface addresses allowed to accept PROXYv2 headers. The option is mostly intended for multi-homed configurations.	server
10	allow-query	Specifies which hosts (an IP address list) are allowed to send queries to this resolver.	query
11	allow-query-cache	Specifies which hosts (an IP address list) can access this server's cache and thus effectively controls recursion.	query
12	allow-query-cache-on	Specifies which hosts (from an IP address list) can access this server's cache. It is used on servers with multiple interfaces.	query
13	allow-query-on	Specifies which local addresses (an IP address list) are allowed to send queries to this resolver. This option is used in multi-homed configurations.	query
14	allow-recursion	Defines an address_match_list of clients that are allowed to perform recursive queries.	query
15	allow-recursion-on	Specifies which local addresses can accept recursive queries.	query, server
16	allow-transfer	Defines an address_match_list of hosts that are allowed to transfer the zone information from this server.	transfer
17	allow-update	Defines an address_match_list of hosts that are allowed to submit dynamic updates for primary zones.	transfer
18	allow-update-forwarding	Defines an address_match_list of hosts that are allowed to submit dynamic updates to a secondary server for transmission to a primary.	transfer
19	also-notify	Defines one or more hosts that are sent NOTIFY messages when zone changes occur.	transfer
20	answer-cookie	Controls whether COOKIE EDNS replies are sent in response to client queries.	query
21	attach-cache	Allows multiple views to share a single cache database.	view
22	auth-nxdomain	Controls whether BIND, acting as a resolver, provides authoritative NXDOMAIN (domain does not exist) answers.	query
23	automatic-interface-scan	Controls the automatic rescanning of network interfaces when addresses are added or removed.	server
24	avoid-v4-udp-ports	Specifies the range(s) of ports to be excluded from use as sources for UDP/IPv4 messages.	deprecated
25	avoid-v6-udp-ports	Specifies the range(s) of ports to be excluded from use as sources for UDP/IPv6 messages.	deprecated
26	bindkeys-file	Specifies the pathname of a file to override the built-in trusted keys provided by named.	dnssec
27	blackhole	Defines an address_match_list of hosts to ignore. The server will neither respond to queries from nor send queries to these addresses.	query
28	bogus	Allows a remote server to be ignored.	server
29	break-dnssec	Enables dns64 synthesis even if the validated result would cause a DNSSEC validation failure.	query
30	buffered	Controls flushing of log messages.	logging
31	ca-file	Specifies the path to a file containing TLS certificates for trusted CA authorities, used to verify remote peer certificates.	server, security
32	catalog-zones	Configures catalog zones in named.conf.	zone
33	category	Specifies the type of data logged to a particular channel.	logging
34	cdnskey	Specifies whether a CDNSKEY record should be published during KSK rollover.	dnssec
35	cds-digest-types	Specifies the digest types to use for CDS resource records.	dnssec
36	cert-file	Specifies the path to a file containing the TLS certificate for a connection.	server, security
37	channel	Defines a stream of data that can be independently logged.	logging
38	check-dup-records	Checks primary zones for records that are treated as different by DNSSEC but are semantically equal in plain DNS.	dnssec, query
39	check-integrity	Performs post-load zone integrity checks on primary zones.	zone
40	check-mx	Checks whether an MX record appears to refer to an IP address.	zone
41	check-mx-cname	Sets the response to MX records that refer to CNAMEs.	zone
42	check-names	Restricts the character set and syntax of certain domain names in primary files and/or DNS responses received from the network.	query, server
43	check-sibling	Specifies whether to check for sibling glue when performing integrity checks.	zone
44	check-spf	Specifies whether to check for a TXT Sender Policy Framework record, if an SPF record is present.	zone
45	check-srv-cname	Sets the response to SRV records that refer to CNAMEs.	zone
46	check-svcb	Specifies whether to perform additional checks on SVCB records.	zone
47	check-wildcard	Checks for non-terminal wildcards.	zone
48	checkds	Controls whether DS queries are sent to parental agents.	dnssec
49	cipher-suites	Specifies a list of allowed cipher suites in the order of preference for TLSv1.3 only.	security
50	ciphers	Specifies a list of allowed ciphers in the order of preference for TLSv1.2 only.	security
51	clients	Specifies an access control list (ACL) of clients that are affected by a given dns64 directive.	query
52	clients-per-query	Sets the initial minimum number of simultaneous recursive clients accepted by the server for any given query before the server drops additional clients.	server
53	controls	Specifies control channels to be used to manage the name server.	server
54	cookie-algorithm	Sets the algorithm to be used when generating a server cookie.	server
55	cookie-secret	Specifies a shared secret used for generating and verifying EDNS COOKIE options within an anycast cluster.	server
56	database	Specifies the type of database to be used to store zone data.	zone
57	deny-answer-addresses	Rejects A or AAAA records if the corresponding IPv4 or IPv6 addresses match a given address_match_list.	query
58	dhparam-file	Specifies the path to a file containing Diffie-Hellman parameters, for enabling cipher suites.	server, security
59	dialup	Concentrates zone maintenance so that all transfers take place once every heartbeat-interval, ideally during a single call.	deprecated
60	directory	Sets the server's working directory.	server
61	disable-algorithms	Disables DNSSEC algorithms from a specified zone.	dnssec
62	disable-ds-digests	Disables DS digest types from a specified zone.	dnssec, zone
63	disable-empty-zone	Disables individual empty zones.	server, zone
64	dlz	Configures a Dynamically Loadable Zone (DLZ) database in named.conf.	zone
65	dns64	Instructs named to return mapped IPv4 addresses to AAAA queries when there are no AAAA records.	query
66	dns64-contact	Specifies the name of the contact for dns64 zones.	server
67	dns64-server	Specifies the name of the server for dns64 zones.	server
68	dnskey-sig-validity		obsolete
69	dnskey-ttl	Specifies the time-to-live (TTL) for DNSKEY resource records.	dnssec
70	dnsrps-enable	Turns on the DNS Response Policy Service (DNSRPS) interface.	server, security
71	dnsrps-library	Specifies the path to the DNS Response Policy Service (DNSRPS) provider library.	server, security
72	dnsrps-options	Provides additional RPZ configuration settings, which are passed to the DNS Response Policy Service (DNSRPS) provider library.	server, security
73	dnssec-accept-expired	Instructs BIND 9 to accept expired DNSSEC signatures when validating.	dnssec
74	dnssec-dnskey-kskonly		obsolete
75	dnssec-loadkeys-interval	Sets the frequency of automatic checks of the DNSSEC key repository.	dnssec
76	dnssec-must-be-secure	Defines hierarchies that must or may not be secure (signed and validated).	deprecated
77	dnssec-policy	Defines a key and signing policy (KASP) for zones.	dnssec
78	dnssec-secure-to-insecure		obsolete
79	dnssec-update-mode		obsolete
80	dnssec-validation	Enables DNSSEC validation in named.	dnssec
81	dnstap	Enables logging of dnstap messages.	logging
82	dnstap-identity	Specifies an identity string to send in dnstap messages.	logging
83	dnstap-output	Configures the path to which the dnstap frame stream is sent.	logging
84	dnstap-version	Specifies a version string to send in dnstap messages.	logging
85	dual-stack-servers	Specifies host names or addresses of machines with access to both IPv4 and IPv6 transports.	server
86	dump-file	Indicates the pathname of the file where the server dumps the database after rndc dumpdb.	logging
87	dyndb	Configures a DynDB database in named.conf.	zone
88	edns	Controls the use of the EDNS0 (RFC 2671) feature.	server
89	edns-udp-size	Sets the maximum advertised EDNS UDP buffer size to control the size of packets received from authoritative servers in response to recursive queries.	query
90	edns-version	Sets the maximum EDNS VERSION that is sent to the server(s) by the resolver.	server
91	empty-contact	Specifies the contact name in the returned SOA record for empty zones.	server, zone
92	empty-server	Specifies the server name in the returned SOA record for empty zones.	server, zone
93	empty-zones-enable	Enables or disables all empty zones.	server, zone
94	endpoints	Specifies a list of HTTP query paths on which to listen.	server, query
95	errors-per-second	Limits the number of errors for a valid domain name and record type.	server
96	exclude	Allows a list of IPv6 addresses to be ignored if they appear in a domain name's AAAA records in dns64.	query
97	exempt-clients	Exempts specific clients or client groups from rate limiting.	query
98	fetch-quota-params	Sets the parameters for dynamic resizing of the fetches-per-server quota in response to detected congestion.	server, query
99	fetches-per-server	Sets the maximum number of simultaneous iterative queries allowed to be sent by a server to an upstream name server before the server blocks additional queries.	server, query
100	fetches-per-zone	Sets the maximum number of simultaneous iterative queries allowed to any one domain before the server blocks new queries for data in or beneath that zone.	server, query
101	file	Specifies the zone's filename.	zone
102	flush-zones-on-shutdown	Controls whether pending zone writes are flushed when the name server exits.	zone
103	forward	Allows or disallows fallback to recursion if forwarding has failed; it is always used in conjunction with the forwarders statement.	query
104	forwarders	Defines one or more resolvers to which queries are forwarded.	query
105	fstrm-set-buffer-hint	Sets the number of accumulated bytes in the output buffer before forcing a buffer flush.	logging
106	fstrm-set-flush-timeout	Sets the number of seconds that unflushed data remains in the output buffer.	logging
107	fstrm-set-input-queue-size	Sets the number of queue entries to allocate for each input queue.	logging
108	fstrm-set-output-notify-threshold	Sets the number of outstanding queue entries allowed on an input queue before waking the I/O thread.	logging
109	fstrm-set-output-queue-model	Sets the queuing semantics to use for queue objects.	logging
110	fstrm-set-output-queue-size	Sets the number of queue entries allocated for each output queue.	logging
111	fstrm-set-reopen-interval	Sets the number of seconds to wait between attempts to reopen a closed output stream.	logging
112	geoip-directory	Specifies the directory containing GeoIP database files.	server
113	heartbeat-interval	Sets the interval at which the server performs zone maintenance tasks for all zones marked as dialup.	deprecated
114	hostname	Specifies the hostname of the server to return in response to a hostname.bind query.	server
115	http	Configures HTTP endpoints on which to listen for DNS-over-HTTPS (DoH) queries.	server, query
116	http-listener-clients	Limits the number of active concurrent connections on a per-listener basis.	server
117	http-port	Specifies the TCP port number the server uses to receive and send unencrypted DNS traffic via HTTP.	server, query
118	http-streams-per-connection	Limits the number of active concurrent HTTP/2 streams on a per-connection basis.	server
119	https-port	Specifies the TCP port number the server uses to receive and send DNS-over-HTTPS protocol traffic.	server, query
120	in-view	Specifies the view in which a given zone is defined.	view, zone
121	inet	Specifies a TCP socket as a control channel.	server
122	inline-signing	Specifies whether BIND 9 maintains a separate signed version of a zone.	dnssec, zone
123	interface-interval	Sets the interval at which the server scans the network interface list.	server
124	ipv4-prefix-length	Specifies the prefix lengths of IPv4 address blocks.	server
125	ipv4only-contact	Specifies the contact for the IPV4ONLY.ARPA zone created by dns64.	server
126	ipv4only-enable	Enables automatic IPv4 zones if a dns64 block is configured.	query
127	ipv4only-server	Specifies the name of the server for the IPV4ONLY.ARPA zone created by dns64.	server, query
128	ipv6-prefix-length	Specifies the prefix lengths of IPv6 address blocks.	server
129	ixfr-from-differences	Controls how IXFR transfers are calculated.	transfer
130	journal	Allows the default journal's filename to be overridden.	zone
131	key	Defines a shared secret key for use with TSIG or the command channel.	security
132	key-directory	Indicates the directory where public and private DNSSEC key files are found.	dnssec
133	key-file	Specifies the path to a file containing the private TLS key for a connection.	server, security
134	key-store	Configures a DNSSEC key store.	dnssec
135	keys	Specifies one or more server_key s to be used with a remote server.	server, security
136	lame-ttl	Sets the resolver's lame cache.	server
137	listen-on	Specifies the IPv4 addresses on which a server listens for DNS queries.	server
138	listen-on-v6	Specifies the IPv6 addresses on which a server listens for DNS queries.	server
139	listener-clients	Specifies a per-listener quota for active connections.	server, query
140	lmdb-mapsize	Sets a maximum size for the memory map of the new-zone database in LMDB database format.	server
141	log-only	Tests rate-limiting parameters without actually dropping any requests.	logging, query
142	logging	Configures logging options for the name server.	logging
143	managed-keys		deprecated
144	managed-keys-directory	Specifies the directory in which to store the files that track managed DNSSEC keys.	dnssec
145	manual-mode	Run key management in a manual mode.	dnssec
146	mapped	Specifies an access control list (ACL) of IPv4 addresses that are to be mapped to the corresponding A RRset in dns64.	query
147	masterfile-format	Specifies the file format of zone files.	zone, server
148	masterfile-style	Specifies the format of zone files during a dump, when the masterfile-format is text.	server
149	match-clients	Specifies a view of DNS namespace for a given subset of client IP addresses.	view
150	match-destinations	Specifies a view of DNS namespace for a given subset of destination IP addresses.	view
151	match-mapped-addresses	Allows IPv4-mapped IPv6 addresses to match address-match list entries for corresponding IPv4 addresses.	server
152	match-recursive-only	Specifies that only recursive requests can match this view of the DNS namespace.	view
153	max-cache-size	Sets the maximum amount of memory to use for an individual cache database and its associated metadata.	server
154	max-cache-ttl	Specifies the maximum time (in seconds) that the server caches ordinary (positive) answers.	server
155	max-clients-per-query	Sets the maximum number of simultaneous recursive clients accepted by the server for any given query before the server drops additional clients.	server
156	max-ixfr-ratio	Sets the maximum size for IXFR responses to zone transfer requests.	transfer
157	max-journal-size	Controls the size of journal files.	transfer
158	max-ncache-ttl	Specifies the maximum retention time (in seconds) for storage of negative answers in the server's cache.	server
159	max-query-count	Sets the maximum number of iterative queries while servicing a recursive query.	server, query
160	max-query-restarts	Sets the maximum number of chained CNAMEs to follow	server, query
161	max-records	Sets the maximum number of records permitted in a zone.	zone, server
162	max-records-per-type	Sets the maximum number of records that can be stored in an RRset.	server
163	max-recursion-depth	Sets the maximum number of levels of recursion permitted at any one time while servicing a recursive query.	server
164	max-recursion-queries	Sets the maximum number of iterative queries while servicing a recursive query.	server, query
165	max-refresh-time	Limits the zone refresh interval to no less often than the specified value, in seconds.	transfer
166	max-retry-time	Limits the zone refresh retry interval to no less often than the specified value, in seconds.	transfer
167	max-rsa-exponent-size	Sets the maximum RSA exponent size (in bits) when validating.	dnssec, query
168	max-stale-ttl	Specifies the maximum time that the server retains records past their normal expiry, to return them as stale records.	server
169	max-table-size	Sets the maximum size of the table used to track requests and rate-limit responses.	server
170	max-transfer-idle-in	Specifies the number of minutes after which inbound zone transfers making no progress are terminated.	transfer
171	max-transfer-idle-out	Specifies the number of minutes after which outbound zone transfers making no progress are terminated.	transfer
172	max-transfer-time-in	Specifies the number of minutes after which inbound zone transfers are terminated.	transfer
173	max-transfer-time-out	Specifies the number of minutes after which outbound zone transfers are terminated.	transfer
174	max-types-per-name	Sets the maximum number of RR types that can be stored for an owner name.	server
175	max-udp-size	Sets the maximum EDNS UDP message size sent by named.	query
176	max-validation-failures-per-fetch	Sets the maximum number of DNSSEC validation failures that can happen in a single fetch.	server
177	max-validations-per-fetch	Sets the maximum number of DNSSEC validations that can happen in a single fetch.	server
178	max-zone-ttl	Specifies a maximum permissible time-to-live (TTL) value, in seconds.	deprecated
179	memstatistics	Controls whether memory statistics are written to the file specified by memstatistics-file at exit.	server, logging
180	memstatistics-file	Sets the pathname of the file where the server writes memory usage statistics on exit.	logging
181	message-compression	Controls whether DNS name compression is used in responses to regular queries.	query
182	min-cache-ttl	Specifies the minimum time (in seconds) that the server caches ordinary (positive) answers.	server
183	min-ncache-ttl	Specifies the minimum retention time (in seconds) for storage of negative answers in the server's cache.	server
184	min-refresh-time	Limits the zone refresh interval to no more often than the specified value, in seconds.	transfer
185	min-retry-time	Limits the zone refresh retry interval to no more often than the specified value, in seconds.	transfer
186	min-table-size	Sets the minimum size of the table used to track requests and rate-limit responses.	query
187	min-transfer-rate-in	Specifies the minimum traffic rate below which inbound zone transfers are terminated.	transfer
188	minimal-any	Controls whether the server replies with only one of the RRsets for a query name, when generating a positive response to a query of type ANY over UDP.	query
189	minimal-responses	Controls whether the server only adds records to the authority and additional data sections when they are required (e.g. delegations, negative responses). This improves server performance.	query
190	multi-master	Controls whether serial number mismatch errors are logged.	transfer
191	new-zones-directory	Specifies the directory where configuration parameters are stored for zones added by rndc addzone.	zone
192	no-case-compress	Specifies a list of addresses that require case-insensitive compression in responses.	server
193	nocookie-udp-size	Sets the maximum size of UDP responses that are sent to queries without a valid server COOKIE.	query
194	nodata-per-second	Limits the number of empty (NODATA) responses for a valid domain name.	query
195	notify	Controls whether NOTIFY messages are sent on zone changes.	transfer
196	notify-defer	Sets the defer time (in seconds) before sending NOTIFY messages for a zone.	transfer, zone
197	notify-delay	Sets the delay (in seconds) between sending sets of NOTIFY messages for a zone.	transfer, zone
198	notify-rate	Specifies the rate at which NOTIFY requests are sent during normal zone maintenance operations.	transfer, zone
199	notify-source	Defines the IPv4 address (and optional port) to be used for outgoing NOTIFY messages.	transfer
200	notify-source-v6	Defines the IPv6 address (and optional port) to be used for outgoing NOTIFY messages.	transfer
201	notify-to-soa	Controls whether the name servers in the NS RRset are checked against the SOA MNAME.	transfer
202	nsec3param	Specifies the use of NSEC3 instead of NSEC, and sets NSEC3 parameters.	dnssec
203	nta-lifetime	Specifies the lifetime, in seconds, for negative trust anchors added via rndc nta.	dnssec
204	nta-recheck	Specifies the time interval for checking whether negative trust anchors added via rndc nta are still necessary.	dnssec
205	null	Causes all messages sent to the logging channel to be discarded.	logging
206	nxdomain-redirect	Appends the specified suffix to the original query name, when replacing an NXDOMAIN with a redirect namespace.	query
207	nxdomains-per-second	Limits the number of undefined subdomains for a valid domain name.	query
208	offline-ksk	Specifies whether the DNSKEY, CDS, and CDNSKEY RRsets are being signed offline.	dnssec
209	options	Defines global options to be used by BIND 9.	server
210	padding	Adds EDNS Padding options to outgoing messages to increase the packet size.	server
211	parent-ds-ttl	Sets the time to live (TTL) of the DS RRset used by the parent zone.	dnssec
212	parent-propagation-delay	Sets the propagation delay from the time the parent zone is updated to when the new version is served by all of the parent zone's name servers.	dnssec, zone
213	parental-agents		dnssec
214	parental-source	Specifies which local IPv4 source address is used to send parental DS queries.	dnssec
215	parental-source-v6	Specifies which local IPv6 source address is used to send parental DS queries.	dnssec
216	pid-file	Specifies the pathname of the file where the server writes its process ID.	server
217	pkcs11-uri		dnssec, pkcs11
218	plugin	Configures plugins in named.conf.	server
219	port	Specifies the UDP/TCP port number the server uses to receive and send DNS protocol traffic.	server, query
220	prefer-server-ciphers	Specifies that server ciphers should be preferred over client ones.	server, security
221	preferred-glue	Controls the order of glue records in an A or AAAA response.	query
222	primaries	Defines one or more servers that zone transfer can be requested from.	transfer, zone
223	print-category	Includes the category in log messages.	logging
224	print-severity	Includes the severity in log messages.	logging
225	print-time	Specifies the time format for log messages.	logging
226	protocols	Specifies the allowed versions of the TLS protocol.	security
227	provide-ixfr	Controls whether a primary responds to an incremental zone request (IXFR) or only responds with a full zone transfer (AXFR).	transfer
228	publish-safety	Increases the amount of time between when keys are published and when they become active, to allow for unforeseen events.	dnssec
229	purge-keys	Specifies the amount of time after which DNSSEC keys that have been deleted from the zone can be removed from disk.	dnssec
230	qname-minimization	Controls QNAME minimization behavior in the BIND 9 resolver.	query
231	qps-scale	Tightens defenses during DNS attacks by scaling back the ratio of the current query-per-second rate.	query
232	query-source	Controls the IPv4 address from which queries are issued. If none, then no IPv4 address would be used to issue the query and therefore only IPv6 servers are queried.	query
233	query-source-v6	Controls the IPv6 address from which queries are issued. If none, then no IPv6 address would be used to issue the query and therefore only IPv4 servers are quried.	query
234	querylog	Specifies whether query logging should be active when named first starts.	logging, server
235	rate-limit	Controls excessive UDP responses, to prevent BIND 9 from being used to amplify reflection denial-of-service (DoS) attacks.	query
236	recursing-file	Specifies the pathname of the file where the server dumps queries that are currently recursing via rndc recursing.	server
237	recursion	Defines whether recursion and caching are allowed.	query
238	recursive-clients	Specifies the maximum number of concurrent recursive queries the server can perform.	query
239	recursive-only	Toggles whether dns64 synthesis occurs only for recursive queries.	query
240	referrals-per-second	Limits the number of referrals or delegations to a server for a given domain.	query
241	remote-hostname	Specifies the expected hostname in the TLS certificate of the remote server.	security
242	remote-servers	Defines a list of servers to be used by primary and secondary zones.	server
243	request-expire	Specifies whether the local server requests the EDNS EXPIRE value, when acting as a secondary.	transfer, query
244	request-ixfr	Controls whether a secondary requests an incremental zone transfer (IXFR) or a full zone transfer (AXFR).	transfer
245	request-nsid	Controls whether an empty EDNS(0) NSID (Name Server Identifier) option is sent with all queries to authoritative name servers during iterative resolution.	query
246	require-cookie	Controls whether responses without a server cookie are accepted.	query
247	require-server-cookie	Controls whether a valid server cookie is required before sending a full response to a UDP request.	query
248	resolver-query-timeout	Specifies the length of time, in milliseconds, that a resolver attempts to resolve a recursive query before failing.	query
249	resolver-use-dns64	Specifies whether to apply DNS64 mappings when sending queries.	server
250	response-padding	Adds an EDNS Padding option to encrypted messages, to reduce the chance of guessing the contents based on size.	query
251	response-policy	Specifies response policy zones for the view or among global options.	server, query, zone, security
252	responselog	Specifies whether response logging should be active when named first starts.	logging, server
253	responses-per-second	Limits the number of non-empty responses for a valid domain name and record type.	query
254	retire-safety	Increases the amount of time a key remains published after it is no longer active, to allow for unforeseen events.	dnssec
255	reuseport	Enables kernel load-balancing of sockets.	server
256	root-key-sentinel	Controls whether BIND 9 responds to root key sentinel probes.	server
257	rrset-order	Defines the order in which equal RRs (RRsets) are returned.	query
258	search	Specifies whether a Dynamically Loadable Zone (DLZ) module is queried for an answer to a query name.	query
259	secret	Defines a Base64-encoded string to be used as the secret by the algorithm.	security
260	secroots-file	Specifies the pathname of the file where the server dumps security roots, when using rndc secroots.	dnssec
261	send-cookie	Controls whether a COOKIE EDNS option is sent along with a query.	query
262	serial-query-rate	Defines an upper limit on the number of queries per second issued by the server, when querying the SOA RRs used for zone transfers.	transfer
263	serial-update-method	Specifies the update method to be used for the zone serial number in the SOA record.	zone
264	server	Defines characteristics to be associated with a remote name server.	server
265	server-addresses	Specifies a list of IP addresses to which queries should be sent in recursive resolution for a static-stub zone.	query, zone
266	server-id	Specifies the ID of the server to return in response to a ID.SERVER query.	server
267	server-names	Specifies a list of domain names of name servers that act as authoritative servers of a static-stub zone.	zone
268	servfail-ttl	Sets the length of time (in seconds) that a SERVFAIL response is cached.	server
269	session-keyalg	Specifies the algorithm to use for the TSIG session key.	security
270	session-keyfile	Specifies the pathname of the file where a TSIG session key is written, when generated by named for use by nsupdate -l.	security
271	session-keyname	Specifies the key name for the TSIG session key.	security
272	session-tickets	Enables or disables session resumption through TLS session tickets.	security
273	severity	Defines the priority level of log messages.	logging
274	sig-signing-nodes	Specifies the maximum number of nodes to be examined in each quantum, when signing a zone with a new DNSKEY.	dnssec
275	sig-signing-signatures	Specifies the threshold for the number of signatures that terminates processing a quantum, when signing a zone with a new DNSKEY.	dnssec
276	sig-signing-type	Specifies a private RDATA type to use when generating signing-state records.	dnssec
277	sig-validity-interval		obsolete
278	sig0checks-quota	Specifies the maximum number of concurrent SIG(0) signature checks that can be processed by the server.	server
279	sig0checks-quota-exempt	Exempts specific clients or client groups from SIG(0) signature checking quota.	server
280	sig0key-checks-limit	Specifies the maximum number of SIG(0) keys to consider when trying to verify a message.	server
281	sig0message-checks-limit	Specifies the maximum number of matching SIG(0) keys to try to verify a message.	server
282	signatures-jitter	Specifies a range for signature expirations.	dnssec
283	signatures-refresh	Specifies how frequently an RRSIG record is refreshed.	dnssec
284	signatures-validity	Indicates the validity period of an RRSIG record.	dnssec
285	signatures-validity-dnskey	Indicates the validity period of DNSKEY records.	dnssec
286	sortlist	Controls the ordering of RRs returned to the client, based on the client's IP address.	query, deprecated
287	stale-answer-client-timeout	Defines the amount of time (in milliseconds) that named waits before attempting to answer a query with a stale RRset from cache.	server, query
288	stale-answer-ttl	Specifies the time to live (TTL) to be returned on stale answers, in seconds.	query
289	startup-notify-rate	Specifies the rate at which NOTIFY requests are sent when the name server is first starting, or when new zones have been added.	transfer, zone
290	statistics-channels	Specifies the communication channels to be used by system administrators to access statistics information on the name server.	logging
291	statistics-file	Specifies the pathname of the file where the server appends statistics, when using rndc stats.	logging, server
292	stderr	Directs the logging channel output to the server's standard error stream.	logging
293	streams-per-connection	Specifies the maximum number of concurrent HTTP/2 streams over an HTTP/2 connection.	server, query
294	suffix	Defines trailing bits for mapped IPv4 address bits in dns64.	query
295	synth-from-dnssec	Enables support for RFC 8198, Aggressive Use of DNSSEC-Validated Cache.	dnssec
296	syslog	Directs the logging channel to the system log.	logging
297	tcp-advertised-timeout	Sets the timeout value (in milliseconds) that the server sends in responses containing the EDNS TCP keepalive option.	query
298	tcp-clients	Specifies the maximum number of simultaneous client TCP connections accepted by the server.	server
299	tcp-idle-timeout	Sets the amount of time (in milliseconds) that the server waits on an idle TCP connection before closing it, if the EDNS TCP keepalive option is not in use.	query
300	tcp-initial-timeout	Sets the amount of time (in milliseconds) that the server waits on a new TCP connection for the first message from the client.	server, query
301	tcp-keepalive	Adds EDNS TCP keepalive to messages sent over TCP.	server
302	tcp-keepalive-timeout	Sets the amount of time (in milliseconds) that the server waits on an idle TCP connection before closing it, if the EDNS TCP keepalive option is in use.	query
303	tcp-listen-queue	Sets the listen-queue depth.	server
304	tcp-only	Sets the transport protocol to TCP.	server
305	tcp-receive-buffer	Sets the operating system's receive buffer size for TCP sockets.	server
306	tcp-send-buffer	Sets the operating system's send buffer size for TCP sockets.	server
307	tkey-gssapi-credential	Sets the security credential for authentication keys requested by the GSS-TSIG protocol.	security
308	tkey-gssapi-keytab	Sets the KRB5 keytab file to use for GSS-TSIG updates.	security
309	tls	Configures a TLS connection.	security
310	tls-port	Specifies the TCP port number the server uses to receive and send DNS-over-TLS protocol traffic.	server, query
311	transfer-format	Controls whether multiple records can be packed into a message during zone transfers.	transfer
312	transfer-message-size	Limits the uncompressed size of DNS messages used in zone transfers over TCP.	transfer
313	transfer-source	Defines which local IPv4 address(es) are bound to TCP connections used to fetch zones transferred inbound by the server.	transfer
314	transfer-source-v6	Defines which local IPv6 address(es) are bound to TCP connections used to fetch zones transferred inbound by the server.	transfer
315	transfers	Limits the number of concurrent inbound zone transfers from a server.	server
316	transfers-in	Limits the number of concurrent inbound zone transfers.	transfer
317	transfers-out	Limits the number of concurrent outbound zone transfers.	transfer
318	transfers-per-ns	Limits the number of concurrent inbound zone transfers from a remote server.	transfer
319	trust-anchor-telemetry	Instructs named to send specially formed queries once per day to domains for which trust anchors have been configured.	dnssec
320	trust-anchors	Defines DNSSEC trust anchors.	dnssec
321	trusted-keys		deprecated
322	try-tcp-refresh	Specifies that BIND 9 should attempt to refresh a zone using TCP if UDP queries fail.	transfer
323	type	Specifies the kind of zone in a given configuration.	zone
324	type forward	Contains forwarding statements that apply to queries within a given domain.	zone
325	type hint	Contains the initial set of root name servers to be used at BIND 9 startup.	zone
326	type mirror	Contains a DNSSEC-validated duplicate of the main data for a zone.	zone
327	type primary	Contains the main copy of the data for a zone.	zone
328	type redirect	Contains information to answer queries when normal resolution would return NXDOMAIN.	zone
329	type secondary	Contains a duplicate of the data for a zone that has been transferred from a primary server.	zone
330	type static-stub	Contains statically configured NS records for a zone.	zone
331	type stub	Contains a duplicate of the NS records of a zone.	zone
332	udp-receive-buffer	Sets the operating system's receive buffer size for UDP sockets.	server
333	udp-send-buffer	Sets the operating system's send buffer size for UDP sockets.	server
334	unix	Specifies a Unix domain socket as a control channel.	obsolete
335	update-check-ksk		obsolete
336	update-policy	Sets fine-grained rules to allow or deny dynamic updates (DDNS), based on requester identity, updated content, etc.	transfer
337	update-quota	Specifies the maximum number of concurrent DNS UPDATE messages that can be processed by the server.	server
338	use-v4-udp-ports	Specifies a list of ports that are valid sources for UDP/IPv4 messages.	deprecated
339	use-v6-udp-ports	Specifies a list of ports that are valid sources for UDP/IPv6 messages.	deprecated
340	v6-bias	Indicates the number of milliseconds of preference to give to IPv6 name servers.	server, query
341	validate-except	Specifies a list of domain names at and beneath which DNSSEC validation should not be performed.	dnssec
342	version	Specifies the version number of the server to return in response to a version.bind query.	server
343	view	Allows a name server to answer a DNS query differently depending on who is asking.	view
344	window	Specifies the length of time during which responses are tracked.	query
345	zero-no-soa-ttl	Specifies whether to set the time to live (TTL) of the SOA record to zero, when returning authoritative negative responses to SOA queries.	zone, query, server
346	zero-no-soa-ttl-cache	Sets the time to live (TTL) to zero when caching a negative response to an SOA query.	zone, query, server
347	zone	Specifies the zone in a BIND 9 configuration.	zone
348	zone-propagation-delay	Sets the propagation delay from the time a zone is first updated to when the new version of the zone is served by all secondary servers.	dnssec, zone
349	zone-statistics	Controls the level of statistics gathered for all zones.	zone, logging