acl：定义IP地址表的名字,用于访问控制等
语法:
acl
acl-name
{
address_match_list
;
}
controls：宣告一个用于rndc工具控制通道
语法: controls { [ inet ( ip_addr | * ) [ port ip_port ] allow {address_match_list} keys {key_list}; ] [ inet ...; ] [ unixpathpermnumberownernumbergroupnumberkeys {key_list}; ] [ unix ...; ] };
include：包含一个文件
语法:
include
filename
;
key：定义key信息用于验证和TSIG验证
语法: keykey_id{ algorithmstring; secretstring; };
logging：定义bing服务的日志, channel -> categroy.
语法: logging { [ channelchannel_name{ ( filepath name[ versions (number| unlimited ) ] [ sizesize spec] | syslogsyslog_facility| stderr | null ); [ severity (critical|error|warning|notice|info|debug[level] |dynamic); ] [ print-categoryyesorno; ] [ print-severityyesorno; ] [ print-timeyesorno; ] }; ] [ categorycategory_name{channel_name; [channel_name; ... ] }; ] ... }; category 参数: default: 默认分类,没有分类的日志都使用这个分类的配置. general: 没有分类的日志都记录在此分类中. database: 服务器内部使用存储zone和缓存数据. security: 允许/拒绝的请求. config: 配置文件分析和处理. resolver: DNS解析,被dns缓存服务器进行递归查询. xfer-in: 接收区域传输. xfer-out: 发送区域传输. notify: NOTIFY协议. client: 客户端请求进程. unmatched: 未匹配的查询? network: 网络操作. update: 动态更新. update-security: 允许/拒绝更新请求. queries: 客户端队列日志. dispatch: 数据包传送日志. dnssec: DNSSEC和TSIG协议处理. lame-servers: 远端的配置错误的服务器发送的请求. delegation-only: NXDOMAIN的结果将被强制定义到delegation-only区域
lwres：定义named为一个轻量级的解析进程
语法: lwres { [ listen-on {ip_addr[portip_port] ; [ip_addr[portip_port] ; ... ] }; ] [ viewview_name; ] [ search {domain_name; [domain_name; ... ] }; ] [ ndotsnumber; ] };
masters：定义主域服务器列表
语法: mastersname[portip_port] { (masters_list|ip_addr[portip_port] [keykey] ) ; [... ] };
options：设定全局配置选项和默认值
语法:
options {
[ version version_string
;
]
[ hostname hostname_string
;
]
[ server-id server_id_string
;
]
[ directory path_name
;
]
[ key-directory path_name
;
]
[ named-xfer path_name
;
]
[ tkey-domain domainname
;
]
[ tkey-dhkey key_name key_tag
;
]
[ cache-file path_name
;
]
[ dump-file path_name
;
]
[ memstatistics-file path_name
;
]
[ pid-file path_name
;
]
[ statistics-file path_name
;
]
[ zone-statistics yes_or_no
;
]
[ auth-nxdomain yes_or_no
;
]
[ deallocate-on-exit yes_or_no
;
]
[ dialup dialup_option
;
]
[ fake-iquery yes_or_no
;
]
[ fetch-glue yes_or_no
;
]
[ flush-zones-on-shutdown yes_or_no
;
]
[ has-old-clients yes_or_no
;
]
[ host-statistics yes_or_no
;
]
[ host-statistics-max number
;
]
[ minimal-responses yes_or_no
;
]
[ multiple-cnames yes_or_no
;
]
[ notify yes_or_no
| explicit
| master-only
;
]
[ recursion yes_or_no
;
]
[ rfc2308-type1 yes_or_no
;
]
[ use-id-pool yes_or_no
;
]
[ maintain-ixfr-base yes_or_no
;
]
[ dnssec-enable yes_or_no
;
]
[ dnssec-validation yes_or_no
;
]
[ dnssec-lookaside domain
trust-anchor domain
;
]
[ dnssec-must-be-secure domain yes_or_no
;
]
[ dnssec-accept-expired yes_or_no
;
]
[ forward ( only
| first
);
]
[ forwarders { [ ip_addr [port ip_port ] ; ...
] };
]
[ dual-stack-servers [port ip_port
] {
( domain_name
[port ip_port
] |
ip_addr
[port ip_port
] ) ;
... };
]
[ check-names ( master
| slave
| response
)
( warn
| fail
| ignore
);
]
[ check-mx ( warn
| fail
| ignore
);
]
[ check-wildcard yes_or_no
;
]
[ check-integrity yes_or_no
;
]
[ check-mx-cname ( warn
| fail
| ignore
);
]
[ check-srv-cname ( warn
| fail
| ignore
);
]
[ check-sibling yes_or_no
;
]
[ allow-notify { address_match_list
};
]
[ allow-query { address_match_list
};
]
[ allow-query-cache { address_match_list
};
]
[ allow-transfer { address_match_list
};
]
[ allow-recursion { address_match_list
};
]
[ allow-update { address_match_list
};
]
[ allow-update-forwarding { address_match_list
};
]
[ update-check-ksk yes_or_no
;
]
[ allow-v6-synthesis { address_match_list
};
]
[ blackhole { address_match_list
};
]
[ avoid-v4-udp-ports { port_list
};
]
[ avoid-v6-udp-ports { port_list
};
]
[ listen-on [ port ip_port
] { address_match_list
};
]
[ listen-on-v6 [ port ip_port
] { address_match_list
};
]
[ query-source ( ( ip4_addr
| *
)
[ port ( ip_port | * )
] |
[ address ( ip4_addr | * )
]
[ port ( ip_port | * )
] ) ;
]
[ query-source-v6 ( ( ip6_addr
| *
)
[ port ( ip_port | * )
] |
[ address ( ip6_addr | * )
]
[ port ( ip_port | * )
] ) ;
]
[ max-transfer-time-in number
;
]
[ max-transfer-time-out number
;
]
[ max-transfer-idle-in number
;
]
[ max-transfer-idle-out number
;
]
[ tcp-clients number
;
]
[ recursive-clients number
;
]
[ serial-query-rate number
;
]
[ serial-queries number
;
]
[ tcp-listen-queue number
;
]
[ transfer-format ( one-answer | many-answers )
;
]
[ transfers-in number
;
]
[ transfers-out number
;
]
[ transfers-per-ns number
;
]
[ transfer-source (ip4_addr
| *
) [port ip_port
] ;
]
[ transfer-source-v6 (ip6_addr
| *
) [port ip_port
] ;
]
[ alt-transfer-source (ip4_addr
| *
) [port ip_port
] ;
]
[ alt-transfer-source-v6 (ip6_addr
| *
) [port ip_port
] ;
]
[ use-alt-transfer-source yes_or_no
;
]
[ notify-source (ip4_addr
| *
) [port ip_port
] ;
]
[ notify-source-v6 (ip6_addr
| *
) [port ip_port
] ;
]
[ also-notify { ip_addr
[port ip_port
] ; [ ip_addr [port ip_port ] ; ...
] };
]
[ max-ixfr-log-size number
;
]
[ max-journal-size size_spec
;
]
[ coresize size_spec
;
]
[ datasize size_spec
;
]
[ files size_spec
;
]
[ stacksize size_spec
;
]
[ cleaning-interval number
;
]
[ heartbeat-interval number
;
]
[ interface-interval number
;
]
[ statistics-interval number
;
]
[ topology { address_match_list
}
];
[ sortlist { address_match_list
}
];
[ rrset-order { order_spec
; [ order_spec ; ...
]
] };
[ lame-ttl number
;
]
[ max-ncache-ttl number
;
]
[ max-cache-ttl number
;
]
[ sig-validity-interval number
;
]
[ min-roots number
;
]
[ use-ixfr yes_or_no
;
]
[ provide-ixfr yes_or_no
;
]
[ request-ixfr yes_or_no
;
]
[ treat-cr-as-space yes_or_no
;
]
[ min-refresh-time number
;
]
[ max-refresh-time number
;
]
[ min-retry-time number
;
]
[ max-retry-time number
;
]
[ port ip_port
;
]
[ additional-from-auth yes_or_no
;
]
[ additional-from-cache yes_or_no
;
]
[ random-device path_name
;
]
[ max-cache-size size_spec
;
]
[ match-mapped-addresses yes_or_no
;
]
[ preferred-glue ( A
| AAAA
| NONE
);
]
[ edns-udp-size number
;
]
[ max-udp-size number
;
]
[ root-delegation-only [ exclude { namelist }
] ;
]
[ querylog yes_or_no
;
]
[ disable-algorithms domain
{ algorithm
; [ algorithm ;
] };
]
[ acache-enable yes_or_no
;
]
[ acache-cleaning-interval number
;
]
[ max-acache-size size_spec
;
]
[ clients-per-query number
;
]
[ max-clients-per-query number
;
]
[ masterfile-format (text
|raw
) ;
]
[ empty-server name
;
]
[ empty-contact name
;
]
[ empty-zones-enable yes_or_no
;
]
[ disable-empty-zone zone_name
;
]
[ zero-no-soa-ttl yes_or_no
;
]
[ zero-no-soa-ttl-cache yes_or_no
;
]
};
参数(Options):
directory: 服务器的工作目录.
key-directory: 保存密钥的目录.
named-xfer: 已经废弃,bind 8中定义named-xfer命令的路径.
tkey-domain: ...
tkey-dhkey: dhkey用于服务器生成dh模式的客户端共享的tkey,服务器必须加载公钥和私钥从工作目录的文件中.
cache-file: 仅为测试,没用.
dump-file: 当执行rndc dumpdb时服务器dump文件的路径.
memstatistics-file: 默认为named.memestats,当退出的服务的时候将服务器的统计信息写到文件中.
pid-file: 服务器记录进程ID的文件路径.
statictics-file: 执行rndc stats将服务器的统计信息写入文件,默认为named.stats
port: 服务器用于DNS协议的UDP/TCP端口号,默认为53.
random-device: entropy(平均信息量?)主要用于DNSSEC操作,像tkey传输,签署域的动态更新,默认为/dev/random,这个选项主要用于当服务器启动的时候初始化配置,reload将忽略这个选项.
preferred-glue: 优先胶? 优先相应的type list
root-delegation-only: 在根区域打开delegation-only的强制解析,并对exclude列表中的根域排除强制解析.
disable-algorithms: 对域禁用特定的DNSSEC算法,可以用多个,
dnssec-lookaside: 当设置dnssec-lookaside,它为验证器提供另外一个能在网络区域的顶层验证DNSKEY的方法.
dnssec-must-be-secure:
指定验证等级,如果选yes,named只接收安全的回应,如果选no,一般的dnssec验证将允许接收不安全的回应.
Boolean 参数:
auth-nxdomain: 如果选yes,AA字节一直设置为NXDOMAIN的回复,即使服务器不是真正可信赖的.默认为no,这是个从bind8后的改变,如果使用老的DNS软件,需要设置为yes.
deallocate-on-exit: 用于bind8在退出的时候进行内存泄露检测,bind9忽略此项,始终做检查.
dialup: 默认为no,是通过拨号网络的方式进行域传输,通常在每个heartbeat-interval执行,通常会抑制一些网络维护流量,一般的notify设置不受影响.
| dialup mode | normal refresh | heart-beat refresh | heart-beat notify |
| no (default) | yes | no | no |
| yes | no | yes | yes |
| notify | yes | no | yes |
| refresh | no | yes | no |
| passive | no | no | no |
| notify-passive | no | no | yes |
节(Tuning): lame-ttl: 设定缓存一个lame服务器的时间,0关闭,默认600秒,最大为1800秒. max-ncache-ttl: 为了减少网络流量和提升性能,服务器记录不正确的回答得时间,默认为10800秒,不能超过7天. max-cache-ttl: 设定服务器存储普通应答的最大缓存时间,默认为7天. min-roots: BIND9无效. sig-validity-interval: 设定DNSSEC自动生成动态更新的过期时间.默认为30天,最长10年. min-refresh-time,max-refresh-time,min-retry-time,max-retry-time: 这些选项控制服务器的运转,当刷新一个区域或者重试失败的传输. edns-udp-size: 这个参数设定发出的EDNS UDP包的大小,有效地值是512-4096之间,默认为4096bytes. max-udp-size: 设定最大的EDNS信息的大小,有效地值是512-4096之间,默认为4096bytes. masterfile-format: 指定区域文件的格式,默认为text. clients-per-query,max-clients-per-query: 设定初始和最大数量服务器接受的客户端并发的递归查询, 服务器内建信息: version: 版本 hostname: 主机名 server-id: 服务器ID 内建空域: empty-server: 指定哪个服务器名将出现在返回的空域中的SOA记录,如果没指定,将使用区域的名字. empty-contact: 指定哪个联系信息将出现在返回的空域的SOA记录中.如果没指定,将使用".". empty-zones-enable: 打开或者关闭空的区域,默认为开启. disable-empty-zone: 关闭单独的空地区域,默认关闭,此参数可指定多次. 额外的Cache参数: acache-enable: 是否打开额外的cache参数. acache-cleaning-interval: 服务器将删除过期的缓存进入,基于LRU based algorithm,每个设定的间隔时间,默认为60分钟,设置成0则不清除. max-acache-size: 设定acache使用的最大的内存大小.
servers：对特定的服务器设置参数
语法: serverip_addr[/prefixlen]{ [ bogusyes_or_no; ] [ provide-ixfryes_or_no; ] [ request-ixfryes_or_no; ] [ ednsyes_or_no; ] [ edns-udp-sizenumber; ] [ max-udp-sizenumber; ] [ transfersnumber; ] [ transfer-format( one-answer | many-answers ); ] ] [ keys{ string ; [ string ; [... ] ] }; ] [ transfer-source (ip4_addr|*) [portip_port] ; ] [ transfer-source-v6 (ip6_addr|*) [portip_port] ; ] [ notify-source (ip4_addr|*) [portip_port] ; ] [ notify-source-v6 (ip6_addr|*) [portip_port] ; ] [ query-source [ address (ip_addr|*) ] [ port (ip_port|*) ]; ] [ query-source-v6 [ address (ip_addr|*) ] [ port (ip_port|*) ]; ] };
trusted_keys：设置可信任的DNSSEC key
语法:
trusted-keys {
string
number
number
number
string
;
[ string number number number string
; [...
]
]
};
view：定义一个视图
viewview_name[class] { match-clients {address_match_list}; match-destinations {address_match_list}; match-recursive-onlyyes_or_no; [view_option; ... ] [zone_statement; ... ] };
zone：定义一个区域
zonezone_name[class] { type master; [ allow-query {address_match_list}; ] [ allow-transfer {address_match_list}; ] [ allow-update {address_match_list}; ] [ update-policy {update_policy_rule[... ] }; ] [ also-notify {ip_addr[portip_port] ; [ip_addr[portip_port] ; ... ] }; ] [ check-names (warn|fail|ignore) ; ] [ check-mx (warn|fail|ignore) ; ] [ check-wildcardyes_or_no; ] [ check-integrityyes_or_no; ] [ dialupdialup_option; ] [ filestring; ] [ masterfile-format (text|raw) ; ] [ journalstring; ] [ forward (only|first) ; ] [ forwarders { [ip_addr[portip_port] ; ... ] }; ] [ ixfr-basestring; ] [ ixfr-tmp-filestring; ] [ maintain-ixfr-baseyes_or_no; ] [ max-ixfr-log-sizenumber; ] [ max-transfer-idle-outnumber; ] [ max-transfer-time-outnumber; ] [ notifyyes_or_no|explicit|master-only; ] [ pubkeynumbernumbernumberstring; ] [ notify-source (ip4_addr|*) [portip_port] ; ] [ notify-source-v6 (ip6_addr|*) [portip_port] ; ] [ zone-statisticsyes_or_no; ] [ sig-validity-intervalnumber; ] [ databasestring; ] [ min-refresh-timenumber; ] [ max-refresh-timenumber; ] [ min-retry-timenumber; ] [ max-retry-timenumber; ] [ key-directorypath_name; ] [ zero-no-soa-ttlyes_or_no; ] }; zonezone_name[class] { type slave; [ allow-notify {address_match_list}; ] [ allow-query {address_match_list}; ] [ allow-transfer {address_match_list}; ] [ allow-update-forwarding {address_match_list}; ] [ update-check-kskyes_or_no; ] [ also-notify {ip_addr[portip_port] ; [ip_addr[portip_port] ; ... ] }; ] [ check-names (warn|fail|ignore) ; ] [ dialupdialup_option; ] [ filestring; ] [ masterfile-format (text|raw) ; ] [ journalstring; ] [ forward (only|first) ; ] [ forwarders { [ip_addr[portip_port] ; ... ] }; ] [ ixfr-basestring; ] [ ixfr-tmp-filestring; ] [ maintain-ixfr-baseyes_or_no; ] [ masters [portip_port] { (masters_list|ip_addr[portip_port] [keykey] ) ; [... ] }; ] [ max-ixfr-log-sizenumber; ] [ max-transfer-idle-innumber; ] [ max-transfer-idle-outnumber; ] [ max-transfer-time-innumber; ] [ max-transfer-time-outnumber; ] [ notifyyes_or_no|explicit|master-only; ] [ pubkeynumbernumbernumberstring; ] [ transfer-source (ip4_addr|*) [portip_port] ; ] [ transfer-source-v6 (ip6_addr|*) [portip_port] ; ] [ alt-transfer-source (ip4_addr|*) [portip_port] ; ] [ alt-transfer-source-v6 (ip6_addr|*) [portip_port] ; ] [ use-alt-transfer-sourceyes_or_no; ] [ notify-source (ip4_addr|*) [portip_port] ; ] [ notify-source-v6 (ip6_addr|*) [portip_port] ; ] [ zone-statisticsyes_or_no; ] [ databasestring; ] [ min-refresh-timenumber; ] [ max-refresh-timenumber; ] [ min-retry-timenumber; ] [ max-retry-timenumber; ] [ multi-masteryes_or_no; ] [ zero-no-soa-ttlyes_or_no; ] }; zonezone_name[class] { type hint; filestring; [ delegation-onlyyes_or_no; ] [ check-names (warn|fail|ignore) ; // Not Implemented. ] }; zonezone_name[class] { type stub; [ allow-query {address_match_list}; ] [ check-names (warn|fail|ignore) ; ] [ dialupdialup_option; ] [ delegation-onlyyes_or_no; ] [ filestring; ] [ masterfile-format (text|raw) ; ] [ forward (only|first) ; ] [ forwarders { [ip_addr[portip_port] ; ... ] }; ] [ masters [portip_port] { (masters_list|ip_addr[portip_port] [keykey] ) ; [... ] }; ] [ max-transfer-idle-innumber; ] [ max-transfer-time-innumber; ] [ pubkeynumbernumbernumberstring; ] [ transfer-source (ip4_addr|*) [portip_port] ; ] [ transfer-source-v6 (ip6_addr|*) [portip_port] ; ] [ alt-transfer-source (ip4_addr|*) [portip_port] ; ] [ alt-transfer-source-v6 (ip6_addr|*) [portip_port] ; ] [ use-alt-transfer-sourceyes_or_no; ] [ zone-statisticsyes_or_no; ] [ databasestring; ] [ min-refresh-timenumber; ] [ max-refresh-timenumber; ] [ min-retry-timenumber; ] [ max-retry-timenumber; ] [ multi-masteryes_or_no; ] }; zonezone_name[class] { type forward; [ forward (only|first) ; ] [ forwarders { [ip_addr[portip_port] ; ... ] }; ] [ delegation-onlyyes_or_no; ] }; zonezone_name[class] { type delegation-only; }; 区域Type: master: 主域服务 slave: 从域服务 stub: 只复制主域的NS记录,属于BIND特有功能. hint: 设定初始化设置根域服务器所用的参数. forward: 域转发设置 delegation-only: 设定返回为NXDOMAIN?