key-directory.\n The following options can be specified in a key-store statement:
Grammar: pkcs11-uri <quoted_string>;
Blocks: key-store
\n-Tags: pkcs11, dnssec
\n+Tags: dnssec, pkcs11
\nThe uri is a string that specifies a PKCS#11 URI Scheme (defined in\n RFC 7512). When set, named will try to create keys inside the\n corresponding PKCS#11 token. This requires BIND to be built with OpenSSL 3,\n and have a PKCS#11 provider configured.
Grammar: zone-statistics ( full | terse | none | <boolean> );
Blocks: options, view, zone (mirror, primary, redirect, secondary, static-stub, stub)
\n-Tags: logging, zone
\n+Tags: zone, logging
\nControls the level of statistics gathered for all zones.
\n \nIf full, the server collects statistical data on all zones,\n unless specifically turned off on a per-zone basis by specifying\n zone-statistics terse or zone-statistics none in the zone\n statement. The statistical data includes, for example, DNSSEC signing\n operations and the number of authoritative answers per query type. The\n@@ -3637,15 +3637,15 @@\n
Grammar: check-dup-records ( fail | warn | ignore );
Blocks: options, view, zone (primary)
\n-Tags: query, dnssec
\n+Tags: dnssec, query
\nChecks primary zones for records that are treated as different by DNSSEC but are semantically equal in plain DNS.
\n \nThis checks primary zones for records that are treated as different by\n DNSSEC but are semantically equal in plain DNS. The default is to\n warn. Other possible values are fail and ignore.
Grammar: zero-no-soa-ttl <boolean>;
Blocks: options, view, zone (mirror, primary, secondary)
\n-Tags: server, query, zone
\n+Tags: zone, query, server
\nSpecifies whether to set the time to live (TTL) of the SOA record to zero, when returning authoritative negative responses to SOA queries.
\n \nIf yes, when returning authoritative negative responses to SOA queries, set\n the TTL of the SOA record returned in the authority section to zero.\n The default is yes.
Grammar: zero-no-soa-ttl-cache <boolean>;
Blocks: options, view
\n-Tags: server, query, zone
\n+Tags: zone, query, server
\nSets the time to live (TTL) to zero when caching a negative response to an SOA query.
\n \nIf yes, when caching a negative response to an SOA query set the TTL to zero.\n The default is no.
Grammar: notify-rate <integer>;
Blocks: options
\n-Tags: transfer, zone
\n+Tags: zone, transfer
\nSpecifies the rate at which NOTIFY requests are sent during normal zone maintenance operations.
\n \nThis specifies the rate at which NOTIFY requests are sent during normal zone\n maintenance operations. (NOTIFY requests due to initial zone loading\n are subject to a separate rate limit; see below.) The default is 20\n per second. The lowest possible rate is one per second; when set to\n zero, it is silently raised to one.
\nGrammar: startup-notify-rate <integer>;
Blocks: options
\n-Tags: transfer, zone
\n+Tags: zone, transfer
\nSpecifies the rate at which NOTIFY requests are sent when the name server is first starting, or when new zones have been added.
\n \nThis is the rate at which NOTIFY requests are sent when the name server\n is first starting up, or when zones have been newly added to the\n name server. The default is 20 per second. The lowest possible rate is\n one per second; when set to zero, it is silently raised to one.
\nGrammar: max-records <integer>;
Blocks: options, view, zone (mirror, primary, redirect, secondary, static-stub, stub)
\n-Tags: server, zone
\n+Tags: zone, server
\nSets the maximum number of records permitted in a zone.
\n \nThis sets the maximum number of records permitted in a zone. The default is\n zero, which means the maximum is unlimited.
\nWarning
\nThis option is deprecated and will be removed in a future version of BIND.
\nGrammar: sortlist { <address_match_element>; ... }; // deprecated
Blocks: options, view
\n-Tags: query, deprecated
\n+Tags: deprecated, query
\nControls the ordering of RRs returned to the client, based on the client\u2019s IP address.
\n \nThis option is deprecated and will be removed in a future release.
\nThe sortlist statement (see below) takes an address_match_list and\n interprets it in a special way. Each top-level statement in the sortlist\n must itself be an explicit address_match_list with one or two elements. The\n first element (which may be an IP address, an IP prefix, an ACL name, or a nested\n@@ -5895,15 +5895,15 @@\n
Grammar: masterfile-format ( raw | text );
Blocks: options, view, zone (mirror, primary, redirect, secondary, stub)
\n-Tags: server, zone
\n+Tags: zone, server
\nSpecifies the file format of zone files.
\n \nThis specifies the file format of zone files (see Additional File Formats\n for details). The default value is text, which is the standard\n textual representation, except for secondary zones, in which the default\n value is raw. Files in formats other than text are typically\n expected to be generated by the named-compilezone tool, or dumped by\n@@ -5971,15 +5971,15 @@\n
Grammar: notify-delay <integer>;
Blocks: options, view, zone (mirror, primary, secondary)
\n-Tags: transfer, zone
\n+Tags: zone, transfer
\nSets the delay (in seconds) between sending sets of NOTIFY messages for a zone.
\n \nThis sets the delay, in seconds, between sending sets of NOTIFY messages\n for a zone. Whenever a NOTIFY message is sent for a zone, a timer will\n be set for this duration. If the zone is updated again before the timer\n expires, the NOTIFY for that update will be postponed. The default is 5\n seconds.
\n@@ -5988,15 +5988,15 @@\nGrammar: max-rsa-exponent-size <integer>;
Blocks: options
\n-Tags: query, dnssec
\n+Tags: dnssec, query
\nSets the maximum RSA exponent size (in bits) when validating.
\n \nThis sets the maximum RSA exponent size, in bits, that is accepted when\n validating. Valid values are 35 to 4096 bits. The default, zero, is\n also accepted and is equivalent to 4096.
\nGrammar: response-policy { zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ ede <string> ]; ... } [ add-soa <boolean> ] [ break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ min-ns-dots <integer> ] [ nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text> } ];
Blocks: options, view
\n-Tags: security, query, zone, server
\n+Tags: zone, query, security, server
\nSpecifies response policy zones for the view or among global options.
\n \nResponse policy zones are named in the response-policy option for\n the view, or among the global options if there is no response-policy\n option for the view. Response policy zones are ordinary DNS zones\n containing RRsets that can be queried normally if allowed. It is usually\n best to restrict those queries with something like\n@@ -7126,15 +7126,15 @@\n
Grammar: log-only <boolean>;
Blocks: options.rate-limit, view.rate-limit
\n-Tags: query, logging
\n+Tags: logging, query
\nTests rate-limiting parameters without actually dropping any requests.
\n \nUse log-only yes to test rate-limiting parameters without actually\n dropping any requests.
Responses dropped by rate limits are included in the RateDropped and\n@@ -9751,15 +9751,15 @@\n \n \n
Grammar: server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
Blocks: zone (static-stub)
\n-Tags: query, zone
\n+Tags: zone, query
\nSpecifies a list of IP addresses to which queries should be sent in recursive resolution for a static-stub zone.
\n \nThis option is only meaningful for static-stub zones. This is a list of IP addresses\n to which queries should be sent in recursive resolution for the zone.\n A non-empty list for this option internally configures the apex\n NS RR with associated glue A or AAAA RRs.
\nFor example, if \u201cexample.com\u201d is configured as a static-stub zone\n@@ -10318,15 +10318,15 @@\n
Defines a stream of data that can be independently logged.
\nlogging
Checks primary zones for records that are treated as different by DNSSEC but are semantically equal in plain DNS.
\nquery, dnssec
dnssec, query
Performs post-load zone integrity checks on primary zones.
\nzone
Sets a maximum size for the memory map of the new-zone database in LMDB database format.
\nserver
Tests rate-limiting parameters without actually dropping any requests.
\nquery, logging
logging, query
Configures logging options for the name server.
\nlogging
Specifies an access control list (ACL) of IPv4 addresses that are to be mapped to the corresponding A RRset in dns64.
query
Specifies the file format of zone files.
\nserver, zone
zone, server
Specifies the format of zone files during a dump, when the masterfile-format is text.
server
Specifies the maximum retention time (in seconds) for storage of negative answers in the server's cache.
\nserver
Sets the maximum number of records permitted in a zone.
\nserver, zone
zone, server
Sets the maximum number of levels of recursion permitted at any one time while servicing a recursive query.
\nserver
Limits the zone refresh retry interval to no less often than the specified value, in seconds.
\ntransfer
Sets the maximum RSA exponent size (in bits) when validating.
\nquery, dnssec
dnssec, query
Specifies the maximum time that the server retains records past their normal expiry, to return them as stale records.
\nserver
Controls whether NOTIFY messages are sent on zone changes.
transfer
Sets the delay (in seconds) between sending sets of NOTIFY messages for a zone.
\ntransfer, zone
zone, transfer
Specifies the rate at which NOTIFY requests are sent during normal zone maintenance operations.
\ntransfer, zone
zone, transfer
Defines the IPv4 address (and optional port) to be used for outgoing NOTIFY messages.
transfer
Specifies the pathname of the file where the server writes its process ID.
\nserver
pkcs11, dnssec
dnssec, pkcs11
Configures plugins in named.conf.
server
Adds an EDNS Padding option to encrypted messages, to reduce the chance of guessing the contents based on size.
\nquery
Specifies response policy zones for the view or among global options.
\nsecurity, query, zone, server
zone, query, security, server
Limits the number of non-empty responses for a valid domain name and record type.
\nquery
Defines characteristics to be associated with a remote name server.
\nserver
Specifies a list of IP addresses to which queries should be sent in recursive resolution for a static-stub zone.
\nquery, zone
zone, query
Specifies the ID of the server to return in response to a ID.SERVER query.
server
Sets the number of "slipped" responses to minimize the use of forged source addresses for an attack.
\nquery
Controls the ordering of RRs returned to the client, based on the client's IP address.
\nquery, deprecated
deprecated, query
Defines the amount of time (in milliseconds) that named waits before attempting to answer a query with a stale RRset from cache.
query, server
Sets the time window for the return of "stale" cached answers before the next attempt to contact, if the name servers for a given zone are not responding.
\nquery, server
Specifies the rate at which NOTIFY requests are sent when the name server is first starting, or when new zones have been added.
\ntransfer, zone
zone, transfer
Specifies the communication channels to be used by system administrators to access statistics information on the name server.
\nlogging
Specifies the length of time during which responses are tracked.
\nquery
Specifies whether to set the time to live (TTL) of the SOA record to zero, when returning authoritative negative responses to SOA queries.
\nserver, query, zone
zone, query, server
Sets the time to live (TTL) to zero when caching a negative response to an SOA query.
\nserver, query, zone
zone, query, server
Specifies the zone in a BIND 9 configuration.
\nzone
Sets the propagation delay from the time a zone is first updated to when the new version of the zone is served by all secondary servers.
\ndnssec, zone
Controls the level of statistics gathered for all zones.
\nlogging, zone
zone, logging
These tables group the various statements permissible in named.conf by\n", "details": [{"source1": "html2text {}", "source2": "html2text {}", "unified_diff": "@@ -515,15 +515,15 @@\n The key-store statement defines how DNSSEC keys should be stored.\n There is one built-in key store named key-directory. Configuring keys to use\n key-store \"key-directory\" is identical to using key-directory.\n The following options can be specified in a _\bk_\be_\by_\b-_\bs_\bt_\bo_\br_\be statement:\n pkcs11-uri_\b\uf0c1\n G\bGr\bra\bam\bmm\bma\bar\br:\b: pkcs11-uri