Adam Tkac 98dc34
/*
Adam Tkac 98dc34
 Sample named.conf BIND DNS server 'named' configuration file
Adam Tkac 98dc34
 for the Red Hat BIND distribution.
Adam Tkac 98dc34
Adam Tkac 98dc34
 See the BIND Administrator's Reference Manual (ARM) for details, in:
Adam Tkac 98dc34
   file:///usr/share/doc/bind-{version}/arm/Bv9ARM.html
Adam Tkac 98dc34
 Also see the BIND Configuration GUI : /usr/bin/system-config-bind and 
Adam Tkac 98dc34
 its manual.
Adam Tkac 98dc34
*/
Adam Tkac 98dc34
jvdias 053216
options
jvdias 053216
{
jvdias 053216
	// Put files that named is allowed to write in the data/ directory:
Adam Tkac 98dc34
	directory 		"/var/named";		// "Working" directory
jvdias 053216
	dump-file 		"data/cache_dump.db";
jvdias 053216
        statistics-file 	"data/named_stats.txt";
jvdias 053216
        memstatistics-file 	"data/named_mem_stats.txt";
jvdias 053216
Adam Tkac 98dc34
Adam Tkac 98dc34
	/*
Adam Tkac 98dc34
	  Specify listenning interfaces. You can use list of addresses (';' is
Adam Tkac 98dc34
	  delimiter) or keywords "any"/"none"
Adam Tkac 98dc34
	*/
Adam Tkac 98dc34
	//listen-on port 53	{ any; };
Adam Tkac 98dc34
	listen-on port 53	{ 127.0.0.1; };
Adam Tkac 98dc34
Adam Tkac 98dc34
	//listen-on-v6 port 53	{ any; };
Adam Tkac 98dc34
	listen-on-v6 port 53	{ ::1; };
Adam Tkac 98dc34
Adam Tkac 98dc34
	/*
Adam Tkac 98dc34
	  Access restrictions
Adam Tkac 98dc34
Adam Tkac 98dc34
	  There are two important options:
Adam Tkac 98dc34
	    allow-query { argument; };
Adam Tkac 98dc34
	      - allow queries for authoritative data
Adam Tkac 98dc34
Adam Tkac 98dc34
	    allow-query-cache { argument; };
Adam Tkac 98dc34
	      - allow queries for non-authoritative data (mostly cached data)
Adam Tkac 98dc34
Adam Tkac 98dc34
	  You can use address, network address or keywords "any"/"localhost"/"none" as argument
Adam Tkac 98dc34
	  Examples:
Adam Tkac 98dc34
	    allow-query { localhost; 10.0.0.1; 192.168.1.0/8; };
Adam Tkac 98dc34
	    allow-query-cache { ::1; fe80::5c63:a8ff:fe2f:4526; 10.0.0.1; };
Adam Tkac 98dc34
	*/
Adam Tkac 98dc34
Adam Tkac 98dc34
	allow-query		{ localhost; };
Adam Tkac 98dc34
	allow-query-cache	{ localhost; };
Adam Tkac 98dc34
Adam Tkac 98dc34
	// Enable/disable recursion - recursion yes/no;
Adam Tkac 98dc34
	recursion yes;
Adam Tkac 98dc34
Adam Tkac 98dc34
	/* DNSSEC related options. See information about keys ("Trusted keys", bellow) */
Adam Tkac 98dc34
Adam Tkac 98dc34
	/* Enable serving of DNSSEC related data - enable on both authoritative
Adam Tkac 98dc34
 	   and recursive servers DNSSEC aware servers */
Adam Tkac 98dc34
	dnssec-enable yes;
Adam Tkac 98dc34
Adam Tkac 98dc34
	/* Enable DNSSEC validation on recursive servers */
Adam Tkac 98dc34
	dnssec-validation yes;
jvdias 053216
};
Adam Tkac 98dc34
jvdias 053216
logging 
jvdias 053216
{
jvdias 053216
/*      If you want to enable debugging, eg. using the 'rndc trace' command,
jvdias 053216
 *      named will try to write the 'named.run' file in the $directory (/var/named).
jvdias 053216
 *      By default, SELinux policy does not allow named to modify the /var/named directory,
jvdias 053216
 *      so put the default debug log file in data/ :
jvdias 053216
 */
jvdias 053216
        channel default_debug {
jvdias 053216
                file "data/named.run";
jvdias 053216
                severity dynamic;
jvdias 053216
        };	
jvdias 053216
};
Adam Tkac 98dc34
Adam Tkac 98dc34
/*
Adam Tkac 98dc34
 Views let a name server answer a DNS query differently depending on who is asking.
Adam Tkac 98dc34
Adam Tkac 98dc34
 By default, if named.conf contains no "view" clauses, all zones are in the 
Adam Tkac 98dc34
 "default" view, which matches all clients.
Adam Tkac 98dc34
Adam Tkac 98dc34
 Views are processed sequentially. The first match is used so the last view should
Adam Tkac 98dc34
 match "any" - it's fallback and the most restricted view.
Adam Tkac 98dc34
Adam Tkac 98dc34
 If named.conf contains any "view" clause, then all zones MUST be in a view.
Adam Tkac 98dc34
*/
Adam Tkac 98dc34
jvdias 053216
view "localhost_resolver"
jvdias 053216
{
jvdias 053216
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
jvdias 053216
 * If all you want is a caching-only nameserver, then you need only define this view:
jvdias 053216
 */
jvdias 053216
	match-clients 		{ localhost; };
jvdias 053216
	recursion yes;
Adam Tkac 98dc34
jvdias 053216
	# all views must contain the root hints zone:
Adam Tkac 98dc34
	zone "." IN {
Adam Tkac 98dc34
	        type hint;
Adam Tkac 98dc34
	        file "/var/named/named.ca";
Adam Tkac 98dc34
	};
jvdias 053216
jvdias 053216
        /* these are zones that contain definitions for all the localhost
jvdias 053216
         * names and addresses, as recommended in RFC1912 - these names should
Adam Tkac 95fd5e
	 * not leak to the other nameservers:
jvdias 053216
	 */
jvdias 053216
	include "/etc/named.rfc1912.zones";
jvdias 053216
};
jvdias 053216
view "internal"
jvdias 053216
{
jvdias 053216
/* This view will contain zones you want to serve only to "internal" clients
jvdias 053216
   that connect via your directly attached LAN interfaces - "localnets" .
jvdias 053216
 */
jvdias fc31cd
	match-clients		{ localnets; };
jvdias 053216
	recursion yes;
jvdias 053216
Adam Tkac 98dc34
	zone "." IN {
Adam Tkac 98dc34
	        type hint;
Adam Tkac 98dc34
	        file "/var/named/named.ca";
Adam Tkac 98dc34
	};
Adam Tkac 95fd5e
Adam Tkac 95fd5e
        /* these are zones that contain definitions for all the localhost
Adam Tkac 95fd5e
         * names and addresses, as recommended in RFC1912 - these names should
Adam Tkac 95fd5e
	 * not leak to the other nameservers:
Adam Tkac 95fd5e
	 */
Adam Tkac 95fd5e
	include "/etc/named.rfc1912.zones";
jvdias 053216
 
jvdias 053216
	// These are your "authoritative" internal zones, and would probably
jvdias 053216
	// also be included in the "localhost_resolver" view above :
jvdias 053216
Adam Tkac 98dc34
	/*
Adam Tkac 98dc34
	  NOTE for dynamic DNS zones and secondary zones:
Adam Tkac 98dc34
Adam Tkac 98dc34
	  DO NOT USE SAME FILES IN MULTIPLE VIEWS!
Adam Tkac 98dc34
Adam Tkac 98dc34
	  If you are using views and DDNS/secondary zones it is strongly
Adam Tkac 98dc34
	  recommended to read FAQ on ISC site (www.isc.org), section
Adam Tkac 98dc34
	  "Configuration and Setup Questions", questions
Adam Tkac 98dc34
	  "How do I share a dynamic zone between multiple views?" and
Adam Tkac 98dc34
	  "How can I make a server a slave for both an internal and an external
Adam Tkac 98dc34
	   view at the same time?"
Adam Tkac 98dc34
	*/
Adam Tkac 98dc34
jvdias 053216
	zone "my.internal.zone" { 
jvdias 053216
		type master;
jvdias 053216
		file "my.internal.zone.db";
jvdias 053216
	};
jvdias 053216
	zone "my.slave.internal.zone" {
jvdias 053216
		type slave;
jvdias 053216
		file "slaves/my.slave.internal.zone.db";
jvdias 053216
		masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
jvdias 053216
		// put slave zones in the slaves/ directory so named can update them
jvdias 053216
	};	
jvdias 053216
	zone "my.ddns.internal.zone" {
jvdias 053216
		type master;
jvdias 053216
		allow-update { key ddns_key; };
Adam Tkac 98dc34
		file "dynamic/my.ddns.internal.zone.db";
jvdias 053216
		// put dynamically updateable zones in the slaves/ directory so named can update them
jvdias 053216
	};			
jvdias 053216
};
Adam Tkac 98dc34
jvdias 053216
key ddns_key
jvdias 053216
{
jvdias 053216
	algorithm hmac-md5;
Adam Tkac 40b004
	secret "use /usr/sbin/dnssec-keygen to generate TSIG keys";
jvdias 053216
};
Adam Tkac 98dc34
Adam Tkac 98dc34
view "external"
jvdias 053216
{
jvdias 053216
/* This view will contain zones you want to serve only to "external" clients
Adam Tkac 95fd5e
 * that have addresses that are not match any above view:
jvdias 053216
 */
Adam Tkac 95fd5e
	match-clients		{ any; };
jvdias 053216
Adam Tkac 98dc34
	zone "." IN {
Adam Tkac 98dc34
	        type hint;
Adam Tkac 98dc34
	        file "/var/named/named.ca";
Adam Tkac 98dc34
	};
Adam Tkac 98dc34
jvdias 053216
	recursion no;
jvdias 053216
	// you'd probably want to deny recursion to external clients, so you don't
jvdias 053216
        // end up providing free DNS service to all takers
jvdias 053216
jvdias 053216
	// These are your "authoritative" external zones, and would probably
jvdias 053216
        // contain entries for just your web and mail servers:
jvdias 053216
jvdias 053216
	zone "my.external.zone" { 
jvdias 053216
		type master;
jvdias 053216
		file "my.external.zone.db";
jvdias 053216
	};
jvdias 053216
};
Adam Tkac 98dc34
Adam Tkac 98dc34
/* Trusted keys
Adam Tkac 98dc34
Adam Tkac 98dc34
  This statement contains DNSSEC keys. If you want DNSSEC aware resolver you
Adam Tkac 98dc34
  have to configure at least one trusted key.
Adam Tkac 98dc34
Adam Tkac 98dc34
  Note that no key written below is valid. Especially root key because root zone
Adam Tkac 98dc34
  is not signed yet.
Adam Tkac 98dc34
*/
Adam Tkac 98dc34
/*
Adam Tkac 98dc34
trusted-keys {
Adam Tkac 98dc34
// Root Key
Adam Tkac 98dc34
"." 257 3 3 "BNY4wrWM1nCfJ+CXd0rVXyYmobt7sEEfK3clRbGaTwSJxrGkxJWoZu6I7PzJu/
Adam Tkac 98dc34
             E9gx4UC1zGAHlXKdE4zYIpRhaBKnvcC2U9mZhkdUpd1Vso/HAdjNe8LmMlnzY3
Adam Tkac 98dc34
             zy2Xy4klWOADTPzSv9eamj8V18PHGjBLaVtYvk/ln5ZApjYghf+6fElrmLkdaz
Adam Tkac 98dc34
             MQ2OCnACR817DF4BBa7UR/beDHyp5iWTXWSi6XmoJLbG9Scqc7l70KDqlvXR3M
Adam Tkac 98dc34
             /lUUVRbkeg1IPJSidmK3ZyCllh4XSKbje/45SKucHgnwU5jefMtq66gKodQj+M
Adam Tkac 98dc34
             iA21AfUVe7u99WzTLzY3qlxDhxYQQ20FQ97S+LKUTpQcq27R7AT3/V5hRQxScI
Adam Tkac 98dc34
             Nqwcz4jYqZD2fQdgxbcDTClU0CRBdiieyLMNzXG3";
Adam Tkac 98dc34
Adam Tkac 98dc34
// Key for forward zone
Adam Tkac 98dc34
example.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM65KbhTjrW1ZaARmPhEZZe
Adam Tkac 98dc34
                      3Y9ifgEuq7vZ/zGZUdEGNWy+JZzus0lUptwgjGwhUS1558Hb4JKUbb
Adam Tkac 98dc34
                      OTcM8pwXlj0EiX3oDFVmjHO444gLkBO UKUf/mC7HvfwYH/Be22GnC
Adam Tkac 98dc34
                      lrinKJp1Og4ywzO9WglMk7jbfW33gUKvirTHr25GL7STQUzBb5Usxt
Adam Tkac 98dc34
                      8lgnyTUHs1t3JwCY5hKZ6CqFxmAVZP20igTixin/1LcrgX/KMEGd/b
Adam Tkac 98dc34
                      iuvF4qJCyduieHukuY3H4XMAcR+xia2 nIUPvm/oyWR8BW/hWdzOvn
Adam Tkac 98dc34
                      SCThlHf3xiYleDbt/o1OTQ09A0=";
Adam Tkac 98dc34
Adam Tkac 98dc34
// Key for reverse zone.
Adam Tkac 98dc34
2.0.192.IN-ADDRPA.NET. 257 3 5 "AQOnS4xn/IgOUpBPJ3bogzwcxOdNax071L18QqZnQQQA
Adam Tkac 98dc34
                                VVr+iLhGTnNGp3HoWQLUIzKrJVZ3zggy3WwNT6kZo6c0
Adam Tkac 98dc34
                                tszYqbtvchmgQC8CzKojM/W16i6MG/ea fGU3siaOdS0
Adam Tkac 98dc34
                                yOI6BgPsw+YZdzlYMaIJGf4M4dyoKIhzdZyQ2bYQrjyQ
Adam Tkac 98dc34
                                4LB0lC7aOnsMyYKHHYeRv PxjIQXmdqgOJGq+vsevG06
Adam Tkac 98dc34
                                zW+1xgYJh9rCIfnm1GX/KMgxLPG2vXTD/RnLX+D3T3UL
Adam Tkac 98dc34
                                7HJYHJhAZD5L59VvjSPsZJHeDCUyWYrvPZesZDIRvhDD
Adam Tkac 98dc34
                                52SKvbheeTJUm6EhkzytNN2SN96QRk8j/iI8ib";
Adam Tkac 98dc34
};
Adam Tkac 98dc34
*/