- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-<!-- $Id: Bv9ARM.ch04.html,v 1.30.2.6.2.20 2006/05/17 02:38:09 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch04.html,v 1.30.2.6.2.21 2006/06/09 07:14:11 marka Exp $ -->
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt>
<dd><dl>
<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2548926">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549061">Copying the Shared Secret to Both Machines</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549069">Informing the Servers of the Key's Existence</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549109">Instructing the Server to Use the Key</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549229">TSIG Key Based Access Control</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549273">Errors</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549129">Copying the Shared Secret to Both Machines</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549138">Informing the Servers of the Key's Existence</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549177">Instructing the Server to Use the Key</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549298">TSIG Key Based Access Control</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549341">Errors</a></span></dt>
</dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2549287">TKEY</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2549336">SIG(0)</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2549355">TKEY</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2549404">SIG(0)</a></span></dt>
<dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt>
<dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549470">Generating Keys</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549606">Signing the Zone</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549681">Configuring Servers</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549539">Generating Keys</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549674">Signing the Zone</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549749">Configuring Servers</a></span></dt>
</dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2549750">IPv6 Support in <span class="acronym">BIND</span> 9</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2549818">IPv6 Support in <span class="acronym">BIND</span> 9</a></span></dt>
<dd><dl>
<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549877">Address Lookups Using AAAA Records</a></span></dt>
<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549965">Address to Name Lookups Using Nibble Format</a></span></dt>
journalled in a similar way.</p>
<p>The zone files of dynamic zones cannot normally be edited by
hand because they are not guaranteed to contain the most recent
- dynamic changes - those are only in the journal file.
+ dynamic changes — those are only in the journal file.
The only way to ensure that the zone file of a dynamic zone
is up to date is to run <span><strong class="command">rndc stop</strong></span>.</p>
<p>If you have to make changes to a dynamic zone
<li>Look up any hostnames in the <code class="literal">site1.internal</code> and
<code class="literal">site2.internal</code> domains.</li>
<li>Look up any hostnames on the Internet.</li>
-<li>Exchange mail with internal AND external people.</li>
+<li>Exchange mail with both internal AND external people.</li>
</ul></div>
<p>Hosts on the Internet will be able to:</p>
<div class="itemizedlist"><ul type="disc">
be the same on both hosts.</p>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2549011"></a>Automatic Generation</h4></div></div></div>
-<p>The following command will generate a 128 bit (16 byte) HMAC-MD5
+<a name="id2549079"></a>Automatic Generation</h4></div></div></div>
+<p>The following command will generate a 128-bit (16 byte) HMAC-MD5
key as described above. Longer keys are better, but shorter keys
are easier to read. Note that the maximum key length is 512 bits;
-keys longer than that will be digested with MD5 to produce a 128
-bit key.</p>
+keys longer than that will be digested with MD5 to produce a
+128-bit key.</p>
<p><strong class="userinput"><code>dnssec-keygen -a hmac-md5 -b 128 -n HOST host1-host2.</code></strong></p>
<p>The key is in the file <code class="filename">Khost1-host2.+157+00000.private</code>.
Nothing directly uses this file, but the base-64 encoded string
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2549045"></a>Manual Generation</h4></div></div></div>
+<a name="id2549113"></a>Manual Generation</h4></div></div></div>
<p>The shared secret is simply a random sequence of bits, encoded
in base-64. Most ASCII strings are valid base-64 strings (assuming
the length is a multiple of 4 and only valid characters are used),
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2549061"></a>Copying the Shared Secret to Both Machines</h3></div></div></div>
+<a name="id2549129"></a>Copying the Shared Secret to Both Machines</h3></div></div></div>
<p>This is beyond the scope of DNS. A secure transport mechanism
should be used. This could be secure FTP, ssh, telephone, etc.</p>
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2549069"></a>Informing the Servers of the Key's Existence</h3></div></div></div>
+<a name="id2549138"></a>Informing the Servers of the Key's Existence</h3></div></div></div>
<p>Imagine <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host 2</em></span> are
both servers. The following is added to each server's <code class="filename">named.conf</code> file:</p>
<pre class="programlisting">
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2549109"></a>Instructing the Server to Use the Key</h3></div></div></div>
+<a name="id2549177"></a>Instructing the Server to Use the Key</h3></div></div></div>
<p>Since keys are shared between two hosts only, the server must
be told when keys are to be used. The following is added to the <code class="filename">named.conf</code> file
for <span class="emphasis"><em>host1</em></span>, if the IP address of <span class="emphasis"><em>host2</em></span> is
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2549229"></a>TSIG Key Based Access Control</h3></div></div></div>
+<a name="id2549298"></a>TSIG Key Based Access Control</h3></div></div></div>
<p><span class="acronym">BIND</span> allows IP addresses and ranges to be specified in ACL
definitions and
<span><strong class="command">allow-{ query | transfer | update }</strong></span> directives.
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2549273"></a>Errors</h3></div></div></div>
+<a name="id2549341"></a>Errors</h3></div></div></div>
<p>The processing of TSIG signed messages can result in
several errors. If a signed message is sent to a non-TSIG
aware server, a FORMERR (format error) will be returned, since
</div>
<div class="sect1" lang="en">
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2549287"></a>TKEY</h2></div></div></div>
+<a name="id2549355"></a>TKEY</h2></div></div></div>
<p><span><strong class="command">TKEY</strong></span> is a mechanism for automatically
generating a shared secret between two hosts. There are several
"modes" of <span><strong class="command">TKEY</strong></span> that specify how the key is
</div>
<div class="sect1" lang="en">
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2549336"></a>SIG(0)</h2></div></div></div>
+<a name="id2549404"></a>SIG(0)</h2></div></div></div>
<p><span class="acronym">BIND</span> 9 partially supports DNSSEC SIG(0)
transaction signatures as specified in RFC 2535 and RFC2931. SIG(0)
uses public/private keys to authenticate messages. Access control
granted or denied based on the key name.</p>
<p>When a SIG(0) signed message is received, it will only be
verified if the key is known and trusted by the server; the server
- will not attempt to locate and/or validate the key.</p>
+ will not attempt to locate and / or validate the key.</p>
<p>SIG(0) signing of multiple-message TCP streams is not
supported.</p>
<p>The only tool shipped with <span class="acronym">BIND</span> 9 that
zone key of another zone above this one in the DNS tree.</p>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2549470"></a>Generating Keys</h3></div></div></div>
+<a name="id2549539"></a>Generating Keys</h3></div></div></div>
<p>The <span><strong class="command">dnssec-keygen</strong></span> program is used to
generate keys.</p>
<p>A secure zone must contain one or more zone keys. The
It is recommended that zone keys use a cryptographic algorithm
designated as "mandatory to implement" by the IETF; currently
the only one is RSASHA1.</p>
-<p>The following command will generate a 768 bit RSASHA1 key for
+<p>The following command will generate a 768-bit RSASHA1 key for
the <code class="filename">child.example</code> zone:</p>
<p><strong class="userinput"><code>dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example.</code></strong></p>
<p>Two output files will be produced:
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2549606"></a>Signing the Zone</h3></div></div></div>
+<a name="id2549674"></a>Signing the Zone</h3></div></div></div>
<p>The <span><strong class="command">dnssec-signzone</strong></span> program is used to
sign a zone.</p>
<p>Any <code class="filename">keyset</code> files corresponding
generate <code class="literal">NSEC</code> and <code class="literal">RRSIG</code>
records for the zone, as well as <code class="literal">DS</code> for
the child zones if <code class="literal">'-d'</code> is specified.
- If <code class="literal">'-d'</code> is not specified then DS RRsets for
+ If <code class="literal">'-d'</code> is not specified, then DS RRsets for
the secure child zones need to be added manually.</p>
<p>The following command signs the zone, assuming it is in a
file called <code class="filename">zone.child.example</code>. By
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2549681"></a>Configuring Servers</h3></div></div></div>
+<a name="id2549749"></a>Configuring Servers</h3></div></div></div>
<p>
To enable <span><strong class="command">named</strong></span> to respond appropriately
- to DNS requests from DNSSEC aware clients
+ to DNS requests from DNSSEC aware clients,
<span><strong class="command">dnssec-enable</strong></span> must be set to yes.
</p>
<p>
iA21AfUVe7u99WzTLzY3qlxDhxYQQ20FQ97S+LKUTpQcq27R7AT3/V5hRQxScI
Nqwcz4jYqZD2fQdgxbcDTClU0CRBdiieyLMNzXG3";
-/* Key for out organizations forward zone */
+/* Key for our organization's forward zone */
example.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM65KbhTjrW1ZaARmPhEZZe
3Y9ifgEuq7vZ/zGZUdEGNWy+JZzus0lUptwgjGwhUS1558Hb4JKUbb
OTcM8pwXlj0EiX3oDFVmjHO444gLkBO UKUf/mC7HvfwYH/Be22GnC
</div>
<div class="sect1" lang="en">
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2549750"></a>IPv6 Support in <span class="acronym">BIND</span> 9</h2></div></div></div>
+<a name="id2549818"></a>IPv6 Support in <span class="acronym">BIND</span> 9</h2></div></div></div>
<p><span class="acronym">BIND</span> 9 fully supports all currently defined forms of IPv6
name to address and address to name lookups. It will also use
IPv6 addresses to make queries when running on an IPv6 capable
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-<!-- $Id: Bv9ARM.ch06.html,v 1.56.2.12.2.37 2006/05/17 02:38:10 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch06.html,v 1.56.2.12.2.38 2006/06/09 07:14:11 marka Exp $ -->
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2552220"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2552360"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2552486"><span><strong class="command">logging</strong></span> Statement Definition and Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2553623"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2553696"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2553758"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2553870"><span><strong class="command">masters</strong></span> Statement Definition and Usage </a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2553885"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2553692"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2553765"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2553828"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2553940"><span><strong class="command">masters</strong></span> Statement Definition and Usage </a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2553955"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
<dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and Usage</a></span></dt>
<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt>
<dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2561410"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2561526"><span><strong class="command">trusted-keys</strong></span> Statement Definition
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2561554"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2561602"><span><strong class="command">trusted-keys</strong></span> Statement Definition
and Usage</a></span></dt>
<dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2561608"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2561684"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
<dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span>
Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2562891"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2563035"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
</dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2564293">Zone File</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2564369">Zone File</a></span></dt>
<dd><dl>
<dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2565862">Discussion of MX Records</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2565938">Discussion of MX Records</a></span></dt>
<dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2566291">Inverse Mapping in IPv4</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2566396">Other Zone File Directives</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2566565"><span class="acronym">BIND</span> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2566366">Inverse Mapping in IPv4</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2566472">Other Zone File Directives</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2566641"><span class="acronym">BIND</span> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
</dl></dd>
</dl>
</div>
<td><p>An IP port <code class="varname">number</code>.
<code class="varname">number</code> is limited to 0 through 65535, with values
below 1024 typically restricted to use by processes running as root.
-In some cases an asterisk (`*') character can be used as a placeholder to
+In some cases, an asterisk (`*') character can be used as a placeholder to
select a random high-numbered port.</p></td>
</tr>
<tr>
</tr>
<tr>
<td><p><code class="varname">number</code></p></td>
-<td><p>A non-negative 32 bit integer
+<td><p>A non-negative 32-bit integer
(i.e., a number between 0 and 4294967295, inclusive).
Its acceptable value might further
be limited by the context in which it is used.</p></td>
permissions set such that only the owner of the file (the user that
<span><strong class="command">named</strong></span> is running as) can access it. If you
desire greater flexibility in allowing other users to access
- <span><strong class="command">rndc</strong></span> commands then you need to create an
- <code class="filename">rndc.conf</code> and make it group readable by a group
+ <span><strong class="command">rndc</strong></span> commands, then you need to create a
+ <code class="filename">rndc.conf</code> file and make it group readable by a group
that contains the users who should have access.</p>
<p>The UNIX control channel type of <span class="acronym">BIND</span> 8 is not supported
in <span class="acronym">BIND</span> 9.0, <span class="acronym">BIND</span> 9.1,
of the file will be saved each time the file is opened.</p>
<p>If you use the <span><strong class="command">versions</strong></span> log file option, then
<span><strong class="command">named</strong></span> will retain that many backup versions of the file by
-renaming them when opening. For example, if you choose to keep 3 old versions
-of the file <code class="filename">lamers.log</code> then just before it is opened
+renaming them when opening. For example, if you choose to keep three old versions
+of the file <code class="filename">lamers.log</code>, then just before it is opened
<code class="filename">lamers.log.1</code> is renamed to
<code class="filename">lamers.log.2</code>, <code class="filename">lamers.log.0</code> is renamed
to <code class="filename">lamers.log.1</code>, and <code class="filename">lamers.log</code> is
specified.
</p>
<p>
-The query log entry reports the client's IP address and port number. The
+The query log entry reports the client's IP address and port number, and the
query name, class and type. It also reports whether the Recursion Desired
flag was set (+ if set, - if not set), EDNS was in use (E) or if the
query was signed (S).</p>
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2553623"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div>
+<a name="id2553692"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div>
<p> This is the grammar of the <span><strong class="command">lwres</strong></span>
statement in the <code class="filename">named.conf</code> file:</p>
<pre class="programlisting"><span><strong class="command">lwres</strong></span> {
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2553696"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div>
+<a name="id2553765"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div>
<p>The <span><strong class="command">lwres</strong></span> statement configures the name
server to also act as a lightweight resolver server. (See
<a href="Bv9ARM.ch05.html#lwresd" title="Running a Resolver Daemon">the section called “Running a Resolver Daemon”</a>.) There may be be multiple
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2553758"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div>
+<a name="id2553828"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting">
<span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] } ;
</pre>
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2553870"></a><span><strong class="command">masters</strong></span> Statement Definition and Usage </h3></div></div></div>
+<a name="id2553940"></a><span><strong class="command">masters</strong></span> Statement Definition and Usage </h3></div></div></div>
<p><span><strong class="command">masters</strong></span> lists allow for a common set of masters
to be easily used by multiple stub and slave zones.</p>
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2553885"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div>
+<a name="id2553955"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div>
<p>This is the grammar of the <span><strong class="command">options</strong></span>
statement in the <code class="filename">named.conf</code> file:</p>
<pre class="programlisting">options {
is ignored on subsequent reloads.</p></dd>
<dt><span class="term"><span><strong class="command">preferred-glue</strong></span></span></dt>
<dd><p>
-If specified the listed type (A or AAAA) will be emitted before other glue
+If specified, the listed type (A or AAAA) will be emitted before other glue
in the additional section of a query response.
The default is not to preference any type (NONE).
</p></dd>
and root zones with an optional exclude list.
</p>
<p>
-Note some TLDs are NOT delegation only (e.g. "DE", "LV", "US" and "MUSEUM").
+Note some TLDs are not delegation only (e.g. "DE", "LV", "US" and "MUSEUM").
</p>
<pre class="programlisting">
options {
</p></dd>
<dt><span class="term"><span><strong class="command">dnssec-lookaside</strong></span></span></dt>
<dd><p>
-When set <span><strong class="command">dnssec-lookaside</strong></span> provides the
+When set, <span><strong class="command">dnssec-lookaside</strong></span> provides the
validator with an alternate method to validate DNSKEY records at the
top of a zone. When a DNSKEY is at or below a domain specified by the
deepest <span><strong class="command">dnssec-lookaside</strong></span>, and the normal dnssec validation
</p></dd>
<dt><span class="term"><span><strong class="command">dnssec-must-be-secure</strong></span></span></dt>
<dd><p>
-Specify heirarchies which must / may not be secure (signed and validated).
-If <strong class="userinput"><code>yes</code></strong> then named will only accept answers if they
+Specify heirarchies which must be or may not be secure (signed and validated).
+If <strong class="userinput"><code>yes</code></strong>, then named will only accept answers if they
are secure.
-If <strong class="userinput"><code>no</code></strong> then normal dnssec validation applies
+If <strong class="userinput"><code>no</code></strong>, then normal dnssec validation applies
allowing for insecure answers to be accepted.
The specified domain must be under a <span><strong class="command">trusted-key</strong></span> or
<span><strong class="command">dnssec-lookaside</strong></span> must be active.
<dd>
<p>If <strong class="userinput"><code>yes</code></strong>, then the
server treats all zones as if they are doing zone transfers across
-a dial on demand dialup link, which can be brought up by traffic
+a dial-on-demand dialup link, which can be brought up by traffic
originating from this server. This has different effects according
to zone type and concentrates the zone maintenance so that it all
happens in a short interval, once every <span><strong class="command">heartbeat-interval</strong></span> and
<span><strong class="command">zone</strong></span> statements,
in which case it overrides the global <span><strong class="command">dialup</strong></span>
option.</p>
-<p>If the zone is a master zone then the server will send out a NOTIFY
+<p>If the zone is a master zone, then the server will send out a NOTIFY
request to all the slaves (default). This should trigger the zone serial
number check in the slave (providing it supports NOTIFY) allowing the slave
to verify the zone while the connection is active.
<dt><span class="term"><span><strong class="command">ixfr-from-differences</strong></span></span></dt>
<dd>
<p>
-When 'yes' and the server loads a new version of a master
+When <strong class="userinput"><code>yes</code></strong> and the server loads a new version of a master
zone from its zone file or receives a new version of a slave
file by a non-incremental zone transfer, it will compare
the new version to the previous one and calculate a set
<dt><span class="term"><span><strong class="command">multi-master</strong></span></span></dt>
<dd><p>
This should be set when you have multiple masters for a zone and the
-addresses refer to different machines. If 'yes' named will not log
+addresses refer to different machines. If <strong class="userinput"><code>yes</code></strong>, named will not log
when the serial number on the master is less than what named currently
has. The default is <strong class="userinput"><code>no</code></strong>.
</p></dd>
<dt><span class="term"><span><strong class="command">dnssec-enable</strong></span></span></dt>
<dd><p>
-Enable DNSSEC support in named. Unless set to <strong class="userinput"><code>yes</code></strong>
+Enable DNSSEC support in named. Unless set to <strong class="userinput"><code>yes</code></strong>,
named behaves as if it does not support DNSSEC.
The default is <strong class="userinput"><code>no</code></strong>.
</p></dd>
<dt><span class="term"><span><strong class="command">querylog</strong></span></span></dt>
<dd><p>
-Specify whether query logging should be started when named start.
-If <span><strong class="command">querylog</strong></span> is not specified then the query logging
+Specify whether query logging should be started when named starts.
+If <span><strong class="command">querylog</strong></span> is not specified, then the query logging
is determined by the presence of the logging category <span><strong class="command">queries</strong></span>.
</p></dd>
<dt><span class="term"><span><strong class="command">check-names</strong></span></span></dt>
from the network. The default varies according to usage area. For
<span><strong class="command">master</strong></span> zones the default is <span><strong class="command">fail</strong></span>.
For <span><strong class="command">slave</strong></span> zones the default is <span><strong class="command">warn</strong></span>.
-For answer received from the network (<span><strong class="command">response</strong></span>)
+For answers received from the network (<span><strong class="command">response</strong></span>)
the default is <span><strong class="command">ignore</strong></span>.
</p>
-<p>The rules for legal hostnames or mail domains are derived from RFC 952
+<p>The rules for legal hostnames and mail domains are derived from RFC 952
and RFC 821 as modified by RFC 1123.
</p>
<p><span><strong class="command">check-names</strong></span> applies to the owner names of A, AAA and
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2556500"></a>Forwarding</h4></div></div></div>
+<a name="id2556576"></a>Forwarding</h4></div></div></div>
<p>The forwarding facility can be used to create a large site-wide
cache on a few servers, reducing traffic over links to external
name servers. It can also be used to allow queries by servers that
<dt><span class="term"><span><strong class="command">forward</strong></span></span></dt>
<dd><p>This option is only meaningful if the
forwarders list is not empty. A value of <code class="varname">first</code>,
-the default, causes the server to query the forwarders first, and
-if that doesn't answer the question the server will then look for
+the default, causes the server to query the forwarders first — and
+if that doesn't answer the question, the server will then look for
the answer itself. If <code class="varname">only</code> is specified, the
server will only query the forwarders.
</p></dd>
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2556550"></a>Dual-stack Servers</h4></div></div></div>
+<a name="id2556626"></a>Dual-stack Servers</h4></div></div></div>
<p>Dual-stack servers are used as servers of last resort to work around
problems in reachability due the lack of support for either IPv4 or IPv6
on the host machine.</p>
<div class="variablelist"><dl>
<dt><span class="term"><span><strong class="command">dual-stack-servers</strong></span></span></dt>
<dd><p>Specifies host names or addresses of machines with access to
-both IPv4 and IPv6 transports. If a hostname is used the server must be able
+both IPv4 and IPv6 transports. If a hostname is used, the server must be able
to resolve the name using only the transport it has. If the machine is dual
-stacked then the <span><strong class="command">dual-stack-servers</strong></span> have no effect unless
+stacked, then the <span><strong class="command">dual-stack-servers</strong></span> have no effect unless
access to a transport has been disabled on the command line
(e.g. <span><strong class="command">named -4</strong></span>).</p></dd>
</dl></div>
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2556934"></a>Interfaces</h4></div></div></div>
+<a name="id2556941"></a>Interfaces</h4></div></div></div>
<p>The interfaces and ports that the server will answer queries
from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes
an optional port, and an <code class="varname">address_match_list</code>.
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2557022"></a>Query Address</h4></div></div></div>
+<a name="id2557098"></a>Query Address</h4></div></div></div>
<p>If the server doesn't know the answer to a question, it will
query other name servers. <span><strong class="command">query-source</strong></span> specifies
the address and port used for such queries. For queries sent over
IPv6, there is a separate <span><strong class="command">query-source-v6</strong></span> option.
-If <span><strong class="command">address</strong></span> is <span><strong class="command">*</strong></span> or is omitted,
+If <span><strong class="command">address</strong></span> is <span><strong class="command">*</strong></span> (asterisk) or is omitted,
a wildcard IP address (<span><strong class="command">INADDR_ANY</strong></span>) will be used.
If <span><strong class="command">port</strong></span> is <span><strong class="command">*</strong></span> or is omitted,
-a random unprivileged port will be used, <span><strong class="command">avoid-v4-udp-ports</strong></span>
-and <span><strong class="command">avoid-v6-udp-ports</strong></span> can be used to prevent named
-from selecting certain ports. The defaults are</p>
+a random unprivileged port will be used. The <span><strong class="command">avoid-v4-udp-ports</strong></span>
+and <span><strong class="command">avoid-v6-udp-ports</strong></span> options can be used to prevent named
+from selecting certain ports. The defaults are:</p>
<pre class="programlisting">query-source address * port *;
query-source-v6 address * port *;
</pre>
<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
<h3 class="title">Note</h3>
If you do not wish the alternate transfer source
- to be used you should set
+ to be used, you should set
<span><strong class="command">use-alt-transfer-source</strong></span>
appropriately and you should not depend upon
getting a answer back to the first refresh
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2545549"></a>Bad UDP Port Lists</h4></div></div></div>
+<a name="id2557708"></a>Bad UDP Port Lists</h4></div></div></div>
<p>
<span><strong class="command">avoid-v4-udp-ports</strong></span> and <span><strong class="command">avoid-v6-udp-ports</strong></span>
specify a list of IPv4 and IPv6 UDP ports that will not be used as system
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2545565"></a>Operating System Resource Limits</h4></div></div></div>
+<a name="id2557724"></a>Operating System Resource Limits</h4></div></div></div>
<p>The server's usage of many system resources can be limited.
Scaled values are allowed when specifying resource limits. For
example, <span><strong class="command">1G</strong></span> can be used instead of
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2545735"></a>Server Resource Limits</h4></div></div></div>
+<a name="id2545606"></a>Server Resource Limits</h4></div></div></div>
<p>The following options set limits on the server's
resource consumption that are enforced internally by the
server rather than the operating system.</p>
will be automatically removed. The default is
<code class="literal">unlimited</code>.</p></dd>
<dt><span class="term"><span><strong class="command">host-statistics-max</strong></span></span></dt>
-<dd><p>In BIND 8, specifies the maximum number of host statistic
+<dd><p>In BIND 8, specifies the maximum number of host statistics
entries to be kept.
Not implemented in BIND 9.
</p></dd>
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2559843"></a>Periodic Task Intervals</h4></div></div></div>
+<a name="id2545787"></a>Periodic Task Intervals</h4></div></div></div>
<div class="variablelist"><dl>
<dt><span class="term"><span><strong class="command">cleaning-interval</strong></span></span></dt>
<dd><p>The server will remove expired resource records
from the cache every <span><strong class="command">cleaning-interval</strong></span> minutes.
The default is 60 minutes. The maximum value is 28 days (40320 minutes).
-If set to 0, no periodic cleaning will occur.</p></dd>
+If set to 0, no periodic cleaning will occur.</p></dd>
<dt><span class="term"><span><strong class="command">heartbeat-interval</strong></span></span></dt>
<dd><p>The server will perform zone maintenance tasks
for all zones marked as <span><strong class="command">dialup</strong></span> whenever this
The client resolver code should rearrange the RRs as appropriate,
that is, using any addresses on the local net in preference to other addresses.
However, not all resolvers can do this or are correctly configured.
-When a client is using a local server the sorting can be performed
+When a client is using a local server, the sorting can be performed
in the server, based on the client's address. This only requires
configuring the name servers, not all the clients.</p>
<p>The <span><strong class="command">sortlist</strong></span> statement (see below) takes
</pre>
<p>If no class is specified, the default is <span><strong class="command">ANY</strong></span>.
If no type is specified, the default is <span><strong class="command">ANY</strong></span>.
-If no name is specified, the default is "<span><strong class="command">*</strong></span>".</p>
+If no name is specified, the default is "<span><strong class="command">*</strong></span>" (asterisk).</p>
<p>The legal values for <span><strong class="command">ordering</strong></span> are:</p>
<div class="informaltable"><table border="1">
<colgroup>
<dd><p>Sets the number of seconds to cache a
lame server indication. 0 disables caching. (This is
<span class="bold"><strong>NOT</strong></span> recommended.)
-Default is <code class="literal">600</code> (10 minutes). Maximum value is
+The default is <code class="literal">600</code> (10 minutes) and the maximum value is
<code class="literal">1800</code> (30 minutes).</p></dd>
<dt><span class="term"><span><strong class="command">max-ncache-ttl</strong></span></span></dt>
-<dd><p>To reduce network traffic and increase performance
+<dd><p>To reduce network traffic and increase performance,
the server stores negative answers. <span><strong class="command">max-ncache-ttl</strong></span> is
used to set a maximum retention time for these answers in the server
in seconds. The default
<dt><span class="term"><span><strong class="command">min-roots</strong></span></span></dt>
<dd>
<p>The minimum number of root servers that
-is required for a request for the root servers to be accepted. Default
+is required for a request for the root servers to be accepted. The default
is <strong class="userinput"><code>2</code></strong>.</p>
<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
<h3 class="title">Note</h3>
<dt><span class="term"><span><strong class="command">edns-udp-size</strong></span></span></dt>
<dd><p>
<span><strong class="command">edns-udp-size</strong></span> sets the advertised EDNS UDP buffer
-size. Valid values are 512 to 4096 (values outside this range will be
+size in bytes. Valid values are 512 to 4096 bytes (values outside this range will be
silently adjusted). The default value is 4096. The usual reason for
-setting edns-udp-size to a non default value it to get UDP answers to
+setting edns-udp-size to a non-default value it to get UDP answers to
pass through broken firewalls that block fragmented packets and/or
block UDP packets that are greater than 512 bytes.
</p></dd>
be specified.
Similarly, for an IPv6 remote server, only
<span><strong class="command">transfer-source-v6</strong></span> can be specified.
-Form more details, see the description of
+For more details, see the description of
<span><strong class="command">transfer-source</strong></span> and
<span><strong class="command">transfer-source-v6</strong></span> in
<a href="Bv9ARM.ch06.html#zone_transfers" title="Zone Transfers">the section called “Zone Transfers”</a>.</p>
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2561410"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div>
+<a name="id2561554"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div>
<pre class="programlisting">trusted-keys {
<em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
[<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2561526"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition
+<a name="id2561602"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition
and Usage</h3></div></div></div>
<p>
The <span><strong class="command">trusted-keys</strong></span> statement defines
<span><strong class="command">trusted-keys</strong></span> are deemed to exist regardless
of what parent zones say. Similarly for all keys listed in
<span><strong class="command">trusted-keys</strong></span> only those keys are
- used to validate the DNSKEY RRset. The parents DS RRset
+ used to validate the DNSKEY RRset. The parent's DS RRset
will not be used.
</p>
<p>
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2561608"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div>
+<a name="id2561684"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div>
<p>The <span><strong class="command">view</strong></span> statement is a powerful new feature
of <span class="acronym">BIND</span> 9 that lets a name server answer a DNS query differently
depending on who is asking. It is particularly useful for implementing
statements are present, all <span><strong class="command">zone</strong></span> statements must
occur inside <span><strong class="command">view</strong></span> statements.</p>
<p>Here is an example of a typical split DNS setup implemented
-using <span><strong class="command">view</strong></span> statements.</p>
+using <span><strong class="command">view</strong></span> statements:</p>
<pre class="programlisting">view "internal" {
// This should match our internal networks.
match-clients { 10.0.0.0/8; };
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2562891"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div>
+<a name="id2563035"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2562898"></a>Zone Types</h4></div></div></div>
+<a name="id2563042"></a>Zone Types</h4></div></div></div>
<div class="informaltable"><table border="1">
<colgroup>
<col>
recommended, since it often speeds server startup and eliminates
a needless waste of bandwidth. Note that for large numbers (in the
tens or hundreds of thousands) of zones per server, it is best to
-use a two level naming scheme for zone file names. For example,
+use a two-level naming scheme for zone file names. For example,
a slave server for the zone <code class="literal">example.com</code> might place
the zone contents into a file called
<code class="filename">ex/example.com</code> where <code class="filename">ex/</code> is
forwarding will be done for the domain, canceling the effects of
any forwarders in the <span><strong class="command">options</strong></span> statement. Thus
if you want to use this type of zone to change the behavior of the
-global <span><strong class="command">forward</strong></span> option (that is, "forward first
-to", then "forward only", or vice versa, but want to use the same
+global <span><strong class="command">forward</strong></span> option (that is, "forward first"
+to, then "forward only", or vice versa, but want to use the same
servers as set globally) you need to re-specify the global forwarders.</p>
</td>
</tr>
<tr>
<td><p><code class="varname">delegation-only</code></p></td>
<td>
-<p>This is used to enforce the delegation only
+<p>This is used to enforce the delegation-only
status of infrastructure zones (e.g. COM, NET, ORG). Any answer that
-is received without a explicit or implicit delegation in the authority
+is received without an explicit or implicit delegation in the authority
section will be treated as NXDOMAIN. This does not apply to the zone
-apex. This SHOULD NOT be applied to leaf zones.</p>
+apex. This should not be applied to leaf zones.</p>
<p><code class="varname">delegation-only</code> has no effect on answers received
from forwarders.</p>
</td>
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2563340"></a>Class</h4></div></div></div>
+<a name="id2563348"></a>Class</h4></div></div></div>
<p>The zone's name may optionally be followed by a class. If
a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>),
is assumed. This is correct for the vast majority of cases.</p>
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2563371"></a>Zone Options</h4></div></div></div>
+<a name="id2563379"></a>Zone Options</h4></div></div></div>
<div class="variablelist"><dl>
<dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt>
<dd><p>See the description of
<span><strong class="command">dialup</strong></span> in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called “Boolean Options”</a>.</p></dd>
<dt><span class="term"><span><strong class="command">delegation-only</strong></span></span></dt>
<dd><p>The flag only applies to hint and stub zones. If set
-to <strong class="userinput"><code>yes</code></strong> then the zone will also be treated as if it
+to <strong class="userinput"><code>yes</code></strong>, then the zone will also be treated as if it
is also a delegation-only type zone.
</p></dd>
<dt><span class="term"><span><strong class="command">forward</strong></span></span></dt>
<dt><span class="term"><span><strong class="command">forwarders</strong></span></span></dt>
<dd><p>Used to override the list of global forwarders.
If it is not specified in a zone of type <span><strong class="command">forward</strong></span>,
-no forwarding is done for the zone; the global options are not used.</p></dd>
+no forwarding is done for the zone and the global options are not used.</p></dd>
<dt><span class="term"><span><strong class="command">ixfr-base</strong></span></span></dt>
<dd><p>Was used in <span class="acronym">BIND</span> 8 to specify the name
of the transaction log (journal) file for dynamic update and IXFR.
</div>
<div class="sect1" lang="en">
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2564293"></a>Zone File</h2></div></div></div>
+<a name="id2564369"></a>Zone File</h2></div></div></div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
<a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div>
and implemented in the DNS. These are also included.</p>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2564311"></a>Resource Records</h4></div></div></div>
+<a name="id2564387"></a>Resource Records</h4></div></div></div>
<p>A domain name identifies a node. Each node has a set of
resource information, which may be empty. The set of resource
information associated with a particular name is composed of
</tr>
<tr>
<td><p>type</p></td>
-<td><p>an encoded 16 bit value that specifies
+<td><p>an encoded 16-bit value that specifies
the type of the resource record.</p></td>
</tr>
<tr>
<td><p>TTL</p></td>
-<td><p>the time to live of the RR. This field
-is a 32 bit integer in units of seconds, and is primarily used by
+<td><p>the time-to-live of the RR. This field
+is a 32-bit integer in units of seconds, and is primarily used by
resolvers when they cache RRs. The TTL describes how long a RR can
be cached before it should be discarded.</p></td>
</tr>
<tr>
<td><p>class</p></td>
-<td><p>an encoded 16 bit value that identifies
+<td><p>an encoded 16-bit value that identifies
a protocol family or instance of a protocol.</p></td>
</tr>
<tr>
<tr>
<td><p>MX</p></td>
<td><p>identifies a mail exchange for the domain.
-A 16 bit preference value (lower is better)
+A 16-bit preference value (lower is better)
followed by the host name of the mail exchange.
Described in RFC 974, RFC 1035.</p></td>
</tr>
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2565436"></a>Textual expression of RRs</h4></div></div></div>
+<a name="id2565580"></a>Textual expression of RRs</h4></div></div></div>
<p>RRs are represented in binary form in the packets of the DNS
protocol, and are usually represented in highly encoded form when
stored in a name server or resolver. In the examples provided in
</tr>
</tbody>
</table></div>
-<p>The MX RRs have an RDATA section which consists of a 16 bit
+<p>The MX RRs have an RDATA section which consists of a 16-bit
number followed by a domain name. The address RRs use a standard
-IP address format to contain a 32 bit internet address.</p>
-<p>This example shows six RRs, with two RRs at each of three
+IP address format to contain a 32-bit internet address.</p>
+<p>The above example shows six RRs, with two RRs at each of three
domain names.</p>
<p>Similarly we might see:</p>
<div class="informaltable"><table border="1">
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2565862"></a>Discussion of MX Records</h3></div></div></div>
+<a name="id2565938"></a>Discussion of MX Records</h3></div></div></div>
<p>As described above, domain servers store information as a
series of resource records, each of which contains a particular
piece of information about a given domain name (which is usually,
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
<a name="Setting_TTLs"></a>Setting TTLs</h3></div></div></div>
-<p>The time to live of the RR field is a 32 bit integer represented
+<p>The time-to-live of the RR field is a 32-bit integer represented
in units of seconds, and is primarily used by resolvers when they
cache RRs. The TTL describes how long a RR can be cached before it
should be discarded. The following three types of TTL are currently
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2566291"></a>Inverse Mapping in IPv4</h3></div></div></div>
+<a name="id2566366"></a>Inverse Mapping in IPv4</h3></div></div></div>
<p>Reverse name resolution (that is, translation from IP address
to name) is achieved by means of the <span class="emphasis"><em>in-addr.arpa</em></span> domain
and PTR records. Entries in the in-addr.arpa domain are made in
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2566396"></a>Other Zone File Directives</h3></div></div></div>
+<a name="id2566472"></a>Other Zone File Directives</h3></div></div></div>
<p>The Master File Format was initially defined in RFC 1035 and
has subsequently been extended. While the Master File Format itself
is class independent all records in a Master File must be of the same
and <span><strong class="command">$TTL.</strong></span></p>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2566416"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div>
+<a name="id2566491"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div>
<p>Syntax: <span><strong class="command">$ORIGIN
</strong></span><em class="replaceable"><code>domain-name</code></em> [<span class="optional"> <em class="replaceable"><code>comment</code></em></span>]</p>
<p><span><strong class="command">$ORIGIN</strong></span> sets the domain name that will
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2566471"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div>
+<a name="id2566547"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div>
<p>Syntax: <span><strong class="command">$INCLUDE</strong></span>
<em class="replaceable"><code>filename</code></em> [<span class="optional">
<em class="replaceable"><code>origin</code></em> </span>] [<span class="optional"> <em class="replaceable"><code>comment</code></em> </span>]</p>
</div>
<div class="sect3" lang="en">
<div class="titlepage"><div><div><h4 class="title">
-<a name="id2566534"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div>
+<a name="id2566610"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div>
<p>Syntax: <span><strong class="command">$TTL</strong></span>
<em class="replaceable"><code>default-ttl</code></em> [<span class="optional">
<em class="replaceable"><code>comment</code></em> </span>]</p>
</div>
<div class="sect2" lang="en">
<div class="titlepage"><div><div><h3 class="title">
-<a name="id2566565"></a><span class="acronym">BIND</span> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div>
+<a name="id2566641"></a><span class="acronym">BIND</span> Master File Extension: the <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div>
<p>Syntax: <span><strong class="command">$GENERATE</strong></span> <em class="replaceable"><code>range</code></em> <em class="replaceable"><code>lhs</code></em> [<span class="optional"><em class="replaceable"><code>ttl</code></em></span>] [<span class="optional"><em class="replaceable"><code>class</code></em></span>] <em class="replaceable"><code>type</code></em> <em class="replaceable"><code>rhs</code></em> [<span class="optional"> <em class="replaceable"><code>comment</code></em> </span>]</p>
<p><span><strong class="command">$GENERATE</strong></span> is used to create a series of
resource records that only differ from each other by an iterator. <span><strong class="command">$GENERATE</strong></span> can
<tr>
<td><p><span><strong class="command">range</strong></span></p></td>
<td><p>This can be one of two forms: start-stop
-or start-stop/step. If the first form is used then step is set to
+or start-stop/step. If the first form is used, then step is set to
1. All of start, stop and step must be positive.</p></td>
</tr>
<tr>
<td><p><span><strong class="command">lhs</strong></span></p></td>
<td>
<p><span><strong class="command">lhs</strong></span> describes the
-owner name of the resource records to be created. Any single <span><strong class="command">$</strong></span> symbols
+owner name of the resource records to be created. Any single
+<span><strong class="command">$</strong></span> (dollar sign) symbols
within the <span><strong class="command">lhs</strong></span> side are replaced by the iterator
value.
To get a $ in the output you need to escape the <span><strong class="command">$</strong></span>
Modifiers are introduced by a <span><strong class="command">{</strong></span> immediately following the
<span><strong class="command">$</strong></span> as <span><strong class="command">${offset[,width[,base]]}</strong></span>.
For example, <span><strong class="command">${-20,3,d}</strong></span> which subtracts 20 from the current value,
-prints the result as a decimal in a zero padded field of width 3. Available
+prints the result as a decimal in a zero-padded field of width 3. Available
output forms are decimal (<span><strong class="command">d</strong></span>), octal (<span><strong class="command">o</strong></span>)
and hexadecimal (<span><strong class="command">x</strong></span> or <span><strong class="command">X</strong></span> for uppercase).
The default modifier is <span><strong class="command">${0,0,d}</strong></span>.
If the <span><strong class="command">lhs</strong></span> is not
absolute, the current <span><strong class="command">$ORIGIN</strong></span> is appended to
the name.</p>
-<p>For compatibility with earlier versions <span><strong class="command">$$</strong></span> is still
+<p>For compatibility with earlier versions, <span><strong class="command">$$</strong></span> is still
recognized as indicating a literal $ in the output.</p>
</td>
</tr>
projects / thirdparty / bind9.git / commitdiff
