Adam Tkac 98dc34
/*
Adam Tkac 98dc34
 Sample named.conf BIND DNS server 'named' configuration file
Adam Tkac 98dc34
 for the Red Hat BIND distribution.
Adam Tkac 98dc34
Adam Tkac 98dc34
 See the BIND Administrator's Reference Manual (ARM) for details, in:
Adam Tkac 98dc34
   file:///usr/share/doc/bind-{version}/arm/Bv9ARM.html
Adam Tkac 98dc34
 Also see the BIND Configuration GUI : /usr/bin/system-config-bind and 
Adam Tkac 98dc34
 its manual.
Adam Tkac 98dc34
*/
Adam Tkac 98dc34
jvdias 053216
options
jvdias 053216
{
jvdias 053216
	// Put files that named is allowed to write in the data/ directory:
Adam Tkac 98dc34
	directory 		"/var/named";		// "Working" directory
jvdias 053216
	dump-file 		"data/cache_dump.db";
jvdias 053216
        statistics-file 	"data/named_stats.txt";
jvdias 053216
        memstatistics-file 	"data/named_mem_stats.txt";
0b15f3
	secroots-file		"data/named.secroots";
0b15f3
	recursing-file		"data/named.recursing";
jvdias 053216
Adam Tkac 98dc34
Adam Tkac 98dc34
	/*
Adam Tkac 98dc34
	  Specify listenning interfaces. You can use list of addresses (';' is
Adam Tkac 98dc34
	  delimiter) or keywords "any"/"none"
Adam Tkac 98dc34
	*/
Adam Tkac 98dc34
	//listen-on port 53	{ any; };
Adam Tkac 98dc34
	listen-on port 53	{ 127.0.0.1; };
Adam Tkac 98dc34
Adam Tkac 98dc34
	//listen-on-v6 port 53	{ any; };
Adam Tkac 98dc34
	listen-on-v6 port 53	{ ::1; };
Adam Tkac 98dc34
Adam Tkac 98dc34
	/*
Adam Tkac 98dc34
	  Access restrictions
Adam Tkac 98dc34
Adam Tkac 98dc34
	  There are two important options:
Adam Tkac 98dc34
	    allow-query { argument; };
Adam Tkac 98dc34
	      - allow queries for authoritative data
Adam Tkac 98dc34
Adam Tkac 98dc34
	    allow-query-cache { argument; };
Adam Tkac 98dc34
	      - allow queries for non-authoritative data (mostly cached data)
Adam Tkac 98dc34
Adam Tkac 98dc34
	  You can use address, network address or keywords "any"/"localhost"/"none" as argument
Adam Tkac 98dc34
	  Examples:
Adam Tkac 98dc34
	    allow-query { localhost; 10.0.0.1; 192.168.1.0/8; };
Adam Tkac 98dc34
	    allow-query-cache { ::1; fe80::5c63:a8ff:fe2f:4526; 10.0.0.1; };
Adam Tkac 98dc34
	*/
Adam Tkac 98dc34
Adam Tkac 98dc34
	allow-query		{ localhost; };
Adam Tkac 98dc34
	allow-query-cache	{ localhost; };
Adam Tkac 98dc34
Tomas Hozza d0fda0
	/* Enable/disable recursion - recursion yes/no;
Tomas Hozza d0fda0
Tomas Hozza d0fda0
	 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
Tomas Hozza d0fda0
	 - If you are building a RECURSIVE (caching) DNS server, you need to enable 
Tomas Hozza d0fda0
	   recursion. 
Tomas Hozza d0fda0
	 - If your recursive DNS server has a public IP address, you MUST enable access 
Tomas Hozza d0fda0
	   control to limit queries to your legitimate users. Failing to do so will
Tomas Hozza d0fda0
	   cause your server to become part of large scale DNS amplification 
Tomas Hozza d0fda0
	   attacks. Implementing BCP38 within your network would greatly
Tomas Hozza d0fda0
	   reduce such attack surface 
Tomas Hozza d0fda0
	 */
Adam Tkac 98dc34
	recursion yes;
Adam Tkac 98dc34
Adam Tkac 98dc34
	/* DNSSEC related options. See information about keys ("Trusted keys", bellow) */
Adam Tkac 98dc34
Adam Tkac 98dc34
	/* Enable serving of DNSSEC related data - enable on both authoritative
Adam Tkac 98dc34
 	   and recursive servers DNSSEC aware servers */
Adam Tkac 98dc34
	dnssec-enable yes;
Adam Tkac 98dc34
Adam Tkac 98dc34
	/* Enable DNSSEC validation on recursive servers */
Adam Tkac 98dc34
	dnssec-validation yes;
Adam Tkac 34adbe
Tomas Hozza 93a69b
	/* In Fedora we use /run/named instead of default /var/run/named
Tomas Hozza 93a69b
	   so we have to configure paths properly. */
Adam Tkac 2043f0
	pid-file "/run/named/named.pid";
Tomas Hozza 93a69b
	session-keyfile "/run/named/session.key";
Tomas Hozza ad6dbb
Tomas Hozza ad6dbb
	managed-keys-directory "/var/named/dynamic";
Tomas Hozza 71f9fb
Tomas Hozza 71f9fb
    /* In Fedora we use system-wide Crypto Policy */
Tomas Hozza 71f9fb
    /* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
Tomas Hozza 71f9fb
    include "/etc/crypto-policies/back-ends/bind.config";
jvdias 053216
};
Adam Tkac 98dc34
jvdias 053216
logging 
jvdias 053216
{
jvdias 053216
/*      If you want to enable debugging, eg. using the 'rndc trace' command,
jvdias 053216
 *      named will try to write the 'named.run' file in the $directory (/var/named).
jvdias 053216
 *      By default, SELinux policy does not allow named to modify the /var/named directory,
jvdias 053216
 *      so put the default debug log file in data/ :
jvdias 053216
 */
jvdias 053216
        channel default_debug {
jvdias 053216
                file "data/named.run";
jvdias 053216
                severity dynamic;
0b15f3
        };
jvdias 053216
};
Adam Tkac 98dc34
Adam Tkac 98dc34
/*
Adam Tkac 98dc34
 Views let a name server answer a DNS query differently depending on who is asking.
Adam Tkac 98dc34
Adam Tkac 98dc34
 By default, if named.conf contains no "view" clauses, all zones are in the 
Adam Tkac 98dc34
 "default" view, which matches all clients.
Adam Tkac 98dc34
Adam Tkac 98dc34
 Views are processed sequentially. The first match is used so the last view should
Adam Tkac 98dc34
 match "any" - it's fallback and the most restricted view.
Adam Tkac 98dc34
Adam Tkac 98dc34
 If named.conf contains any "view" clause, then all zones MUST be in a view.
Adam Tkac 98dc34
*/
Adam Tkac 98dc34
jvdias 053216
view "localhost_resolver"
jvdias 053216
{
jvdias 053216
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
jvdias 053216
 * If all you want is a caching-only nameserver, then you need only define this view:
jvdias 053216
 */
jvdias 053216
	match-clients 		{ localhost; };
jvdias 053216
	recursion yes;
Adam Tkac 98dc34
jvdias 053216
	# all views must contain the root hints zone:
Adam Tkac 98dc34
	zone "." IN {
Adam Tkac 98dc34
	        type hint;
Adam Tkac 98dc34
	        file "/var/named/named.ca";
Adam Tkac 98dc34
	};
jvdias 053216
jvdias 053216
        /* these are zones that contain definitions for all the localhost
jvdias 053216
         * names and addresses, as recommended in RFC1912 - these names should
Adam Tkac 95fd5e
	 * not leak to the other nameservers:
jvdias 053216
	 */
jvdias 053216
	include "/etc/named.rfc1912.zones";
jvdias 053216
};
jvdias 053216
view "internal"
jvdias 053216
{
jvdias 053216
/* This view will contain zones you want to serve only to "internal" clients
jvdias 053216
   that connect via your directly attached LAN interfaces - "localnets" .
jvdias 053216
 */
jvdias fc31cd
	match-clients		{ localnets; };
jvdias 053216
	recursion yes;
jvdias 053216
Adam Tkac 98dc34
	zone "." IN {
Adam Tkac 98dc34
	        type hint;
Adam Tkac 98dc34
	        file "/var/named/named.ca";
Adam Tkac 98dc34
	};
Adam Tkac 95fd5e
Adam Tkac 95fd5e
        /* these are zones that contain definitions for all the localhost
Adam Tkac 95fd5e
         * names and addresses, as recommended in RFC1912 - these names should
Adam Tkac 95fd5e
	 * not leak to the other nameservers:
Adam Tkac 95fd5e
	 */
Adam Tkac 95fd5e
	include "/etc/named.rfc1912.zones";
600bfd
jvdias 053216
	// These are your "authoritative" internal zones, and would probably
jvdias 053216
	// also be included in the "localhost_resolver" view above :
jvdias 053216
Adam Tkac 98dc34
	/*
Adam Tkac 98dc34
	  NOTE for dynamic DNS zones and secondary zones:
Adam Tkac 98dc34
Adam Tkac 98dc34
	  DO NOT USE SAME FILES IN MULTIPLE VIEWS!
Adam Tkac 98dc34
Adam Tkac 98dc34
	  If you are using views and DDNS/secondary zones it is strongly
Adam Tkac 98dc34
	  recommended to read FAQ on ISC site (www.isc.org), section
Adam Tkac 98dc34
	  "Configuration and Setup Questions", questions
Adam Tkac 98dc34
	  "How do I share a dynamic zone between multiple views?" and
Adam Tkac 98dc34
	  "How can I make a server a slave for both an internal and an external
Adam Tkac 98dc34
	   view at the same time?"
Adam Tkac 98dc34
	*/
Adam Tkac 98dc34
jvdias 053216
	zone "my.internal.zone" { 
jvdias 053216
		type master;
jvdias 053216
		file "my.internal.zone.db";
jvdias 053216
	};
jvdias 053216
	zone "my.slave.internal.zone" {
jvdias 053216
		type slave;
jvdias 053216
		file "slaves/my.slave.internal.zone.db";
jvdias 053216
		masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
jvdias 053216
		// put slave zones in the slaves/ directory so named can update them
jvdias 053216
	};	
jvdias 053216
	zone "my.ddns.internal.zone" {
jvdias 053216
		type master;
jvdias 053216
		allow-update { key ddns_key; };
Adam Tkac 98dc34
		file "dynamic/my.ddns.internal.zone.db";
jvdias 053216
		// put dynamically updateable zones in the slaves/ directory so named can update them
0b15f3
	};
jvdias 053216
};
Adam Tkac 98dc34
jvdias 053216
key ddns_key
jvdias 053216
{
jvdias 053216
	algorithm hmac-md5;
Adam Tkac 40b004
	secret "use /usr/sbin/dnssec-keygen to generate TSIG keys";
jvdias 053216
};
Adam Tkac 98dc34
Adam Tkac 98dc34
view "external"
jvdias 053216
{
jvdias 053216
/* This view will contain zones you want to serve only to "external" clients
Adam Tkac 95fd5e
 * that have addresses that are not match any above view:
jvdias 053216
 */
Adam Tkac 95fd5e
	match-clients		{ any; };
jvdias 053216
Adam Tkac 98dc34
	zone "." IN {
Adam Tkac 98dc34
	        type hint;
Adam Tkac 98dc34
	        file "/var/named/named.ca";
Adam Tkac 98dc34
	};
Adam Tkac 98dc34
jvdias 053216
	recursion no;
jvdias 053216
	// you'd probably want to deny recursion to external clients, so you don't
jvdias 053216
        // end up providing free DNS service to all takers
jvdias 053216
jvdias 053216
	// These are your "authoritative" external zones, and would probably
jvdias 053216
        // contain entries for just your web and mail servers:
jvdias 053216
jvdias 053216
	zone "my.external.zone" { 
jvdias 053216
		type master;
jvdias 053216
		file "my.external.zone.db";
jvdias 053216
	};
jvdias 053216
};
Adam Tkac 98dc34
Adam Tkac 98dc34
/* Trusted keys
Adam Tkac 98dc34
Adam Tkac 98dc34
  This statement contains DNSSEC keys. If you want DNSSEC aware resolver you
Adam Tkac 98dc34
  have to configure at least one trusted key.
Adam Tkac 98dc34
Adam Tkac 98dc34
  Note that no key written below is valid. Especially root key because root zone
Adam Tkac 98dc34
  is not signed yet.
Adam Tkac 98dc34
*/
Adam Tkac 98dc34
/*
Adam Tkac 98dc34
trusted-keys {
Adam Tkac 98dc34
// Root Key
Adam Tkac 98dc34
"." 257 3 3 "BNY4wrWM1nCfJ+CXd0rVXyYmobt7sEEfK3clRbGaTwSJxrGkxJWoZu6I7PzJu/
Adam Tkac 98dc34
             E9gx4UC1zGAHlXKdE4zYIpRhaBKnvcC2U9mZhkdUpd1Vso/HAdjNe8LmMlnzY3
Adam Tkac 98dc34
             zy2Xy4klWOADTPzSv9eamj8V18PHGjBLaVtYvk/ln5ZApjYghf+6fElrmLkdaz
Adam Tkac 98dc34
             MQ2OCnACR817DF4BBa7UR/beDHyp5iWTXWSi6XmoJLbG9Scqc7l70KDqlvXR3M
Adam Tkac 98dc34
             /lUUVRbkeg1IPJSidmK3ZyCllh4XSKbje/45SKucHgnwU5jefMtq66gKodQj+M
Adam Tkac 98dc34
             iA21AfUVe7u99WzTLzY3qlxDhxYQQ20FQ97S+LKUTpQcq27R7AT3/V5hRQxScI
Adam Tkac 98dc34
             Nqwcz4jYqZD2fQdgxbcDTClU0CRBdiieyLMNzXG3";
Adam Tkac 98dc34
Adam Tkac 98dc34
// Key for forward zone
Adam Tkac 98dc34
example.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM65KbhTjrW1ZaARmPhEZZe
Adam Tkac 98dc34
                      3Y9ifgEuq7vZ/zGZUdEGNWy+JZzus0lUptwgjGwhUS1558Hb4JKUbb
Adam Tkac 98dc34
                      OTcM8pwXlj0EiX3oDFVmjHO444gLkBO UKUf/mC7HvfwYH/Be22GnC
Adam Tkac 98dc34
                      lrinKJp1Og4ywzO9WglMk7jbfW33gUKvirTHr25GL7STQUzBb5Usxt
Adam Tkac 98dc34
                      8lgnyTUHs1t3JwCY5hKZ6CqFxmAVZP20igTixin/1LcrgX/KMEGd/b
Adam Tkac 98dc34
                      iuvF4qJCyduieHukuY3H4XMAcR+xia2 nIUPvm/oyWR8BW/hWdzOvn
Adam Tkac 98dc34
                      SCThlHf3xiYleDbt/o1OTQ09A0=";
Adam Tkac 98dc34
Adam Tkac 98dc34
// Key for reverse zone.
Adam Tkac 98dc34
2.0.192.IN-ADDRPA.NET. 257 3 5 "AQOnS4xn/IgOUpBPJ3bogzwcxOdNax071L18QqZnQQQA
Adam Tkac 98dc34
                                VVr+iLhGTnNGp3HoWQLUIzKrJVZ3zggy3WwNT6kZo6c0
Adam Tkac 98dc34
                                tszYqbtvchmgQC8CzKojM/W16i6MG/ea fGU3siaOdS0
Adam Tkac 98dc34
                                yOI6BgPsw+YZdzlYMaIJGf4M4dyoKIhzdZyQ2bYQrjyQ
Adam Tkac 98dc34
                                4LB0lC7aOnsMyYKHHYeRv PxjIQXmdqgOJGq+vsevG06
Adam Tkac 98dc34
                                zW+1xgYJh9rCIfnm1GX/KMgxLPG2vXTD/RnLX+D3T3UL
Adam Tkac 98dc34
                                7HJYHJhAZD5L59VvjSPsZJHeDCUyWYrvPZesZDIRvhDD
Adam Tkac 98dc34
                                52SKvbheeTJUm6EhkzytNN2SN96QRk8j/iI8ib";
Adam Tkac 98dc34
};
Adam Tkac 98dc34
*/