Home | History | Annotate | Line # | Download | only in etc 
      1 # $NetBSD: named.conf,v 1.14 2025/08/06 02:03:59 kim Exp $
      2 
      3 # boot file for secondary name server
      4 # Note that there should be one primary entry for each SOA record.
      5 # If you cannot get DNSSEC to work, and you see the following message:
      6 # DNSKEY: verify failed due to bad signature (keyid=19036): \
      7 # RRSIG validity period has not begun 
      8 # Fix your clock. You can comment out the dnssec entries temporarily to
      9 # get to an ntp server.
     10 
     11 options {
     12 	directory "/etc/namedb";
     13 	dnssec-validation auto;
     14 	managed-keys-directory "keys";
     15 	bindkeys-file "bind.keys";
     16 	allow-recursion { localhost; localnets; };
     17 
     18 	#
     19 	# An EDNS buffer size of 1232 bytes will avoid fragmentation on
     20 	# nearly all current networks. This is based on an MTU of 1280,
     21 	# which is required by the IPv6 specification, minus 48 bytes for
     22 	# the IPv6 and UDP headers and the aforementioned research.
     23 	#
     24 	# https://www.dnsflagday.net/2020/
     25 	#
     26 	max-udp-size 1232;
     27 	edns-udp-size 1232;
     28 
     29 	# RFC 8482
     30 	minimal-any yes;
     31 	minimal-responses yes;
     32 
     33 	#
     34 	# This forces all queries to come from port 53; might be
     35 	# needed for firewall traversals but should be avoided if
     36 	# at all possible because of the risk of spoofing attacks.
     37 	#
     38 	#query-source address * port 53;
     39 };
     40 
     41 zone "." {
     42 	type hint;
     43 	file "root.cache";
     44 };
     45 
     46 zone "localhost" {
     47 	type master;
     48 	file "localhost";
     49 };
     50 
     51 zone "127.IN-ADDR.ARPA" {
     52 	type master;
     53 	file "127";
     54 };
     55 
     56 zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" {
     57 	type master;
     58 	file "loopback.v6";
     59 };
     60 
     61 # example secondary server config:
     62 #
     63 # zone "Berkeley.EDU" {
     64 # 	type slave;
     65 # 	file "berkeley.edu.cache";
     66 # 	masters {
     67 # 		128.32.130.11;
     68 # 		128.32.133.1;
     69 # 	};
     70 # };
     71 
     72 # zone "32.128.IN-ADDR.ARPA" {
     73 # 	type slave;
     74 # 	file "128.32.cache";
     75 # 	masters {
     76 # 		128.32.130.11;
     77 # 		128.32.133.1;
     78 # 	};
     79 # };
     80 
     81 # example primary server config:
     82 # 
     83 # zone "Berkeley.EDU" {
     84 # 	type master;
     85 # 	file "berkeley.edu";
     86 # };
     87 
     88 # zone "32.128.IN-ADDR.ARPA" {
     89 # 	type master;
     90 # 	file "128.32";
     91 # };
     92