nsd.conf(5) nsd 4.15.0 nsd.conf(5) (NAME) nsd.conf - NSD (SYNOPSIS) nsd.conf (DESCRIPTION) nsd(8) . nsd (zone) (primaries) (secondaries) . . . : attribute: value () # . . "file name.zone". (EXAMPLES) nsd.conf . # Example nsd.conf file for example.com. # This is a comment. server: server-count: 1 # use this number of cpu cores username: zonelistfile: //var/db/nsd/zone.list logfile: //var/log/nsd.log pidfile: /run/nsd/nsd.pid xfrdfile: //var/db/nsd/xfrd.state zone: name: example.com zonefile: //etc/nsd/example.com.zone zone: # this server is the primary and 192.0.2.1 is the secondary. name: primaryzone.com zonefile: //etc/nsd/primaryzone.com.zone notify: 192.0.2.1 NOKEY provide-xfr: 192.0.2.1 NOKEY zone: # this server is the secondary and 192.0.2.2 is the primary. name: secondaryzone.com zonefile: //etc/nsd/secondaryzone.com.zone allow-notify: 192.0.2.2 NOKEY request-xfr: 192.0.2.2 NOKEY kill -HUP . kill -TERM . (FILE FORMAT) . ':' . . server: verify: key: pattern: zone: tls-auth: remote-control: . . zone: . server: NSD . verify: . key: . pattern: . tls-auth: TLS XFR-over-TLS . include: . . . chroot ( chroot) include chroot ( chroot) . '*' (wildcard) "foo/nsd.d/*.conf". '?' '{}' '[]' '~' glob(7) . . (Server Options) ( NSD ) server: . server: . ip-address: [@port] [servers] [bindtodevice] [setfib] NSD ip-address (bind) . IP . (port) . NSD (wildcard) . -a. () NSD [@port] . NSD 1 server-count . IP . (ranges) . . ip4 ip6 IP . IP . udp 0.0.0.0 IP . anycast . ip- transparent ( ). bindtodevice SO_BINDTODEVICE . . . setfib SO_SETFIB fib getaddrinfo . FIB ( ) . . interface: [@port] [servers] [bindtodevice] [setfib] ip-address ( unbound.conf). ip-transparent: NSD . NSD IP . no . ip-freebind: IP_FREEBIND (down) . ip-transparent . no . reuseport: SO_REUSEPORT server-count (file descriptors) . . server-count 1 ( ) . no . FreeBSD . send-buffer-size: . 0 . ( ARP NDP) . 4194304 (4 ) . receive-buffer-size: . 0 . 1048576 (1 ) . debug-mode: nsd . no . -d. yes ( ) (supervisor) . do-ip4: yes NSD IPv4 . yes . do-ip6: yes NSD IPv6 . yes . database: 4.8.0 NSD . zonelistfile: //var/db/nsd/zone.list . . NSD . zone-name pattern-name . addzone delzone nsd-control . identity: CH TXT ID.SERVER . gethostname(3) . -i. hide-identity . version: CH TXT version.server version.bind . . hide-version . nsid: NSID EDNS nsid EDNS . _ascii ascii . -I. logfile: logfile . stderr syslog ( LOG_DAEMON) . -l. log-only-syslog: syslog . systemd stderr journald . syslog stderr . syslog stderr . no . server-count: NSD . 1 . -N. cpu-affinity: ... (CPU affinity) () NSD. . server-N-cpu-affinity: NSD N . cpu-affinity . cpu-affinity . xfrd-cpu-affinity: xfrd . cpu-affinity . cpu-affinity . tcp-count: TCP . 100 . -n. . tcp-reject-overflow: yes TCP tcp- count ( ) . no . tcp-query-count: TCP . 0 . tcp-timeout: TCP . (zone transfer) TCP . 120 . tcp-mss: (MSS) TCP . MSS ( 1220) Path MTU . MSS ( TCP_MAXSEG) . MSS MTU . outgoing-tcp-mss: (MSS) TCP XFR . MSS ( 1220) Path MTU . MSS ( TCP_MAXSEG) . MSS MTU NSD . tcp-listen-queue: (backlog) TCP . TCP . . (flooding) . BSD -1 256 . -1 . xfrd-tcp-max: xfrd . 128 . 256 . . NSD : xfrd-tcp-max: 32 xfrd-tcp-pipeline: 128 rrl-size: 1000. . server-count tcp-count ( ) . xfrd-tcp-pipeline: tcp xfrd . 65536 128 . . ipv4-edns-size: EDNS IPv4. 1232 . ipv6-edns-size: EDNS IPv6. 1232 . pidfile: pid "/run/nsd/nsd.pid" . -P. "" pid pidfile . "". pid . username: (chown ) . . port: . 53 . -p. statistics: . ( ) . -s. chroot: NSD chroot . chroot chroot . chroot . "" ( ) chroot . "" . -t. username: . id id.gid . -u. zonesdir: . NSD zonelistfile logfile pidfile xfrdfile xfrdir server-key-file server-cert- file control-key-file control-cert-file . "" ( ) . "//etc/nsd" . difffile: NSD3 . xfrdfile: soa NSD . . . "" . NSD . //var/db/nsd/xfrd.state . xfrdir: . NSD . /tmp . xfrd-reload-timeout: -1 xfrd (reload) . xfrd . . 1 . verbosity: (verbosity) . 0 . 1 (notifies) . 2 . 3 . -V. 0 NSD . 1 ( ) . 2 TCP axfr . hide-version: NSD CHAOS. no . hide-identity: NSD CHAOS. no . drop-updates: yes UPDATE . no . use-systemd: . libsystemd NSD systemd . log-time-ascii: ascii "no" epoch . yes . . syslog syslog . log-time-iso: log-time-ascii: yes ISO8601 . no . round-robin: (round robin) . . no . minimal-responses: . . (referrals) . --enable-minimal-responses . no . confine-to-zone: yes (apex) ( CNAME) . no . refuse-any: ANY. . (rrl) ANY UDP ANY (truncation) TCP ANY . no . NSD RFC 8482 4.1 (RRset) . A AAAA MX DNSKEY RRSIG . reload-config: TSIG SIGHUP. no . zonefiles-check: mtime NSD sighup. ( ). yes . reload nsd-control . zonefiles-write: N . "zonefile" "" ( ) . 3600 (1 ) . rrl-size: . 1000000 . (buckets) . rrl-ratelimit: qps ( ). ( 200 qps). 0 ( ) whitelist-ratelimit 0 . verbosity 2 . TCP . NSD (drop) . "rrl-slip" TC . slip 2 . 3 . rrl-slip 10 . rrl-ratelimit rrl-size rrl-whitelist-ratelimit reconfig nsd-control ( ). . rrl-slip: SLIP ( "truncated" 1) . 0 SLIP 1 SLIP . 2 +TC . rrl-ipv4-prefix-length: IPv4. . 24 . rrl-ipv6-prefix-length: IPv6. . 64 . rrl-whitelist-ratelimit: qps . ( 2000 qps). rrl-whitelist qps . 0 . answer-cookie: DNS RFC7873 . no . DNS (DoS) . . IP . ( rrl-ratelimit ) . anycast . . cookie-secret cookie-staging-secret . nsd-control(8) . cookie-secret-file . . cookie-secret: <128 bit hex string> . cookie-secret . cookie-staging-secret: <128 bit hex string> . anycast . cookie-staging-secret cookie-secret . cookie-secret-file: DNS . cookie-secret cookie-staging-secret . "//var/db/nsd/cookiesecrets.txt" . 4.10.1 NSD "//etc/nsd/nsd_cookiesecrets.txt" . cookie-secret-file . add_cookie_secret drop_cookie_secret activate_cookie_secret nsd-control(8) . . tls-service-key: TLS TCP TLS . (853) tls-port . :interface port@ IP . DNS over TLS . TLS . tls-service-pem . "" () . (restart) (reload ) chroot ( ) . tls-service-pem: pem tls. "" () . tls-service-ocsp: pem ocsp tls OCSP stapling. "" () . OCSP stapling : openssl ocsp -no_nonce \ -respout /path/to/ocsp.pem \ -CAfile /path/to/ca_and_any_intermediate.pem \ -issuer /path/to/direct_issuer.pem \ -cert /path/to/cert.pem \ -url "$( openssl x509 -noout -ocsp_uri -in /path/to/cert.pem )" tls-port: TCP TLS . 853 . number@ DNS over TLS . tls-auth-port: TCP TLS . TLS Transfer over TLS (XoT) . tls-cert-bundle . () tls-auth client-cert client-key tls-auth () . tls-auth-xfr-only: tls-auth-port . . provide-xfr tls-auth . . tls-cert-bundle: null "" . "/etc/pki/tls/certs/ca-bundle.crt". Transfer over TLS (XoT) . proxy-protocol-port: proxy protocol. . PROXYv2 UDP TCP TLS . xdp-interface: XDP . AF_XDP UDP . "" () . () : o cpu-affinity . o / rx/tx . XDP . server-count . server-count XDP . o PROXYv2 DNSTAP (ratelimiting) XDP . xdp-program-path: eBPF XDP XSKMAP . XDP . NSD UDP ( Ethernet[+VLAN]+IPv4/6) 53 . XDP BPF_MAP_TYPE_XSKMAP "xsks_map" . NSD XDP ( xdp-program-load ) XSKMAP . XDP bpffs (pin) ( xdp- bpffs-path ). "/usr/share/nsd/xdp-dns-redirect_kern.o" . xdp-program-load: NSD XDP . no XDP . xdp-interface yes . xdp-bpffs-path: bpffs / xsks_map. XDP NSD BPF . NSD XDP NSD // bpffs . XDP NSD ( ). bpffs (/sys/fs/bpf) . bpffs (mount) . "/sys/fs/bpf" . xdp-force-copy: XDP_COPY zero copy AF_XDP. AF_XDP . no . metrics-enable: HTTP prometheus. nsd-control stats_noreset prometheus . ( libevent2 ) ( zonestats) zonestats . zonestats zonestats "zone" zonestats: examplezone: nsd_zonestats_queries_total{zone="examplezone"} nsd-control stats ( nsd-control stats_noreset) HTTP (reset) . metrics-interface: NSD prometheus . IP . 0.0.0.0 0:: . ip4 ip6 IP . 127.0.0.1 1:: . metrics-port: HTTP. 9100 . metrics-path: HTTP . "/metrics" . (Remote Control) remote-control: nsd-control(8) NSD . localhost . TLS TCP (self- signed) . nsd-control-setup . chroot NSD chroot (superuser) . control-enable: . no . control-interface: NSD ( TCP) . . 0.0.0.0 0:: . control-enable NSD localhost 127.0.0.1 1:: . ip4 ip6 IP . (named pipe) . . . . control-port: . 8952 . server-key-file: //etc/nsd/nsd_server.key. nsd-control-setup . nsd nsd-control . server-cert-file: //etc/nsd/nsd_server.pem. nsd-control-setup . nsd nsd-control . control-key-file: //etc/nsd/nsd_control.key. nsd-control-setup . nsd-control . control-cert-file: //etc/nsd/nsd_control.pem. . nsd-control-setup . nsd-control . (Verifier options) verify: . enable: . no . port: . 5347 . ip-address: ( localhost 127.0.0.1 1:: ). IP . ip- address verify . verify-zones: . verifier: ( IXFR AXFR) . 0 . . . : VERIFY_ZONE . VERIFY_ZONE_ON_STDIN (stdin) "yes" "no" . VERIFY_IP_ADDRESSES . IPv6 IPv6 IPv4 . VERIFY_PORT VERIFY_IP_ADDRESS. VERIFY_IPV6_ADDRESS IPv6 . VERIFY_IPV6_PORT VERIFY_IPV6_ADDRESS. VERIFY_IPV4_ADDRESS IPv4 . VERIFY_IPV4_PORT VERIFY_IPV4_ADDRESS. verifier-count: . 1 . verifier-feed-zone: (stdin). verifier-timeout: . . 0 . (Pattern Options) pattern: . . name: . ( ) . "_implicit_" ( nsd.conf ) . include-pattern: . . : zonefile allow-query allow-notify request-xfr allow-axfr-fallback notify notify-retry provide-xfr store-ixfr ixfr-number ixfr-size create-ixfr zonestats outgoing-interface verify-zone verifier verifier-feed-zone verifier-timeout catalog catalog-member-pattern . . (Zone Options) zone: . . . nsd.conf ( ) delzone repattern . name: . (apex) . '.' ( FQDN) "example.com" "sub.example.net.". . zonefile: . . . ( ) . ( ). '/' '%s' "\047" (escape) . zonefile "%1/%2/%s.zone". %s . %1 . %2 . %3 . %z (TLD) . %y . %x . allow-query: . allow-query . BLOCKED . NOKEY TSIG . BLOCKED . allow-query IP TSIG ( ). ip-spec IP (IPv4 IPv6) 1.2.3.4/24 1.2.3.4&255.255.255.0 1.2.3.4-1.2.3.25 . ip-spec / & @ - . allow-notify: . () (notifies) UDP TCP () . (BLOCKED) . NOKEY TSIG . BLOCKED . ip-spec IP (IPv4 IPv6) 1.2.3.4/24 1.2.3.4&255.255.255.0 1.2.3.4-1.2.3.25 . number@ 1.2.3.4@5300 1.2.3.4/24@5300 5300. ip-spec / & @ - . request-xfr: [AXFR|UDP] [tls-auth-name] . ( ) AXFR/IXFR . number@ 1.2.3.4@5300. AXFR/IXFR . tls-auth-name tls-auth XFR-over-TLS . AXFR IXFR AXFR . NSD NSD . AXFR IXFR AXFR . UDP UDP IXFR . UDP TSIG NSD (Kaminsky) . UDP IXFR TCP . tls-auth-name TLS ( 853) . tls-auth XFR . TLS 1.3 XFR-over-TLS . allow-axfr-fallback: request-xfr . NSD ( ) ( ) IXFR AXFR . yes . size-limit-xfr: request-xfr . XFR . . 0 . 0 . notify: . ( ) UDP . number@ 1.2.3.4@5300. . NSD ( ). notify-retry: notify . . provide-xfr: [tls-auth-name] . ( ) XFR . . XFR . BLOCKED . BLOCKED . ip-spec IP (IPv4 IPv6) 1.2.3.4/24 1.2.3.4&255.255.255.0 1.2.3.4-1.2.3.25 . number@ 1.2.3.4@5300 1.2.3.4/24@5300 5300. ip-spec / & @ - . tls-auth-name TLS . tls-auth-port SAN (Subject Alternative Name) DNS CN (Common Name) auth-domain-name tls-auth . tls-cert-bundle . tls-auth XFR . tls-port . tls-auth-xfr-only . TLS 1.3 XFR-over-TLS . outgoing-interface: . AXFR|IXFR ( ) ( ) . ip-address IP (IPv4 IPv6) . number@ 1.2.3.4@5300. store-ixfr: IXFR provide-xfr . no . IXFR AXFR . ixfr-number: IXFR . 5 . ixfr-size: IXFR . 1048576 . 0 . IXFR store-ixfr no . NSD IXFR . IXFR . create-ixfr: IXFR . store-ixfr yes IXFR . off . nsd-checkzone -i IXFR . IXFR ixfr (spool) . IXFR AXFR IXFR . max-refresh-time: (refresh) . . SOA . min-refresh-time: . max-retry-time: (retry) . . SOA . min-retry-time: . min-expire-time: . "refresh+retry+1" . refresh retry SOA 1 . refresh retry max-refresh-time min-refresh-time max-retry-time min-retry-time . zonestats: zone-stats NSD . . stats stats_noreset nsd-control . "" . "%s" . . include-pattern: . . rrl-whitelist: rrltype . whitelist-ratelimit . rrltype . . rrltype RRL NSD . ( 2). RRL : nxdomain error referral any rrsig wildcard nodata dnskey positive all. multi-primary-check: no . . . . verify-zone: . verify-zones verify: . verifier: . verifier verify: . verifier-feed-zone: . verifier-feed-zone verify: . verifier-timeout: . 0 () . verifier-timeout verify: . catalog: consumer . (consumer) . . group group catalog-member-pattern . group . producer . "nsd-control addzone " catalog-producer-zone . group . request-xfr . //var/db/nsd/zone.list zonelistfile . nsd-control zonestatus . . nsd-control zonestatus catalog-member-id: . . . . allow-query: 0.0.0.0/0 BLOCKED allow-query: ::0/0 BLOCKED . TLS . catalog-member-pattern: group . catalog-producer-zone: . "nsd-control addzone " . . (Key Declarations) key: . . name: . . tsig . algorithm: hmac-md5 hmac-sha1 hmac-sha224 hmac-sha256 hmac-sha384 hmac-sha512. 'sha1' 'sha256' . sha256 . . secret: base64. secret: ( base64) include: . . secret base64 . ( 4 A-Za-z0-9 ) dev-random base64 . TLS (TLS Auth Declarations) tls-auth: TLS . XFR-over-TLS : name: tls-auth. TLS . auth-domain-name: RFC8310 . . provide-xfr . request-xfr . client-cert: TLS NSD . pem . client-key . client-key: TLS . client-key-pw: client-key . include: . DNSTAP (DNSTAP Logging Options) DNSTAP dnstap: . . dnstap-enable: dnstap . no . yes dnstap dnstap-log-..-messages . dnstap-socket-path: . "//var/run/nsd-dnstap.sock" . dnstap-ip: <"" or addr[@port]> "" . address address@port ( "127.0.0.1@3333") TCP TLS . "" . dnstap-tls: TLS dnstap-ip . TCP . yes . dnstap-tls-server-name: . "" . dnstap-tls-client-key-file: "" . dnstap-tls-client-cert-file: "" . dnstap-send-identity: . no . dnstap-send-version: . no . dnstap-identity: "" (hostname) . "" . dnstap-version: "" . "" . dnstap-log-auth-query-messages: (auth query). no . NSD . dnstap-log-auth-response-messages: (auth response). no . NSD . NSD BIND9 (NSD CONFIGURATION FOR BIND9 HACKERS) BIND9 named.conf(5) . BIND9 'Primary' 'Secondary' . (Secondary zones) . . NSD allow-notify request-xfr . BIND9 allow-notify ( ) NSD allow-notify . BIND9 NSD request-xfr . BIND9 : # Config file for example.org options { dnssec-enable yes; }; key tsig.example.org. { algorithm hmac-md5; secret "aaaaaabbbbbbccccccdddddd"; }; server 162.0.4.49 { keys { tsig.example.org. ; }; }; zone "example.org" { type secondary; file "secondary/example.org.signed"; primaries { 162.0.4.49; }; }; NSD DNSSEC . dnssec-enable options . NSD IP {}server . NSD : # Config file for example.org key: name: tsig.example.org. algorithm: hmac-md5 secret: "aaaaaabbbbbbccccccdddddd" zone: name: "example.org" zonefile: "secondary/example.org.signed" # the primary is allowed to notify and will provide zone data. allow-notify: 162.0.4.49 NOKEY request-xfr: 162.0.4.49 tsig.example.org. . allow-notify request-xfr . allow-notify . (Primary zones) BIND9 . . NSD . BIND9 : zone "example.nl" { type primary; file "example.nl"; }; NSD : zone: name: "example.nl" zonefile: "example.nl" # allow anybody to request xfr. provide-xfr: 0.0.0.0/0 NOKEY provide-xfr: ::0/0 NOKEY # to list a secondary server you would in general give # provide-xfr: 1.2.3.4 tsig-key.name. # notify: 1.2.3.4 NOKEY (Other) NSD DNS (Authoritative-only) . DNS (resolvers) (caches) . BIND9 DNS NSD . BIND9 resolver cache . resolver caching BIND9 NSD . (FILES) //etc/nsd/nsd.conf NSD (SEE ALSO) nsd(8), nsd-checkconf(8), nsd-checkzone(8), nsd-control(8) (AUTHORS) NSD NLnet Labs RIPE NCC . CREDITS . (BUGS) nsd.conf (parser) . . NLnet Labs July 19, 26 nsd.conf(5)