diff options
Diffstat (limited to 'doc/arm/Bv9ARM-book.xml')
| -rw-r--r-- | doc/arm/Bv9ARM-book.xml | 73 |
1 files changed, 43 insertions, 30 deletions
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index d11a1ac0..f6ea92ea 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> -<!-- File: $Id: Bv9ARM-book.xml,v 1.478.8.6 2011-05-16 04:19:47 marka Exp $ --> +<!-- File: $Id: Bv9ARM-book.xml,v 1.478.8.9 2011-06-09 03:14:04 marka Exp $ --> <book xmlns:xi="http://www.w3.org/2001/XInclude"> <title>BIND 9 Administrator Reference Manual</title> @@ -1188,11 +1188,11 @@ zone "eng.example.com" { </para> <para> This command requires that the - <command>auto-dnssec</command> zone option to be set - to <literal>allow</literal>, - <literal>maintain</literal>, or - <literal>create</literal>, and also requires - the zone to be configured to allow dynamic DNS. + <command>auto-dnssec</command> zone option be set + to <literal>allow</literal> or + <literal>maintain</literal>, + and also requires the zone to be configured to + allow dynamic DNS. See <xref linkend="dynamic_update_policies"/> for more details. </para> @@ -1217,10 +1217,10 @@ zone "eng.example.com" { </para> <para> This command requires that the - <command>auto-dnssec</command> zone option to - be set to <literal>maintain</literal> or - <literal>create</literal>, and also requires - the zone to be configured to allow dynamic DNS. + <command>auto-dnssec</command> zone option + be set to <literal>maintain</literal>, + and also requires the zone to be configured to + allow dynamic DNS. See <xref linkend="dynamic_update_policies"/> for more details. </para> @@ -7588,22 +7588,27 @@ avoid-v6-udp-ports {}; <varlistentry> <term><command>serial-query-rate</command></term> - <listitem> - <para> - Slave servers will periodically query master servers - to find out if zone serial numbers have changed. Each such - query uses - a minute amount of the slave server's network bandwidth. To - limit the - amount of bandwidth used, BIND 9 limits the rate at which - queries are - sent. The value of the <command>serial-query-rate</command> option, - an integer, is the maximum number of queries sent per - second. - The default is 20. - </para> - </listitem> - </varlistentry> + <listitem> + <para> + Slave servers will periodically query master + servers to find out if zone serial numbers have + changed. Each such query uses a minute amount of + the slave server's network bandwidth. To limit + the amount of bandwidth used, BIND 9 limits the + rate at which queries are sent. The value of the + <command>serial-query-rate</command> option, an + integer, is the maximum number of queries sent + per second. The default is 20. + </para> + <para> + In addition to controlling the rate SOA refresh + queries are issued at + <command>serial-query-rate</command> also controls + the rate at which NOTIFY messages are sent from + both master and slave zones. + </para> + </listitem> + </varlistentry> <varlistentry> <term><command>serial-queries</command></term> @@ -8749,6 +8754,10 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; The delay, in seconds, between sending sets of notify messages for a zone. The default is five (5) seconds. </para> + <para> + The overall rate that NOTIFY messages are sent for all + zones is controlled by <command>serial-query-rate</command>. + </para> </listitem> </varlistentry> </variablelist> @@ -9230,8 +9239,8 @@ deny-answer-aliases { "example.net"; }; <para> The rules encoded in a response policy zone (RPZ) are applied only to responses to queries that ask for recursion (RD=1). - RPZs are normal DNS zones containing largely valid RRsets - that can be queried normal if allowed. + RPZs are normal DNS zones containing RRsets + that can be queried normally if allowed. It is usually best to restrict those queries with something like <command>allow-query {none; };</command> or <command>allow-query { 127.0.0.1; };</command>. @@ -9243,6 +9252,8 @@ deny-answer-aliases { "example.net"; }; records resolved in the process of generating the response. The owner name of a QNAME rule is the query name relativized to the RPZ. + The records in a rewrite rule are usually A, AAAA, or special + CNAMEs, but can be any type except DNAME. </para> <para> @@ -9342,6 +9353,7 @@ nodata.domain.com CNAME *. bad.domain.com A 10.0.0.1 AAAA 2001:2::1 ok.domain.com CNAME ok.domain.com. +*.badzone.domain.com CNAME garden.example.com. ; IP rules rewriting all answers for 127/8 except 127.0.0.1 8.0.0.0.127.ip CNAME . @@ -10001,7 +10013,7 @@ view "external" { <optional> min-retry-time <replaceable>number</replaceable> ; </optional> <optional> max-retry-time <replaceable>number</replaceable> ; </optional> <optional> key-directory <replaceable>path_name</replaceable>; </optional> - <optional> auto-dnssec <constant>allow</constant>|<constant>maintain</constant>|<constant>create</constant>|<constant>off</constant>; </optional> + <optional> auto-dnssec <constant>allow</constant>|<constant>maintain</constant>|<constant>off</constant>; </optional> <optional> zero-no-soa-ttl <replaceable>yes_or_no</replaceable> ; </optional> }; @@ -10013,6 +10025,7 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea <optional> allow-transfer { <replaceable>address_match_list</replaceable> }; </optional> <optional> allow-update-forwarding { <replaceable>address_match_list</replaceable> }; </optional> <optional> update-check-ksk <replaceable>yes_or_no</replaceable>; </optional> + <optional> dnssec-update-mode ( <replaceable>maintain</replaceable> | <replaceable>no-resign</replaceable> ); </optional> <optional> dnssec-dnskey-kskonly <replaceable>yes_or_no</replaceable>; </optional> <optional> dnssec-secure-to-insecure <replaceable>yes_or_no</replaceable> ; </optional> <optional> try-tcp-refresh <replaceable>yes_or_no</replaceable>; </optional> @@ -11058,7 +11071,7 @@ example.com. NS ns2.example.net. <para> Zones configured for dynamic DNS may also use this option to allow varying levels of automatic DNSSEC key - management. There are four possible settings: + management. There are three possible settings: </para> <para> <command>auto-dnssec allow;</command> permits |