The acl statement (or access control statement) defines groups of hosts which can then be permitted or denied access to the nameserver.

An acl statement takes the following form:

acl <acl-name> {
	<match-element>;     
	[<match-element>; ...] 
};

In this statement, replace <acl-name> with the name of the access control list and replace <match-element> with a semi-colon separated list of IP addresses. Most of the time, an individual IP address or IP network notation (such as 10.0.1.0/24) is used to identify the IP addresses within the acl statement.

The following access control lists are already defined as keywords to simplify configuration:

When used in conjunction with other statements (such as the options statement), acl statements can be very useful in preventing the misuse of a BIND nameserver.

The following example defines two access control lists and uses an options statement to define how they are treated by the nameserver:

 acl black-hats {     
	10.0.2.0/24;     192.168.0.0/24;  };  
	acl red-hats {     10.0.1.0/24;  };  
options {     
	blackhole { black-hats; };     
	allow-query { red-hats; };     
	allow-recursion { red-hats; };  
}    

This example contains two access control lists, black-hats and red-hats. Hosts in the black-hats list are denied access to the nameserver, while hosts in the red-hats list are given normal access.

The include statement allows files to be included in a named.conf file. In this way, sensitive configuration data (such as keys) can be placed in a separate file with restrictive permissions.

An include statement takes the following form:

include  "<file-name>"

In this statement, <file-name> is replaced with an absolute path to a file.

The options statement defines global server configuration options and sets defaults for other statements. It can be used to specify the location of the named working directory, the types of queries allowed, and much more.

The options statement takes the following form:

options {          
	<option>; 	
	[<option>; ...]  
}; 

In this statement, the <option> directives are replaced with a valid option.

The following are commonly used options:

There are several other options also available, many of which rely upon one another to work properly. Refer to the BIND 9 Administrator Reference Manual referenced in Section 16.7.1, “Installed Documentation” and the bind.conf man page for more details.

A zone statement defines the characteristics of a zone, such as the location of its configuration file and zone-specific options. This statement can be used to override the global options statements.

A zone statement takes the following form:

zone <zone-name> <zone-class> {      
	<zone-options>;      
	[<zone-options>; ...] 
};

In this statement, <zone-name> is the name of the zone, <zone-class> is the optional class of the zone, and <zone-options> is a list of options characterizing the zone.

The <zone-name> attribute for the zone statement is particularly important. It is the default value assigned for the $ORIGIN directive used within the corresponding zone file located in the /var/named/ directory. The named daemon appends the name of the zone to any non-fully qualified domain name listed in the zone file.

For example, if a zone statement defines the namespace for example.com, use example.com as the <zone-name> so it is placed at the end of hostnames within the example.com zone file.

For more information about zone files, refer to Section 16.3, “Zone Files”.

The most common zone statement options include the following:

Most changes to the /etc/named.conf file of a master or slave nameserver involves adding, modifying, or deleting zone statements. While these zone statements can contain many options, most nameservers require only a small subset to function efficiently. The following zone statements are very basic examples illustrating a master-slave nameserver relationship.

The following is an example of a zone statement for the primary nameserver hosting example.com (192.168.0.1):

zone "example.com" IN {   
	type master;   
	file "example.com.zone";   
	allow-update { none; }; 
};

In the statement, the zone is identified as example.com, the type is set to master, and the named service is instructed to read the /var/named/example.com.zone file. It also tells named not to allow any other hosts to update.

A slave server's zone statement for example.com is slightly different from the previous example. For a slave server, the type is set to slave and in place of the allow-update line is a directive telling named the IP address of the master server.

The following is an example slave server zone statement for example.com zone:

zone "example.com" {   
	type slave;   
	file "example.com.zone";   
	masters { 192.168.0.1; }; 
};

This zone statement configures named on the slave server to query the master server at the 192.168.0.1 IP address for information about the example.com zone. The information that the slave server receives from the master server is saved to the /var/named/example.com.zone file.