@@ -147,15 +147,15 @@ NSD will bind to the listed ip\-address. Can be given multiple times
147
147
to bind multiple ip\- addresses. Optionally, a port number can be given.
148
148
If none are given NSD listens to the wildcard interface. Same as command-line option
149
149
.BR \- a.
150
- . IP
150
+
151
151
To limit which NSD server(s) listen on the given interface, specify one or
152
152
more servers separated by whitespace after <ip>[@port]. Ranges can be used as
153
153
a shorthand to specify multiple consecutive servers. By default every server
154
154
will listen.
155
- . IP
155
+
156
156
If an interface name is used instead of ip4 or ip6, the list of IP addresses
157
157
associated with that interface is picked up and used at server start.
158
- . IP
158
+
159
159
For servers with multiple IP addresses that can be used to send traffic
160
160
to the internet, list them one by one, or the source address of replies
161
161
could be wrong. This is because if the udp socket associates a source
@@ -302,7 +302,7 @@ Increase it to allow more zone transfer sockets, like to 256.
302
302
To save memory, this can be lowered, set it lower together with some other
303
303
settings to have reduced memory footprint for NSD. xfrd\- tcp\- max: 32
304
304
and xfrd\- tcp\- pipeline: 128 and rrl\- size: 1000
305
- . IP
305
+
306
306
This reduces memory footprint, other memory usage is caused mainly by
307
307
the server\- count setting, the number of server processes, and the
308
308
tcp\- count setting, which keeps buffers per server process, and by the
@@ -398,14 +398,14 @@ Default is 0. 1 gives more information about incoming notifies and
398
398
zone transfers. 2 lists soft warnings that are encountered. 3 prints
399
399
more information. Same as command-line option
400
400
.BR \- V .
401
- . IP
401
+
402
402
Verbosity 0 will print warnings and errors, and other events that are
403
403
important to keep NSD running.
404
- . IP
404
+
405
405
Verbosity 1 prints additionally messages of interest. Successful notifies,
406
406
successful incoming zone transfer (the zone is updated), failed incoming
407
407
zone transfers or the inability to process zone updates.
408
- . IP
408
+
409
409
Verbosity 2 prints additionally soft errors, like connection resets over TCP.
410
410
And notify refusal, and axfr request refusals.
411
411
.TP
@@ -536,7 +536,7 @@ service port number. The port number (853) is configured with tls\-port.
536
536
To turn it on, create an interface: option line in config with @port
537
537
appended to the IP-address. This creates the extra socket on which the
538
538
DNS over TLS service is provided.
539
- . IP
539
+
540
540
The file is the private key for the TLS session. The public certificate is
541
541
in the tls-service-pem file. Default is "", turned off. Requires a
542
542
restart (a reload is not enough) if changed, because the private key is
@@ -568,7 +568,7 @@ If you want to use mutual TLS authentication in Transfer over TLS (XoT) connecti
568
568
this is where the primary server enables a dedicated port for this purpose. Certificates in
569
569
.BR tls-cert-bundle
570
570
are used for verifying the authenticity of a client or a secondary server.
571
- . IP
571
+
572
572
Client (secondary) must enable
573
573
.BR tls-auth ,
574
574
configure
@@ -621,10 +621,10 @@ NSD will bind to the listed addresses to service control requests
621
621
Use 0.0.0.0 and ::0 to service the wildcard interface. If none are given
622
622
NSD listens to the localhost 127.0.0.1 and ::1 interfaces for control,
623
623
if control is enabled with control\- enable.
624
- . IP
624
+
625
625
If an interface name is used instead of ip4 or ip6, the list of IP addresses
626
626
associated with that interface is picked up and used at server start.
627
- . IP
627
+
628
628
With an absolute path, a unix local named pipe is used for control. The
629
629
file is created with user and group that is configured and access bits
630
630
are set to allow members of the group access. Further access can be
@@ -802,24 +802,24 @@ each zone.
802
802
The file containing the zone information. If this attribute is present
803
803
it is used to read and write the zone contents. If the attribute is
804
804
absent it prevents writing out of the zone.
805
- . IP
805
+
806
806
The string is processed so that one string can be used (in a pattern)
807
807
for a lot of different zones. If the label or character does not exist the
808
808
percent-character is replaced with a period for output (i.e. for the
809
809
third character in a two letter domain name).
810
- . IP
810
+
811
811
.B %s\fR is replaced with the zone name.
812
- . IP
812
+
813
813
.B %1\fR is replaced with the first character of the zone name.
814
- . IP
814
+
815
815
.B %2\fR is replaced with the second character of the zone name.
816
- . IP
816
+
817
817
.B %3\fR is replaced with the third character of the zone name.
818
- . IP
818
+
819
819
.B %z\fR is replaced with the toplevel domain name of the zone.
820
- . IP
820
+
821
821
.B %y\fR is replaced with the next label under the toplevel domain.
822
- . IP
822
+
823
823
.B %x\fR is replaced with the next-next label under the toplevel domain.
824
824
.TP
825
825
.B allow\-query:\fR <ip\-spec> <key\-name | NOKEY | BLOCKED>
@@ -1061,7 +1061,7 @@ property, or if a group property is missing or invalid, the pattern specified
1061
1061
by the \fB catalog \- member \- pattern \fR option is used. Group properties are valid
1062
1062
if there is only a single value matching the name of a for member zones valid
1063
1063
pattern.
1064
- . IP
1064
+
1065
1065
A zone with the option set to \fI producer \fR , can be used to produce a
1066
1066
catalog zone. Member zones for catalog producer zones can be added with
1067
1067
"\fI nsd \- control addzone <zone> <pattern> \fR ", where <pattern> has a
@@ -1071,17 +1071,17 @@ Catalog producer zones must be primary zones and may not have a
1071
1071
\fB request \- xfr \fR option. Catalog producer zones will \fI not \fR read content
1072
1072
from zone files, but will reconstruct the zone on startup from the member zone
1073
1073
entries in @zonelistfile@, specified with the \fB zonelistfile \fR option.
1074
- . IP
1074
+
1075
1075
The status of both catalog consumer and producer zones can be verified with
1076
1076
\fI nsd \- control zonestatus \fR . It will show the number of member zones and, if
1077
1077
the catalog zone is invalid, the reason for it to be invalid is shown.
1078
1078
\fI nsd \- control zonestatus \fR will also show the entry of a catalog member zone
1079
1079
in the catalog (consumer or producer) zone as \fB catalog-member-id: \fR .
1080
- . IP
1080
+
1081
1081
A catalog zone can either be catalog consumer zone or a catalog producer zone
1082
1082
but not both. Likewise, catalog member zones can be either a member of catalog
1083
1083
consumer zone or a catalog producer zone but not both.
1084
- . IP
1084
+
1085
1085
Catalog zones contain a list of zones that are served. Use \fB allow \- query:
1086
1086
0.0.0.0/0 BLOCKED \fR and \fB allow \- query: ::0/0 BLOCKED \fR in a catalog zone
1087
1087
zone or pattern clause to prevent revealing the catalog. Also consider using
0 commit comments