upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-11 10:29:59 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

[9.18] fix: doc: Expand blackhole description

Browse source 
Clarify the behavior of negated addresses within the `blackhole`
statement to prevent common configuration misunderstandings.

Closes #5733

Backport of MR !11541

Merge branch 'backport-5733-expand-blackhole-description-9.18' into 'bind-9.18'

See merge request isc-projects/bind9!11671
This commit is contained in:
Mark Andrews 2026-03-12 13:11:50 +11:00
commit fc29c6a9d7
1 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
doc/arm/reference.rst
View file

@ -3149,6 +3149,17 @@ for details on how to specify IP address lists.
from or use to resolve a query. Queries from these addresses are not
responded to. The default is ``none``.
When configuring this list, note that BIND evaluates Access Control Lists
sequentially (first match wins). A common misconception is that the directive
``!address;`` blocks everything except that address. In reality, it only
explicitly exempts ``address`` from the blackhole; all other IP addresses
reach the end of the list without matching, meaning they are also not
blackholed.
To successfully blackhole all traffic *except* specific addresses, you must
explicitly catch the remaining traffic with ``any;`` at the end of the list.
For example: ``!address; any;``
.. namedconf:statement:: keep-response-order
:tags: server
:short: Defines an :any:`address_match_list` of addresses which do not accept reordered answers within a single TCP stream.