upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-20 23:00:56 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

man page fixes for Solaris.

Browse source 
git-svn-id: file:///svn/unbound/trunk@838 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2008-01-10 15:46:55 +00:00
parent fe6f28ddc5
commit 22b8057cca
5 changed files with 404 additions and 307 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
doc/Changelog
View file

@ -4,6 +4,7 @@
by linking with .lo instead of .o files in the ldns package. by linking with .lo instead of .o files in the ldns package.
- nicer do-ip6: yes/no documentation. - nicer do-ip6: yes/no documentation.
- nicer linking of libevent .o files. - nicer linking of libevent .o files.
- man pages render correctly on solaris.
9 January 2008: Wouter 9 January 2008: Wouter
- fixup openssl RAND problem, when the system is not configured to - fixup openssl RAND problem, when the system is not configured to

52
doc/unbound-checkconf.8
View file

@ -1,3 +1,4 @@
.TH "unbound-checkconf" "8" "@date@" "NLnet Labs" "unbound @version@"
.\" .\"
.\" unbound-checkconf.8 -- unbound configuration checker manual .\" unbound-checkconf.8 -- unbound configuration checker manual
.\" .\"
@ -6,40 +7,37 @@
.\" See LICENSE for the license. .\" See LICENSE for the license.
.\" .\"
.\" .\"
.Dd @date@ .SH "NAME"
.Dt unbound-checkconf 8 .LP
.Sh NAME
unbound-checkconf unbound-checkconf
.Nd Check unbound configuration file for errors. \- Check unbound configuration file for errors.
.Sh SYNOPSIS .SH "SYNOPSIS"
.Nm unbound-checkconf .B unbound-checkconf
.Op Fl h .RB [ \-h ]
.Op cfgfile .IR cfgfile
.Sh DESCRIPTION .SH "DESCRIPTION"
.Ic Unbound-checkconf .B Unbound-checkconf
checks the configuration file for the checks the configuration file for the
.Xr unbound 8 \fIunbound\fR(8)
DNS resolver for syntax and other errors. DNS resolver for syntax and other errors.
The config file syntax is The config file syntax is described in
described in \fIunbound.conf\fR(5).
.Xr unbound.conf 5 . .P
.Pp
The available options are: The available options are:
.Bl -tag -width indent .TP
.It Fl h .B \-h
Show the version and commandline option help. Show the version and commandline option help.
.It cfgfile .TP
.I cfgfile
The config file to read with settings for unbound. It is checked. The config file to read with settings for unbound. It is checked.
If omitted, the config file at the default location is checked. If omitted, the config file at the default location is checked.
.El .SH "EXIT CODE"
.Sh EXIT CODE
The unbound-checkconf program exits with status code 1 on error, The unbound-checkconf program exits with status code 1 on error,
0 for a correct config file. 0 for a correct config file.
.Sh FILES .SH "FILES"
.Bl -tag -width indent .TP
.It Pa /etc/unbound/unbound.conf .I /etc/unbound/unbound.conf
unbound configuration file. unbound configuration file.
.El .SH "SEE ALSO"
.Sh SEE ALSO \fIunbound.conf\fR(5),
.Xr unbound.conf 5 , \fIunbound\fR(8).
.Xr unbound 8 .

110
doc/unbound-host.1
View file

@ -1,3 +1,4 @@
.TH "unbound\-host" "1" "@date@" "NLnet Labs" "unbound @version@"
.\" .\"
.\" unbound-host.1 -- unbound DNS lookup utility .\" unbound-host.1 -- unbound DNS lookup utility
.\" .\"
@ -6,74 +7,87 @@
.\" See LICENSE for the license. .\" See LICENSE for the license.
.\" .\"
.\" .\"
.Dd @date@ .SH "NAME"
.Dt unbound-host 1 .LP
.Sh NAME .B unbound\-host
unbound-host \- unbound DNS lookup utility
.Nd unbound DNS lookup utility .SH "SYNOPSIS"
.Sh SYNOPSIS .LP
.Nm unbound-host .B unbound\-host
.Op Fl vdh .RB [ \-vdh ]
.Op Fl c Ar class .RB [ \-c
.Op Fl t Ar type .IR class ]
hostname .RB [ \-t
.Op Fl y Ar key .IR type ]
.Op Fl f Ar keyfile .I hostname
.Op Fl F Ar namedkeyfile .RB [ \-y
.Sh DESCRIPTION .IR key ]
.Ic Unbound-host .RB [ \-f
Uses the unbound validating resolver to query for the hostname and display .IR keyfile ]
results. With the \fB-v\fR option it displays validation .RB [ \-F
.IR namedkeyfile ]
.SH "DESCRIPTION"
.LP
.B Unbound\-host
uses the unbound validating resolver to query for the hostname and display
results. With the \fB\-v\fR option it displays validation
status: secure, insecure, bogus (security failure). status: secure, insecure, bogus (security failure).
.P
.Pp
The available options are: The available options are:
.Bl -tag -width indent .TP
.It hostname .I hostname
This name is resolved (looked up in the DNS). This name is resolved (looked up in the DNS).
If a IPv4 or IPv6 address is given, a reverse lookup is performed. If a IPv4 or IPv6 address is given, a reverse lookup is performed.
.It Fl h .TP
.B \-h
Show the version and commandline option help. Show the version and commandline option help.
.It Fl v .TP
.B \-v
Enable verbose output and it shows validation results, on every line. Enable verbose output and it shows validation results, on every line.
Secure means that the NXDOMAIN (no such domain name), nodata (no such data) Secure means that the NXDOMAIN (no such domain name), nodata (no such data)
or positive data response validated correctly with one of the keys. or positive data response validated correctly with one of the keys.
Insecure means that that domain name has no security set up for it. Insecure means that that domain name has no security set up for it.
Bogus (security failure) means that the response failed one or more checks, Bogus (security failure) means that the response failed one or more checks,
it is likely wrong, outdated, tampered with, or broken. it is likely wrong, outdated, tampered with, or broken.
.It Fl d .TP
Enable debug output to stderr. One -d shows what the resolver and validator .B \-d
are doing and may tell you what is going on. More times, -d -d, gives a Enable debug output to stderr. One \-d shows what the resolver and validator
are doing and may tell you what is going on. More times, \-d \-d, gives a
lot of output, with every packet sent and received. lot of output, with every packet sent and received.
.It Fl c Ar class .TP
.B \-c \fIclass
Specify the class to lookup for, the default is IN the internet class. Specify the class to lookup for, the default is IN the internet class.
.It Fl t Ar type .TP
.B \-t \fItype
Specify the type of data to lookup. The default looks for IPv4, IPv6 and Specify the type of data to lookup. The default looks for IPv4, IPv6 and
mail handler data, or domain name pointers for reverse queries. mail handler data, or domain name pointers for reverse queries.
.It Fl y Ar key .TP
.B \-y \fIkey
Specify a public key to use as trust anchor. This is the base for a chain Specify a public key to use as trust anchor. This is the base for a chain
of trust that is built up from the trust anchor to the response, in order of trust that is built up from the trust anchor to the response, in order
to validate the response message. Can be given as a DS or DNSKEY record. to validate the response message. Can be given as a DS or DNSKEY record.
For example -y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD". For example \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD".
.It Fl f Ar keyfile .TP
.B \-f \fIkeyfile
Reads keys from a file. Every line has a DS or DNSKEY record, in the format Reads keys from a file. Every line has a DS or DNSKEY record, in the format
as for -y. The zone file format, the same as dig and drill produce. as for \-y. The zone file format, the same as dig and drill produce.
.It Fl F Ar namedkeyfile .TP
Reads keys from a BIND-style named.conf file. Only the trusted-key {}; entries .B \-F \fInamedkeyfile
Reads keys from a BIND\-style named.conf file. Only the trusted\-key {}; entries
are read. are read.
.El .SH "EXAMPLES"
.Sh EXAMPLES .LP
Some examples of use. Some examples of use.
.Pp .P
$ unbound-host www.example.com $ unbound\-host www.example.com
.Pp .P
$ unbound-host -v -y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" www.example.com $ unbound\-host \-v \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" www.example.com
.Pp .P
$ unbound-host -v -y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" 192.0.2.153 $ unbound\-host \-v \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" 192.0.2.153
.Sh EXIT CODE .SH "EXIT CODE"
The unbound-host program exits with status code 1 on error, The unbound\-host program exits with status code 1 on error,
0 on no error. The data may not be available on exit code 0, exit code 1 0 on no error. The data may not be available on exit code 0, exit code 1
means the lookup encountered a fatal error. means the lookup encountered a fatal error.
.Sh SEE ALSO .SH "SEE ALSO"
.Xr unbound.conf 5 , \fIunbound.conf\fR(5),
.Xr unbound 8 . \fIunbound\fR(8).

60
doc/unbound.8
View file

@ -1,3 +1,4 @@
.TH "unbound" "8" "@date@" "NLnet Labs" "unbound @version@"
.\" .\"
.\" unbound.8 -- unbound manual .\" unbound.8 -- unbound manual
.\" .\"
@ -6,42 +7,45 @@
.\" See LICENSE for the license. .\" See LICENSE for the license.
.\" .\"
.\" .\"
.Dd @date@ .SH "NAME"
.Dt unbound 8 .LP
.Sh NAME .B unbound
unbound \- Unbound DNS validating resolver @version@.
.Nd Unbound DNS validating resolver @version@. .SH "SYNOPSIS"
.Sh SYNOPSIS .LP
.Nm unbound .B unbound
.Op Fl h .RB [ \-h ]
.Op Fl d .RB [ \-d ]
.Op Fl v .RB [ \-v ]
.Op Fl c Ar cfgfile .RB [ \-c
.Sh DESCRIPTION .IR cfgfile ]
.Ic Unbound .SH "DESCRIPTION"
.LP
.B Unbound
is an implementation of a DNS resolver, that does caching and is an implementation of a DNS resolver, that does caching and
DNSSEC validation. DNSSEC validation.
.Pp .P
The available options are: The available options are:
.Bl -tag -width indent .TP
.It Fl h .B \-h
Show the version and commandline option help. Show the version and commandline option help.
.It Fl c Ar cfgfile .TP
.B \-c\fI cfgfile
Set the config file with settings for unbound to read instead of the Set the config file with settings for unbound to read instead of the
file at default location /etc/unbound/unbound.conf. The syntax is file at default location /etc/unbound/unbound.conf. The syntax is
described in described in \fIunbound.conf\fR(5).
.Xr unbound.conf 5 . .TP
.It Fl d .B \-d
Debug flag, do not fork into the background, but stay attached to the Debug flag, do not fork into the background, but stay attached to the
console. This flag will also delay writing to the logfile until the console. This flag will also delay writing to the logfile until the
thread-spawn time. So that most config and setup errors appear on stderr. thread\-spawn time. So that most config and setup errors appear on stderr.
.It Fl v .TP
.B \-v
Increase verbosity. If given multiple times, more information is logged. Increase verbosity. If given multiple times, more information is logged.
This is in addition to the verbosity (if any) from the config file. This is in addition to the verbosity (if any) from the config file.
.El .SH "SEE ALSO"
.Sh SEE ALSO \fIunbound.conf\fR(5),
.Xr unbound.conf 5 , \fIunbound\-checkconf\fR(8).
.Xr unbound-checkconf 8 . .SH "AUTHORS"
.Sh AUTHORS .B Unbound
.Ic Unbound
developers are mentioned in the CREDITS file in the distribution. developers are mentioned in the CREDITS file in the distribution.

488
doc/unbound.conf.5
View file

@ -1,3 +1,4 @@
.TH "unbound.conf" "5" "@date@" "NLnet Labs" "unbound @version@"
.\" .\"
.\" unbound.conf.5 -- unbound.conf manual .\" unbound.conf.5 -- unbound.conf manual
.\" .\"
@ -6,39 +7,44 @@
.\" See LICENSE for the license. .\" See LICENSE for the license.
.\" .\"
.\" .\"
.Dd @date@ .SH "NAME"
.Os FreeBSD .LP
.Dt unbound.conf 5 .B unbound.conf
.Sh NAME \- Unbound configuration file.
.Nm unbound.conf .SH "SYNOPSIS"
.Nd Unbound configuration file. .LP
.Sh SYNOPSIS .B unbound.conf
.Nm unbound.conf .SH "DESCRIPTION"
.Sh DESCRIPTION .LP
.Ic unbound.conf .B unbound.conf
is used to configure is used to configure
.Xr unbound 8 . \fIunbound\fR(8).
The file format has attributes and values. Some attributes have attributes inside them. The file format has attributes and values. Some attributes have attributes inside them.
The notation is: attribute: value. The notation is: attribute: value.
.Pp .P
Comments start with # and last to the end of line. Empty lines are Comments start with # and last to the end of line. Empty lines are
ignored as is whitespace at the beginning of a line. ignored as is whitespace at the beginning of a line.
.Pp .P
The utility The utility
.Xr unbound-checkconf 8 \fIunbound\-checkconf\fR(8)
can be used to check unbound.conf prior to usage. can be used to check unbound.conf prior to usage.
.Sh EXAMPLE .SH "EXAMPLE"
An example config file is shown below. Copy this to /etc/unbound/unbound.conf An example config file is shown below. Copy this to /etc/unbound/unbound.conf
and start the server with: and start the server with:
.P
.nf .nf
$ unbound -c /etc/unbound/unbound.conf $ unbound \-c /etc/unbound/unbound.conf
.fi .fi
.P
Most settings are the defaults. Stop the server with: Most settings are the defaults. Stop the server with:
.P
.nf .nf
$ kill `cat /etc/unbound/unbound.pid` $ kill `cat /etc/unbound/unbound.pid`
.fi .fi
.P
Below is a minimal config file. The source distribution contains an extensive Below is a minimal config file. The source distribution contains an extensive
example.conf file with all the options. example.conf file with all the options.
.P
.nf .nf
# unbound.conf(5) config file for unbound(8). # unbound.conf(5) config file for unbound(8).
server: server:
@ -48,210 +54,253 @@ server:
# logfile: "/etc/unbound/unbound.log" #uncomment to use logfile. # logfile: "/etc/unbound/unbound.log" #uncomment to use logfile.
pidfile: "/etc/unbound/unbound.pid" pidfile: "/etc/unbound/unbound.pid"
# verbosity: 1 # uncomment and increase to get more logging. # verbosity: 1 # uncomment and increase to get more logging.
# listen on all interfaces, answer queries from the local subnet. # listen on all interfaces, answer queries from the local subnet.
interface: 0.0.0.0 interface: 0.0.0.0
interface: ::0 interface: ::0
access-control: 10.0.0.0/8 allow access\-control: 10.0.0.0/8 allow
access-control: 2001:DB8::/64 allow access\-control: 2001:DB8::/64 allow
.fi .fi
.Sh FILE FORMAT .SH "FILE FORMAT"
.LP
There must be whitespace between keywords. Attribute keywords end with a colon ':'. An attribute There must be whitespace between keywords. Attribute keywords end with a colon ':'. An attribute
is followed by its containing attributes, or a value. is followed by its containing attributes, or a value.
.Pp .P
Files can be included using the Files can be included using the
.Ic include: .B include:
directive. It can appear anywhere, and takes a single filename as an argument. directive. It can appear anywhere, and takes a single filename as an argument.
Processing continues as if the text from the included file was copied into Processing continues as if the text from the included file was copied into
the config file at that point. the config file at that point.
.Ss Server Options .SS "Server Options"
These options are part of the These options are part of the
.Ic server: .B server:
clause. clause.
.Bl -tag -width indent .TP
.It \fBverbosity:\fR <number> .B verbosity: \fI<number>
The verbosity number, level 0 means no verbosity, only errors. Level 1 The verbosity number, level 0 means no verbosity, only errors. Level 1
gives operational information. Level 2 gives query level information, gives operational information. Level 2 gives query level information,
output per query. Level 3 gives algorithm level information. output per query. Level 3 gives algorithm level information.
Default is level 1. The verbosity can also be increased from the commandline, Default is level 1. The verbosity can also be increased from the commandline,
see see
.Xr unbound 8 . \fIunbound\fR(8).
.It \fBnum-threads:\fR <number> .TP
.B num\-threads: \fI<number>
The number of threads to create to serve clients. Use 1 for no threading. The number of threads to create to serve clients. Use 1 for no threading.
.It \fBport:\fR <port number> .TP
.B port: \fI<port number>
The port number, default 53, on which the server responds to queries. The port number, default 53, on which the server responds to queries.
.It \fBinterface:\fR <ip address> .TP
.B interface: \fI<ip address>
Interface to use to connect to the network. This interface is listened to Interface to use to connect to the network. This interface is listened to
for queries from clients, and answers to clients are given from it. for queries from clients, and answers to clients are given from it.
Can be given multiple times to work on several interfaces. If none are Can be given multiple times to work on several interfaces. If none are
given the default is to listen to localhost. given the default is to listen to localhost.
The interfaces are not changed on a reload (kill -HUP) but only on restart. The interfaces are not changed on a reload (kill \-HUP) but only on restart.
.It \fBoutgoing-interface:\fR <ip address> .TP
.B outgoing\-interface: \fI<ip address>
Interface to use to connect to the network. This interface is used to send Interface to use to connect to the network. This interface is used to send
queries to authoritative servers and receive their replies. Can be given queries to authoritative servers and receive their replies. Can be given
multiple times to work on several interfaces. If none are given the multiple times to work on several interfaces. If none are given the
default (all) is used. You can specify the same interfaces in default (all) is used. You can specify the same interfaces in
.Ic interface: .B interface:
and and
.Ic outgoing-interface: .B outgoing\-interface:
lines, the interfaces are then used for both purposes. Outgoing queries are lines, the interfaces are then used for both purposes. Outgoing queries are
sent via a random outgoing interface to counter spoofing. sent via a random outgoing interface to counter spoofing.
.It \fBoutgoing-port:\fR <port number> .TP
.B outgoing\-port: \fI<port number>
The starting port number where the outgoing query port range is allocated. The starting port number where the outgoing query port range is allocated.
Default is 1053. Default is 1053.
.It \fBoutgoing-range:\fR <number> .TP
.B outgoing\-range: \fI<number>
Number of ports to open. This number is opened per thread for every outgoing Number of ports to open. This number is opened per thread for every outgoing
query interface. Must be at least 1. Default is 16. query interface. Must be at least 1. Default is 16.
Larger numbers give more protection against spoofing attempts, but need Larger numbers give more protection against spoofing attempts, but need
extra resources from the operating system. extra resources from the operating system.
.It \fBoutgoing-num-tcp:\fR <number> .TP
.B outgoing\-num\-tcp: \fI<number>
Number of outgoing TCP buffers to allocate per thread. Default is 10. If set Number of outgoing TCP buffers to allocate per thread. Default is 10. If set
to 0, or if do_tcp is "no", no TCP queries to authoritative servers are done. to 0, or if do_tcp is "no", no TCP queries to authoritative servers are done.
.It \fBincoming-num-tcp:\fR <number> .TP
.B incoming\-num\-tcp: \fI<number>
Number of incoming TCP buffers to allocate per thread. Default is 10. If set Number of incoming TCP buffers to allocate per thread. Default is 10. If set
to 0, or if do_tcp is "no", no TCP queries from clients are accepted. to 0, or if do_tcp is "no", no TCP queries from clients are accepted.
.It \fBmsg-buffer-size:\fR <number> .TP
.B msg\-buffer\-size: \fI<number>
Number of bytes size of the message buffers. Default is 65552 bytes, enough Number of bytes size of the message buffers. Default is 65552 bytes, enough
for 64 Kb packets, the maximum DNS message size. No message larger than this for 64 Kb packets, the maximum DNS message size. No message larger than this
can be sent or received. Can be reduced to use less memory, but some requests can be sent or received. Can be reduced to use less memory, but some requests
for DNS data, such as for huge resource records, will result in a SERVFAIL for DNS data, such as for huge resource records, will result in a SERVFAIL
reply to the client. reply to the client.
.It \fBmsg-cache-size:\fR <number> .TP
.B msg\-cache\-size: \fI<number>
Number of bytes size of the message cache. Default is 4 megabytes. Number of bytes size of the message cache. Default is 4 megabytes.
.It \fBmsg-cache-slabs:\fR <number> .TP
.B msg\-cache\-slabs: \fI<number>
Number of slabs in the message cache. Slabs reduce lock contention by threads. Number of slabs in the message cache. Slabs reduce lock contention by threads.
Must be set to a power of 2. Setting (close) to the number of cpus is a Must be set to a power of 2. Setting (close) to the number of cpus is a
reasonable guess. reasonable guess.
.It \fBnum-queries-per-thread:\fR <number> .TP
.B num\-queries\-per\-thread: \fI<number>
The number of queries that every thread will service simultaneously. The number of queries that every thread will service simultaneously.
If more queries arrive that need servicing, they are dropped. This forces If more queries arrive that need servicing, they are dropped. This forces
the client to resend after a timeout; allowing the server time to work on the client to resend after a timeout; allowing the server time to work on
the existing queries. Default 1024. the existing queries. Default 1024.
.It \fBrrset-cache-size:\fR <number> .TP
.B rrset\-cache\-size: \fI<number>
Number of bytes size of the RRset cache. Default is 4 megabytes. Number of bytes size of the RRset cache. Default is 4 megabytes.
.It \fBrrset-cache-slabs:\fR <number> .TP
.B rrset\-cache\-slabs: \fI<number>
Number of slabs in the RRset cache. Slabs reduce lock contention by threads. Number of slabs in the RRset cache. Slabs reduce lock contention by threads.
Must be set to a power of 2. Must be set to a power of 2.
.It \fBcache-max-ttl:\fR <seconds> .TP
.B cache\-max\-ttl: \fI<seconds>
Time to live maximum for RRsets and messages in the cache. Default is Time to live maximum for RRsets and messages in the cache. Default is
86400 seconds (1 day). If the maximum kicks in, responses to clients 86400 seconds (1 day). If the maximum kicks in, responses to clients
still get decrementing TTLs based on the original (larger) values. still get decrementing TTLs based on the original (larger) values.
When the internal TTL expires, the cache item has expired. When the internal TTL expires, the cache item has expired.
Can be set lower to force the resolver to query for data often, and not Can be set lower to force the resolver to query for data often, and not
trust (very large) TTL values. trust (very large) TTL values.
.It \fBinfra-host-ttl:\fR <seconds> .TP
.B infra\-host\-ttl: \fI<seconds>
Time to live for entries in the host cache. The host cache contains Time to live for entries in the host cache. The host cache contains
roundtrip timing and EDNS support information. Default is 900. roundtrip timing and EDNS support information. Default is 900.
.It \fBinfra-lame-ttl:\fR <seconds> .TP
.B infra\-lame\-ttl: \fI<seconds>
The time to live when a delegation is discovered to be lame. Default is 900. The time to live when a delegation is discovered to be lame. Default is 900.
.It \fBinfra-cache-slabs:\fR <number> .TP
.B infra\-cache\-slabs: \fI<number>
Number of slabs in the infrastructure cache. Slabs reduce lock contention Number of slabs in the infrastructure cache. Slabs reduce lock contention
by threads. Must be set to a power of 2. by threads. Must be set to a power of 2.
.It \fBinfra-cache-numhosts:\fR <number> .TP
.B infra\-cache\-numhosts: \fI<number>
Number of hosts for which information is cached. Default is 10000. Number of hosts for which information is cached. Default is 10000.
.It \fBinfra-cache-lame-size:\fR <number> .TP
.B infra\-cache\-lame\-size: \fI<number>
Number of bytes that the lameness cache per host is allowed to use. Default Number of bytes that the lameness cache per host is allowed to use. Default
is 10 kb, which gives maximum storage for a couple score zones, depending on is 10 kb, which gives maximum storage for a couple score zones, depending on
the lame zone name lengths. the lame zone name lengths.
.It \fBdo-ip4:\fR <yes or no> .TP
.B do\-ip4: \fI<yes or no>
Enable or disable whether ip4 queries are answered or issued. Default is yes. Enable or disable whether ip4 queries are answered or issued. Default is yes.
.It \fBdo-ip6:\fR <yes or no> .TP
.B do\-ip6: \fI<yes or no>
Enable or disable whether ip6 queries are answered or issued. Default is yes. Enable or disable whether ip6 queries are answered or issued. Default is yes.
If disabled, queries are not answered on IPv6, and queries are not sent on If disabled, queries are not answered on IPv6, and queries are not sent on
IPv6 to the internet nameservers. IPv6 to the internet nameservers.
.It \fBdo-udp:\fR <yes or no> .TP
.B do\-udp: \fI<yes or no>
Enable or disable whether UDP queries are answered or issued. Default is yes. Enable or disable whether UDP queries are answered or issued. Default is yes.
.It \fBdo-tcp:\fR <yes or no> .TP
.B do\-tcp: \fI<yes or no>
Enable or disable whether TCP queries are answered or issued. Default is yes. Enable or disable whether TCP queries are answered or issued. Default is yes.
.It \fBaccess-control:\fR <IP netblock> <action> .TP
.B access\-control: \fI<IP netblock> <action>
The netblock is given as an IP4 or IP6 address with /size appended for a The netblock is given as an IP4 or IP6 address with /size appended for a
classless network block. The action can be deny, refuse or allow. classless network block. The action can be deny, refuse or allow.
Deny stops queries from hosts from that netblock. Deny stops queries from hosts from that netblock.
Refuse stops queries too, but sends a DNS rcode REFUSED error message back. Refuse stops queries too, but sends a DNS rcode REFUSED error message back.
Allow gives access to clients from that netblock. Allow gives access to clients from that netblock.
By default only localhost is allowed, the rest is refused. By default only localhost is allowed, the rest is refused.
The default is refused, because that is protocol-friendly. The DNS protocol The default is refused, because that is protocol\-friendly. The DNS protocol
is not designed to handle dropped packets due to policy, and dropping may is not designed to handle dropped packets due to policy, and dropping may
result in (possibly excessive) retried queries. result in (possibly excessive) retried queries.
.It \fBchroot:\fR <directory> .TP
.B chroot: \fI<directory>
If given a chroot is done to the given directory. The default is If given a chroot is done to the given directory. The default is
"/etc/unbound". If you give "" no chroot is performed. "/etc/unbound". If you give "" no chroot is performed.
.It \fBusername:\fR <name> .TP
.B username: \fI<name>
If given, after binding the port the user privileges are dropped. Default is If given, after binding the port the user privileges are dropped. Default is
"unbound". If you give username: "" no user change is performed. "unbound". If you give username: "" no user change is performed.
.Pp .IP
If this user is not capable of binding the If this user is not capable of binding the
port, reloads (by signal HUP) will still retain the opened ports. port, reloads (by signal HUP) will still retain the opened ports.
If you change the port number in the config file, and that new port number If you change the port number in the config file, and that new port number
requires privileges, then a reload will fail; a restart is needed. requires privileges, then a reload will fail; a restart is needed.
.It \fBdirectory:\fR <directory> .TP
.B directory: \fI<directory>
Sets the working directory for the program. Sets the working directory for the program.
.It \fBlogfile:\fR <filename> .TP
.B logfile: \fI<filename>
If "" is given, logging goes to stderr, or nowhere once daemonized. If "" is given, logging goes to stderr, or nowhere once daemonized.
The logfile is appended to, in the following format: The logfile is appended to, in the following format:
.nf
[seconds since 1970] unbound[pid:tid]: type: message. [seconds since 1970] unbound[pid:tid]: type: message.
If this option is given, the use-syslog is option is set to "no". .fi
If this option is given, the use\-syslog is option is set to "no".
The logfile is reopened (for append) when the config file is reread, on The logfile is reopened (for append) when the config file is reread, on
SIGHUP. SIGHUP.
.It \fBuse-syslog:\fR <yes or no> .TP
.B use\-syslog: \fI<yes or no>
Sets unbound to send log messages to the syslogd, using Sets unbound to send log messages to the syslogd, using
.Xr syslog 3 . \fIsyslog\fR(3).
The log facility LOG_DAEMON is used, with identity "unbound". The log facility LOG_DAEMON is used, with identity "unbound".
The logfile setting is overridden when use-syslog is turned on. The logfile setting is overridden when use\-syslog is turned on.
The default is to log to syslog. The default is to log to syslog.
.It \fBpidfile:\fR <filename> .TP
.B pidfile: \fI<filename>
The process id is written to the file. Default is "/etc/unbound/unbound.pid". The process id is written to the file. Default is "/etc/unbound/unbound.pid".
So, So,
.nf .nf
kill -HUP `cat /etc/unbound/unbound.pid` kill \-HUP `cat /etc/unbound/unbound.pid`
.fi .fi
triggers a reload, triggers a reload,
.nf .nf
kill -QUIT `cat /etc/unbound/unbound.pid` kill \-QUIT `cat /etc/unbound/unbound.pid`
.fi .fi
gracefully terminates. gracefully terminates.
.It \fBroot-hints:\fR <filename> .TP
.B root\-hints: \fI<filename>
Read the root hints from this file. Default is nothing, using builtin hints Read the root hints from this file. Default is nothing, using builtin hints
for the IN class. The file has the format of zone files, with root for the IN class. The file has the format of zone files, with root
nameserver names and addresses only. The default may become outdated, nameserver names and addresses only. The default may become outdated,
when servers change, therefore it is good practice to use a root-hints file. when servers change, therefore it is good practice to use a root\-hints file.
.It \fBhide-identity:\fR <yes or no> .TP
.B hide\-identity: \fI<yes or no>
If enabled id.server and hostname.bind queries are refused. If enabled id.server and hostname.bind queries are refused.
.It \fBidentity:\fR <string> .TP
.B identity: \fI<string>
Set the identity to report. If set to "", the default, then the hostname Set the identity to report. If set to "", the default, then the hostname
of the server is returned. of the server is returned.
.It \fBhide-version:\fR <yes or no> .TP
.B hide\-version: \fI<yes or no>
If enabled version.server and version.bind queries are refused. If enabled version.server and version.bind queries are refused.
.It \fBversion:\fR <string> .TP
.B version: \fI<string>
Set the version to report. If set to "", the default, then the package Set the version to report. If set to "", the default, then the package
version is returned. version is returned.
.It \fBtarget-fetch-policy:\fR <"list of numbers"> .TP
.B target\-fetch\-policy: \fI<"list of numbers">
Set the target fetch policy used by unbound to determine if it should fetch Set the target fetch policy used by unbound to determine if it should fetch
nameserver target addresses opportunistically. The policy is described per nameserver target addresses opportunistically. The policy is described per
dependency depth. dependency depth.
.Pp .IP
The number of values determines the maximum dependency depth The number of values determines the maximum dependency depth
that unbound will pursue in answering a query. that unbound will pursue in answering a query.
A value of -1 means to fetch all targets opportunistically for that dependency A value of \-1 means to fetch all targets opportunistically for that dependency
depth. A value of 0 means to fetch on demand only. A positive value fetches depth. A value of 0 means to fetch on demand only. A positive value fetches
that many targets opportunistically. that many targets opportunistically.
.Pp .IP
Enclose the list between quotes ("") and put spaces between numbers. Enclose the list between quotes ("") and put spaces between numbers.
The default is "3 2 1 0 0". Setting all zeroes, "0 0 0 0 0" gives behaviour The default is "3 2 1 0 0". Setting all zeroes, "0 0 0 0 0" gives behaviour
closer to that of BIND 9, while setting "-1 -1 -1 -1 -1" gives behaviour closer to that of BIND 9, while setting "\-1 \-1 \-1 \-1 \-1" gives behaviour
rumoured to be closer to that of BIND 8. rumoured to be closer to that of BIND 8.
.It \fBharden-short-bufsize:\fR <yes or no> .TP
.B harden\-short\-bufsize: \fI<yes or no>
Very small EDNS buffer sizes from queries are ignored. Default is off, since Very small EDNS buffer sizes from queries are ignored. Default is off, since
it is legal protocol wise to send these, and unbound tries to give very it is legal protocol wise to send these, and unbound tries to give very
small answers to these queries, where possible. small answers to these queries, where possible.
.It \fBharden-large-queries:\fR <yes or no> .TP
.B harden\-large\-queries: \fI<yes or no>
Very large queries are ignored. Default is off, since it is legal protocol Very large queries are ignored. Default is off, since it is legal protocol
wise to send these, and could be necessary for operation if TSIG or EDNS wise to send these, and could be necessary for operation if TSIG or EDNS
payload is very large. payload is very large.
.It \fBharden-glue:\fR <yes or no> .TP
.B harden\-glue: \fI<yes or no>
Will trust glue only if it is within the servers authority. Default is on. Will trust glue only if it is within the servers authority. Default is on.
.It \fBharden-dnssec-stripped:\fR <yes or no> .TP
Require DNSSEC data for trust-anchored zones, if such data is absent, .B harden\-dnssec\-stripped: \fI<yes or no>
Require DNSSEC data for trust\-anchored zones, if such data is absent,
the zone becomes bogus. If turned off, and no DNSSEC data is received the zone becomes bogus. If turned off, and no DNSSEC data is received
(or the DNSKEY data fails to validate), then the zone is made insecure, (or the DNSKEY data fails to validate), then the zone is made insecure,
this behaves like there is no trust anchor. You could turn this off if this behaves like there is no trust anchor. You could turn this off if
@ -259,60 +308,71 @@ you are sometimes behind an intrusive firewall (of some sort) that
removes DNSSEC data from packets, or a zone changes from signed to removes DNSSEC data from packets, or a zone changes from signed to
unsigned to badly signed often. If turned off you run the risk of a unsigned to badly signed often. If turned off you run the risk of a
downgrade attack that disables security for a zone. Default is on. downgrade attack that disables security for a zone. Default is on.
.It \fBdo-not-query-address:\fR <IP address> .TP
.B do\-not\-query\-address: \fI<IP address>
Do not query the given IP address. Can be IP4 or IP6. Append /num to Do not query the given IP address. Can be IP4 or IP6. Append /num to
indicate a classless delegation netblock, for example like indicate a classless delegation netblock, for example like
10.2.3.4/24 or 2001::11/64. 10.2.3.4/24 or 2001::11/64.
.It \fBdo-not-query-localhost:\fR <yes or no> .TP
If yes, localhost is added to the do-not-query-address entries, both .B do\-not\-query\-localhost: \fI<yes or no>
If yes, localhost is added to the do\-not\-query\-address entries, both
IP6 ::1 and IP4 127.0.0.1/8. If no, then localhost can be used to send IP6 ::1 and IP4 127.0.0.1/8. If no, then localhost can be used to send
queries to. Default is yes. queries to. Default is yes.
.It \fBmodule-config:\fR <"module names"> .TP
.B module\-config: \fI<"module names">
Module configuration, a list of module names separated by spaces, surround Module configuration, a list of module names separated by spaces, surround
the string with quotes (""). The modules can be validator, iterator. the string with quotes (""). The modules can be validator, iterator.
Setting this to "iterator" will result in a non-validating server. Setting this to "iterator" will result in a non\-validating server.
Setting this to "validator iterator" will turn on DNSSEC validation. Setting this to "validator iterator" will turn on DNSSEC validation.
You must also set trust-anchors for validation to be useful. You must also set trust\-anchors for validation to be useful.
.It \fBtrust-anchor-file:\fR <filename> .TP
.B trust\-anchor\-file: \fI<filename>
File with trusted keys for validation. Both DS and DNSKEY entries can appear File with trusted keys for validation. Both DS and DNSKEY entries can appear
in the file. The format of the file is the standard DNS Zone file format. in the file. The format of the file is the standard DNS Zone file format.
Default is "", or no trust anchor file. Default is "", or no trust anchor file.
.It \fBtrust-anchor:\fR <"Resource Record"> .TP
.B trust\-anchor: \fI<"Resource Record">
A DS or DNSKEY RR for a key to use for validation. Multiple entries can be A DS or DNSKEY RR for a key to use for validation. Multiple entries can be
given to specify multiple trusted keys, in addition to the trust-anchor-files. given to specify multiple trusted keys, in addition to the trust\-anchor\-files.
The resource record is entered in the same format as 'dig' or 'drill' prints The resource record is entered in the same format as 'dig' or 'drill' prints
them, the same format as in the zone file. Has to be on a single line, with them, the same format as in the zone file. Has to be on a single line, with
"" around it. A TTL can be specified for ease of cut and paste, but is ignored. "" around it. A TTL can be specified for ease of cut and paste, but is ignored.
A class can be specified, but class IN is default. A class can be specified, but class IN is default.
.It \fBtrusted-keys-file:\fR <filename> .TP
.B trusted\-keys\-file: \fI<filename>
File with trusted keys for validation. Specify more than one file File with trusted keys for validation. Specify more than one file
with several entries, one file per entry. Like \fBtrust-anchor-file\fR with several entries, one file per entry. Like \fBtrust\-anchor\-file\fR
but has a different file format. Format is BIND-9 style format, but has a different file format. Format is BIND\-9 style format,
the trusted-keys { name flag proto algo "key"; }; clauses are read. the trusted\-keys { name flag proto algo "key"; }; clauses are read.
.It \fBval-override-date:\fR <rrsig-style date spec> .TP
.B val\-override\-date: \fI<rrsig\-style date spec>
Default is "" or "0", which disables this debugging feature. If enabled by Default is "" or "0", which disables this debugging feature. If enabled by
giving a RRSIG style date, that date is used for verifying RRSIG inception giving a RRSIG style date, that date is used for verifying RRSIG inception
and expiration dates, instead of the current date. Do not set this unless and expiration dates, instead of the current date. Do not set this unless
you are debugging signature inception and expiration. you are debugging signature inception and expiration.
.It \fBval-bogus-ttl:\fR <number> .TP
.B val\-bogus\-ttl: \fI<number>
The time to live for bogus data. This is data that has failed validation; The time to live for bogus data. This is data that has failed validation;
due to invalid signatures or other checks. The TTL from that data cannot be due to invalid signatures or other checks. The TTL from that data cannot be
trusted, and this value is used instead. The value is in seconds, default 900. trusted, and this value is used instead. The value is in seconds, default 900.
The time interval prevents repeated revalidation of bogus data. The time interval prevents repeated revalidation of bogus data.
.It \fBval-clean-additional:\fR <yes or no> .TP
.B val\-clean\-additional: \fI<yes or no>
Instruct the validator to remove data from the additional section of secure Instruct the validator to remove data from the additional section of secure
messages that are not signed properly. Messages that are insecure, bogus, messages that are not signed properly. Messages that are insecure, bogus,
indeterminate or unchecked are not affected. Default is yes. Use this setting indeterminate or unchecked are not affected. Default is yes. Use this setting
to protect the users that rely on this validator for authentication from to protect the users that rely on this validator for authentication from
protentially bad data in the additional section. protentially bad data in the additional section.
.It \fBval-permissive-mode:\fR <yes or no> .TP
.B val\-permissive\-mode: \fI<yes or no>
Instruct the validator to mark bogus messages as indeterminate. The security Instruct the validator to mark bogus messages as indeterminate. The security
checks are performed, but if the result is bogus (failed security), the checks are performed, but if the result is bogus (failed security), the
reply is not withheld from the client with SERVFAIL as usual. The client reply is not withheld from the client with SERVFAIL as usual. The client
receives the bogus data. For messages that are found to be secure the AD bit receives the bogus data. For messages that are found to be secure the AD bit
is set in replies. Also logging is performed as for full validation. is set in replies. Also logging is performed as for full validation.
The default value is "no". The default value is "no".
.It \fBval-nsec3-keysize-iterations:\fR <"list of values"> .TP
.B val\-nsec3\-keysize\-iterations: \fI<"list of values">
List of keysize and iteration count values, separated by spaces, surrounded List of keysize and iteration count values, separated by spaces, surrounded
by quotes. Default is "1024 150 2048 500 4096 2500". This determines the by quotes. Default is "1024 150 2048 500 4096 2500". This determines the
maximum allowed NSEC3 iteration count before a message is simply marked maximum allowed NSEC3 iteration count before a message is simply marked
@ -320,188 +380,208 @@ insecure instead of performing the many hashing iterations. The list must
be in ascending order and have at least one entry. If you set it to be in ascending order and have at least one entry. If you set it to
"1024 65535" there is no restriction to NSEC3 iteration values. "1024 65535" there is no restriction to NSEC3 iteration values.
This table must be kept short; a very long list could cause slower operation. This table must be kept short; a very long list could cause slower operation.
.It \fBkey-cache-size:\fR <number> .TP
.B key\-cache\-size: \fI<number>
Number of bytes size of the key cache. Default is 4 megabytes. Number of bytes size of the key cache. Default is 4 megabytes.
.It \fBkey-cache-slabs:\fR <number> .TP
.B key\-cache\-slabs: \fI<number>
Number of slabs in the key cache. Slabs reduce lock contention by threads. Number of slabs in the key cache. Slabs reduce lock contention by threads.
Must be set to a power of 2. Setting (close) to the number of cpus is a Must be set to a power of 2. Setting (close) to the number of cpus is a
reasonable guess. reasonable guess.
.It \fBlocal-zone:\fR <zone> <type> .TP
.B local\-zone: \fI<zone> <type>
Configure a local zone. The type determines the answer to give if there is Configure a local zone. The type determines the answer to give if there is
no match from local-data. The types are deny, refuse, static, transparent, no match from local\-data. The types are deny, refuse, static, transparent,
redirect, nodefault, and are explained below. After that the default settings redirect, nodefault, and are explained below. After that the default settings
are listed. Use local-data: to enter data into the local zone. Answers for are listed. Use local\-data: to enter data into the local zone. Answers for
local zones are authoritative DNS answers. By default the zones are class IN. local zones are authoritative DNS answers. By default the zones are class IN.
.Bl -tag -width indent .TP 10
.It \fIdeny\fR \h'5'\fIdeny\fR
Do not send an answer, drop the query. Do not send an answer, drop the query.
If there is a match from local data, the query is answered. If there is a match from local data, the query is answered.
.It \fIrefuse\fR .TP 10
\h'5'\fIrefuse\fR
Send an error message reply, with rcode REFUSED. Send an error message reply, with rcode REFUSED.
If there is a match from local data, the query is answered. If there is a match from local data, the query is answered.
.It \fIstatic\fR .TP 10
\h'5'\fIstatic\fR
If there is a match from local data, the query is answered. If there is a match from local data, the query is answered.
Otherwise, the query is answered with nodata or nxdomain. Otherwise, the query is answered with nodata or nxdomain.
For a negative answer a SOA is included in the answer if present For a negative answer a SOA is included in the answer if present
as local-data for the zone apex domain. as local\-data for the zone apex domain.
.It \fItransparent\fR .TP 10
\h'5'\fItransparent\fR
If there is a match from local data, the query is answered. If there is a match from local data, the query is answered.
Otherwise, the query is resolved normally. Otherwise, the query is resolved normally.
If no local-zone is given local-data causes a transparent zone If no local\-zone is given local\-data causes a transparent zone
to be created by default. to be created by default.
.It \fIredirect\fR .TP 10
\h'5'\fIredirect\fR
The query is answered from the local data for the zone name. The query is answered from the local data for the zone name.
There may be no local data beneath the zone name. There may be no local data beneath the zone name.
This answers queries for the zone, and all subdomains of the zone This answers queries for the zone, and all subdomains of the zone
with the local data for the zone. with the local data for the zone.
It can be used to redirect a domain to a different address, with It can be used to redirect a domain to a different address, with
local-zone: "example.com." redirect and local\-zone: "example.com." redirect and
local-data: "example.com. A 127.0.0.1" local\-data: "example.com. A 127.0.0.1"
queries for www.example.com and www.foo.example.com are redirected. queries for www.example.com and www.foo.example.com are redirected.
.It \fInodefault\fR .TP 10
\h'5'\fInodefault\fR
Used to turn off default contents for AS112 zones. The other types Used to turn off default contents for AS112 zones. The other types
also turn off default contents for the zone. The 'nodefault' option also turn off default contents for the zone. The 'nodefault' option
has no other effect than turning off default contents for the has no other effect than turning off default contents for the
given zone. given zone.
.El .P
The default zones are localhost, reverse 127.0.0.1 and ::1, and the AS112 The default zones are localhost, reverse 127.0.0.1 and ::1, and the AS112
zones. The AS112 zones are reverse DNS zones for private use and reserved zones. The AS112 zones are reverse DNS zones for private use and reserved
IP addresses for which the servers on the internet cannot provide correct IP addresses for which the servers on the internet cannot provide correct
answers. They are configured by default to give nxdomain (no reverse answers. They are configured by default to give nxdomain (no reverse
information) answers. The defaults can be turned off by specifying your information) answers. The defaults can be turned off by specifying your
own local-zone of that name, or using the 'nodefault' type. Below is a own local\-zone of that name, or using the 'nodefault' type. Below is a
list of the default zone contents. list of the default zone contents.
.Bl -tag -width indent .TP 10
.It \fIlocalhost\fR \h'5'\fIlocalhost\fR
The IP4 and IP6 localhost information is given. NS and SOA records are provided The IP4 and IP6 localhost information is given. NS and SOA records are provided
for completeness and to satisfy some DNS update tools. Default content: for completeness and to satisfy some DNS update tools. Default content:
.nf .nf
local-zone: "localhost." static local\-zone: "localhost." static
local-data: "localhost. 10800 IN NS localhost." local\-data: "localhost. 10800 IN NS localhost."
local-data: "localhost. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" local\-data: "localhost. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
local-data: "localhost. 10800 IN A 127.0.0.1" local\-data: "localhost. 10800 IN A 127.0.0.1"
local-data: "localhost. 10800 IN AAAA ::1" local\-data: "localhost. 10800 IN AAAA ::1"
.fi .fi
.It \fIreverse IPv4 loopback\fR .TP 10
\h'5'\fIreverse IPv4 loopback\fR
Default content: Default content:
.nf .nf
local-zone: "127.in-addr.arpa." static local\-zone: "127.in\-addr.arpa." static
local-data: "127.in-addr.arpa. 10800 IN NS localhost." local\-data: "127.in\-addr.arpa. 10800 IN NS localhost."
local-data: "127.in-addr.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" local\-data: "127.in\-addr.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
local-data: "1.0.0.127.in-addr.arpa. 10800 IN PTR localhost." local\-data: "1.0.0.127.in\-addr.arpa. 10800 IN PTR localhost."
.fi .fi
.It \fIreverse IPv6 loopback\fR .TP 10
\h'5'\fIreverse IPv6 loopback\fR
Default content: Default content:
.nf .nf
local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." static local\-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." static
local-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN NS localhost." local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN NS localhost."
local-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
local-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN PTR localhost." local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN PTR localhost."
.fi .fi
.It \fIreverse RFC1918 local use zones\fR .TP 10
Reverse data for zones 10.in-addr.arpa, 16.172.in-addr.arpa to \h'5'\fIreverse RFC1918 local use zones\fR
31.172.in-addr.arpa, 168.192.in-addr.arpa. Reverse data for zones 10.in\-addr.arpa, 16.172.in\-addr.arpa to
The \fBlocal-zone:\fR is set static and as \fBlocal-data:\fR SOA and NS 31.172.in\-addr.arpa, 168.192.in\-addr.arpa.
The \fBlocal\-zone:\fR is set static and as \fBlocal\-data:\fR SOA and NS
records are provided. records are provided.
.It \fIreverse RFC3330 IP4 this, link-local, testnet and broadcast\fR .TP 10
Reverse data for zones 0.in-addr.arpa, 254.169.in-addr.arpa, \h'5'\fIreverse RFC3330 IP4 this, link\-local, testnet and broadcast\fR
2.0.192.in-addr.arpa, 255.255.255.255.in-addr.arpa. Reverse data for zones 0.in\-addr.arpa, 254.169.in\-addr.arpa,
.It \fIreverse RFC4291 IP6 unspecified\fR 2.0.192.in\-addr.arpa, 255.255.255.255.in\-addr.arpa.
.TP 10
\h'5'\fIreverse RFC4291 IP6 unspecified\fR
Reverse data for zone 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. Reverse data for zone 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.
.It \fIreverse RFC4193 IPv6 Locally Assigned Local Addresses\fR .TP 10
\h'5'\fIreverse RFC4193 IPv6 Locally Assigned Local Addresses\fR
Reverse data for zone D.F.ip6.arpa. Reverse data for zone D.F.ip6.arpa.
.It \fIreverse RFC4291 IPv6 Link Local Addresses\fR .TP 10
\h'5'\fIreverse RFC4291 IPv6 Link Local Addresses\fR
Reverse data for zones 8.E.F.ip6.arpa to B.E.F.ip6.arpa. Reverse data for zones 8.E.F.ip6.arpa to B.E.F.ip6.arpa.
.El
.\" End of local-zone listing. .\" End of local-zone listing.
.It \fBlocal-data:\fR "<resource record string>" .TP 5
.B local\-data: \fI"<resource record string>"
Configure local data, which is served in reply to queries for it. Configure local data, which is served in reply to queries for it.
The query has to match exactly unless you configure the local-zone as The query has to match exactly unless you configure the local\-zone as
redirect. If not matched exactly, the local-zone type determines redirect. If not matched exactly, the local\-zone type determines
further processing. If local-data is configured that is not a subdomain of further processing. If local\-data is configured that is not a subdomain of
a local-zone, a transparent local-zone is configured. a local\-zone, a transparent local\-zone is configured.
For record types such as TXT, use single quotes, as in For record types such as TXT, use single quotes, as in
local-data: 'example. TXT "text"'. local\-data: 'example. TXT "text"'.
.El .SS "Stub Zone Options"
.Ss Stub Zone Options .LP
There may be multiple There may be multiple
.Ic stub-zone: .B stub\-zone:
clauses. Each with a name: and zero or more hostnames or IP addresses. clauses. Each with a name: and zero or more hostnames or IP addresses.
For the stub zone this list of nameservers is used. Class IN is assumed. For the stub zone this list of nameservers is used. Class IN is assumed.
.Bl -tag -width indent .TP
.It \fBname:\fR <domain name> .B name: \fI<domain name>
Name of the stub zone. Name of the stub zone.
.It \fBstub-host:\fR <domain name> .TP
.B stub\-host: \fI<domain name>
Name of stub zone nameserver. Is itself resolved before it is used. Name of stub zone nameserver. Is itself resolved before it is used.
.It \fBstub-addr:\fR <IP address> .TP
.B stub\-addr: \fI<IP address>
IP address of stub zone nameserver. Can be IP 4 or IP 6. IP address of stub zone nameserver. Can be IP 4 or IP 6.
To use a nondefault port for DNS communication append '@' with the port number. To use a nondefault port for DNS communication append '@' with the port number.
.El .SS "Forward Zone Options"
.Ss Forward Zone Options .LP
There may be multiple There may be multiple
.Ic forward-zone: .B forward\-zone:
clauses. Each with a name: and zero or more hostnames or IP addresses. clauses. Each with a name: and zero or more hostnames or IP addresses.
For the forward zone this list of nameservers is used to forward the queries For the forward zone this list of nameservers is used to forward the queries
to. The servers have to handle further recursion for the query. Class IN is to. The servers have to handle further recursion for the query. Class IN is
assumed. A forward-zone entry with name "." and a forward-addr target will assumed. A forward\-zone entry with name "." and a forward\-addr target will
forward all queries to that other server (unless it can answer from the cache). forward all queries to that other server (unless it can answer from the cache).
.Bl -tag -width indent .TP
.It \fBname:\fR <domain name> .B name: \fI<domain name>
Name of the forward zone. Name of the forward zone.
.It \fBforward-host:\fR <domain name> .TP
.B forward\-host: \fI<domain name>
Name of server to forward to. Is itself resolved before it is used. Name of server to forward to. Is itself resolved before it is used.
.It \fBforward-addr:\fR <IP address> .TP
.B forward\-addr: \fI<IP address>
IP address of server to forward to. Can be IP 4 or IP 6. IP address of server to forward to. Can be IP 4 or IP 6.
To use a nondefault port for DNS communication append '@' with the port number. To use a nondefault port for DNS communication append '@' with the port number.
.El .SH "MEMORY CONTROL EXAMPLE"
.Sh MEMORY CONTROL EXAMPLE
In the example config settings below memory usage is reduced. Some service In the example config settings below memory usage is reduced. Some service
levels are lower, notable very large data and a high TCP load are no longer levels are lower, notable very large data and a high TCP load are no longer
supported. Very large data and high TCP loads are exceptional for the DNS. supported. Very large data and high TCP loads are exceptional for the DNS.
DNSSEC validation is enabled, just add trust anchors. DNSSEC validation is enabled, just add trust anchors.
If you do not have to worry about programs using more than 1 meg of memory, If you do not have to worry about programs using more than 1 meg of memory,
the below example is not for you. Use the defaults to receive full service. the below example is not for you. Use the defaults to receive full service.
.Pp .P
.nf .nf
# example settings that reduce memory usage # example settings that reduce memory usage
server: server:
num-threads: 1 num\-threads: 1
outgoing-num-tcp: 1 # this limits TCP service, uses less buffers. outgoing\-num\-tcp: 1 # this limits TCP service, uses less buffers.
incoming-num-tcp: 1 incoming\-num\-tcp: 1
outgoing-range: 1 # uses less memory, but less port randomness. outgoing\-range: 1 # uses less memory, but less port randomness.
msg-buffer-size: 8192 # note this limits service, 'no huge stuff'. msg\-buffer\-size: 8192 # note this limits service, 'no huge stuff'.
msg-cache-size: 102400 # 100 Kb. msg\-cache\-size: 102400 # 100 Kb.
msg-cache-slabs: 1 msg\-cache\-slabs: 1
rrset-cache-size: 102400 # 100 Kb. rrset\-cache\-size: 102400 # 100 Kb.
rrset-cache-slabs: 1 rrset\-cache\-slabs: 1
infra-cache-numhosts: 200 infra\-cache\-numhosts: 200
infra-cache-numlame: 10 infra\-cache\-numlame: 10
key-cache-size: 102400 # 100 Kb. key\-cache\-size: 102400 # 100 Kb.
key-cache-slabs: 1 key\-cache\-slabs: 1
num-queries-per-thread: 30 num\-queries\-per\-thread: 30
target-fetch-policy: "2 1 0 0 0 0" target\-fetch\-policy: "2 1 0 0 0 0"
harden-large-queries: "yes" harden\-large\-queries: "yes"
harden-short-bufsize: "yes" harden\-short\-bufsize: "yes"
do-ip6: no # save a bit of memory if not used. do\-ip6: no # save a bit of memory if not used.
.fi .fi
.Sh FILES .SH "FILES"
.Bl -tag -width indent .TP
.It Pa /etc/unbound .I /etc/unbound
default unbound working directory and default default unbound working directory and default
.Xr chroot 2 \fIchroot\fR(2)
location. location.
.It Pa unbound.conf .TP
.I unbound.conf
unbound configuration file. unbound configuration file.
.It Pa unbound.pid .TP
.I unbound.pid
default unbound pidfile with process ID of the running daemon. default unbound pidfile with process ID of the running daemon.
.It Pa unbound.log .TP
.I unbound.log
unbound log file. default is to log to unbound log file. default is to log to
.Xr syslog 3 . \fIsyslog\fR(3).
.El .SH "SEE ALSO"
.Sh SEE ALSO \fIunbound\fR(8),
.Xr unbound 8 , \fIunbound\-checkconf\fR(8).
.Xr unbound-checkconf 8 . .SH "AUTHORS"
.Sh AUTHORS .B Unbound
.Ic Unbound
was written by NLnet Labs. Please see CREDITS file was written by NLnet Labs. Please see CREDITS file
in the distribution for further details. in the distribution for further details.