// Sample named.conf file for recursive nameservers in Cambridge
// This version uses BIND 9.11 catalog zones.

// This configuration has the mostly same effect as sample.named.conf, with
// the advantages of being much shorter and atomatically updating the list
// of zones. The differences are in the zone file names and the slightly
// looser allow-query and allow-transfer ACLs. The ACLs include the whole of
// RFC 1918 address space, i.e. institution-private as well as CUDN-private
// addresses. For documentation, this configuration file includes copies of
// the ACLs that appear in the catalog zone.

// Available from https://www.dns.cam.ac.uk/code/nsconfig/forward.named.conf

// Overview documentation at https://www.dns.cam.ac.uk/servers/stealth.html

options {

  //******* Local installation details - CHECK & ADJUST THESE *******

	directory "/var/named";	// Data (zones etc) file directory

  // Controls allowing access to your nameserver, except where overridden in
  // individual "zone" statements. The following options match the
  // configuration in the catz.arpa.cam.ac.uk zone:

	allow-transfer { camplus; };
	allow-query { camplus; };

  // The following turns off the generation of "notify" messages.

	notify master-only;

  // The following option puts an upper limit on zone update journal
  // size. This option isn't needed if you are using BIND 9.12 or later.

	max-journal-size 64K;

  // The following option enables DNSSEC validation.
  // See https://www.dns.cam.ac.uk/servers/validation.html
  // for more details.

	dnssec-validation auto;

  // The following directives set up automatic configuration of the set of
  // stealth secondary zones.
  //
  // You should ensure that the zone directory /var/named/catz exists -
  // it is not created automatically.

	catalog-zones {
		zone "catz.arpa.cam.ac.uk"
			zone-directory "catz";
	};

};

// The following ACL defines the CUDN networks, plus the RFC 1928 ranges
// reserved for institution-private use. The configuration in the
// catz.arpa.cam.ac.uk zone includes ACLs matching this:

acl camplus {
	// Public CUDN address blocks
	128.232.0.0/16;
	129.169.0.0/16;
	131.111.0.0/16;
	192.18.195.0/24;
	192.84.5.0/24;
	192.153.213.0/24;
	193.60.80.0/20;
	193.63.252.0/23;
	2001:630:210::/44; # JANET PA
	2a00:1098:5::/48; # Mythic Beasts PA
	2a05:b400::/32; # CUDN PI
	// CUDN-wide private addresses
	// and institution-private addresses
	10.0.0.0/8;
	172.16.0.0/12;
	192.168.0.0/16;
	// localhost
	127.0.0.0/8; ::1;
};

// The following zones provide forward and reverse lookup for "localhost".
// You can omit these if you are running BIND 9.12.

zone "localhost" {
	type master;
	file "db.localhost";
};

zone "1.0.0.127.in-addr.arpa" {
	type master;
	file "db.localhost-rev";
};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" {
	type master;
	file "db.localhost-rev";
};

// The following zone contains the configuration for all Cambridge zones.
// The list of zones is the same as in sample.named.conf (excluding the
// three localhost zones above), with the same list of masters for each
// zone. The zone files are stored in the catalog-zone zone-directory
// configured above.
//
// If you are using the institution-private address range 10.0.0.0/9
// (see https://www.dns.cam.ac.uk/domains/reverse/ten.html)
// then you can configure your own zone for 10.in-addr.arpa and it will
// take precedence over the catalog zone version.

zone "catz.arpa.cam.ac.uk" {
	type slave;
	file "db.catz";
	masters { 131.111.8.37; 131.111.12.37; };
};

// End of zone definitions

logging {

	/* For a description of what all this means and what is
	 * possible you should read the current BIND documentation.
	 * You probably will want to adjust your logging. What follows
	 * is just a starter suggestion.
	 */

	/* If, as is common, you wish to send log messages to syslog,
	 * we suggest dedicating a syslog "facility", here local7, to
	 * the nameserver, with syslog configured to log *all* local7
	 * messages, irrespective of severity, and then assert fine
	 * grain control here.
	 * For example, /etc/syslog.conf might contain -
	 *    local7.info	/var/adm/messages
	 */

	// Specify logging channels and their filtering levels -

	channel syslog_critical {	// critical or worse
		syslog local7;
		severity critical;
		print-category yes;		// print category name
		print-severity yes;		// print severity level
	};

	channel syslog_error {		// errors or worse
		syslog local7;
		severity error;
		print-category yes;		// print category name
		print-severity yes;		// print severity level
	};

	channel syslog_warning {	// warning or worse
		syslog local7;
		severity warning;
		print-category yes;		// print category name
		print-severity yes;		// print severity level
	};

	channel syslog_info {		// info or worse
		syslog local7;
		severity info;
		print-category yes;		// print category name
		print-severity yes;		// print severity level
	};

	// Specify which categories of message go to which channels -

	category general { syslog_error; };	// Msgs uncategorised as yet by BIND
	category default { syslog_error; };	// Msg categories unspecified below

	category config { syslog_warning; };	// Config file processing

	// The volume of "update denied" messages provoked by
	// mis-configured NT systems on the net can be overwhelming.
	// You can suppress them using
	//
	// category update-security { syslog_critical; };

};

//  End
