// Sample named.conf file for recursive nameservers in Cambridge
// This version forwards queries to the central recursive servers.

// Available from https://www.dns.cam.ac.uk/code/nsconfig/forward.named.conf

// Overview documentation at https://www.dns.cam.ac.uk/servers/stealth.html

options {

  //******* Local installation details - CHECK & ADJUST THESE *******

	directory "/var/named";	// Data (zones etc) file directory

  // Controls allowing access to your nameserver, except where
  // overridden in individual "zone" statements.

	allow-transfer {none;};	// or maybe "camnets", or something in between
	allow-query {camnets;};	// or maybe just your own institution

  // The following directive foward queries to our central DNS resolvers.
  // This automatically disables BIND's built-in empty zones, so reverse
  // DNS queries for CUDN private addresses will also be forwarded.

	forward only;

	forwarders { 131.111.8.42; 131.111.12.20; };

  // The following option enables DNSSEC validation.
  // See https://www.dns.cam.ac.uk/servers/validation.html
  // for more details.

	dnssec-validation auto;

};

// The following ACL defines the CUDN networks.

acl camnets {
	// Public CUDN address blocks
	128.232.0.0/16;
	129.169.0.0/16;
	131.111.0.0/16;
	192.18.195.0/24;
	192.84.5.0/24;
	192.153.213.0/24;
	193.60.80.0/20;
	193.63.252.0/23;
	2001:630:210::/44; # JANET PA
	2a00:1098:5::/48; # Mythic Beasts PA
	2a05:b400::/32; # CUDN PI
	// CUDN-wide private addresses
	! 172.31.0.0/16; 172.16.0.0/12;
	10.128.0.0/9;
	// localhost
	127.0.0.1; ::1;
	// You might also want to include any institution-wide
	// private addresses here
};

logging {

	/* For a description of what all this means and what is
	 * possible you should read the current BIND documentation.
	 * You probably will want to adjust your logging. What follows
	 * is just a starter suggestion.
	 */

	/* If, as is common, you wish to send log messages to syslog,
	 * we suggest dedicating a syslog "facility", here local7, to
	 * the nameserver, with syslog configured to log *all* local7
	 * messages, irrespective of severity, and then assert fine
	 * grain control here.
	 * For example, /etc/syslog.conf might contain -
	 *    local7.info	/var/adm/messages
	 */

	// Specify logging channels and their filtering levels -

	channel syslog_critical {	// critical or worse
		syslog local7;
		severity critical;
		print-category yes;		// print category name
		print-severity yes;		// print severity level
	};

	channel syslog_error {		// errors or worse
		syslog local7;
		severity error;
		print-category yes;		// print category name
		print-severity yes;		// print severity level
	};

	channel syslog_warning {	// warning or worse
		syslog local7;
		severity warning;
		print-category yes;		// print category name
		print-severity yes;		// print severity level
	};

	channel syslog_info {		// info or worse
		syslog local7;
		severity info;
		print-category yes;		// print category name
		print-severity yes;		// print severity level
	};

	// Specify which categories of message go to which channels -

	category general { syslog_error; };	// Msgs uncategorised as yet by BIND
	category default { syslog_error; };	// Msg categories unspecified below

	category config { syslog_warning; };	// Config file processing

	// The volume of "update denied" messages provoked by
	// mis-configured NT systems on the net can be overwhelming.
	// You can suppress them using
	//
	// category update-security { syslog_critical; };

};

//  End
