// Sample named.conf file for nameservers in Cambridge

// Available from https://www.dns.cam.ac.uk/code/nsconfig/sample.named.conf

// Overview documentation at https://www.dns.cam.ac.uk/servers/stealth.html

// This file is designed for recent versions of BIND 9. It is a model
// configuration, which you should expect to adjust for individual
// circumstances, and it should not be relied upon to be fully
// up-to-date either.

// There are stripped-down alternative versions for configurations
// that forward to the central resolvers, or that use the BIND 9.11
// cataog zone feature. See the documentation link above for details.

options {

  //******* Local installation details - CHECK & ADJUST THESE *******

	directory "/var/named";	// Data (zones etc) file directory

  // Controls allowing access to your nameserver, except where
  // overridden in individual "zone" statements.

	allow-transfer {none;};	// or maybe "camnets", or something in between
	allow-query {camnets;};	// or maybe just your own institution

  // By default BIND sends "notify" messages to the authoritative
  // nameservers for a zone whenever it acquires a new version of it.
  // If you are a stealth slave, then these are (almost always) wasted
  // IP traffic, and may even cause annoyance to those who log everything.
  //
  // The following turns off the generation of "notify" messages for
  // secondary zones. If you have zones for which you are an official
  // secondary, you may want to override by using "notify yes;" in the
  // corresponding zone statements.

	notify master-only;

  // BIND keeps a journal file for each zone that is being updated
  // incrementally. These can get extremely large, especially for
  // signed zones. The following option puts an upper limit on their
  // size. (If you are allowing clients to transfer a signed zone from
  // you, you should set the value substantially higher, e.g. several
  // megabytes. The option can be used in individual zone statements
  // if necessary.) This option isn't needed if you are using BIND 9.12
  // or later.

	max-journal-size 64K;

  // The following option enables DNSSEC validation.
  // See https://www.dns.cam.ac.uk/servers/validation.html
  // for more details.

	dnssec-validation auto;

};

// To control BIND 9.x operations without restarting the daemon, you
// should use the "rndc" program distributed with BIND. If you do not
// have a "controls" statement in your configuration file, BIND will
// listen for rndc commands on port 953 on the loopback interfaces only,
// and require them to be signed with a key that it reads from /etc/rndc.key.
// A suitable key can be set up by running "rndc-confgen -a".
//
// This default configuration is adequate for many nameservers.
// You can use a "controls" statement to create much more elaborate
// configurations for rndc, but any such would be too idiosyncratic
// to describe here.

// The following ACL defines the CUDN networks.
//
// Most nameservers on the CUDN will have incoming DNS requests (UDP and TCP
// port 53) blocked at the CUDN border routers, and so will not be able to
// provide DNS service to those outside even if they wanted to.
//
// If your nameserver is accessible from the Internet, then it must
// not provide recursive service to clients outside the CUDN, and only
// provide access to specific authoritative zones. You can do this by adding
//
//   allow-query { any; };
//   allow-transfer { any; };	// or something more restrictive
//
// to the relevant "zone" statement, overriding the default in "options"
// above.
//
// Some nameserver managers will want to restrict access to something
// more restrictive than "camnets", e.g. just their own institution.

acl camnets {
	// Public CUDN address blocks
	128.232.0.0/16;
	129.169.0.0/16;
	131.111.0.0/16;
	192.18.195.0/24;
	192.84.5.0/24;
	192.153.213.0/24;
	193.60.80.0/20;
	193.63.252.0/23;
	2001:630:210::/44; # JANET PA
	2a00:1098:5::/48; # Mythic Beasts PA
	2a05:b400::/32; # CUDN PI
	// CUDN-wide private addresses
	! 172.31.0.0/16; 172.16.0.0/12;
	10.128.0.0/9;
	// localhost
	127.0.0.1; ::1;
	// You might also want to include any institution-wide
	// private addresses here
};

// The db.null, db.localhost, and db.localhost-rev zone files referenced
// below must be supplied from outside, but once supplied need never
// be changed. You can find links to suitable versions, based BIND's
// built-in empty zones, at https://www.dns.cam.ac.uk/servers/stealth.html

// The following zones provide forward and reverse lookup for "localhost".
// You can omit these if you are running BIND 9.12.

zone "localhost" {
	type master;
	file "db.localhost";
};

zone "1.0.0.127.in-addr.arpa" {
	type master;
	file "db.localhost-rev";
};

zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" {
	type master;
	file "db.localhost-rev";
};

// Definitions of zones to be slaved.
//
// Note that there is no requirement to slave all the zones mentioned
// here (but see the notes later on concerning the reverse zones for
// CUDN-wide private addresses). The list given covers most, but not
// all, of the CUDN. Other zones not mentioned here may be available,
// but there is no guarantee that will continue.
//
// The db.xxx files do not need to be primed. The nameserver will set
// them up for itself, filling them with current data from the net.
//
// You should skip all these zone configurations if you are using
// forwarding or almost all of them if you are using catalog-zones.
//
// The central nameservers have IPv6 addresses as well as IPv4 ones.
// If your nameserver has IPv6 connectivity, you can use these instead
// (it is not sensible to specify both the IPv4 and IPv6 addresses for
// the same server):
//
//  IPv4 address   IPv6 address             Name
//  131.111.8.37   2001:630:212:8::d:a0     authdns0.csx.cam.ac.uk
//  131.111.12.37  2001:620:212:12::d:a1    authdns1.csx.cam.ac.uk
//  131.111.8.42   2001:630:212:8::d:0      recdns0.csx.cam.ac.uk
//  131.111.12.20  2001:620:212:12::d:1     recdns1.csx.cam.ac.uk
//
// The last two should only be used for forwarding recursive requests,
// or in a stub resolver's configuration.

zone "cam.ac.uk" {
	type slave;
	file "db.cam";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "111.131.in-addr.arpa" {
	type slave;
	file "db.131.111";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "80.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.80";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "81.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.81";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "82.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.82";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "83.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.83";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "84.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.84";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "85.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.85";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "86.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.86";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "87.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.87";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "88.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.88";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "89.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.89";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "90.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.90";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "91.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.91";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "92.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.92";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "93.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.93";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "94.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.94";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "95.60.193.in-addr.arpa" {
	type slave;
	file "db.193.60.95";
	masters { 131.111.8.37; 131.111.12.37; };
};


zone "195.18.192.in-addr.arpa" {
	type slave;
	file "db.192.18.195";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "5.84.192.in-addr.arpa" {
	type slave;
	file "db.192.84.5";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "213.153.192.in-addr.arpa" {
	type slave;
	file "db.192.153.213";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "252.63.193.in-addr.arpa" {
	type slave;
	file "db.192.63.252";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "253.63.193.in-addr.arpa" {
	type slave;
	file "db.192.63.253";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "1.2.0.0.3.6.0.1.0.0.2.ip6.arpa" {
	type slave;
	file "db.2001:630:21x";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "0.0.4.b.5.0.a.2.ip6.arpa" {
	type slave;
	file "db.2a05:b400";
	masters { 131.111.8.37; 131.111.12.37; };
};

// The following zone contains the reverse lookup information
// for IPv4 addresses in the range 128.232.[128-255].*. See
// https://www.dns.cam.ac.uk/domains/reverse/

zone "in-addr.arpa.cam.ac.uk" {
	type slave;
	file "db.cam-rev";
	masters { 131.111.8.37; 131.111.12.37; };
};

// maths (+ damtp, dpmms, statslab), cl and eng are maintained as separate
// zones under cam, and require specific mention if they are to be slaved.
// If included, they should be fetched from the appropriate departmental
// nameservers given below, not from the CS-maintained nameservers.

zone "damtp.cam.ac.uk" {
	type slave;
	file "db.damtp";
	masters { 131.111.20.101; 131.111.20.202; };
};

zone "dpmms.cam.ac.uk" {
	type slave;
	file "db.dpmms";
	masters { 131.111.20.101; 131.111.20.202; };
};

zone "maths.cam.ac.uk" {
	type slave;
	file "db.maths";
	masters { 131.111.20.101; 131.111.20.202; };
};

zone "newton.cam.ac.uk" {
	type slave;
	file "db.newton";
	masters { 131.111.20.101; 131.111.20.202; };
};

zone "statslab.cam.ac.uk" {
	type slave;
	file "db.statslab";
	masters { 131.111.20.101; 131.111.20.202; };
};

zone "16.111.131.in-addr.arpa" {
	type slave;
	file "db.131.111.16";
	masters { 131.111.20.101; 131.111.20.202; };
};

zone "17.111.131.in-addr.arpa" {
	type slave;
	file "db.131.111.17";
	masters { 131.111.20.101; 131.111.20.202; };
};

zone "18.111.131.in-addr.arpa" {
	type slave;
	file "db.131.111.18";
	masters { 131.111.20.101; 131.111.20.202; };
};

zone "20.111.131.in-addr.arpa" {
	type slave;
	file "db.131.111.20";
	masters { 131.111.20.101; 131.111.20.202; };
};

zone "24.111.131.in-addr.arpa" {
	type slave;
	file "db.131.111.24";
	masters { 131.111.20.101; 131.111.20.202; };
};

zone "145.111.131.in-addr.arpa" {
	type slave;
	file "db.131.111.145";
	masters { 131.111.20.101; 131.111.20.202; };
};

zone "cl.cam.ac.uk" {
	type slave;
	file "db.cl";
	masters { 128.232.0.19; 128.232.0.18; };
};

zone "cst.cam.ac.uk" {
	type slave;
	file "db.cst";
	masters { 128.232.0.19; 128.232.0.18; };
};

zone "232.128.in-addr.arpa" {
	type slave;
	file "db.128.232";
	masters { 128.232.0.19; 128.232.0.18; };
};

zone "2.0.2.1.2.0.0.3.6.0.1.0.0.2.ip6.arpa" {
	type slave;
	file "db.2001:630:212:2xx";
	masters { 128.232.0.19; 128.232.0.18; };
};

zone "0.1.1.0.0.0.4.b.5.0.a.2.ip6.arpa" {
	type slave;
	file "db.2a05:b400:110";
	masters { 128.232.0.19; 128.232.0.18; };
};

zone "eng.cam.ac.uk" {
	type slave;
	file "db.eng";
	masters { 129.169.8.9; 129.169.8.8; };
};

zone "169.129.in-addr.arpa" {
	type slave;
	file "db.129.169";
	masters { 129.169.8.9; 129.169.8.8; };
};

// Zones for CUDN-wide private addresses.
//
// The following zones describe the hosts with RFC1918 private addresses
// that are routed throughout the CUDN but blocked at the border routers.
//
// private.cam.ac.uk is now properly delegated from cam.ac.uk, but the
// corresponding reverse zones are not, and cannot be, delegated from
// their nominal parent zone. So your nameserver will not be able to
// see them unless you take some action.
//
// The contents of these zones should not be made available outside
// the CUDN. The settings of "allow-query" and "allow-transfer" given
// earlier will ensure that. If you have modified them, make sure that
// you are not leaking this data to the outside world, if necessary
// by adding
//
//	allow-query { camnets; };	// or less
//	allow-transfer { camnets; };	// or less
//
// to the following zone statements.

zone "private.cam.ac.uk" {
	type slave;
	file "db.priv";
	masters { 131.111.8.37; 131.111.12.37; };
        // There are special names in private.cam.ac.uk which have more than
        // 100 records, so we remove this limit for this zone
	max-records-per-type 0;
};

zone "16.172.in-addr.arpa" {
	type slave;
	file "db.172.16";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "17.172.in-addr.arpa" {
	type slave;
	file "db.172.17";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "18.172.in-addr.arpa" {
	type slave;
	file "db.172.18";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "19.172.in-addr.arpa" {
	type slave;
	file "db.172.19";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "20.172.in-addr.arpa" {
	type slave;
	file "db.172.20";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "21.172.in-addr.arpa" {
	type slave;
	file "db.172.21";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "22.172.in-addr.arpa" {
	type slave;
	file "db.172.22";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "23.172.in-addr.arpa" {
	type slave;
	file "db.172.23";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "24.172.in-addr.arpa" {
	type slave;
	file "db.172.24";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "25.172.in-addr.arpa" {
	type slave;
	file "db.172.25";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "26.172.in-addr.arpa" {
	type slave;
	file "db.172.26";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "27.172.in-addr.arpa" {
	type slave;
	file "db.172.27";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "28.172.in-addr.arpa" {
	type slave;
	file "db.172.28";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "29.172.in-addr.arpa" {
	type slave;
	file "db.172.29";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "30.172.in-addr.arpa" {
	type slave;
	file "db.172.30";
	masters { 131.111.8.37; 131.111.12.37; };
};

// The following zones contain the reverse lookup information for IPv4
// addresses in 10.128.0.0/9. If you are using the institution-private
// address range 10.0.0.0/9, then instead of slaving our version you
// should provide your own zone for 10.in-addr.arpa. See
// https://www.dns.cam.ac.uk/domains/reverse/ten.html

zone "in-addr.arpa.private.cam.ac.uk" {
	type slave;
	file "db.priv-rev";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "10.in-addr.arpa" {
	type slave;
	file "db.10";
	masters { 131.111.8.37; 131.111.12.37; };
};

// End of zone definitions

logging {

	/* For a description of what all this means and what is
	 * possible you should read the current BIND documentation.
	 * You probably will want to adjust your logging. What follows
	 * is just a starter suggestion.
	 */

	/* If, as is common, you wish to send log messages to syslog,
	 * we suggest dedicating a syslog "facility", here local7, to
	 * the nameserver, with syslog configured to log *all* local7
	 * messages, irrespective of severity, and then assert fine
	 * grain control here.
	 * For example, /etc/syslog.conf might contain -
	 *    local7.info	/var/adm/messages
	 */

	// Specify logging channels and their filtering levels -

	channel syslog_critical {	// critical or worse
		syslog local7;
		severity critical;
		print-category yes;		// print category name
		print-severity yes;		// print severity level
	};

	channel syslog_error {		// errors or worse
		syslog local7;
		severity error;
		print-category yes;		// print category name
		print-severity yes;		// print severity level
	};

	channel syslog_warning {	// warning or worse
		syslog local7;
		severity warning;
		print-category yes;		// print category name
		print-severity yes;		// print severity level
	};

	channel syslog_info {		// info or worse
		syslog local7;
		severity info;
		print-category yes;		// print category name
		print-severity yes;		// print severity level
	};

	// Specify which categories of message go to which channels -

	category general { syslog_error; };	// Msgs uncategorised as yet by BIND
	category default { syslog_error; };	// Msg categories unspecified below

	category config { syslog_warning; };	// Config file processing

	// The volume of "update denied" messages provoked by
	// mis-configured NT systems on the net can be overwhelming.
	// You can suppress them using
	//
	// category update-security { syslog_critical; };

};

//  End
